# ABI decode layout mismatch reverts

Caller and callee disagree on byte layout: return types, struct offsets, lengths, metadata prefixes, codec names

_Area: Smart contract access control and control flow. Seen in 10 disclosed reports; latest 2025-09-01. Updated 2026-10-23._

## How it works
A caller and callee must agree on the exact byte layout crossing the boundary: return types, struct offsets, data length, metadata prefixes, account sizes, codec names, or interface-conformance flags. When one side assumes a layout the other does not produce, the decoder reverts on unexpected bytes or misreads them as a valid-looking value. The broken assumption is "this interface/offset/prefix/length describes what the other side actually emits." Nothing checks it at runtime, so the mismatch surfaces as a hard revert or wrong data on every call.

## Where it shows up
- An interface declares a return type the implementation does not return (native vs ERC20 variants) [E5](https://bugbountylibrary.com/r/c4%3A2022-04-backd%3AM-13.md).
- Assembly or fixed-offset slicing of a struct that contains a dynamic field (bytes/string/array) [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.4.md).
- A base contract imposes a fixed metadata prefix on hook data that some hooks do not encode [E7](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.6.md).
- Legacy unpackers or exact-length checks applied to accounts that may carry extensions [E4](https://bugbountylibrary.com/r/cantina%3Asolaxy%3A3.1.2.md).
- Codec registration names that must match proto `amino.name` options [E8](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AM-05.md).
- Message type inferred from sign mode rather than the actual type URL [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md).
- A router interface chosen without matching the payload requirements of the call [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md).
- A callee that enforces interface conformance (EIP-165) the caller does not implement [E6](https://bugbountylibrary.com/r/c4%3A2023-10-brahma%3AM-01.md).

## How to review
The invariant: for every external call and every decode, the declared layout equals the producer's actual layout. Check each interface method's return signature against the real implementation, including native-token variants [E5](https://bugbountylibrary.com/r/c4%3A2022-04-backd%3AM-13.md). For struct decoding, confirm whether any nested field is dynamic; if so, read the first 32 bytes as an offset pointer and follow it rather than slicing at a fixed position [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.4.md). For shared hook/executor bases, diff each hook's encoder against the prefix the base decodes [E7](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.6.md). For accounts, verify size checks tolerate documented extensions, and compare test-harness trimming against the production parse path [E4](https://bugbountylibrary.com/r/cantina%3Asolaxy%3A3.1.2.md). For codecs, diff registration strings character-for-character against proto options [E8](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AM-05.md). For message routing, confirm type is derived from the type URL, not sign mode [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md). For external-ecosystem integration, check the target's changelog for newly required interface checks such as EIP-165 [E6](https://bugbountylibrary.com/r/c4%3A2023-10-brahma%3AM-01.md). For cross-chain routers, confirm the chosen interface supports the payload the call carries [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md).

## Variants seen
- Dynamic-field offset read as inline value [E3](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.4.md).
- Metadata prefix assumed but absent in claim hooks [E7](https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.6.md).
- Fixed-size unpacker vs extension-bearing accounts [E4](https://bugbountylibrary.com/r/cantina%3Asolaxy%3A3.1.2.md).
- Codec name mismatch breaking legacy encoding [E8](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AM-05.md).
- Sign mode misclassified as transaction type [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md).
- Wrong router interface for payload-carrying calls [E2](https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md).
- Missing EIP-165 conformance blocking guard installation [E6](https://bugbountylibrary.com/r/c4%3A2023-10-brahma%3AM-01.md).
- Interface return type absent in native-token implementation [E5](https://bugbountylibrary.com/r/c4%3A2022-04-backd%3AM-13.md).

## Impact and severity
In the evidence these mismatches caused deterministic reverts that broke core flows: debt repayment, swaps, reward claims, balance queries, legacy signing, cross-chain rebalancing, guard setup, and block indexing [E1-E8]. Severity is high where the path is on a critical flow and reverts unconditionally; lower where it degrades a secondary feature. Silent misreads (wrong data rather than revert) and indexer/streaming hooks that halt downstream processing worsen impact [E1](https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md).

## Evidence
- E1: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AH-02.md
- E2: https://bugbountylibrary.com/r/sherlock%3A2024-02-tapioca%3AM-13.md
- E3: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.4.md
- E4: https://bugbountylibrary.com/r/cantina%3Asolaxy%3A3.1.2.md
- E5: https://bugbountylibrary.com/r/c4%3A2022-04-backd%3AM-13.md
- E6: https://bugbountylibrary.com/r/c4%3A2023-10-brahma%3AM-01.md
- E7: https://bugbountylibrary.com/r/cantina%3Asuperform_may2025%3A3.1.6.md
- E8: https://bugbountylibrary.com/r/c4%3A2025-02-initia-cosmos%3AM-05.md