1

In the Coursera course "Bitcoin and Cryptocurrency Technologies" course, a coin called ScroogeCoin was introduced.

This coin is similar to bitcoin in that each transaction consists of a set of inputs and outputs. Inputs point to outputs from previous transactions with corresponding signatures, and outputs contain the value and address the value is applied to.

The protocol checks that (sum of input values) - (sum of output values) >= 0, and this difference is the transaction fee.

I feel that this condition is too loose and there may be a potential problem. For example, suppose Alice has a coin of value 50 and spends 100, while Bob has a coin of value 100 and spends 50. Both of these are in the same transaction. Then the protocol would allow this to pass.

I feel that the protocol should check instead

For all addresses, (sum of input values from address) - (sum of output values that is spending from address) >= 0

This is because the original protocol allows spending from someone else's address. This sounds like something that can be exploited e.g. an implicit money transfer from Bob to Alice is hidden. We can assume Alice and Bob are colluding to achieve this.

Is this benign?

Improve this question
1
  • 1
    I don't think I really understand what you are concerned about. As long as Alice and Bob both consent to the spending of their coins, then there is no problem, right? Are you worried that the rest of the network can't tell how Alice's and Bob's coins were allocated between the two outputs? Well, why should they be able to tell? It isn't anyone's business except Alice and Bob's.
    – Nate Eldredge
    Nov 13, 2017 at 13:58

3 Answers 3

Reset to default
0

In order to create an input, you need to be able to prove that you have the right to spend the those coins, usually by possessing the corresponding private key for their address.

For example, suppose Alice has a coin of value 50 and spends 100, while Bob has a coin of value 100 and spends 50. Both of these are in the same transaction.

To make a transaction as you describe, both Alice and Bob's private keys must be available at the same time. This is conceptually equivalent to Alice and Bob using the same wallet. In practice, Alice and Bob would have to use seperate transactions if their wallets were different.

Improve this answer
5
  • Yes, both Alice and Bob's private keys are used to create the respective signatures. For example, Alice can use her private key to create the signature, send the corresponding input and output to Bob, and then Bob completes creation of the transaction by creating signatures for his input and output coins. Are you saying that this is a possible exploit in theory, but implementation-wise we disallow this because a single transaction must use input addresses from a single wallet?
    – simpleton
    Nov 13, 2017 at 15:51
  • That's not possible while keeping the keys secret. The author of the transaction must know all the keys. So in your example, Alice and Bob are the same person. You can't create a single transaction containing different people's keys.
    – Adam Millerchip
    Nov 13, 2017 at 15:54
  • Sorry I pressed enter and accidentally sent my reply before it was complete. In my updated reply, I described a way to collude and construct such a transaction without leaking private keys. Is there anything in the protocols or validations that disallow this?
    – simpleton
    Nov 13, 2017 at 15:59
  • Yes I hadn't noticed your edit. I'm not completely sure if what you describe regarding sharing the signature is possible, but since we're talking theoretically let's assume it is. The result of creating such a transaction would be that 50 of Bob's coins are used to pay Alice's benefactor. A transaction works by summing the inputs then distributing to the outputs. The spending signature does not specify the output destination, that is defined at the transaction level. Bob would have to create this transaction, and has no motivation to do so.
    – Adam Millerchip
    Nov 13, 2017 at 16:08
  • 1
    So I guess this is possible? I agree there may be little motivation. I was thinking that maybe due to outside forces Alice and Bob are prohibited from sending money to each other and this allows them to hide the fact. Then again, I just realized there are several other ways for Alice and Bob to achieve the same objective. Thank you for the discussion!
    – simpleton
    Nov 13, 2017 at 16:19
1

It doesn't matter whose coins are funding (inputs) for the transaction the validation check still works.

(sum of input values) - (sum of output values) >= 0

There's nothing that states sum of input values on a per user basis. As long as the total value of the inputs, no matter who or where they come from, exceeds or equals the total value of the outputs the transaction passes the check.

Update: It's not an exploit. Each transaction input is treated separately and the condition to spend each input must be met separately. If Alice supplies an input tx then she'll also have to supply a scriptSig for that single input to prove she's entitled to spend it. Likewise with Bob's transaction, he'll have to supply a completely separate scriptSig that proves he's entitled to spend his input transaction.

Alice can't spend Bob's transaction and vice-versa (unless it's a multisig, spend by anyone etc) no matter how they are combined as inputs.

Improve this answer
2
  • Yes, I am asking why the validation is designed this way and whether this can be exploited. And I gave an example of a possible exploitation (or maybe this is not considered an exploitation).
    – simpleton
    Nov 13, 2017 at 12:34
  • Reply to update: I believe a single transaction can contain multiple inputs and multiple outputs. See en.bitcoin.it/wiki/Transaction#Explanation. Each input has its own separate signature and the validation condition is applied to all inputs and all outputs. Thus, unless I am missing something it seems to me that I can construct such a transaction and make the network accept it.
    – simpleton
    Nov 13, 2017 at 15:49
0

Your misunderstanding is here:

For example, suppose Alice has a coin of value 50 and spends 100, while Bob has a coin of value 100 and spends 50. 

That is not possible. When an output is spent by an input, it is always spent entirely. You don't get to say how much of that output is left in place - the amount you are getting from that input is exactly the amount created by the previous amount.

If Bob has a coin of value 100, and only wants to spend 50, all he can do is spent his coin of 100, and add an extra output to the transaction that sends 50 back to himself (typically to a new address of his, for privacy reasons).

Improve this answer
2
  • I wasn't clear. What I meant is. Alice spends coin of 50, sends coin of value 100 to some address X. Bob spends coin of 100, sends coin of value 50 to some address Y. Both of these happen in the same transaction. Thus, in this transaction, we see inputs with value {50, 100}, and outputs with value {50, 100}.
    – simpleton
    Nov 13, 2017 at 16:05
  • What you meant is what?
    – Pieter Wuille
    Nov 13, 2017 at 16:07

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.