Track 2 · Keys & identity · lesson 3

Where addresses come from

6 min

0x9f2e4a17b3c8d5f60e91a2b7c4d8e3f501a6c41a

Forty hex characters. Twenty bytes. Here is where each part comes from and why it looks like that.

Derivation

Take the public key — 64 bytes, minus its format prefix.
Hash it with keccak-256, producing 32 bytes.
Keep the last 20. Throw the first 12 away.
Prefix with 0x.

Discarding 12 bytes is not waste. It shortens the address and adds a second one-way step: even if elliptic curves were broken tomorrow, an address that has never signed anything has never revealed its public key, so an attacker would still need a keccak preimage.

The moment you send your first transaction, that protection is gone — the signature reveals the public key. Which is a real argument against reusing addresses.

Why the mixed capitals

You have seen addresses written 0x9F2e4A17… and wondered whether case matters.

It does not, for correctness — but the capitalisation is a checksum. EIP-55 hashes the lowercase address and uses the result to decide which letters to capitalise. A wallet can then check the pattern and catch a typo.

Predict

You mistype one character of an address and send funds. What happens?

The transaction fails — the address does not existThe funds go to an address nobody holds the key for, permanentlyIt goes to the nearest valid address

The zero address

0x0000000000000000000000000000000000000000 is a real address with no key.

It is what an uninitialised address variable equals, and it appears constantly as a sentinel: tokens are "burned" by sending them there, and minting is represented as a transfer from it.

That dual role has a sharp edge. An address variable that was never set is indistinguishable from one deliberately set to zero — the same ambiguity you met with mappings. Contracts have shipped with an owner of address(0), which means nobody can ever call the owner-only functions again.

Check

Are `0x9f2e…` and `0x9F2E…` the same address?

Yes — case is a checksum, not part of the addressNo, they are different addressesOnly if the checksum is valid

Worth remembering

An address is the last 20 bytes of the keccak-256 hash of the public key.
Discarding the first 12 bytes shortens it and adds a second one-way step.
Mixed capitalisation is an EIP-55 checksum that catches typos; case does not change the address.
Every 20-byte value is a valid address — a mistyped one accepts funds and loses them forever.
The zero address is a real, keyless address used for burning and minting, and is a common uninitialised-variable trap.