Bytecode verified via sibling
This contract shares identical runtime bytecode with KeyRegistry (0x016c93c3...) which has been verified through compiler archaeology.
A 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
Historical Significance
Each address gets one record, a string holding a key and the timestamp it was written. setKey(string) stores a key and stamps it with the block time, revokeKey() clears both, and getKeyData(address) and getKeyTimestamp(address) read any address's record back. The flaw is in who the record is filed under: both writers index on tx.origin rather than msg.sender, so any contract a user calls can call setKey or revokeKey in the middle of that call and overwrite or wipe the user's key without the user ever touching this contract. Source recovered by exact bytecode match: solc v0.1.1+commit.6ff4cd6 with the optimizer off reproduces all 1105 bytes of the creation transaction.
Context
Deployed in 2015 on the Ethereum Frontier network.
Key Facts
Description
Each address gets one record, a string holding a key and the timestamp it was written. setKey(string) stores a key and stamps it with the block time, revokeKey() clears both, and getKeyData(address) and getKeyTimestamp(address) read any address's record back. The flaw is in who the record is filed under: both writers index on tx.origin rather than msg.sender, so any contract a user calls can call setKey or revokeKey in the middle of that call and overwrite or wipe the user's key without the user ever touching this contract. Source recovered by exact bytecode match: solc v0.1.1+commit.6ff4cd6 with the optimizer off reproduces all 1105 bytes of the creation transaction.
Source Verified
Heuristic Analysis
The following characteristics were detected through bytecode analysis and may not be accurate.
Frontier Era
The initial release of Ethereum. A bare-bones implementation for technical users.
Bytecode Overview
Verified Source Available
Source verified through compiler archaeology and exact bytecode matching.
View Verification ProofShow source code (Solidity)
// Submitted by EthereumHistory (ethereumhistory.com)
contract KeyRegistry {
struct Key {
string data;
uint timestamp;
}
mapping (address => Key) keys;
function setKey(string key) {
keys[tx.origin].data = key;
keys[tx.origin].timestamp = now;
}
function revokeKey() {
keys[tx.origin].data = "";
keys[tx.origin].timestamp = 0;
}
function getKeyData(address owner) returns (string) {
return keys[owner].data;
}
function getKeyTimestamp(address owner) returns (uint) {
return keys[owner].timestamp;
}
}External Links
Related contracts
Contract 0x3b33fd...67cc6e
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0x3b33fd...67cc6eSeptember 25, 2015Contract 0xb1cae1...3af281
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0xb1cae1...3af281September 25, 2015Contract 0xd0f28a...a2b650
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0xd0f28a...a2b650September 25, 2015Contract 0x6fe164...c7ef7a
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0x6fe164...c7ef7aSeptember 25, 2015KeyRegistry
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0x016c93...befc1aSeptember 25, 2015Contract 0xaeb702...0008b1
Same deployerA 2015 public key directory that keys every entry off tx.origin instead of msg.sender.
0xaeb702...0008b1September 25, 2015