Skip to main content
9 votes
Accepted

Are Micropayment channels still subject to malleability after BIP65?

There are a variety of different ways to construct a micropayment channel, but there are two designs that I think are particularly relevant to your question about "simple, one-directional, ...
David A. Harding's user avatar
8 votes
Accepted

Is it possible to combine two separate transactions into one transaction by only using their signatures?

The only possibility in Bitcoin today is the one described by kaykurokawa. Every signature specifies which inputs and outputs it signs for, so if you want independently-created signatures, it will be ...
Pieter Wuille's user avatar
7 votes
Accepted

Are the witnesses segregated with Schnorr signatures?

Schnorr (bip-340) signatures have been introduced as part of v1 Segwit outputs with the CHECKSIGADD opcode. Therefore bip-340 signatures are part of the witness and are not part of the hash forming ...
Antoine Poinsot's user avatar
6 votes

Is it possible to combine two separate transactions into one transaction by only using their signatures?

Yes. But they require the transaction to be signed a certain way. OP_CHECKSIG has settable flags, which determines which of the inputs and outputs are signed. If SIGHASH_SINGLE and ...
k kurokawa's user avatar
  • 2,082
6 votes
Accepted

Lightning network: how was malleability actually fixed?

As far as I know, the malleability issue was fixed with the Segwit soft fork in August 2017. Yes. Was the malleability issue fixed with SIGHASH_NOINPUTor with some other method? No, using SegWit. ...
Pieter Wuille's user avatar
6 votes
Accepted

Why was transaction malleability fix required for Lightning network?

Alice creates a multisig transaction sending 100btc to a shared Alice-Bob output–one that requires both signatures–and signs it. We’ll call this transaction Tx0. And she only reveals Tx0 to Bob after: ...
Preet's user avatar
  • 458
6 votes
Accepted

Are non-SegWit transactions still malleable?

It's important to point out that segwit doesn't prevent malleability: in many ways the actual transaction data can still be changed by third parties. It just makes it harmless for the purposes of ...
Pieter Wuille's user avatar
6 votes
Accepted

When is a Miniscript solution malleable?

Malleability in the context of Miniscript Malleability is the possibility for a third party to turn a valid satisfaction into another valid satisfaction. That is, to change the witness in the input of ...
Antoine Poinsot's user avatar
5 votes
Accepted

Does Segwit mean easier government monitoring?

No, that's completely wrong. There is absolutely no anonymity benefit to third-party transaction malleability. Third-party transaction malleability makes use of a symmetry in ECDSA signatures that ...
Murch's user avatar
  • 75.4k
5 votes

Are non-SegWit transactions still malleable?

Does that mean that non-SegWit transactions are still malleable? Yes. Segwit does not change non-segwit inputs so the malleability fixes it introduces only apply to segwit inputs. If so, what ...
Ava Chow's user avatar
  • 70.5k
4 votes
Accepted

Why are miners allowed to change a tx id?

BIP 62 proposed to make transaction malleability impossible. No it didn't. It would have outlawed a limited number of known and addressable forms of malleability. In particular, it did not prevent ...
Pieter Wuille's user avatar
4 votes

How are transaction IDs generated and how are they then changed by transaction malleability?

The transaction ID is the SHA256d(signedTransaction) = SHA256(SHA256(signedTransaction)). Sha256d is SHA256 applied two times. Example: Let us consider the transaction with ID ...
Thorkil Værge's user avatar
4 votes
Accepted

OP_RETURN malleability?

The OP_RETURN is in the scriptPubKey, which is signed as part of the transaction, so it can't be altered. So it is not malleable. The known types of malleability are described in BIP 62.
Ken Shirriff's user avatar
4 votes
Accepted

In ECDSA, why is (r,−s mod n) complementary to (r, s)?

ECDSA signatures are pairs (r,s) such that r = x(m/s*G + r/s*P) mod n, where P is the public key and m is the message digest. x() in that equation means "the X coordinate of". In that ...
Pieter Wuille's user avatar
4 votes
Accepted

Transaction malleability

The transaction that you submitted and the transaction that was malleated in-flight or by a miner are both legitimate (valid) transactions. Transaction malleability means that a valid transaction can ...
Ugam Kamat's user avatar
  • 7,408
4 votes

Is a transaction with a non-segwit input STILL considered malleable? If so how?

I think you are conflating two types of malleability: The first one is txid malleability of a presigned transaction: two (or more) parties can't trustlessly build a chain of unconfirmed transactions ...
Antoine Poinsot's user avatar
3 votes
Accepted

Bitcoin Core 0.13 -- jsonrpc interface -- conflicted transactions

If you call listtransaction, you should get a JSON array called walletconflicts. If your transaction conflicts with another transaction in your mempool or with a transaction in a block, this ...
Jonas Schnelli's user avatar
3 votes

testnet3 frequent tx malleability

The miner which confirms current blocks on testnet is malleating transactions. I can confirm this. But what is the problem? Current consensus rules allow this. Trust me. I am an expert in ...
amaclin's user avatar
  • 6,770
3 votes
Accepted

testnet3 frequent tx malleability

Someone (let's call her Alice onwards) is messing up with testnet transactions, it happened to one of mines earlier today. What's happening Alice is changing the s representation of the EDCSA ...
sr_gi's user avatar
  • 3,220
3 votes
Accepted

If well-built wallet software can avoid transaction malleability, why does the lightning network need an additional malleability fix?

My understanding is that wallets can avoid creating malleable transactions. It depends. For typical transactions, standardness rules on the network make malleated transactions unlikely to be relayed ...
Pieter Wuille's user avatar
3 votes

Is transaction malleability the only consensus issue that needs fix to allow lightning network?

BIP62 has been scrapped and will never be implemented. Instead a much better solution with many more advantages, Seggregated Wittness, has been developed and is currently being rolled out. Its ...
Jannes's user avatar
  • 6,344
3 votes

Transaction Malleability, if i want to change signature, what part should I change, so that it would remain valid?

A signature consists of two numbers r and s. You can change s with N - s (N is the elliptic curve order) and it would still be valid. Sources of malleability are documented here https://github.com/...
Mike D's user avatar
  • 3,569
3 votes
Accepted

Why didn't Bitcoin implement segwit in the first place?

Why didn't Bitcoin implement segwit in the first place? The reason Bitcoin didn't initially have SegWit is up to interpretation, I would say that it simply was not thought of prior to transaction ...
Mason Ticehurst's user avatar
3 votes

what does segwit remove?

If SegWit removes signature data, where does it put it exactly ? what does it mean that it puts at the end of the transaction ? and how does it make a block to contain more transactiosn? It doesn't ...
Pieter Wuille's user avatar
3 votes
Accepted

How and when were high-s signatures made non-standard?

The requirement for transactions to only have low-s signatures is a standardness rule. Standardness is enforced at the mempool policy level and is not a protocol rule. Although the mempool behavior of ...
Murch's user avatar
  • 75.4k
3 votes

Is a transaction with a non-segwit input STILL considered malleable? If so how?

The status of BIP146 is “withdrawn”. Even for segwit inputs, high-s ECDSA signatures are only non-standard but consensus valid. I don’t know about the other malleability issues in detail, but would ...
Murch's user avatar
  • 75.4k
3 votes
Accepted

Bitcoin transaction malleability is it only for unconfirmed transaction?

TL;DR: Yes, once a transaction is confirmed, unless a chain reorganization makes it unconfirmed again, no forms of malleability are possible. SegWit specifically fixed TXID malleability of unconfirmed ...
Vojtěch Strnad's user avatar
2 votes
Accepted

Is CheckSequenceVerify only a stop-gap measure?

CSV is not a stop-gap solution. Before you can say that, you first need to define what the problem is. CSV solves the problem that you can't use CLTV in contracts that need a spending delay where the ...
Pieter Wuille's user avatar
2 votes

Spending own generated unconfirmed change in the v.0.9.0 era

It is basically never a good idea to be spending from an unconfirmed transaction, regardless of transaction malleability fixes or other improvements. Unconfirmed transactions are not final and thus ...
Ava Chow's user avatar
  • 70.5k
2 votes

tx-malleability who re-signed the tx?

Actually, nobody else can create a valid signature for your transaction inputs, as they do not possess the private keys to do so. When a transaction is malleated by a third party, it is not re-signed,...
Murch's user avatar
  • 75.4k

Only top scored, non community-wiki answers of a minimum length are eligible