<p>A Cardano/ADA address consists of two components; a spending credential and a staking credential.</p>
<p>By default, the spending and staking credential are derived from the same private key. However it is also possible to create an address from spending and staking credentials from different private keys. This is a mangled address.</p>
<p>For these mangled addresses, the ADA attached to the spending credential is what determines how much staking rewards are earned, but any rewards accruing due to this ADA can only be spent by the holder of the private key that generated the staking credential.</p>

CC BY-SA 4.0
2023-07-13T22:42:31.897Z
2023-07-13T22:42:31.897Z
Erik de Castro Lopo
<p>And specifically to your question (and continuing from Erik's answer), yes this can potentially affect your app.  The issue is that since the address may be one of these mangled (or &quot;frankenstein&quot;) addresses, if you naively send the rewards to this address they may not be going to the intended person.<br />
One method some people use is to check for the first registration of the staking address, which should normally be by the &quot;real&quot; owner.</p>

CC BY-SA 4.0
2023-07-20T11:08:47.777Z
What do you mean by the "first registration" and are there any common methods of checking that?
0x6f6b
CC BY-SA 4.0
2023-07-24T04:00:38.550Z
In provider's like blockfrost, when you want to receive list of addresses having a particular staking part, it allows giving this list, sorted with time it first appeared on chain. See https://docs.blockfrost.io/#tag/Cardano-Accounts/paths/~1accounts~1%7Bstake_address%7D~1addresses/get.
Sourabh
CC BY-SA 4.0
2023-07-27T12:09:21.110Z
Ok, so if I use the "accounts/{stake_address}/addresses" endpoint and send rewards to the oldest address in the list, I will be safer. Is there any risk that when I use the "accounts/{stake_address}/addresses/assets" endpoint it will return assets that the account doesn't own?
0x6f6b
CC BY-SA 4.0
2023-08-16T23:13:55.533Z
yes but only the real owner of the tokens could spoof them to another staking address, which makes no sense for him
wutzebaer
CC BY-SA 4.0
2023-07-20T09:54:17.720Z
2023-07-20T09:54:17.720Z
ZachSweet
<p>I am developing a dApp where a user can send a few ada (3) to an address that I am listening to on my backend server, and I send a few tokens back depending on what NFTs they have in the wallet. When the transaction is received, I get the stake key from the sender's address using the Blockfrost API and read all assets they control. I then calculate how many tokens they are owed and send those to them.</p>
<p>I have seen mangled addresses mentioned a few times when developing, but I'm still struggling to wrap my head around them or understand if they would affect my app. Any insight would be much appreciated.</p>

<blockfrost><mangled-address>
Could someone explain mangled addresses to me?
# Could someone explain mangled addresses to me?

(Asked by: username_0 on 2023-07-13)

I am developing a dApp where a user can send a few ada (3) to an address that I am listening to on my backend server, and I send a few tokens back depending on what NFTs they have in the wallet. When the transaction is received, I get the stake key from the sender's address using the Blockfrost API and read all assets they control. I then calculate how many tokens they are owed and send those to them.

I have seen mangled addresses mentioned a few times when developing, but I'm still struggling to wrap my head around them or understand if they would affect my app. Any insight would be much appreciated.

**Tags:** blockfrost, mangled-address

---

## 2 answers

### Answer by username_1 on 2023-07-13. Score: 3 | Accepted answer

A Cardano/ADA address consists of two components; a spending credential and a staking credential.

By default, the spending and staking credential are derived from the same private key. However it is also possible to create an address from spending and staking credentials from different private keys. This is a mangled address.

For these mangled addresses, the ADA attached to the spending credential is what determines how much staking rewards are earned, but any rewards accruing due to this ADA can only be spent by the holder of the private key that generated the staking credential.


---

### Answer by username_2 on 2023-07-20. Score: 1

And specifically to your question (and continuing from Erik's answer), yes this can potentially affect your app. The issue is that since the address may be one of these mangled (or "frankenstein") addresses, if you naively send the rewards to this address they may not be going to the intended person.  
One method some people use is to check for the first registration of the staking address, which should normally be by the "real" owner.

> **Comments:**
> **username_0**: What do you mean by the "first registration" and are there any common methods of checking that?  
> **username_3**: In provider's like blockfrost, when you want to receive list of addresses having a particular staking part, it allows giving this list, sorted with time it first appeared on chain. See https://docs.blockfrost.io/#tag/Cardano-Accounts/paths/~1accounts~1%7Bstake_address%7D~1addresses/get.  
> **username_0**: Ok, so if I use the "accounts/{stake_address}/addresses" endpoint and send rewards to the oldest address in the list, I will be safer. Is there any risk that when I use the "accounts/{stake_address}/addresses/assets" endpoint it will return assets that the account doesn't own?  
> **username_4**: yes but only the real owner of the tokens could spoof them to another staking address, which makes no sense for him  

---

