3

I'm currently working on some Bitcoin code and whilst I'm hoping I've covered my bases, I wanted to check the implementation theory.

If I understand the malleable bug it's basically... You create a transaction address for the transaction to take place on. At this point a transaction id is created (txid)

The txid is changed before the transaction is complete on the network, creating a second txid, that the transaction will eventually be completed/confirmed/verified on.

So if that is correct (please correct me if I'm wrong)...

A script/program transferring coins to somebody should work something like this:

A transaction address is created and given to the payee to transfer the requested balance to. That transaction address is checked periodically for number of confirmations. When the transaction address receives 6 or more confirmations it can be considered as completed.

Is there a better/quicker/securer way ?

Thanks

Improve this question
6
  • 2
    You're confusing addresses with the transaction id. Addresses can't be changed. The transaction id can be. You create a transaction sending btc to an address. The problem is you can't simply use thee transaction id to track the progress of the transaction because someone can change that id and then you don't see it going into the blockchain even though it has.
    – Jannes
    Commented Feb 14, 2014 at 23:34
  • Thanks Jannes. So why wouldn't people try to verify against transaction addresses instead of transaction IDs ?
    – Mark
    Commented Feb 14, 2014 at 23:39
  • Yeah that's basically what you're supposed to do. Keep an eye on your own balance and match any transaction you see to any transaction you made earlier. Just not by the id but by the addresses. Which basically means you make your own hash of the important (non-malleable) parts of the transaction that you create and then you keep an eye on the blockchain for that hash. There's a recommended best practices for such a hash. Best to follow those and not implement something yourself based on what some random lurker on here tells you (meaning: i may have parts or all of this wrong)
    – Jannes
    Commented Feb 15, 2014 at 1:16
  • github.com/bitcoin/bitcoin/pull/3656
    – Jannes
    Commented Feb 15, 2014 at 1:17
  • I think your question would be much clearer if you edited it to reflect your new knowledge about the difference between addresses and transaction ids. ;)
    – Murch ♦
    Commented Feb 15, 2014 at 12:26

1 Answer 1

Reset to default
1

Lower the confirmation. The security reports are specific, 1 confirmation is not safe. 2 confirmations is considered 'safe'. More is considered 'safe'. You can "rock'n roll" with 2 confirmation. MtGox died the epic death because their custom made wallet was accepting coins after just 1 confirmation

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.