Every smart contract interaction on Ethereum reduces to one thing: the data field of a transaction. That hex blob — calldata — tells the EVM which function to run and with what arguments. Understanding how it is built is essential for debugging failed transactions, verifying what a wallet is actually signing, and building contract tooling.
The 4-Byte Function Selector
The first 4 bytes of calldata are the function selector: the first 4 bytes of the Keccak-256 hash of the canonical function signature — the function name plus comma-separated parameter types, with no spaces. For example, transfer(address,uint256) hashes to 0xa9059cbb — a selector you will see in every ERC-20 transfer.
Two details matter: parameter types must be canonical (uint expands to uint256), and overloads produce different selectors — transfer(address,uint256) and transfer(address,uint96) are different functions. You can compute any selector with our Function Selector Calculator, which runs Keccak-256 locally via the Keccak256 Hash tool.
ABI Argument Encoding
Everything after the selector is the ABI-encoded arguments. Static types — uint256, address, bytes32, bool — are padded to 32-byte words in place. Dynamic types — string, bytes, arrays — are encoded as an offset pointer to a tail region containing a length prefix followed by the data.
A call to transfer(0xAbC..., 1000000) therefore encodes as: the 4-byte selector, one 32-byte word for the left-padded address, and one 32-byte word for the amount. Tuples and nested arrays add offset indirection — the reason hand-decoding complex calldata is error-prone. Our ABI Encoder & Decoder handles uint, address, bytes, string, and array types entirely client-side.
EIP-55 Address Checksums
Ethereum addresses are 20-byte hex strings with no built-in error detection — a single wrong character sends funds to a different address. EIP-55 solves this by mixing case: each hex letter is uppercased or lowercased based on the Keccak-256 hash of the lowercase address. Wallets and explorers display the checksummed form (0x52908400098527886E0F7030069857D2E4169EE7), so a typo produces an invalid checksum rather than a silent loss. Verify any address with the EIP-55 Address Checksum Validator.
Units: Wei, Gwei, and Ether
Calldata amounts and gas prices are denominated in Wei, the smallest unit: 1 ETH = 1018 Wei, and gas prices are conventionally quoted in Gwei (109 Wei). Because these values exceed JavaScript's safe integer range, always convert with BigInt precision — our Wei/Gwei/ETH Converter does exactly that, with no floating-point errors.
Why This Matters for Security
Phishing attacks increasingly rely on users signing opaque calldata. If you can decode the selector and arguments, you can see that a "claim airdrop" transaction is actually setApprovalForAll(attacker, true). Every tool referenced above — the full Ethereum Developer Toolkit — runs 100% in your browser, so you can inspect suspicious calldata without pasting it into a third-party server.
Frequently Asked Questions
How do I decode calldata without the contract ABI?
Start with the 4-byte selector — look it up in a public selector database or compute candidates with a selector calculator. If the selector matches a known signature, the argument types tell you how to decode the rest: 32-byte words for static types, offset pointers for dynamic ones.
Why is Keccak-256 used instead of SHA-256?
Ethereum adopted Keccak-256 — the original submission to the SHA-3 competition — before NIST finalized the SHA-3 standard with different padding. They are related but not identical: Keccak-256 and SHA3-256 produce different hashes for the same input.
Do all transactions have calldata?
No. A plain ETH transfer has empty calldata — the value field carries the amount. Calldata only appears when calling contract code, and a contract's receive() or fallback() function handles calls with empty or unmatched calldata.
