Bitcoin Stack Exchange is a question and answer site for Bitcoin crypto-currency enthusiasts. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I understand that BIP12 was withdrawn, and probably because of this exploit below. Can someone explain how this attack would have worked and the effect it would have on the network?

 for (;;) {
    RAND_bytes(nonce.b, sizeof(nonce));
    RIPEMD160(nonce.b, sizeof(nonce), digest);
    if (
      digest[0] == 174 && // OP_CHECKMULTISIG
      digest[1] ==  76 && // OP_PUSHDATA1
      digest[2] ==  16    // 0x16
    ) {
      // We'll print status info on partial hits, just to make things more
      // interesting.
      printf("%llx\n", nonce.i);
      print_hex(digest, 20);

      // Check for full hit
      if (digest[19] == 117) // OP_DROP
share|improve this question
up vote 3 down vote accepted

Each transaction has a certain number of "sigops", the number of signature validation script ops like OP_CHECKSIG in its scripts. These script ops are very expensive to compute. Transactions with too many sigops are considered non-standard and will not be relayed by most clients. Blocks with too many sigops in their transactions are illegal and will be rejected entirely.

That exploit allows you to include sigops in transactions without increasing the sigop count. It could be used to create a very slow-to-compute transaction that isn't very big size-wise. Not a huge exploit, and it could be worked around, but it demonstrates an important weakness in BIP 12: OP_EVAL scripts can't be analyzed accurately without running them first.

share|improve this answer
Thank you, I need to learn sigop count and how it's done.... I'm getting the impression the QT client counts operations in a weighted curve.. (OP_CheckSig counts as X operations, and OP_Equal counts as Y operations where X > Y) Is this correct? Is cost per operation sometimes >1 per operation? – LamonteCristo Dec 22 '12 at 18:41
@makerofthings7 Only CHECKSIG and CHECKMULTISIG count. CHECKSIG counts as 1 sigop. CHECKMULTISIG always counts as 20 except inside of a P2SH transaction's hashed script where it usually counts as the number of public keys passed to CHECKMULTISIG. – theymos Dec 22 '12 at 21:14

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.