Blockstream co-founder Gregory Maxwell reveals vulnerability in Bitcoin SV multisig

The multisignature system in Bitcoin SV does not secure users’ assets, according to Blockstream co-founder Gregory Maxwell.

AND ITS GONE: Popular BSV multisig provides no security at all and eventually the coins all go poof.
byu/nullc inbsv

In February 2020, as part of a Bitcoin SV update called Genesis, developers replaced Bitcoin’s P2SH multisignature mechanism with their own scheme.

As a result, a solution known as ElectrumSV—or ‘multisig accumulator’—emerged. This script provides transaction validation when the required number of signatures is met or exceeded.

Blockstream CEO Adam Back wrote that, due to a bug, the actual execution condition was a number of signatures that was less than or equal to the required number, including zero.

Wow that’s a nasty BSV-only bug. Less than or equal instead of greater than or equal (number of signatures in a multisig). Presume they removed the standard p2sh multisig and replaced with this bugged home-brew multisig due to BSV anti-soft fork posturing, to undo soft-forks.

— Adam Back (@adam3us) November 8, 2020

«As a result, these scripts had no protection whatsoever and could be executed by sending a pair of zeros,» Maxwell noted.

He said that no real funds were compromised, but there are a few lessons to draw from this. In his view, the issues would not have arisen if Bitcoin SV developers had used proven multisig mechanisms rather than ‘home-grown cryptography’.

«User Bitcoin scripts require the same attention as other cryptographic functions,» Maxwell noted.

In April, the creators of Bitcoin SV stated that the Bitcoin testnet fork had been processing 1,300 transactions per second for an extended period, and peaked at 6,400 TPS.

Subscribe to ForkLog news on Twitter!