hard20 pts · first answer countssoliditysmart-contract-security

Hash collision with encodePacked

An allowlist checks keccak256(abi.encodePacked(name, role)) against signed hashes, where name and role are both strings. What can go wrong?

A.Different pairs like ("ad", "min") and ("a", "dmin") produce the same packed bytes and the same hash, so one signature can authorize a different pairB.abi.encodePacked cannot take stringsC.keccak256 returns a different hash each time for stringsD.Packed encoding adds random padding, so hashes never match

← Domain separator after a chain split msg.value inside a multicall →