mpapec

Bitcoin Gold (BTG) was 51% attacked

Preamble

Bitcoin Gold is a Bitcoin hard-fork that aims to be GPU-mineable by using the Equihash algorithm with parameters (144, 5) also known as "Zhash". The Bitcoin Gold website claims Zhash "uses more memory than an ASIC can muster, but runs fine on many graphics cards". Bitcoin Gold was previously 51% attacked in May 2018 when it was estimated that up to $18 million worth of BTG was double-spent.

The Attacks

Between Thursday and Friday we detected two deep reorgs on BTG, both of which contained double-spends. Their details are listed below. All times are GMT.

Using PGP signatures with bitcoin script OP_CHECKDATASIG

Dr. Mark B. Lundeberg, 2018 August 30 bitcoincash:qqy9myvyt7qffgye5a2mn2vn8ry95qm6asy40ptgx2

Since version 2.1, GnuPG is able to use the very same secp256k1 elliptic curve signature algorithm (ECDSA) as used in bitcoin. Quite soon Bitcoin Cash will add a new script opcode OP_CHECKDATASIG that is able to check signatures not just on the containing transaction, but also on arbitrary data. For fun, let's try to intersect the two signature systems and see what can be done!

Background

OP_CHECKDATASIG signatures

The P2SH script:

OP_HASH160 
0x14 
<hash160 of alice's secret>	
OP_EQUAL 
OP_TOALTSTACK 
OP_HASH160 
0x14

Intro

May 15th is bringing a network upgrade (also known as a hard fork) to the $BCH network. Along w/ a 32 MB block size we're reactivating a bunch of OP codes. Thanks to the advice of @MADinMelbourne I decided to see exactly what each new OP code was bringing to the table.

Below I list each new OP code w/ a quick description and then demonstrate how it works by showing a small validation script and then what the stack would look like after.

Please let me know if you spot errors. Thanks!

	When embarking on community moderation and when claiming the authority to mete out judgements, clear policy and procedure is
	key to keep the moral authority to do so and to protect all of the parties involved.
	Effective immediately, The Perl Foundation (TPF)'s Community Affairs Team (CAT) will not accept any incoming reports nor issue
	any rulings until such time as:

	a) a set of policies can be created to govern it
	b) that policy is voted on and accepted by the TPF governing board
	c) the policy, reporting procedure, and CAT board membership are clearly posted on the TPF's main website

	Once this is done we hope to rebuild a sense of trust within the Perl Community and to act to keep it safe and welcoming.

	// Copyright (c) 2020 Xiaohui Liu.
	// Use of this source code is governed by a MIT-style license.

	// This is an implementation of https://craigwright.net/blog/bitcoin-blockchain-tech/offline-addressing
	// For more info, also see Episode 4 of Bitcoin Class with Satoshi: Extended Address https://youtu.be/rezvcJ4j-7U
	const bsv = require('bsv');
	const BN = bsv.crypto.BN
	const Hash = bsv.crypto.Hash
	const G = bsv.crypto.Point.getG()
	const N = bsv.crypto.Point.getN()

	const crypto = require('crypto')
	const assert = require('assert')

	function sha256 (buffer) {
	assert(Buffer.isBuffer(buffer), `Argument must be a buffer, received ${typeof buffer}`)

	const hash = crypto.createHash('sha256')
	hash.update(buffer)
	return hash.digest()
	}

	function interceptNetworkRequests(ee) {
	const open = XMLHttpRequest.prototype.open;
	const send = XMLHttpRequest.prototype.send;

	const isRegularXHR = open.toString().indexOf('native code') !== -1;


	// don't hijack if already hijacked - this will mess up with frameworks like Angular with zones
	// we work if we load first there which we can.
	if (isRegularXHR) {

	#include "merkle.h"

	#include <assert.h>
	#include <string.h>
	#include <stdio.h>

	void merkle_init(merkle_ctx* ctx){
	ctx->size = 0;
	ctx->mutated = false;
	}

	let BITBOXCli = require('bitbox-cli/lib/bitbox-cli').default;
	let BITBOX = new BITBOXCli();

	let hdnode = BITBOX.HDNode.fromXPriv('xpriv');

	let transactionBuilder = new BITBOX.TransactionBuilder();
	let originalAmount = 21732;
	let txid = 'b7cb6dee60b70952c9a5285fd978957ff857140844ad81cff2cca7ddb87e0028';
	let byteCount = BITBOX.BitcoinCash.getByteCount({ P2PKH: 5 }, { P2PKH: 5 });
	let sendAmount = originalAmount - byteCount;