PoCs Check

Guide
中文

Number Format Bypass Tester Guide

Overview

The Number Format Bypass Tester is used to check if wallets can be bypassed by changing the numeric format (decimal, binary, hex, octal) in transaction parameters.

Vulnerability Identification

Connect your wallet, then test different number formats for the same value (1,000,000).

If the wallet shows different security warnings or skips them completely for certain formats, a vulnerability exists.

Fix Recommendation

Wallets should normalize all numeric values before security checks to ensure consistent filtering regardless of number format.

Ethereum Network: Mainnet

Account Address:

0x0000000000000000000000000000000000000000

Signature Results

No signature records
// Number format equivalence in JavaScript

// All of these represent the same value (1000000):
console.log(1000000 === 0b11110100001001000000); // true (Binary)
console.log(1000000 === 0xF4240); // true (Hexadecimal)
console.log(1000000 === 0o3641100); // true (Octal)

// However, wallets may perform security checks based on string pattern matching
// rather than normalized numeric values, creating a security vulnerability.

// Example of a wallet security filter that might check for large decimal values:
function naiveSecurityCheck(value) {
  // This might only check patterns like /^\d{7,}$/ to detect large numbers
  // but would miss equivalent values in other formats
  return /^\d{7,}$/.test(value.toString());
}

console.log(naiveSecurityCheck(1000000)); // true (would trigger warning)
console.log(naiveSecurityCheck(0xF4240)); // false (might bypass warning)