Skip to content

abi.decode of Untrusted bytes Parameter

SAFE-0308 External Calls Checked automatically by the scanner
1

What goes wrong

A user-supplied bytes parameter is abi.decoded into a typed structure without validation. Malformed input reverts (griefing) or, when decoded into addresses/amounts used for accounting or calls, lets an attacker steer privileged logic.

2

The vulnerable pattern

proof of concept — how it is exploited
// function exec(bytes calldata data) external {
//   (address to, uint256 amt) = abi.decode(data,(address,uint256));
//   token.transfer(to, amt); }
// attacker crafts data to move tokens to themselves.
3

How to fix it

the pattern that is safe
require(data.length >= EXPECTED, "bad payload");
(address to, uint256 amt) = abi.decode(data, (address, uint256));
require(to != address(0) && amt > 0, "bad params");
Validate decoded values before acting on them.
Check your own contract for this

The SaferICO scanner runs 201 detectors over your Solidity source, SAFE-0308 among them. Paste an address or the source itself — a small per-scan fee, shown before you sign, or unlimited on any plan.

Run the scanner See how it is attacked Read the docs