ethresear.ch: Exploring dynamic casing checksums to mitigate address poisoning
(Mitsuhamizu), 08:59: poisoning works because people check only prefix and suffix, so the receiver shares a short lived code and the sender's wallet derives a dynamic casing fingerprint from Keccak256(address plus code) that fails for a pasted lookalike.
