Oversize preimage attack.



Summary:

In a recent email exchange, Olaoluwa Osuntokun discusses the requirement of using a 110k preimage to redeem and dropping it to the blockchain. This process would create a non-standard transaction which may not propagate. Similarly, an almost 4MB preimage would require grinding out a tiny signature to redeem in a tx small enough. However, Segwit's witness program validation logic ensures that each element of the passed witness stack is less-than-or-equal-to the maximum script element size of 520 bytes. This check is enforced before execution itself, thus enforcing a ceiling on the pre-image size even without the additional OP_SIZE check. Following this, a modification was made to their scripts similar to the one discussed. In response, Rusty thanks Olaoluwa Osuntokun for sounding the alarm with the mailing-list post and enquires about any other issues that may have been missed.


Updated on: 2023-05-23T23:39:55.866509+00:00