Quote from: riqo on May 02, 2024, 09:05:13 PM

Wallet Address | Wallet Tag
1A1zP1eP5QGefi2DMPTfTL5SLmv7DivfNa| 313e

How a Wallet Tag is generated ?
The wallet tag is basicly generated through encrypting the wallet address in SHA256 and extraction from that hash the two first and last alphanumeric characters,together.

First of all what you are doing is not encrypting (SHA256 is also not an encryption algorithm). It is called computing checksum.

Secondly, since this checksum is very small (2 bytes) it is not that hard to brute force it and create a fake address with the same checksum. I computed this address in a second with the same checksum.

Code:

1A1zP1eP5QGefi2DMPTfTL4oWtPc8zFosz | 313e

Of course this is just a concept to show how easy it is to find a "collision" when the checksum is very small. In practice the attacker needs the key to the malicious address which means they have to perform a process similar to generating a "vanity address", an address that has the same starting characters. The extra 16 bit checksum doesn't slow down that process enough to be impactful.