# Truncated or packed field misparsed

Fixed-width reads, truncation, or packed decode of a field that is read elsewhere

_Area: Smart contract access control and control flow. Seen in 3 disclosed reports; latest 2025-05-29. Updated 2026-10-25._

## How it works
A field is defined with one width or position in a packed format, but the code that reads it uses a different width or offset. A 32-byte load of a 1-byte flag absorbs the next field's bytes; a slice takes the wrong 20 bytes of a packed pair; a parser accepts a buffer that ends before a mandatory byte. The reader and the writer disagree about the layout, so the decoded value is silently wrong rather than rejected.

## Where it shows up
- Hand-written assembly parsers: check every `mload`/`mstore` against the declared field width in the packed format [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AM-4.md)
- Boolean flags decoded with `iszero(iszero(...))` over a wide load, where adjacent bytes force the result true [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AM-4.md)
- Go/byte-stream decoders that call `ReadByte` and treat `io.EOF` as benign, accepting truncated input [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-1.md)
- Slicing a packed address pair with the wrong offset, e.g. `_srcAddress[20:]` instead of the leading 20 bytes [E3](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-11.md)
- Any field the spec marks mandatory but whose absence is not explicitly rejected [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-1.md)

## How to review
Establish the canonical layout (spec, encoder, or sender) and confirm the decoder matches it byte-for-byte: same width, same offset, same endianness. For each field, ask what the reader does when the buffer is short or the field is adjacent to another. The invariant: a decoded field must depend only on its own bytes, and truncated input must be rejected, not defaulted. Cross-check the reader against the writer or a mock that produces the format [E3](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-11.md).

## Variants seen
- Over-wide load of a 1-byte flag flipping read-only accounts to writable [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AM-4.md)
- Missing mandatory trailing byte accepted as a default value, causing consensus split [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-1.md)
- Wrong slice offset on a packed src/dst address pair, breaking all cross-chain calls [E3](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-11.md)

## Impact and severity
Wrong permissions on bridge accounts [E1](https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AM-4.md), total bridging failure from a caller check that always reverts [E3](https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-11.md), and client consensus divergence [E2](https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-1.md). Severity rises when the misparse is on a trust or authorization check, or when it affects every message rather than an edge case.

## Evidence
- E1: https://bugbountylibrary.com/r/sherlock%3A2025-05-dodo-cross-chain-dex%3AM-4.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2023-01-optimism%3AM-1.md
- E3: https://bugbountylibrary.com/r/c4%3A2023-09-maia%3AM-11.md