Create simple and secure transaction without checksig?

Question

According to my previously asked question (P2SH secure spending. How?) creating transactions without signature checking is probably not secure.

Anyway, I see many transactions

(for ex.:40eee3ae1760e3a8532263678cdf64569e6ad06abc133af64f735e52562bccc8)

with scriptpubkey like: OP_HASH160 [pubkey] OP_EQUAL

With very similar to

OP_SHA256 [hash] OP_EQUAL (from my prev. question)

And scriptsig doesnt have OP_CHECKSIG

PUSHDATA(72)[3045022100ad0851c69dd756b45190b5a8e97cb4ac3c2b0fa2f2aae23aed6ca97ab33bf88302200b248593abc1259512793e7dea61036c601775ebb23640a0120b0dba2c34b79001] 

PUSHDATA(69)[5141042f90074d7a5bf30c72cf3a8dfd1381bdbd30407010e878f3a11269d5f74a58788505cdca22ea6eab7cfb40dc0e07aba200424ab0d79122a653ad0c7ec9896bdf51ae]

I can't beleeve this transaction are insecure. But what the difference with this ones?

Answer 1

This transaction actually does have a signature check. Instead of OP_CHECKSIG, it's OP_CHECMULTISIG as the script is a multisignature script. The script in this case is the redeemScript which is provided in the input itself. To see this OP_CHECKMULSITIG, you need to decode the redeemScript.

The redeemScript is:

5141042f90074d7a5bf30c72cf3a8dfd1381bdbd30407010e878f3a11269d5f74a58788505cdca22ea6eab7cfb40dc0e07aba200424ab0d79122a653ad0c7ec9896bdf51ae

Decoded, this redeemScript is:

1 042f90074d7a5bf30c72cf3a8dfd1381bdbd30407010e878f3a11269d5f74a58788505cdca22ea6eab7cfb40dc0e07aba200424ab0d79122a653ad0c7ec9896bdf 1 OP_CHECKMULTISIG

As you can see, this has an OP_CHECKMULTISIG in it which does do a signature check. OP_CHECKMULTISIG checks that n of the public keys listed provide a signature. n is the number that is at the beginning of the script. In this case, n is 1, and the public key is 042f90074d7a5bf30c72cf3a8dfd1381bdbd30407010e878f3a11269d5f74a58788505cdca22ea6eab7cfb40dc0e07aba200424ab0d79122a653ad0c7ec9896bdf. So this script is looking for a signature that corresponds to that public key.