1

Just wondering what the output from gettransaction (or should I be using getblock?) would look like if I passed it a txid(or blockhash) that contained a set of transactions that exploited the double spend bug CVE-2018-17144? Is it distinguishable from a normal, non double-spend? Does the wallet being queried have to know about both the addresses spent to, in order to show anything out of the ordinary?

2

You could use $ getblock <blockhash> 2 or $ getrawtransaction <tx-hash> 2.

Here is a transaction that exploited this bug on testnet: fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59

$ bitcoin-cli -testnet getrawtransaction fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59
    {
      "txid": "fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59",
      "hash": "fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59",
      "version": 1,
      "size": 403,
      "vsize": 403,
      "weight": 1612,
      "locktime": 0,
      "vin": [
        {
          "txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
          "vout": 1,
          "scriptSig": {
            "asm": "3045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e3[ALL] 0455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8",
            "hex": "483045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8"
          },
          "sequence": 4294967295
        },
        {
          "txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
          "vout": 1,
          "scriptSig": {
            "asm": "304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da3773[ALL] 0455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8",
            "hex": "47304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da377301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8"
          },
          "sequence": 4294967295
        }
      ],
      "vout": [
        {
          "value": 0.09900000,
          "n": 0,
          "scriptPubKey": {
            "asm": "OP_DUP OP_HASH160 c8b876680fef08df5278a9df92df7e30b83cbb71 OP_EQUALVERIFY OP_CHECKSIG",
            "hex": "76a914c8b876680fef08df5278a9df92df7e30b83cbb7188ac",
            "reqSigs": 1,
            "type": "pubkeyhash",
            "addresses": [
              "mypGR6pDS85nidXk3DoHZCNBuYd6WBhzgU"
            ]
          }
        }
      ],
      "hex": "0100000002d9bf9d812cfc91e3ff3b7f68e85269f64e7825de0fa61ff9dde117c73b72086a010000008b483045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8ffffffffd9bf9d812cfc91e3ff3b7f68e85269f64e7825de0fa61ff9dde117c73b72086a010000008a47304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da377301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8ffffffff01e00f9700000000001976a914c8b876680fef08df5278a9df92df7e30b83cbb7188ac00000000",
      "blockhash": "00000000eba3f43a8624750f39e4520a1678c0dbdf8707bfa4854a12fbf086c5",
      "confirmations": 0,
      "time": 1537995498,
      "blocktime": 1537995498
    }

Is it distinguishable from a normal, non double-spend?

You will notice the input is listed twice in the 'vin':

"txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
"vout": 1,

That is considered a double spend.

Does the wallet being queried have to know about both the addresses spent to, in order to show anything out of the ordinary?

The wallet would have to be watching the associated addresses or it probably wouldn't have that transaction stored. Even if it's a full node, you can only get the tx by txid if you have indexed the blockchain using -txindex flag.

  • You see in that json where you have vin.vout twice, and theyre both 1. Is it always this way? While idly browsing the block explorer rich list for a coin I've got some old hodlings, I noticed this: chainz.cryptoid.info/funk/tx.dws?1211915.htm - is that also this same exploit? The txid is repeated over and over, but the vout is different, unlike your example – Caius Jard Oct 23 '18 at 19:54
  • If only the vout is different, then it is a different output from the same transaction – JBaczuk Oct 28 '18 at 0:53
  • So I need to chase the transaction outputs back to find ones with the same vout? – Caius Jard Oct 28 '18 at 7:51
  • If you're looking for a double spend, yes. A transaction output is identified uniquely by it's txid and vout together. This is because transactions can have multiple outputs. – JBaczuk Oct 28 '18 at 16:00
  • 1
    Yes, it appears so – JBaczuk Oct 28 '18 at 19:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.