How to handle weak scripts?

[miner2251]

Be careful with custom scripts. Coins can be taken without any valid signatures.

A good example of that case is what happened recently here: https://mempool.space/address/bc1p78u5v2rgsu7gf79yw5c85fs3da0hfsw25ht5tr6p3mvh5wvmck6qpxcn8z

As you can see, the TapScript is unsafe:

Code:

OP_PUSHBYTES_32 fa9b5ec193f735c41b804fc6ace1d28e81a299fc815c0f5009dd2dd7d0293c3b
OP_CHECKSIG
OP_IF
OP_PUSHBYTES_32 ff1275b635cd160914cfe1bc516f521abde0fc8ae3fd92ae01ca16449e4758e9
OP_ENDIF

Normally, when you have the "true owner" of these coins, then you create a valid signature, and spend them to a proper destination. However, because OP_CHECKSIG is followed by OP_IF, then coins can be also moved unconditionally, without signing anything, by just pushing "OP_TRUE" and "<empty>" on a witness stack.

And now, the question is: what to do with cases like that? Should these coins be sent back? And if so, then how it should be done? Because moving them to a weak address, will only move them to other hands, when someone else will notice, how they can be moved. And moving them to the same public key, without a vulnerable part, can be unnoticed by the "true owner", and then, they can be forever locked, if nobody will claim them. Another option is 1-of-2 multisig between the "fa9b5ec193f735c41b804fc6ace1d28e81a299fc815c0f5009dd2dd7d0293c3b", and some second party, but again: if some user has a weak wallet, filled only with these weak keys, then it can simply skip more secure scripts, even if they will contain that public key, or some hash of it.

Any ideas?

Also, does anyone know, which buggy wallet could be used to make things like that? Because maybe there are more victims we don't know about, as long as their TapScripts are hidden.

[pooya87]

This is not the first time people try to create their own custom locking scripts and end up messing something up and instead of "locking" coins, they either burn their coins in a script no-one can spend or create an "anyone can spend" output. It's something that existed from day one and it is almost never an actual wallet software that does this, since any decent wallet sticks to the standard scripts that are tried and are impossible to have such flaws (eg. P2PKH, P2WPKH, etc.).

This usually happens when someone tries to manually create their own scripts. Although I too am curious to know how this Tapscript is made since not that many tools support it yet.

[miner2251]

It's something that existed from day one

Of course. But the question is: what to do with them? Just keep it? Is it called "stealing", if some coins can be moved unconditionally, without any signatures?

And if someone believes, that they should be sent back, then how exactly it should be done? Because sending them to the same address means, that just yet another person will sweep them, without any signatures.

Also, it seems there are more affected addresses, which use the same public key, even if coin amounts are smaller: https://mempool.space/tx/56f4c8b2c11ce6010637f8f831ad03430bc1686fc39d4833ec0281ddbef01a22

[pooya87]

Well it's someone else's money if they made a mistake, so taking it would be stealing.

How to give it back?
In this case I suppose since the key is still safe, the process is straight forward just time consuming.
1) Take the coins
I say if you see something like that, the correct way is to spend those coins immediately by sending them to an address you control.
2) Announce it publicly
In the transaction spending them you could include an OP_RETURN output containing a text that assures them of your intentions with a text also saying something like "visit bitcointalk.org to know what to do".
Then open up a topic on popular bitcoin related forums (here and reddit/r/bitcoin are good options) announcing what you did and why.
3) Ask for proof before you give it back
Ask those who claim to be the "real" owner to provide a signed message from the private key that was used in the flawed script. The message should contain a date, purpose and a new address so that you can send the coins back to the real owner.
4) Send the coins back to that address
That's self explanatory.

P.S. Honorable mention of @johoe who saved 800BTC...
https://www.ccn.com/archive/crypto/interview-johoe-hacker-returned-800-bitcoins/