# Only part of keccak256() is used as hash, making it susceptible to collision attacks

PartyDAO truncated keccak256 to 15/16 bytes for governance and distribution hashes, enabling birthday-collision attacks to hijack party governance or drain TokenDistributor funds.

- Payout: Contest reward
- Severity: medium
- Program: PartyDAO
- Credited: 0xA5DF
- Disclosed: 2022-11-17
- Write-up quality: 6/10
- Original: https://github.com/code-423n4/2022-09-party-findings/issues/231
- Library page: https://bugbountylibrary.com/r/c4%3A2022-09-party%3AM-03
- Tags: domain:web3 impact:funds-loss impact:integrity kind:contest platform:code4rena sev:medium tech:evm tech:solidity technique:source-review vuln:accounting-error vuln:crypto vuln:governance

**Target:** Solidity crowdfund governance hash and TokenDistributor distribution hash
**Root cause:** Only 15 bytes (DistributionState.distributionHash15) and 16 bytes (Crowdfund.governanceOptsHash) of keccak256 output are stored/compared, reducing collision resistance to ~2^60/2^64.
**Steps:**
1. Identify truncated hashes at Crowdfund.sol L275/L325 and TokenDistributor.sol L26.
2. Craft two structs (legit vs malicious) differing only in last bits (feeRecipient for FixedGovernanceOpts, fee for DistributionInfo).
3. Run birthday attack generating ~1.4e18 hashes split between legit and malicious sets to find a 15-byte collision.
4. Submit legit struct to register party/distribution, then reuse colliding malicious struct to pass buy()/claim() with attacker-controlled hosts, passThresholdBps, feeRecipient, or malicious token.
**How found:** Code review spotted non-standard truncated keccak256 outputs and reasoned about birthday-attack feasibility, computing hash counts, CPU cycles and storage requirements to argue practicality for well-funded attackers.
**Exploitation:** Attacker registers a legitimate party/distribution with the colliding hash, then submits the malicious struct sharing the same truncated hash to inject themselves as host (veto DoS), lower passThresholdBps to pass arbitrary votes draining Party funds, set feeRecipient, or claim legitimate token distribution assets via a malicious ERC20/party.
**Escalation:** Chains governance hijack to fund theft; distribution collision drains TokenDistributor across all tokens.
**Insight:** Any place a hash is truncated below full width (storage packing, gas optimization) should be evaluated with birthday-attack math; even 16 bytes is only ~2^64 and becomes plausible for high-value targets with optimized hardware.