1

In Bitcoin you can have different UTXO with different public keys in a single transaction.

So suppose someone broadcasts a transaction with sending 10000 BTC. Theoretically I can copy this transaction, add my input with 0.1 BTC and change output to my address. Then sign a transaction and rebroadcast it.

Some miner will receive it, and get transaction with two inputs: from initial sender (10000 BTC unlocked by him) and mine (0.1 BTC unlocked with my public key); and 1 output to my address. The whole transaction is signed with my private key. Public key for verifying the signature is extracted from one of the inputs. So my public key from the second input can be used for this purpose and the transaction will be valid. The source of 10000 BTC is unlocked with owner's private key, so I'll just steal the money.

Suppose my transaction has bigger fee and propagates across the network faster then original.

Is this threat real or not? If not then why? If yes then why isn't it eliminated trough restricting transaction inputs so all of them have the same public key?

EDIT: What I mean is use a transaction with 2 inputs: one is used as an actual source of coins and is unlocked with a valid signature (because it is copied from the transaction of the one who owns the money) and another one is used as public key provider (it can be 0.00001 BTC, but must be unlocked with my public key so that is can be retrieved during whole transaction signature verifying and the whole transaction would be valid).

Improve this question
1

2 Answers 2

Reset to default
2

The signing of the transaction is done over the entire content of the transaction. Any subsequent changes to the transaction would invalidate that signature and thus the entire transaction.

It should be noted that there are certain cases when the signature is not performed on the entire content of the transaction (a SIGHASH other than SIGHASH_ALL is used). However, these are some specific use cases.

Improve this answer
6
  • 1
    I wrote a post on my blog explaining SIGHASH: joaobordalo.com/articles/2023/07/13/explaining_sighash.html
    – bordalix
    Commented Sep 18, 2023 at 15:53
  • I undestand that. But you could change the signature also and sign it with YOUR key. Since public key is retrieved from one of the inputs (and one of them has my public key), it can be the input with my public key, so the signture will be valid.
    – Denys Malovanyi
    Commented Sep 18, 2023 at 16:05
  • 1
    @DenysMalovanyi You can't change someone's signature because you don't have the corresponding private key. You can't add another additional input with your signature because you will invalidate signature in original input. You can't replace the original signature with your signature because your signature will not unlock the coins.
    – dassd
    Commented Sep 18, 2023 at 16:13
  • 1
    @DenysMalovanyi If you add an extra input, the transaction changes, and thus the message being signed changes, and thus the original signature for the original input will not be valid anymore. You seem to be under the assumption that the original's signature only applies to the original input - this is not correct, it applies to the entire transaction, and that changes when you add an input.
    – Pieter Wuille
    Commented Sep 18, 2023 at 16:23
  • 1
    @PieterWuille, yes, that clears things up for me, thank you all for the replies.
    – Denys Malovanyi
    Commented Sep 18, 2023 at 16:27
0

There are different SIGHASH flags which indicate what parts of the transaction are signed. In the case of SIGHASH_ALL every input and output is part of the message that is being signed and so you wouldn't be able to change an input or an output of a transaction without going back to the owner of the private key who signed it in the first place to request another signature.

Improve this answer
3
  • I undestand that. But you could change the signature also and sign it with YOUR key. Since public key is retrieved from one of the inputs (and one of them has my public key), it can be the input with my public key, so the signture will be valid.
    – Denys Malovanyi
    Commented Sep 18, 2023 at 16:05
  • @DenysMalovanyi: To unlock a UTXO it requires a signature for a specific public key. You can try adding an additional UTXO that requires a signature from a public key that you own the private key for. But you won't have the private key to provide a signature to unlock the first UTXO, just the second. Hence you won't be able to spend the first UTXO.
    – Michael Folkson
    Commented Sep 18, 2023 at 16:12
  • I agree, I don't have a private key for the first UTXO, but I can just copy the input that spends this UTXO from another transaction along with the signature which unlocks it. As I know transactions are broadcasted to the network when created. If someone will be fast and lucky enough to catch this transaction early, copy-paste its input and add their own one, then broadcast the new transaction so that miners will receive it before the original reaches them, one could potentially steal the money.
    – Denys Malovanyi
    Commented Sep 18, 2023 at 16:18

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.