Maybe my question is stupid, but

imagine that I'm trying to spend inputs from p2sh.

For example, p2sh scriptPubKey looks like:

OP_SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a OP_EQUAL

I know, that the SHA256(0x01) = 4bf5122f...85459a (hacker do not know that, until I broadcast tx)

So I broadcast transaction with the folowing scriptsig:

OP_1 (0x51)

Why hacker can't take this unconfirmed transaction, extract scriptsig, and replace outputs to his own outputs ?

Also, what to do, if RBF (replace-by-fee) flag is set?

Of course, I'm not talking about transactions with OP_CHECKSIG

  • Just to be technically correct, a P2SH scriptPubKey` is actually OP_HASH160 <scriptHash> OP_EQUAL, see en.bitcoin.it/wiki/Transaction#Pay-to-Script-Hash
    – JBaczuk
    Dec 17, 2018 at 15:30
  • Yes, thank you. Is there any diff with HASH160, or problem the same ?
    – Andrew
    Dec 17, 2018 at 15:37
  • It's not really relevant to the question, just for correctness.
    – JBaczuk
    Dec 17, 2018 at 15:49

2 Answers 2


You're correct that anybody could just replace the outputs and take the funds for themselves. This script has no authorization needed on the spender's part, so once the redeemscript is known, it's practically become an anyone-can-spend script.

Assigning an RBF enabled sequence (or not) on the transaction makes no difference (perhaps only for relay policy), since any sequence set can also be replaced by anybody.


Of course, I'm not talking about transactions with OP_CHECKSIG

I think this is the core of your misunderstanding. P2SH is not intended to be secure if you use an insecure script. It is simply a way to conveniently and cheaply producing an output with a policy and security that is equivalent to a script.

In practice, no script without a type of CHECKSIG operation will be secure, for the reasons you give yourself.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.