search

rainbreak / solidity-btc-parser

Solidity library to parse raw Bitcoin transaction bytes
Other
33 stars 12 forks source link

Security of the checkValueSent function #19

Open achempion opened 6 years ago

achempion commented 6 years ago

Due to some Hash160 so-called collisions we cant use checkValueSent function. For example, we can have two BTC addresses that both have the same Hash 160, for instance: https://blockchain.info/ru/address/17AXqoGmJ71Noc2hZvDnP1wGPZTVykXsPd https://blockchain.info/ru/address/37rYmLmCr1Kktmj8h1tNoeJCY5kDaGHpjp

My proposition is that we need to add another argument to specify the type of BTC address (p2p, p2sh or both).

Here we need to check specifically for our type of an address. https://github.com/rainbreak/solidity-btc-parser/blob/master/src/btc_tx.sol#L286

rainbreak commented 6 years ago

Thanks for catching this! I won't have time to make a fix any time soon, but if anyone wants to propose a patch thatd be great.