0

According to my previously asked question (P2SH secure spending. How?) creating transactions without signature checking is probably not secure.

Anyway, I see many transactions

(for ex.:40eee3ae1760e3a8532263678cdf64569e6ad06abc133af64f735e52562bccc8)

with scriptpubkey like: OP_HASH160 [pubkey] OP_EQUAL

With very similar to 

OP_SHA256 [hash] OP_EQUAL (from my prev. question)

And scriptsig doesnt have OP_CHECKSIG

PUSHDATA(72)[3045022100ad0851c69dd756b45190b5a8e97cb4ac3c2b0fa2f2aae23aed6ca97ab33bf88302200b248593abc1259512793e7dea61036c601775ebb23640a0120b0dba2c34b79001] 

PUSHDATA(69)[5141042f90074d7a5bf30c72cf3a8dfd1381bdbd30407010e878f3a11269d5f74a58788505cdca22ea6eab7cfb40dc0e07aba200424ab0d79122a653ad0c7ec9896bdf51ae]

I can't beleeve this transaction are insecure. But what the difference with this ones?

Improve this question

1 Answer 1

Reset to default
3

This transaction actually does have a signature check. Instead of OP_CHECKSIG, it's OP_CHECMULTISIG as the script is a multisignature script. The script in this case is the redeemScript which is provided in the input itself. To see this OP_CHECKMULSITIG, you need to decode the redeemScript.

The redeemScript is:

5141042f90074d7a5bf30c72cf3a8dfd1381bdbd30407010e878f3a11269d5f74a58788505cdca22ea6eab7cfb40dc0e07aba200424ab0d79122a653ad0c7ec9896bdf51ae

Decoded, this redeemScript is:

1 042f90074d7a5bf30c72cf3a8dfd1381bdbd30407010e878f3a11269d5f74a58788505cdca22ea6eab7cfb40dc0e07aba200424ab0d79122a653ad0c7ec9896bdf 1 OP_CHECKMULTISIG

As you can see, this has an OP_CHECKMULTISIG in it which does do a signature check. OP_CHECKMULTISIG checks that n of the public keys listed provide a signature. n is the number that is at the beginning of the script. In this case, n is 1, and the public key is 042f90074d7a5bf30c72cf3a8dfd1381bdbd30407010e878f3a11269d5f74a58788505cdca22ea6eab7cfb40dc0e07aba200424ab0d79122a653ad0c7ec9896bdf. So this script is looking for a signature that corresponds to that public key.

Improve this answer
2
  • I'm still don't get it. Ok, in input we can set op_checkmultisigsig and be sure that transaction can't be replaced. It's no requered for spending, right? What if some funds left with the same scriptpubkey (HASH160 [pubkey] EQUAL)? To spend inputs, we just need to provide data, which HASH160 will equal to e9c3dd0c07...e9c3dd0c07. So, we know that data from spending transaction (its 3045022100ad0...a2c34b79001) Where is my mistake?
    – Andrew
    Commented Dec 20, 2018 at 9:58
  • The output script is a special type known as P2SH. You have to provide something in the input which hashes to that hash. But, that something itself is also a script and is interpreted too. So you must also meet the conditions of that script too. Since that script includes an OP_CHECKMULTISIG, you will need to provide signatures, and without the private keys, you can't do that.
    – Ava Chow ♦
    Commented Dec 20, 2018 at 19:54

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.