With the upcoming release of Bitcoin Core 0.9, I am wondering how the transaction malleability issue is being fixed and what are the consequences of the fix?

It appears that transaction malleability is causing a few problems for the Bitcoin network:

  • The network is DDoSed by multiple apparent double-spends being relayed
  • Senders of the transactions need to avoid spending 0 confirmation transactions in case they become invalidated by malleability
  • When saving TxIDs of spent transaction for record keeping one has to make sure the TxID did not get changed later

Will all of those issues be addressed in the upcoming update, and if so, how will they be addressed?

  • The second and third items are outside the scope of the basic Bitcoin client and wallet software; they'd be issues for an exchange's custom software to address. Commented Mar 2, 2014 at 14:19
  • The release notes for Bitcoin Core 0.90 (the reference client) lay out several fixes for transaction malleability: bitcointalk.org/index.php?topic=495683.0
    – ChrisW
    Commented Mar 2, 2014 at 20:21

1 Answer 1


Transaction malleability is a consequence of the features of Bitcoin. The input data (scriptSig) for claiming outputs is purposely malleable to allow for useful scenarios where one would want to claim outputs in different ways.

The consequence of these features is that the hash of the transaction changes and shouldn't be considered as a useful piece of information other than referencing outputs of transactions that have been confirmed.

With that being said, I'm not sure what changes the client could implement to prevent the hash from changing. Perhaps it can enforce specific rules, like making non-canonical data pushes non standard, however that may interfere with later extensions to Bitcoin.

  • If the scriptSig is purposefully malleable, can't it just be excluded when calculating the txid?
    – Minthos
    Commented Apr 4, 2015 at 0:58

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.