How to handle weak scripts?

[miner2251]

Be careful with custom scripts. Coins can be taken without any valid signatures.

A good example of that case is what happened recently here: https://mempool.space/address/bc1p78u5v2rgsu7gf79yw5c85fs3da0hfsw25ht5tr6p3mvh5wvmck6qpxcn8z

As you can see, the TapScript is unsafe:

Code:

OP_PUSHBYTES_32 fa9b5ec193f735c41b804fc6ace1d28e81a299fc815c0f5009dd2dd7d0293c3b
OP_CHECKSIG
OP_IF
OP_PUSHBYTES_32 ff1275b635cd160914cfe1bc516f521abde0fc8ae3fd92ae01ca16449e4758e9
OP_ENDIF

Normally, when you have the "true owner" of these coins, then you create a valid signature, and spend them to a proper destination. However, because OP_CHECKSIG is followed by OP_IF, then coins can be also moved unconditionally, without signing anything, by just pushing "OP_TRUE" and "<empty>" on a witness stack.

And now, the question is: what to do with cases like that? Should these coins be sent back? And if so, then how it should be done? Because moving them to a weak address, will only move them to other hands, when someone else will notice, how they can be moved. And moving them to the same public key, without a vulnerable part, can be unnoticed by the "true owner", and then, they can be forever locked, if nobody will claim them. Another option is 1-of-2 multisig between the "fa9b5ec193f735c41b804fc6ace1d28e81a299fc815c0f5009dd2dd7d0293c3b", and some second party, but again: if some user has a weak wallet, filled only with these weak keys, then it can simply skip more secure scripts, even if they will contain that public key, or some hash of it.

Any ideas?

Also, does anyone know, which buggy wallet could be used to make things like that? Because maybe there are more victims we don't know about, as long as their TapScripts are hidden.

[pooya87]

This is not the first time people try to create their own custom locking scripts and end up messing something up and instead of "locking" coins, they either burn their coins in a script no-one can spend or create an "anyone can spend" output. It's something that existed from day one and it is almost never an actual wallet software that does this, since any decent wallet sticks to the standard scripts that are tried and are impossible to have such flaws (eg. P2PKH, P2WPKH, etc.).

This usually happens when someone tries to manually create their own scripts. Although I too am curious to know how this Tapscript is made since not that many tools support it yet.

[miner2251]

It's something that existed from day one

Of course. But the question is: what to do with them? Just keep it? Is it called "stealing", if some coins can be moved unconditionally, without any signatures?

And if someone believes, that they should be sent back, then how exactly it should be done? Because sending them to the same address means, that just yet another person will sweep them, without any signatures.

Also, it seems there are more affected addresses, which use the same public key, even if coin amounts are smaller: https://mempool.space/tx/56f4c8b2c11ce6010637f8f831ad03430bc1686fc39d4833ec0281ddbef01a22