2020-11-11 00:49 |
A Reddit post by former Blockstream developer and co-founder Gregory Maxwell states that Bitcoin SV’s multisig contracts no longer provide any security to the users, causing a loss of all BSV tokens. However, no real user funds have been affected by the critical bug; the statement reads.
In a quest to offer users a faster and less costly payment system, Bitcoin SV had to make some changes to Bitcoin Cash’s consensus rules during the hard fork in November 2018. One of the key changes was to rip out P2SH, or pay-to-script-hash, which allows a user to send a transaction to a “script” rather than a public key address. This was important for users signing into multisig addresses, which are wallet addresses that require several private keys to sign the transaction.
BSV abandoned the P2SH with a homebred solution in “Electrumsv (and presumably elsewhere)” called accumulator multisig, which is a script that looks like a P2PKH, or pay-to-public key hash, buts adds up “the number of passes and compares them to a threshold.” The problem arises on the threshold figure whereby instead of accepting X signatures or more, the developers instead coded accepting X signatures or less.
Electrumsv released a statement on Monday asking users not to send any funds to the accumulator multisig wallet to avoid losing their funds.
Please do not change the script type of your wallet, and especially do not change it to accumulator multi-signature. As one of our users unfortunately found out, it is broken and using it will result in the loss of coins. — rt12https://t.co/nhAbdo4h2V
— ElectrumSV (@ElectrumSV) November 8, 2020
According to Maxwell, the developers did not test the multisig solution well enough, only checking if too many signatures would raise a problem but leaving out the consequences of fewer signatures to the multisig wallets. He writes,
“The result is that these scripts had no security at all and could just be spent by a scriptsig that pushes a couple of zeros.”
One user, Aaron67, claims he lost 600 BSV (~$94,800) due to the exploit code when he sent his tokens to the multisig wallet – losing every single token. He explains that he thought it was safe to send funds to the wallet as it was featured by CoinGeek, a website run by Calvin Ayre, a close friend to nChain’s and Bitcoin SV founder, Craig Wright. According to the ElectrumSV team, the harmful bugs came from the developers at nChain.
A failed code change on Bitcoin SVAccording to Maxwell, the current BSV bug is not clear if it was an honest mistake or a scam from developers. However, he warns users from sending large amounts using scripts that are culpable of being a scam or built by developers that are easily deceived.
Even if the critical bug is accidental, Maxwell claims the error could be avoided if the developers took the time to check and test the homebred multisig wallet. Moreover, the issue could be completely avoided if the BSV developers did not gut “the competent, time tested, and highly peer-reviewed mechanisms” used on Bitcoin multisig wallet in favor of the less tested BSV homebred accumulator multisig solution.
In his closing remarks, Maxwell states that the presence of such a simple code error shows that there may be other issues on the BSV code.
“Kinda makes you wonder what amazing bugs are lurking in their node software or wallets,” he states. “I can say for sure: I'm not going to run any of it and risk finding out.”
The post Bitcoin SV Multisig Wallet, ElectrumSV, Exploited; Putting Real Users’ BSV In Jeopardy first appeared on BitcoinExchangeGuide.
Similar to Notcoin - TapSwap on Solana Airdrops In 2024
Bitcoin SV (BSV) íà Currencies.ru
|
