Baaleos commented 6 years ago

Just examining the code - I cannot see anything anywhere that deals with public / private keys etc. The way the code is written at the moment, would it not be possible for someone to maliciously spoof another persons identity and empty their balance? It looks like the transaction system just lets you specify the from and to address explicitly and it accepts the transaction to the block assuming it gets mined, whether you had the right to spend the coins in the persons address or not.

Of course, I may be wrong - can someone direct me to where this exists or confirm if it is an issue?

Bitcoin from memory derives the public bitcoin addresses from the private keys - meaning only someone who has the private keys can sign transactions. (Basically like signing a cheque)

Mat001 commented 6 years ago

My understanding is that @dvf kept this code simple for demo purposes and hasn't added some other features that would be required otherwise...

seghcder commented 6 years ago

Agree. And it does that very well.

jamesbaker1 commented 6 years ago

https://github.com/dvf/blockchain/pull/63

anguianomaria commented 6 years ago

dvf / blockchain

Security? #107

107