2

I understand that BIP12 was withdrawn, and probably because of this exploit below. Can someone explain how this attack would have worked and the effect it would have on the network?

 for (;;) {
    RAND_bytes(nonce.b, sizeof(nonce));
    RIPEMD160(nonce.b, sizeof(nonce), digest);
    if (
      digest[0] == 174 && // OP_CHECKMULTISIG
      digest[1] ==  76 && // OP_PUSHDATA1
      digest[2] ==  16    // 0x16
    ) {
      // We'll print status info on partial hits, just to make things more
      // interesting.
      printf("%llx\n", nonce.i);
      print_hex(digest, 20);

      // Check for full hit
      if (digest[19] == 117) // OP_DROP
        return;
    }

1 Answer 1

4

Each transaction has a certain number of "sigops", the number of signature validation script ops like OP_CHECKSIG in its scripts. These script ops are very expensive to compute. Transactions with too many sigops are considered non-standard and will not be relayed by most clients. Blocks with too many sigops in their transactions are illegal and will be rejected entirely.

That exploit allows you to include sigops in transactions without increasing the sigop count. It could be used to create a very slow-to-compute transaction that isn't very big size-wise. Not a huge exploit, and it could be worked around, but it demonstrates an important weakness in BIP 12: OP_EVAL scripts can't be analyzed accurately without running them first.

2
  • Thank you, I need to learn sigop count and how it's done.... I'm getting the impression the QT client counts operations in a weighted curve.. (OP_CheckSig counts as X operations, and OP_Equal counts as Y operations where X > Y) Is this correct? Is cost per operation sometimes >1 per operation? Dec 22, 2012 at 18:41
  • @makerofthings7 Only CHECKSIG and CHECKMULTISIG count. CHECKSIG counts as 1 sigop. CHECKMULTISIG always counts as 20 except inside of a P2SH transaction's hashed script where it usually counts as the number of public keys passed to CHECKMULTISIG.
    – theymos
    Dec 22, 2012 at 21:14

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.