search

bitpay / insight

A bitcoin blockchain explorer and API
https://insight.bitpay.com/
MIT License
1.19k stars 1.11k forks source link

bch-insight.bitpay.com is accepting invalid transactions. *server vulnerability* #954

Closed coinbackup closed 5 years ago

coinbackup commented 6 years ago

I can send a completely invalid transaction to bch-insight.bitpay.com and it will accept the tx into the mempool. The curious thing is, test-bch-insight.bitpay.com works fine.

See transaction 775b336a562879fabb49a460b9432b2fb2c6dff1cd7a6ec91343166589e36587 on bch-insight. It has a fee of -50 BCH. Yes, that's a negative fee. The tx output is much greater than the input.

See address pq8m97pnmzk5u6pw8thpd447meu7s000uqf2mu2fpe. There are several unconfirmed txs. These will remain unconfirmed for a long time because their nLockTime is set to at least a month in the future. One of them has an nLockTime set to the year 2080. The server should not be accepting these transactions. A malicious individual could easily break your node by flooding the mempool with invalid transactions.

Also, all of those unconfirmed txs are trying to spend the same UTXO. Only the first attempted spend of a UTXO should have been accepted.

Again, test-bch-insight.bitpay.com works great, so I'm not sure why the livenet instance is different.

christiangirl41 commented 5 years ago

Pay for my Bitpay card with debut card

christiangirl41 commented 5 years ago

I’d like to pay for BitPay card with debit/ credit card

matiu commented 5 years ago

Hi, Thanks a lot for the detailed report.

The server at bch-insight.bitpay.com uses a transition version of Bitcore (v5) that is been replaced with our current version v8. We will update is as soon as possible, sorry for the inconveniences.