2

I was wondering, if I used an address adr0 to spend some coins in a transaction tx0 that give the coins to a different address adr1, and eventually, after some time, I receive some (completely unrelated) coins to the same address adr0. Can somebody take the transaction tx0 I signed and publish it in order to spend the new coins with the old transaction? (after all, they belong to the same address, and I already signed and gave a transaction that spends coins from this address).

If so, how is it that address reuse is not directly forbidden? if not, can you detail why?

Improve this question

2 Answers 2

Reset to default
5

Can somebody take the transaction tx0 I signed and publish it in order to spend the new coins with the old transaction?

No.

Firstly, the transaction inputs are already known to have been used. Any node examining the block will know that the rerun transaction has invalid inputs.

Secondly I expect (but haven't checked) the inputs to the signature include both addresses. This prevents the signature being misused in the way you suggest. (See Murch's clarification in comment below)

It may help (if not you, some other readers) to remember that bitcoins don't exist outside or inside the blockchain. The only thing that exists are transaction inputs and outputs. You can't use a signed transaction with inputs A,B and C to use inputs D and E. The signature prevents you altering the signed contents without invalidating the signature.

how is it that address reuse is not directly forbidden? if not, can you detail why?

Addresses can be reused. The most obvious problem is one of privacy. If you give someone an address so they can buy $0.01 of tent-pegs from you, they can then see on the blockchain that you also received $300,000,000 recently to that address and go buy a big hammer and come to visit you at 3 a.m.

Improve this answer
3
  • Small note: privacy is not the only concern, though perhaps it is the most pertinent. Having multiple signatures from the same privkey could potentially weaken the security assumptions of asymmetric key cryptography— though no current attacks are currently known, it is not impossible that one will be discovered in the future. This is a small worry that could be fixed if needed, but worth mentioning.
    – chytrik
    Jul 17, 2018 at 22:29
  • Do note that there is a small edge case, where if a transaction is signed with SIGHASH_SINGLE, but the vin given is outside the bounds of the transaction, that signature is valid for any transaction output to that address, past, present, or future!
    – Raghav Sood
    Aug 2, 2018 at 11:09
  • It may help to clarify that the utxo is identified uniquely via the outpoint. Strictly speaking the signature doesn't commit to the address of the input, but only fulfills the corresponding output script the funds were locked to. In the case of P2PKH this happens to reference the address to identify the intended spender. ;)
    – Murch ♦
    Aug 2, 2018 at 17:21
0

For this you should take a look at a system called "unspend transaction outputs" (utxo). This system works as follows:

Every transaction consists of one or more inputs and one or more outputs. The input specifies, where the money came from by referencing a previous output. And the output describes who and/or how the money can be spend.

So when you sent the coins in tx0, you spent the output, in which you received the money in the first place. As this output is now spent, it cannot be referenced again. And following from that, your previously used tx0 which was signed by you cannot be used again. It would be invalid because it tries to spend an already spent output. For the reasons why you shouldn't reuse addresses, see this

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.