text:
What factors decides the number of tokens to generate?
Tron has decided to generate 100B tokens with some initial price? What parameters do these centralised crypto owners consider before deciding the number and price of tokens?

There are no answer to that.
Depends on many things the token creators want to accomplish.


text:
Can't sync to Bitcoin Network
I'm a newbie to this community.
I have been trying to download all the blocks and be a full node, but I cannot connect to peers.
I checked my firewall and there seems no problem, and tried to add node option ( -addnode=~~) and I used some active nodes addresses in https://bitnodes.io/nodes, but none of them worked.
I am using my college network, so I requested to unblock peer-to-peer network if there are any restrictions, and they responded yes.
Also I checked my ip addresses in https://bitnodes.io/#join-the-network and it showed green.
Please help me.. I really want to be a bitcoin full node but I have no idea what's wrong.
This is my debug.log
'''

2021-11-22T13:01:28Z Bitcoin Core version v22.0.0 (release build)

2021-11-22T13:01:28Z Qt 5.12.11 (static), plugin=windows (static)

2021-11-22T13:01:28Z Static plugins:

2021-11-22T13:01:28Z  QWindowsIntegrationPlugin, version 330752

2021-11-22T13:01:28Z  QWindowsVistaStylePlugin, version 330752

2021-11-22T13:01:28Z Style: windowsvista / QWindowsVistaStyle

2021-11-22T13:01:28Z System: Windows 10 (10.0), x86_64-little_endian-llp64

2021-11-22T13:01:28Z Screen: \\.\DISPLAY1 1920x1080, pixel ratio=1.0

2021-11-22T13:01:28Z Screen: \\.\DISPLAY2 1920x1080, pixel ratio=1.0

2021-11-22T13:01:28Z Assuming ancestors of block
00000000000000000008a89e854d57e5667df88f1cdef6fde2fbca1de5b639ad have valid signatures.

2021-11-22T13:01:28Z Setting nMinimumChainWork=00000000000000000000000000000000000000001fa4663bbbe19f82de910280

2021-11-22T13:01:28Z Using the 'sse4(1way),sse41(4way),avx2(8way)' SHA256 implementation

2021-11-22T13:01:28Z Using RdSeed as additional entropy source

2021-11-22T13:01:28Z Using RdRand as an additional entropy source

2021-11-22T13:01:29Z GUI: "registerShutdownBlockReason: Successfully registered: Bitcoin Core is
not safely closed.

2021-11-22T13:01:29Z Default data directory C:\Users\USER\AppData\Roaming\Bitcoin

2021-11-22T13:01:29Z Using data directory D:\Bitcoin

2021-11-22T13:01:29Z Config file: D:\Bitcoin\bitcoin.conf (not found, skipping)

2021-11-22T13:01:29Z Using at most 125 automatic connections (2048 file descriptors available)

2021-11-22T13:01:29Z Using 16 MiB out of 32/2 requested for signature cache, able to store 524288
elements

2021-11-22T13:01:29Z Using 16 MiB out of 32/2 requested for script execution cache, able to store
524288 elements

2021-11-22T13:01:29Z Script verification uses 15 additional threads

2021-11-22T13:01:29Z scheduler thread start

2021-11-22T13:01:29Z Using wallet directory D:\Bitcoin\wallets

2021-11-22T13:01:29Z init message: verifying wallets..

2021-11-22T13:01:29Z init message: Loading banlist…

2021-11-22T13:01:29Z Missing or invalid file D:\Bitcoin\banlist.dat

2021-11-22T13:01:29Z Recreating the banlist database

2021-11-22T13:01:29Z SetNetworkActive: true

2021-11-22T13:01:29Z Failed to read fee estimates from D:\Bitcoin\fee_estimates.dat. Continue
anyway.

2021-11-22T13:01:29Z Using /16 prefix for IP bucketing

2021-11-22T13:01:29Z Cache configuration:

2021-11-22T13:01:29Z * Using 2.0 MiB for block index database

2021-11-22T13:01:29Z * Using 8.0 MiB for chain state database

2021-11-22T13:01:29Z * Using 440.0 MiB for in-memory UTXO set (plus up to 286.1 MiB of unused
mempool space)

2021-11-22T13:01:29Z init message: Loading block index…

2021-11-22T13:01:29Z Switching active chainstate to Chainstate [ibd] @ height -1 (null)

2021-11-22T13:01:29Z Opening LevelDB in D:\Bitcoin\blocks\index

2021-11-22T13:01:29Z Opened LevelDB successfully

2021-11-22T13:01:29Z Using obfuscation key for D:\Bitcoin\blocks\index: 0000000000000000

2021-11-22T13:01:29Z LoadBlockIndexDB: last block file = 0

2021-11-22T13:01:29Z LoadBlockIndexDB: last block file info: CBlockFileInfo(blocks=0, size=0,
heights=0...0, time=1970-01-01...1970-01-01)

2021-11-22T13:01:29Z Checking all blk files are present...

2021-11-22T13:01:29Z Initializing databases...

2021-11-22T13:01:29Z Opening LevelDB in D:\Bitcoin\chainstate

2021-11-22T13:01:29Z Opened LevelDB successfully

2021-11-22T13:01:29Z Wrote new obfuscate key for D:\Bitcoin\chainstate: 6da95d8aa0da912c

2021-11-22T13:01:29Z Using obfuscation key for D:\Bitcoin\chainstate: 6da95d8aa0da912c

2021-11-22T13:01:29Z  block index             257ms

2021-11-22T13:01:29Z loadblk thread start

2021-11-22T13:01:29Z UpdateTip: new
best=000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f height=0 version=0x00000001
log2_work=32.000022 tx=1 date='2009-01-03T18:15:05Z' progress=0.000000 cache=0.0MiB(0txo)

2021-11-22T13:01:29Z block tree size = 1

2021-11-22T13:01:29Z nBestHeight = 0

2021-11-22T13:01:29Z Failed to open mempool file from disk. Continuing anyway.

2021-11-22T13:01:29Z loadblk thread exit

2021-11-22T13:01:29Z AddLocal(147.46.95.38:8333,1)

2021-11-22T13:01:29Z Discover: DESKTOP-AT03A6B - 147.46.95.38

2021-11-22T13:01:29Z Bound to 127.0.0.1:8334

2021-11-22T13:01:29Z torcontrol thread start

2021-11-22T13:01:29Z Bound to [::]:8333

2021-11-22T13:01:29Z Bound to 0.0.0.0:8333

2021-11-22T13:01:29Z init message: Loading P2P addresses…

2021-11-22T13:01:29Z Missing or invalid file D:\Bitcoin\peers.dat

2021-11-22T13:01:29Z Recreating peers.dat

2021-11-22T13:01:29Z Missing or invalid file D:\Bitcoin\anchors.dat

2021-11-22T13:01:29Z 0 block-relay-only anchors will be tried for connections.

2021-11-22T13:01:29Z init message: Starting network threads…

2021-11-22T13:01:29Z net thread start

2021-11-22T13:01:29Z dnsseed thread start

2021-11-22T13:01:29Z addcon thread start

2021-11-22T13:01:29Z Loading addresses from DNS seed dnsseed.bluematt.me

2021-11-22T13:01:29Z init message: loading complete

2021-11-22T13:01:29Z opencon thread start

2021-11-22T13:01:29Z msghand thread start

2021-11-22T13:01:29Z GUI: Platform customization: "windows"

2021-11-22T13:01:29Z Loading addresses from DNS seed seed.bitcoin.sprovoost.nl

2021-11-22T13:01:29Z Loading addresses from DNS seed seed.bitcoin.jonasschnelli.ch

2021-11-22T13:01:29Z Loading addresses from DNS seed seed.btc.petertodd.org

2021-11-22T13:01:30Z Loading addresses from DNS seed seed.bitcoin.wiz.biz

2021-11-22T13:01:30Z Loading addresses from DNS seed seed.bitcoinstats.com

2021-11-22T13:01:31Z Loading addresses from DNS seed dnsseed.emzy.de

2021-11-22T13:01:31Z Loading addresses from DNS seed seed.bitcoin.sipa.be

2021-11-22T13:01:31Z Loading addresses from DNS seed dnsseed.bitcoin.dashjr.org

2021-11-22T13:01:31Z 209 addresses found from DNS seeds

2021-11-22T13:01:31Z dnsseed thread exit

'''

How do you infer that you're not synchronizing and/or have no connections? What RPC output, or something in the GUI screen? Is there anything more in debug.log after the end of what you paste?

@PieterWuille / There are no peers on GUI peer tab, otherwise if I use my mobile hotspot instead of college network, I can connect to peers. / After the above log file I get these kinds of messages repeated : 2021-11-22T13:33:44Z Potential stale tip detected, will try using extra outbound peer (last tip update: 1935 seconds ago)

@PieterWuille / In the GUI network traffic tab, I see no data being sent or received. When I ping my IP addresses in https://bitnodes.io/#join-the-network, network traffic tab shows some data transfer.

source: Stack Exchange

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/

sort: votes


text:
Invalid input scripts? Why are they included? Is there a correct way to identify them?
Transaction 88025f2bfa2435a7036a865ea0b4748491d21f9b8cfd72788e9d1c9aa8977e7d is valid, but its one and only input has an invalid script. (There are many transactions like this, but this one will suffice as an example.)
The previous transaction for the input is all zeroes, and the output index is 0xffffffff which is technically not possible as far as I understand. Is one or both of these values used to determine the (in)validity of the script, or is there some other indicator that the script is not valid? How do the block explorers determine whether an input script is valid or not?
Also, if the input script is invalid, then why is it included at all? This transaction has a 49-byte input script. The hex bytes are: 0315ef0a04a656cf612f466f756e6472792055534120506f6f6c202364726f70676f6c642f0e9d8b480000000000000000. What is all this data if it is not a script, and why would it be sent as part of the transaction?

Possible duplicate of What is the coinbase?

In a coinbase transaction like the one you linked, the input scripts are mostly just not validated because nothing is being spent as is a special type of transaction only used by miners. It keeps the format of the transaction the same as all the others in the chain, though the scriptSig has almost no meaning and isn't expected to be parsable as a real script.

all_licenses: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/4.0/


text:
Is this calculation of mining probability using the Bernoulli trial formula accurate?
I'm trying to understand the formulas for successfully mining a block (without a pool) based on hashrate over time (i.e. to chart the probability of finding a block at various historical points compared to network hashrate at the time).
It seems like this post is exactly the formula I'm looking for, but it doesn't actually add up. I'm awful at math so I can't tell if I'm missing a step or if the post is wrong. If there's a better/more accurate way of figuring this out, please share, but I'm specifically interested in learning if this is wrong or not and why.
It says the probability of being the one to successfully mine a block with 13.5 TH/s and a network hashrate of 11,000,000 TH/s = 0.00000122
Then it says:

Now, in a month, there are N=6*24*30 mined blocks. To find the probability of winning one award in a month, we use the Bernoulli trial formula
N*p1*(1-p1)^(N-1) = 0.0026

Now when I put that in Excel with N=4320, I get .005243, I only come up with the same answer when I divide N by two for N=2160, but I can't figure out any reason for that to be the case. Am I missing something or is this just a typo? Is this formula even a good way of approximating this?

The formula is a reasonable approximation.  It looks to me like your calculation is right, and the blog author has made an error.
There is a minor inaccuracy in that the number of blocks per month is not fixed at 6*24*30, but is subject to random variation.  So a slightly improved solution is to work out the average number of terahashes needed for one block (h = 11000000 * 600, assuming that the network hash rate is stable and the block difficulty has adjusted accordingly).  Then your probability of winning a block on each of your hashes is q1 = 1 / h, and you will perform M = 12.5 * 60 * 60 * 24 * 30 hashes in one month.  If you treat the number of blocks you win as a Poisson distribution, the probability of winning one block in a month is given by λ * exp(-λ) where λ = M*q1.  This yields the slightly larger number 0.005273.


text:
Partial Proof of Work in Pools
Technically speaking a full PoW solution is one whose hash value is below a certain threshold value say V. It is not equivalent to saying that the hash value must begin with say X number of zeros (unless the threshold value is a power of 2).
My question is what is the usual practice in mining pools where one needs to submit partial proof of work to give a proof that he has worked on finding the block honestly? Lets say in some 'round' the miners in a pool have got their best (the least) hash values as v= v1,v2,..v_n. Is there a function that takes in v as an input and computes the reward for each of the miners ? Are there are checkpoint sort of system where say if the submitted share has hash value lying in between some range then that miner is categorised in that range. Once all the members are categorised into groups (which would reflect how powerful mining rigs they have), they can then be paid for their service proportionately.  Of course there is no need to categorise, like the way I mention but is it how it works in practice ? If so, how are the level checkpoints distributed ?

It depends on the payout system that they are using. Most payout systems use some sort of payment based on shares. A share is a Proof of Work that a miner submits to the pool. This Proof of Work is a "full PoW solution". But instead of having to meet the target for the Bitcoin network, shares just need to meet an easier target set by the mining pool.
Pools track how much work and how much hashrate someone has based upon the number, frequency, and difficulty of the shares submitted to them. They then use that to compute the payout amount. This computation depends on the payout system being used (e.g. PPS, PPLNS, etc.). The different payout systems calculate the final payout in different ways, but they all use this concept of shares.
The shares themselves are not categorized by their value. A pool knows what difficulty a particular miner is mining at so all shares are treated as being at that difficulty even if the value meets some other difficulty. The hashrate can be inferred from the number and rate of shares being submitted at a particular difficulty; the value of the hashes are not important so long as they meet the target.

Quick question, what prevents a miner from creating duplicate accounts and submitting the same shares twice? For example, minerA computes a valid PoW solution to the difficulty target set by the pool. minerB somehow reads what minerA has submitted and resubmits the same shares without any actual work. I assume this is entirely dependent on the pool, but are there some standards to prevent this? Perhaps the PoW has some added hashes/values in the input script to differentiate a user? Maybe rejecting the same shares that are already submitted? Thanks :)

There aren't really standards for anything involved in mining pool operation. However, since shares are really just blocks with potentially invalid PoWs, each share is unique. Furthermore, because pools issue work to miners with specific parameters, they can use some unique identifier to be included in the share so that the miner can be identified. Many pools use part of the extranonce in the coinbase transaction to do this. So if two miners submit the same share, the person who is identified by the extranonce is the one who gets credited with the work, and he is only credited once.

Thanks @AndrewChow for answering. For clarity, the exact algorithm defers from one payout system to another but the overall idea is to look at the shares submitted and its frequency to "figure out" a miner's hash rate. That is, lower the hash values and higher the frequencies of the submitted shares more this is hash rate. Is that correct ? 2nd question, is there any other way of submitting a partial proof of work ? One could for eg submit a picture of electric meter, but it can't be verified in a decentralised manner. Are there any alternate decentralised ideas for partial proof of work ?

Actually, since the 2nd question seems a little off topic from the thread, i'll post it as a new question :)


text:
When you trade on an exchange where does the bitcoin or other crypto go to
Do exchanges use an intermediate address when fulfilling transactions or is it always user to user when buying/selling between cryptocurrencies?

I believe exchanges mostly hold Bitcoin in addresses that belong to the exchange, not to their customers.
This has benefits for them:

They can then transfer Bitcoin amounts between different accounts for users of their service without the need to create any Bitcoin transactions and pay associated mining fees.
They can then create aggregate Bitcoin transactions which reduce transaction fees when paying to non-customers or into wallets not controlled by the exchange. For example they can create one transaction with one input and ten outputs instead of ten transactions each with one input and one output.

There are implications for the customers of the exchange
The exact details will depend on exactly which "exchange" you are using and may change over time.
If you use the "exchange" to pay BTC to someone who is not a customer of the same "exchange", there will be a record in the blockchain but it may not be possible to identify which customer of the exchange initiated the transfer.
If you use the exchange to buy BTC with USD or ETH, or vice versa, there will generally be no transaction recorded on the blockchain if, as many do, they keep your account balance and other details in a database that is completely separate from any actual cryptocurrency-wallets.
This is analogous to the distinction between a "custodial-wallet" and a desktop-wallet. WIth the first you are not the actual owner of any Bitcoins, you are effectively the creditor of a debt denominated in Bitcoins.

so am I right in saying you cannot track your transactions via the blockchain and would have to use their internal ledger?

@user2330270: The exact details will depend on exactly which "exchange" you are using and may change over time. If you use the "exchange" to pay BTC to someone who is not a customer of the same "exchange", there will be a record in the blockchain but it may not be possible to identify which customer of the exchange initiated the transfer.


text:
Number of main chain in a blockchain network
I just have a very basic doubt. Suppose there's a public blockchain network like Bitcoin comprising several nodes. Would it be possible that this network consists of multiple mainchains??I am not talking about the situation where orphan nodes are created. My situation is say, there are 4 txns T1,T2,T3,T4. Now for each of these transactions, would there be 4 separate main chain for each transaction or one single mainblockchain which comprises these transactions in same/diff blocks that might have got generated after from the beginning of the genesis block.

The purpose of the blockchain is to reach consensus on the state of the network. Everybody has to be in agreement which money belongs to whom in order for the network to be useful. All four transactions would be collected in the same chain.

Yes I was also thinking that eventually there would be one main blockchain in the network and all 4 transactions would be gettng attached to it in same/different blocks. Otherwise it would n't be possible for a block to contain more than one transaction. In other words, had this been not the case there would be four diff main blockchains for four diff transactions.

I think I see where your question is coming from now. Did you think that immediately when a transaction is created it is included in a block? That is not the case. Transactions are first broadcast to the network and kept on a waiting list called the memory pool by each node that receives them. Miners pick a set of transactions from their memory pool that they include in their block template. Only once a miner finds a new valid block, transactions get confirmed. The successful miner determines the order of the transactions in the block.

I think that this question might help your understanding: https://bitcoin.stackexchange.com/q/12427/5406


text:
Removing old public keys Part2
I've managed to create a wallet with some old private keys from Armory.
After verifying that there are no funds on these addresses, I've closed Electrum
and deleted all files in C:\Users\MyName\AppData\Roaming\Electrum\wallets\ and the config file. The cache folder was empty.
After restarting Electrum and creating a NEW wallet the old addresses (and Keys) where still there.

Where are these keys stored?
How can I remove these old addresses?

In the answer to Removing old public keys @rdymac writes something about
"second click options". I was not able to find informations about this option.
Clicking an address a second time or double clicking gives no result.
Right-click doesn't give the option to delete the address.

After restarting Electrum and creating a NEW wallet the old addresses (and Keys) where still there.

So you went through the process of creating a new wallet? You got asked what wallet type you wanted to create, you chose standard wallet, a seed was generated and displayed and then in the step after that you were asked to re-enter the seed to confirm that you wrote it down properly. After that it asks you to enter a password if you like. You did all this?
If you created a new wallet file then it should not contain your old addresses. The only way it can contain your old addresses are:

the old wallet file is still on your hard drive and you have that opened. you can switch wallet files via file > open or file  > recently open. it's also possible to specify a specific wallet file via the -w command line switch. For example c:\path\to\electrum.exe -w c:\path\to\wallet. If you don't specify a specific wallet file it'll open the default_wallet file in the \Users\YourUserName\AppData\Roaming\Electrum\wallets folder
you have a malware infection and those addresses aren't really yours. they belong to the malware author and the malware is injecting all your wallets with those addresses in the hope that you will send bitcoin to them.

Also note that public keys are not private keys. You imported armory private keys not public keys.

Thank you for your answer. I expected the addresse tab to be initially empty - without further checking I've assumed to see the old addresses. Excuse me. However the question of how to delete single IMPORTED address/key is still open.

You can only import private keys in wallets created specifically for that purpose. You cannot import them into standard deterministic wallets. If you created a wallet specifically using imported private keys you can delete them by going to view > show addresses, switching to addresses tab, right clicking on the corresponding address and choose to remove from the wallet. See the screenshot here.


text:
What can 1 master public key in a multisig reveal?
Assume you have the following situation:
You are going to create a new multisig wallet with Electrum.
2 signatures are from old hardware wallets and 1 signature is brand new.
The new multisig will only be used with Electrum and Electrum personal server connected to Bitcoin Core. The 2 old signatures from the hardware wallets has been used with the hardware wallets own wallets (like Ledger Live and Trezor Wallet). Then I guess we can assume that the master public keys from those 2 wallets has been uploaded to some server somewhere and could be "leaked".
From a privacy standpoint, if I create a new multisig, is it possible to get any information from the 2 old master public keys? Or, do you need all 3 keys?
Would it be a good practice to create two new master public keys (by "reinstalling" the old hardware wallets) and create a new multisig with 3 brand new keys (and treat them with more care in the future)? Or is it fine, because 1 key is new?

From a security perspective related to spending bitcoins, since only the master public keys have been compromised, there is no way that the attackers can derive the child public keys as they do not have access to the chain code. However, if the chain code is also revealed, there is no way to derive child private keys and hence the attacker cannot spend the funds. So if you are trying to create transactions with 1-of-3 or 2-of-3 multi-sig, the attacker still does not have access to the signatures (since he does not have the private keys)
However, if you are going to create a P2SH address of all the 3 public keys involved, there is no way anyone can recreate this address even if they know the 2 of the 3 public keys.

Thanks for the reply! I was more concerned from a privacy standpoint (and not security). If it's possible to know all addresses (and the full balance of the wallet) from only 1 master public key in a multi-sig. But I guess it's not possible then. And if you want to generate a fresh master public key, you could simply create a new passphrase for your seed. So, not that much trouble to go through,

The way that wallet balance is calculated is by scanning the blockchain from the hash of all 3 addresses (I assume that you will create a P2SH instead of using the raw public keys as script). Since one of your master public key will always be private, the malicious actor would never be able to calculate the has effectively as all the 3 public keys will be used to create one.


text:
Upgrading v0.14.2 to the latest v0.17.0.1 for 3 active wallets on one device
I am using a laptop dedicated to bitcoin, with bitcoin core installed, and switch between 3 active wallets. The switch is done using backups of all the files (including ‘wallet.dat’), held in ‘%AppData\Roaming\Bitcoin’ folder (these exclude ‘blocks’ & ‘chainstate’ folders).  I also have ‘private keys’ backups. For security reasons the laptop wallet remains empty (no BTC value) as the default position & all backups are stored off-line & further encrypted.  Rather than merge the wallets into one, I need to keep them separated out for reasons of logistics.

Firstly, please kindly advise if its possible to upgrade the client directly from currently installed v0.14.2 to the latest v0.17.0.1 (ignoring in between versions) using the default set of files representing an empty wallet?  I suspect this is possible?
Following the client upgrade to v0.17.0.1, kindly advise if the backed-up files, when loaded for one of the active wallets will correctly re-instate the wallet?
If 2 above is problematic, then I assume importing the appropriate set of private keys will successfully re-instate the active wallet?  This does seem to be confirmed as a solution from previous answers to similar questions.

I am a newbie to this site.  Please be patient with me:)
Thank you


text:
Merkle root for Taproot key path spending?
I'm referring to a page of Taproot test vectors provided in BIP 341.
In the section called keyPathSpending and then inputSpending under that, there are 7 JSON objects that provide parameters to test tweaking keys and then signing and verifying data with Schnorr signatures. The first of these JSON objects contains "merkleRoot": null. However, all of the others include a merkle root.
For example, the second one provides the following data:
{
    "given": {
        "txinIndex": 1,
        "internalPrivkey": "1e4da49f6aaf4e5cd175fe08a32bb5cb4863d963921255f33d3bc31e1343907f",
        "merkleRoot": "5b75adecf53548f3ec6ad7d78383bf84cc57b55a3127c72b9a2481752dd88b21",
        "hashType": 131
    },
    "intermediary": {
        "internalPubkey": "187791b6f712a8ea41c8ecdd0ee77fab3e85263b37e1ec18a3651926b3a6cf27",
        "tweak": "cbd8679ba636c1110ea247542cfbd964131a6be84f873f7f3b62a777528ed001",
        "tweakedPrivkey": "ea260c3b10e60f6de018455cd0278f2f5b7e454be1999572789e6a9565d26080",
        "sigMsg": "0083020000000065cd1d00d7b7cab57b1393ace2d064f4d4a2cb8af6def61273e127517d44759b6dafdd9900000000808f891b00000000225120147c9c57132f6e7ecddba9800bb0c4449251c92a1e60371ee77557b6620f3ea3ffffffffffcef8fb4ca7efc5433f591ecfc57391811ce1e186a3793024def5c884cba51d",
        "precomputedUsed": [],
        "sigHash": "325a644af47e8a5a2591cda0ab0723978537318f10e6a63d4eed783b96a71a4d"
    },
    "expected": {
        "witness": [
            "052aedffc554b41f52b521071793a6b88d6dbca9dba94cf34c83696de0c1ec35ca9c5ed4ab28059bd606a4f3a657eec0bb96661d42921b5f50a95ad33675b54f83"
        ]
    }
},

For key path spending, why is there a merkle root? What leaf nodes were used to derive these merkle roots from inputs that contain no control blocks?

For key path spending, why is there a merkle root?

In the "given" section, only the internal private key is given. In key path spending, one signs with the tweaked private key. The tweaked private key is computed from the internal private key and the Merkle root.

What leaf nodes were used to derive these merkle roots from inputs that contain no control blocks?

That shouldn't matter for testing your key-path signing logic.


text:
How does OP_CHECKSIG work for Taproot script path spending?
I've been studying all the ways Taproot transactions can be spent and I can get all of them to work except for when script path spending is used and the script is executed. Transaction 0c045625... is a good example. I'll focus on input 0 here.
I have successfully recreated the merkle tree of tagged hashes to match the witness program from the previous output, which I thought would be the hard part but it turned out to be quite easy.
But when the script finally executes, it still has to succeed, which means in most cases the signatures will also have to be verified. I can successfully verify signatures in key path spending inputs, but none of the script path spending ones.
Here is the segwit data for input 0 (the first two fields are the signatures):
107cc602f65b07acc72c1e71f9e443059256a844d3340deea90ca29d656c63e49eb0216be7e31a5e8ab02aa9e719ba43f05af84e86cf1912fbdf57ebbcf4cd5801
7a0c65d587f0859d7cf50009162b16c79fec22ecc485d0f8faf555f3718cda9a4891186a4a26ce7365516a0017806a6c3475d341866cd8b20c7891d02e2bc523
20c041f567623260a7b7caba5158cc0b864d735d36329db41fa41ffbb09ac86f71ad204cb206cf18865fd546b018324a8e94212dad909b3cd778bce22a219b9ac391ebac
c110551a18489887bdb3242f46719e7d375b0cc5c3062ff8430b8d20e904783e8cc913b7fd44a48042cfda824efc872816549871226770204d0884c60ba693a315

Here is the parsed witness script for input 0:
c041f567623260a7b7caba5158cc0b864d735d36329db41fa41ffbb09ac86f71
OP_CHECKSIGVERIFY
4cb206cf18865fd546b018324a8e94212dad909b3cd778bce22a219b9ac391eb
OP_CHECKSIG

Using Schnorr signatures, I can not get these public keys to verify the signatures. The signatures use sighash byte 01, or the default 00.
As for the data to be signed, I've tried verifying these signatures using TapSighash tagged hashes of the data (like I do for key path spending), or just using a single or double SHA256 of the data, but nothing works.
As for the public key to verify the signatures, I've tried using the public keys in the script directly, or applied as tweaks to an xonly public key parsed from the witness program, and vice versa, but nothing I've used to tweak any of these 32-byte pubkeys works either.
Since the public keys are 32 bytes and the signatures are 64 (and it's a Taproot transaction), I assume these must be verifiable using Schnorr signatures.
What am I missing? All the other stuff I've done with Schnorr signatures works, and it is pretty simple. So there has to be a step I am missing.
For input 0 in the transaction linked to above, here is the data that my program is using to attempt to verify these signatures:
Witness Program:
0c96a8191c84ba0a4b64d8766a95ed49508bc24e768ee1945d21e8e850c8cbf3

Public Keys:
c041f567623260a7b7caba5158cc0b864d735d36329db41fa41ffbb09ac86f71
4cb206cf18865fd546b018324a8e94212dad909b3cd778bce22a219b9ac391eb

Signatures:
107cc602f65b07acc72c1e71f9e443059256a844d3340deea90ca29d656c63e49eb0216be7e31a5e8ab02aa9e719ba43f05af84e86cf1912fbdf57ebbcf4cd5801
7a0c65d587f0859d7cf50009162b16c79fec22ecc485d0f8faf555f3718cda9a4891186a4a26ce7365516a0017806a6c3475d341866cd8b20c7891d02e2bc523

Hash of Data to Sign (using only a single SHA256 of the serialized pieces of data, which seems to be the Taproot convention):
30264f68fd7f000080bbbe5b9e550000d0244f68fd7f000040bbbe5b9e550000

When a script path is used to redeem a Taproot output, and the script is executed, how are these pieces of data used to verify the signatures when OP_CHECKSIG is called?

Did you construct the hash being signed according to the rules in BIP342? The rules are slightly different for script path spending and key path spending.

That was it. The extension described in BIP342 was missing. After I added that, it worked.

@Zephyrus Could you make your solution into an answer and mark it as accepted, so that the question doesn't show as being unanswered?


text:
SIGHASH_SINGLE with no corresponding output
Transaction 99fc1e5c753459808bac56435b3d45f2fcf0dd73016ea14460d63e9ddf353714 is an interesting example.
This transaction has 5 inputs and 1 output. All of the input scripts include 1 public key and 1 signature. They all use the same public key and all of the signatures have SIGHASH byte 03 (SIGHASH_SINGLE). Inputs 1 - 4 all have the exact same signature, which means the same piece of data was used to create the signature.
The public key for all inputs is:
044edfcf9dfe6c0b5c83d1ab3f78d1b39a46ebac6798e08e19761f5ed89ec83c108172c4776865f02047b39cd704135c00c1b00085e0d1b9255405ac7079fa50a2

The signature for inputs 1 - 4 is:
3045022100912f994094193109a9faedf7ef855220638f95ac51c66d4eb46740dd1c0813fa0220100bc99adb8b64fb784173ca8883a78835e156b74f143c02e071dc82695e847203

However, there is only one output in the transaction, so there is no corresponding output for inputs 1 - 4. When this transaction was added to the blockchain, all of those inputs had to be verified. What data was signed in order to create the signature for inputs 1 - 4?
The explanation at the bottom of this site says that if there is no corresponding output, then the message that gets signed is always 0100000000000000000000000000000000000000000000000000000000000000. However, the public key fails to verify this piece of data for the signature from inputs 1 - 4.
What data is signed to produce a signature in a case like this?

The explanation at the bottom of this site says that if there is no corresponding output, then the message that gets signed is always 0100000000000000000000000000000000000000000000000000000000000000. However, the public key fails to verify this piece of data for the signature from inputs 1 - 4.

That's almost correct. When a legacy (pre-segwit) transaction input has a signature with SIGHASH_SINGLE, and no corresponding output at the same index, the message hash signed is 0x0100000000000000000000000000000000000000000000000000000000000000. ECDSA specifies that the message is hashed before being converted to a scalar. In Bitcoin, that is usually accomplished by a double-SHA256 hash. But in the case of this SIGHASH_SINGLE mismatch condition, the signature is created as if the 0x0100000000000000000000000000000000000000000000000000000000000000 is the output of the double-SHA256 hash. That arguably makes it not really an ECDSA signature, and (hopefully) tools that aren't aware of Bitcoin's specific rules will not consider this a valid signature.

Hi! I have tried to verify this signature and I believe I have correctly follow the instructions. The verification still failed. Any chance someone can spot the mistake ?
https://gist.github.com/rllola/3a6be4222c7b52f934c28843e7b965aa

My mistake was that I was using the wrong function to verify the signature in python instead of verify you should use verify_digest if you are using the ecdsa lib.
I have updated the gist : https://gist.github.com/rllola/3a6be4222c7b52f934c28843e7b965aa
I hope it will help people.


text:
Proper way to get sha256 hash in c++ using openssl?
Given the following variables:
unsigned char text [] = "Test String";
unsigned int len = strlen ((const char*) text);
unsigned char hash [SHA256_DIGEST_LENGTH];

Is there any reason to do this...
SHA256_CTX sha256;
SHA256_Init (&sha256);
SHA256_Update (&sha256, text, len);
SHA256_Final (hash, &sha256);

instead of simply doing this?
SHA256 (text, len, hash);

For me, they both produce the same result. Are there situations where they might not?
Also, does the SHA256 function always return the same pointer that was passed as its third parameter, or are there cases where it might return something else?

This would probably be more suitable asked on Cryptography StackExchange.
I think that SHA256() is preferred over the _CTX, _Init, _Update, _Final functions. IIRC, these latter "low-level" functions are deprecated for external usage:

SHA256 low level APIs are deprecated for public use, but still ok for internal use. Source 1, Source 2.

The recommended method is to use the EVP interface, which is what SHA256() does.
Based on this code here, the return value is either the third parameter, or a null pointer.

Note the implementation using EVP_Q_digest is new in 3.0.x, which many systems and people aren't yet using; in 1.1.1 and below it used the lowlevel Init,Update,Final, which were not deprecated.

@dave_thompson_085 on the other hand older OpenSSL versions won't spit deprecation warnings when using SHA256_Init(), SHA256_Update() and SHA256_Final(). The older OpenSSL versions obviously used those instead.

@0xC0000022L that's exactly what he said.

@meshcollider it wasn't exactly but definitely very close to what he said. Which is why I upvoted the comment and tried to add some more context. Apologies if that offended you.

Is there any reason to do this...
SHA256_CTX sha256;
SHA256_Init (&sha256);
SHA256_Update (&sha256, text, len);
SHA256_Final (hash, &sha256);

Yes there is. But not for your particular case.
The reason would be if you do not have a contiguous buffer to which you can point the "composite" SHA256() function.
As it so happens there are quite a few scenarios where you can run into this. The most common is probably that you are trying not to be wasteful with memory. Another is that you have a multi-GiB file; then - depending on the constraints placed on your own implementation - you may not be able to even allocate a contiguous buffer large enough to accommodate the full size of the file. Now if you wanted to compute the digest (here SHA2) hash on that, it could be better to do something like this instead (pseudo code):
SHA256_CTX sha256;
SHA256_Init(&sha256);
FILE* f = ...; // pretend it's valid and gets cleaned up
while(true)
{
    unsigned char buf[4096];
    // in case we get less bytes back than we request
    size_t actual_len = read_from_file(f, buf, sizeof(buf));
    SHA256_Update(&sha256, buf, actual_len);
}
SHA256_Final(hash, &sha256);

And that's the reason why it is so annoying that those three functions are now deprecated. Sure, EVP offers replacements, but their semantics differ quite a bit. In particular you can no longer keep the context in a stack variable unless you have some sort of smart pointer.

For me, they both produce the same result. Are there situations where they might not?

Not really. For cases where it is practical to pass a contiguous buffer and a length, these are equivalent as you pointed out in your question.


text:
Do LND reserve balances overlap with each other in any way?
LND 0.16.2-beta
I'm looking at the commands walletbalance and listchannels (which has output similar to pendingchannels). I've modified the numbers in these examples.
$ ./lncli walletbalance
{
    "total_balance": "1111111",
    "confirmed_balance": "1111111",
    "unconfirmed_balance": "0",
    "locked_balance": "0",
    "reserved_balance_anchor_chan": "44444",
    "account_balance": {
        "default": {
            "confirmed_balance": "1111111",
            "unconfirmed_balance": "0"
        }
    }
}

Notice that walletbalance returns a field called reserved_balance_anchor_chan. The documentation gives this definition:

Anchor channels include up to two special outputs called anchors which
are used for timely CPFP fee-bumping of force-closed channels.

But the response from listchannels (which I've shortened in order to save space) includes a separate local reserve amount for each channel.
$ ./lncli listchannels
{
    "channels": [
        {
            "active": true,
            "capacity": "1111111",
            "local_balance": "555555",
            "remote_balance": "444444",
            "local_chan_reserve_sat": "11111",
            "remote_chan_reserve_sat": "11111",
            "local_constraints": {
                "chan_reserve_sat": "11111",
            },
            "remote_constraints": {
                "chan_reserve_sat": "11111",
            }
        }
    ]
}

Notice the local_chan_reserve_sat field. So each channel has its own reserve balance and the node also has this anchor channel with its own reserve balance.
Do the local channel reserve balances overlap at all with the anchor channel reserve balance? In other words, if I have local channel reserve balances of 11111, 22222 and 33333, and I also have an anchor channel reserve balance of 55555, then is my total reserve balance 66666 or 122221?

The short answer is no.
If you have X value in local_chan_reserve_sat (X=x1+x2+...+Xn being n the number of channels you have opened) and Y value in reserved_balance_anchor_chan, then the total reserve will be X+Y.
local_chan_reserve_sat is the value you cannot go under in a channel. Once achieved, you'll never be able to spend from the reserve. The purpose of it is discouraging misbehavior, basically having something to lose so you don't try to spend an old state once you have completely depleted the channel. This funds are off-chain.
reserved_balance_anchor_chan, on the other hand, are funds reserved for fee bumping in case they're needed (as you mention in your answer). These funds are on-chain.


text:
Is there any way to test that a mining system is set up correctly (solo mining)?
I am running a full node and have written some mining software to learn more about how bitcoin works. I know that the chances of mining a block are basically zero given my hash rate, but I am curious if my setup valid just in case.
When I call:
bitcoin-cli getblocktemplate '{"rules": ["segwit"]}'

I get back the json template with the following capabilities and mutable
  "capabilities": [
    "proposal"
  ],

  ...

  "mutable": [
    "time",
    "transactions",
    "prevblock"
  ],

Given these values for capabilities and mutable will the network allow me to insert my coinbase transaction and submit a block? If I intentionally set the difficulty low and generate a block I get the high-hash response, so as far as I can tell the network is able to decode my block. Just looking for other ways to test and verify the setup.

Hi CryptoJoe, I think https://bitcoin.stackexchange.com/q/17553/5406 may answer your question.

Thanks @Murch for the tip. That is a helpful post. I can see testnet, signet and regtest being very useful for many things. Since I'm able to submit a block and get the high-hash error response I know that the network can decode my blocks. I guess the true test if the main network will accept my block is just to wait and see if I ever successfully mine one.


text:
Blockchain.com payments
Need some assistance if I need to stop and take my losses. I had Bitcoin mined and the earned profits. I paid the commission fee and the profit was moved to blockchain.com. They requested a payment of $3500 because it’s a new wallet. Unfortunately I didn’t pay it timely due to purchase limits only cash app and coinbase accounts. I paid the $3500. But then they said Bec of the delay i had to pay an additional $2000. Yes I paid that and now they are saying I need to pay $3500 again within 3-4 days.  Is this normal process?  Please help!

No, you're being scammed, see e.g. this related topic: https://bitcoin.stackexchange.com/q/103011/5406

If your next question is How do I recover from a cryptocurrency scam there are lots of questions and helpful answers on this website. Don't trust PMs from or about "recovery experts".

Is it even possible to recover?

It's very unlikely, the money is probably gone.

Thanks Murch! I’ll take this loss and learn from it. Glad I came here to ask before digging myself deeper!

Yes, this is a common process used by scammers. It ends up in you paying them lots to withdraw your money that has never been yours without receiving even 1 cent from them.
Don't write to them but seek help from your local authorities.


text:
Python: Why the addresses and keys generated by pywallet and bip32utils using the same 12 mnemonic words don't match?
I tried to generate wallets by using pywallet and bip32utils (Python). But I noted that the addresses/keys of the 2 wallets, namely wallet_pywallet and wallet_bip39 don't match with each other.
I noted that the addresses/keys of wallet_bip39 match with Exodus, but wallet_pywallet doesn't. We have been using pywallet for such a long time so I believe wallet_pywallet should be correct as well. Why is there such a discrepancy?
Below is the code, while the code for wallet_bip39 is obtained from this post.
from pywallet import wallet
import binascii
import mnemonic
import bip32utils

def bip39(mnemonic_words):
    mobj = mnemonic.Mnemonic("english")
    seed = mobj.to_seed(mnemonic_words)

    bip32_root_key_obj = bip32utils.BIP32Key.fromEntropy(seed)
    bip32_child_key_obj = bip32_root_key_obj.ChildKey(
        44 + bip32utils.BIP32_HARDEN
    ).ChildKey(
        0 + bip32utils.BIP32_HARDEN
    ).ChildKey(
        0 + bip32utils.BIP32_HARDEN
    ).ChildKey(0).ChildKey(0)

    return {
        'mnemonic_words': mnemonic_words,
        'addr': bip32_child_key_obj.Address(),
        'publickey': binascii.hexlify(bip32_child_key_obj.PublicKey()).decode(),
        'privatekey': bip32_child_key_obj.WalletImportFormat(),
        'coin': 'BTC'
    }

mnemonic_words = wallet.generate_mnemonic()

wallet_pywallet = wallet.create_wallet(network="BTC", seed=mnemonic_words, children=0)
wallet_bip39 = bip39(mnemonic_words)

print(wallet_pywallet)
print()
print(wallet_bip39)


text:
How is wallet balance from unspent transactions in cryptography terms?
There is already a good almost complete answer here (but missing the cryptography explanation):
How is a wallet's balance computed?

Is a bitcoin wallets balance calculated on the client computer app? eg. Leger Live

How is bitcoin wallet balance calculated cryptographically?

Does Ledger Live app check/compare each transaction+hash & transaction+signature hash like mempool nodes do?

Or does it only look at the unspent output addresses and check if they are children of wallet public key? If so how does it do this in cryptography terms?

Is a bitcoin wallets balance calculated on the client computer app? eg. Leger Live

yes.

How is bitcoin wallet balance calculated cryptographically?

There's no cryptography involved, certainly no encryption.
You add the credits and subtract the debits.

Does Ledger Live app check/compare each transaction+hash & transaction+signature hash like mempool nodes do?

All nodes verify the data they receive, so far as they are able to. This involves computing hashes and verifying digital signatures. see Wikipedia article and Mastering Bitcoin, Chapter 4

Or does it only look at the unspent output addresses and check if they are children of wallet public key?

Yes.

If so how does it do this in cryptography terms?

Since wallets derive these keys and addresses, they just keep a list of them.
The original derivation involves hashes. The hashing algorithms come from the world of cryptography but are not encryption.
The method for deriving many addresses from a single seed is described in BIP32

Thanks but can you advise my second question? I clarified it below:
I create 5 bitcoin wallet public addresses & receive bitcoin on them.
I reset&restore my hardware wallet from recovery recovery.
I open my wallet app. example Ledger live.
How does the wallet app calculate WHICH bitcoin public addresses are children of hardware wallets recovery seed private key?
It has no cache at this point so how does it calculate this.
There has to be some hashing to do this and I'm wondering what it hashes to do it.

See newly added final paragraph


text:
If my phone is powered off will i still receive my bitcoin
I sent someone Bitcoin but they said they didn't receive it because their phone is powered off but I got a complete transaction confirmation

The recipient doesn't need to have a wallet online to receive Bitcoins.
This is because the transfer of the money is recorded in the blockchain - which every full node (wallets etc) worldwide has a copy of.
Bitcoin wallets don't actually contain money. So they don't literally receive money. The only really important data in a wallet is the secret number known as a private key.

You should first check on the transaction (tx) id generated when you sent the funds and then check it on any btc explorer (https://btc.com/) to confirm that it was sent and how many confirmations.
You should use that as a proof that your funds were sent properly.


text:
Bitcoin was sent to my wallet 7 days ago but it has not reflect in the wallet
I checked the bitcoin explorer to check if the bitcoin is in and Yes it is but it stays unspent but it has not reflect in the wallet of the main address for 7days now
d325c9a20df855cb1a051d6ed1cee6aea795f2cdd3befaa913855cd1d6128532
This is the transaction id

If you need more help, please give us more information about what wallet you're using, whether you see nothing or an unconfirmed transaction in the wallet, and what happened after trying the suggestions I provided in my answer.

Your transaction is indeed confirmed on the network. This means that either your wallet failed to pick it up, or it paid a different address than you think.

Check whether the address that the transaction credits indeed belongs to your wallet. Verify that the address is not a "watch-only" address.
Check if your wallet is out of sync. Many wallets have a way to "rescan" or "resync" the blockchain. You can probably find instructions by searching for " out of sync".

What if my wallet failed to pick it up, will it still be spendable after sometime

Yes, the transaction records are in the blockchain, if the transaction did go to your address, it's just a matter of your wallet properly reading this shared global state.


text:
My bitcoin hasn't been received for good 10days now
I have sent my first Transaction from a bitcoin machine and waiting for it to arrive at another address but when i click on the Transaction ID of the addresses is Unspent? It only required 3 Confirmations but is now 115? Where is my bitcoin and how do i receive it?
15AwkRrfooSwFiegrVvMk8HaGwE8h83Kk1

Whoever knows the private key for address 15Aw...3Kk1 has 0.003 BTC available to spend. It was received 11 days ago in transaction d325...8532.

What software are you using to receive? Also could you clarify how doing the two things I suggested on your prior question https://bitcoin.stackexchange.com/a/105342/5406 went?


text:
NBitcoin in C# MVC App Gives Me A WitnessProgramMissmatch Error When I Try to Build The Transaction
I am writing tests for an app I built that uses NBitcoin to send bitcoin and make bitcoin transactions.
I have the following code to create fake bitcoins for an integration test:
private ICoin[] CreateFakeCoins(TxInList inputs, Script scriptPubKey)
{
    var coins = inputs.Select(i => new Coin(i.PrevOut, inputs.Transaction.Outputs.CreateNewTxOut(Money.Coins(0.1m), scriptPubKey.WitHash.ScriptPubKey))).ToArray();
    for (int i = 0; i < coins.Length; i++)
    {
        coins[i] = coins[i].ToScriptCoin(scriptPubKey);
    }
    return coins;
}

My integration test has this piece of code that's supposed to send the fake bitcoins to another wallet.
var k = new BitcoinSecret(new Key(), Network.TestNet);
var moneyInWallet1 = BitcoinHelper.GetBitcoinAddress(walletTestNet?.Address, Network.TestNet);

Transaction tx = Network.TestNet.CreateTransaction();
var privkey = new BitcoinSecret(walletTestNet?.Address, Network.TestNet);
var scriptPubKey = PayToWitScriptHashTemplate.Instance.GenerateScriptPubKey(k.PubKey.ScriptPubKey.WitHash);
var scriptPubKeyRec = PayToWitScriptHashTemplate.Instance.GenerateScriptPubKey(privkey.PubKey.ScriptPubKey.WitHash);

tx.Inputs.Add(new OutPoint(tx.GetHash(), 0), scriptPubKey.ToWitScript());
tx.Inputs.Add(new OutPoint(tx.GetHash(), 1), scriptPubKey.ToWitScript());
tx.Outputs.Add("21", k.PubKey.WitHash);
tx.Sign(new[] { k }, CreateFakeCoins(tx.Inputs, scriptPubKey));

Assert.Equal(k.GetAddress(ScriptPubKeyType.Segwit).ToString().Substring(0, 3), "tb1");
Assert.Equal(tx.Outputs[0].Value.Satoshi / 100000000, 21);
Assert.Equal(moneyInWallet1.Address.ToString().Substring(0, 3), "tb1");

var builder = Network.TestNet.CreateTransactionBuilder();
var (receiveAddress, receiveBtcSecret) = BitcoinHelper.GetBitcoinAddress(privKeyCurrent, Network.TestNet);
var (fromAddressProcessed, fromBtcSecret) = BitcoinHelper.GetBitcoinAddress(walletTestNet?.Address, Network.TestNet);

var amountSatoshiMult = Math.Ceiling(0.0006*100000000.00);
Money amountConvertedtoMoney = new Money((long)amountSatoshiMult);

var testibleOutputs = tx.Outputs.AsCoins().Cast<ICoin>().ToArray();
var txBuild = builder
    .AddCoins(testibleOutputs)
    .AddKeys(fromBtcSecret)
    .Send(receiveAddress, amountConvertedtoMoney)
    .SetChange(fromAddressProcessed, ChangeType.All)
    .SendFees(Money.Coins(new decimal(0.0001)));

NBitcoin.Policy.TransactionPolicyError[] errors = null;
Transaction nextTx = txBuild.BuildTransaction(true);
var testerForBuilder = builder.Verify(nextTx, out errors);
Console.WriteLine(errors);
Console.WriteLine(testerForBuilder);
Assert.Equal(true, testerForBuilder);

In this code, the BitcoinHelper.GetBitcoinAddress function simply receives an address string and returns a proper NBitcoin BitcoinAddress object.
This is a picture of the error I get:

Notice the WitnessProgramMissmatch error.
What is the problem? Is CreateFakeCoins not correctly creating fake coins for testing? How can I make this work?

Does this answer your question? Witness program hash mismatch while signing bech32 transaction

The fix was simple. I changed:
tx.Outputs.Add("21", k.PubKey.WitHash);
tx.Sign(new[] { k }, CreateFakeCoins(tx.Inputs, scriptPubKey));

To
tx.Outputs.Add("21", privkey.PubKey.WitHash);
tx.Sign(new[] { k }, CreateFakeCoins(tx.Inputs, scriptPubKey.ToWitScript()));

After this it worked. I was adding the 21 coins to the receiving private key, not the sending private key. Also I had to convert scriptPubKey which was a Script to a WitScript.


text:
Can the genesis block of bitcoin be put to qr codes?
I Think I own the genesis block it really eats my name.it has my real name on it
with QR codes.WHen I check it from Blockchain site its the same as the one I got.

Welcome to Bitcoin.StackExchange! I am having trouble understanding what exactly you are asking. The genesis block in Bitcoin is hard-coded, and therefore cannot be spent. Can you edit your question to be a bit more specific?

I use an old version of wallet address  bitcoinwallet.com then I put my name on it using my ninja name kingkiromomochi.bitcoinwallet.com. then i put my name i was surprised half a second when i address it using the genesis block.

Thanks for replying.  its the one that starts with 1A1 then ends in DivfNa. that nonces must be waiting for me for along time.


text:
Is it possible that one knows how much BTC is in wallet.dat without knowing password?
Someone says that he or she wants to sell his or her wallet.dat which seems to contain a lot of BTC.
He shows screenshot of wallet software containing many BTCs.
He says that when I place wallet.dat in the wallet software location I can see how much BTC in contains, but it needs password to transact.
Is it possible?
Otherwise, is he trying to cheat me out of money?

It’s a scam, nobody would sell a wallet.dat file, or at least nobody should buy one. It’s a terribly insecure way to transact!!

is he [or she] trying to cheat me out of money?

Yes.
Even if you had a copy of their wallet, they have the private-key and can control any funds that appear in your copy of the wallet, now or in future. Even after they give you the password and even after you change the password.
What they are probably giving you is a "watch-only" wallet - often used by conmen to deceive people. The password to a watch-only wallet does not let you spend the money in it.
There's no need for a genuine seller to use this convoluted method of selling a wallet.dat file.
If they really wanted to sell Bitcoins they would  have you set up your own wallet without their help and have you tell them your bitcoin-address so they can send the bitcoins from their wallet to yours (note that the underlying reality is more complex, wallets hold private-keys not bitcoins, but this is the normal way to sell Bitcoins).
There is never a good reason to exchange wallet-passwords or private keys. You should never get involved in any arrangement that involves doing this.
You should do your own research on Bitcoin first and never accept advice or assistance from people who show such deceitful intent or appear to be trying to confuse you.


text:
Lightning network (lnd): What's the best way to report lnd server issues/ask for help with channels that won't close?
I've been running a lnd/bitcoind node (mainnet) for a few months now. I had a couple open channels, made a couple purchases, things seemed pretty stable. But then I moved cross country, and in the process backed up my server and restored my drives to a new machine with a different IP (I might have lost about 3-4 days worth of data in the process). But now neither of my channels seem willing to close (they've been stuck with a decently sized limbo balance in the 'waiting_close_channels' state for like two weeks now).
How do I properly report an issue? What site should I use? What log files need to be available? What other information should I provide?
Thanks!


text:
Transaction deserialization test vectors for Elements sidechain?
I'm working on adding support for Elements sidechain to  https://github.com/Simplexum/python-bitcointx/ library.
Transaction serialization/deserialization seems to be working, but to test it properly, I need samples of different transactions (with or without assets, confidential/unconfidential etc).
Preparing these samples by hand is tedious. Elements source contain tx_valid.json data, but it seems to contain only bitcoin transactions - if you try to decoderawtransaction() some of the data from that file with elements-cli, you get "TX decode failed"
I am not sure if it is possible to get real transactions from Liquid network - while blockstream.info have an explorer for Liquid, it does not show raw transaction data.
Is there a chance to get such sample data somewhere (besides generating it myself) ?

https://github.com/ElementsProject/elements/blob/elements-0.14.1/qa/rpc-tests/confidential_transactions.py generates various tranactions. I think I will be able to dump the txs and use them in my tests.


text:
How to watch lots of wallet addresses for new bitcoin transactions?
I need to watch many wallet addresses for new bitcoin transactions as they enter new blocks. I also need this transaction data to make updates on my end
What are my options?

Here are a couple strategies I've used:
Run a bitcoin node: bitcoind has a -blocknotify flag you can run that will allow you to execute a command with each new block. You can then use JSON-RPC to query your node for all transactions/addresses in the block. It will take a bit of work to set this up, but it will work
Use a service: I've used https://www.blockcypher.com/ which works well, but it can be pricey. https://blockchainwebhooks.com is much more affordable, but not as many features.
Hope this helps! Let me know if you have any questions

If you want an android app to watch the balance of addresses, you can use Sentinal.  It's created by the Samourai wallet guys, it's awesome.


text:
Testnet difficulty change
Has something changed recently in testnet?
Today I've been seeing new blocks appear every 1-5 seconds instead of the usual 10-20 minutes

Testnet has a built in functionality that changes the difficulty to 1 if the mining process takes 20 minutes or longer.
This question explains the dropping of difficulty to 1.
So while the difficulty is 1, the blocks are being formed rapidly until the difficulty reaches to a value which takes 10 minutes.

It's a bit more subtle than that.  Normally when this happens, the difficulty only drops to 1 for the next block.  The following block has to be at the regular difficulty, unless another 20 minutes elapse.  So this doesn't directly explain blocks every few seconds. I believe this happens when a difficulty-1 block, added under the 20-minute rule, is the last block before a regular difficulty adjustment (every 2016 blocks).  In that case the adjustment sets the new difficulty to 1, and this sticks until it adjusts again 2016 blocks later and eventually creeps back up.

I think there has been another question explaining this, and I will link it if I can find it.


text:
can someone please help me I am lost i transfered coins from paxfull to bitcoin core
I bought bitcoins to pay a bill. which never happened because of something called protcal? IDK.
then i read online that bitcoincore was a good wallett to transfer and pay bills. now I have no idea how to use it or see them. someone please help.. dumb damsal in destress

Using what service did you attempt to buy the coins? You'll need to set up a wallet of some sort in order to receive/send bitcoins, if bitcoin core is too complicated there are simpler wallets available (such as a mobile wallet on your phone).

yes well I just read if you have an older laptop...it wont sync...thats what the app on my laptop says....weeks it will take weekds...

You can download bitcoin-core from here
But it's not highly recommended since you may need to download the whole blockchain.
What I recommended as an alternative is Electrum since you can use public bitcoin servers without downloading the whole blockchain

Is highly recommended if you can run it, it is the reference client but, it requires downloading the entire blockchain.

license: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/3.0/


text:
What next after coin creation?
I am working on the new litecoin source 0.15.0.1. Change the required things in the source and compiled.
I am able to generate the blocks. Now How I can add a miner to this coin/network to mine this coin.
Any Help or resource links will be helpful.

Download CpuMiner for your platform
Unzip/Untar the file & Then Try:
./minerd -a scrypt -o http://127.0.0.1:19333 -u rpcuser -p rpcpass -t 1 -D --coinbase-addr=LTCorRespectiveAltCoinAddress -P
better to play,  ./mined --help for params.

all_licenses: Creative Commons - Attribution Share-Alike - https://creativecommons.org/licenses/by-sa/3.0/


text:
Bitcoin public key to private key
I did go thru a lot of articles which say's It's highly impossible to break the bitcoin public-key and get a private key from it.
I understand that the public key does hold some info of it's corresponding private key.
Can anyone suggest me some steps for manual calculation and reversing the scalar multiplication from the public key so I obtain the private key?
I'm not looking for any scripts for doing this but I'm looking for mathematical steps in-order to reverse the public key to private key.

The mathematical steps that you ask for are those required for breaking the public key cryptography system. Currently, those steps are unknown.

Ya may want to try the math stack, there's LaTeX support there instead of code highlighting... From what I've read if you can get the owner of a given address to sign things improperly, see the Wiki Signature generation algorithm (jump to ... it is also crucial to select different k for different signatures... specifically), it's then possible to solve for the private key without an exhaustive search. Side note, this could be used for burning data via private keys intentionally revealed as a final transaction.

First, you can see on this forum how to calculate the public key from the private key using Elliptic Curve (EC) maths: How do you get a Bitcoin Public Key from a Private Key
The G point stated there is the "base point" in EC and it is a known parameter. You can see all the parameters used by the EC used in bitcoin here:
https://en.bitcoin.it/wiki/Secp256k1
In brief, the EC for bitcoin is known as secp256k1: y^2 = x^3 + 7,
and the public key is formed by repetitive point doubling and scalar point multiplications.
So as you see, the problem is trying to reverse a series of modular multiplications, or what in EC maths is called the discrete logarithm problem (in analogy to the real discrete logarithm problem in other cryptosystems such as DSA and DH): given two points P and Q (which belong to a subgroup of an EC) find out the integer x that satisfies the equation Q = x·P
So now you can use different algorithms to try to reverse the operation: the most well known are the baby-step, giant-step algorithm, and Pollard's rho method.
You can find a step-by-step description of them here: http://andrea.corbellini.name/2015/06/08/elliptic-curve-cryptography-breaking-security-and-a-comparison-with-rsa/

I think this can serve as a start point.

How to find at least one private key from a large list of compressed public keys secp256k1 I assume that there are new methods and ways to do this. Please describe how this can be done? https://crypto.stackexchange.com/questions/70006/how-to-find-at-least-one-private-key-from-a-large-list-of-compressed-public-keys

@Rozwrcd: what you ask is infeasible.

This is simply practically not possible; it's one of the basic premises of public-key cryptography:

The strength of a public key cryptography system relies on the computational effort (work factor in cryptography) required to find the private key from its paired public key. If so, effective security only requires keeping the private key private; the public key can be openly distributed without compromising security.

Unless somebody breaks the cryptographic algorithm used to generate the keys, your best bet is to simply generate random keys and check whether the corresponding public key matches the one you already have. (Well, that's a slight exaggeration but you get the point.)

Yes, brute force the private key and check if generated public keys match is about the only conceivable method presently.

I think its not possible to get back the public key, someone would have applied supercomputing power to get back all the bitcoins and become super rich.

A public key is derived from a private key. To derive the public key you need an Elliptic Curve, Bitcoin chose to use secp256k1. Your public key is your private key multiplied by the generator point (which is a constant set in the secp256k1 standard), so it's a point on the curve


text:
How does BitGo Multi-Sig work?
BitGo advertises, that each online wallet you create is a multi-sig. That is cool, since I see it as more unlikely to someone guess 2 of the private keys.
What I don't understand is how this multi-sig works, when I just go online by signing in with my email and starting a transaction. Where is the multi-sig part? It is just BitGo signing the transaction, but when am I using my PrivKey?
I hope the question makes sense. Thanks in advance

The multisig is all handled in the backend without you having to handle private keys directly.
BitGo stores your private keys too, presumably in an encrypted form which is protected by your password so they can't access the private keys. When you login, your wallet is loaded in your browser locally and it contains one set of your private keys. When you make a transaction, it is made in your browser and signed in your browser using the private keys that were loaded. This transaction is then sent off to BitGo who also signs the transaction, presumably after you use 2FA to authenticate the send. Then it is broadcast to the network.
The third set of private keys are ones that only you have. You should have downloaded those (along with the set that BitGo has in your encrypted wallet) when you created your wallet. That set of keys also lets you create transactions without BitGo being involved.

Great, thanks! I think this nearly answers my question. Would you say this is a typical construction for hot-wallets?  - That the private key is encrypted with my password and then locally loaded into my browser?
Also, this "locally loaded into my browser". Does this mean that if my computer is infected, someone can steal the private key? Or what kind of dangers are involved in this? Thanks in advance!

It is typical for web wallets to locally load the wallet in your browser and they just store it encrypted on the server. However this is not a guarantee and you should still be wary of web wallets. Note that exchange wallets are not the same as web wallets. Because the private keys are loaded into your browser's memory, anything that can read that memory could steal your private keys. This may include other web pages with malicious Javascript as well as any malware on your machine.

I understand. So is it true if I say that the value proposition of BitGo is, that even if something spoofs my private key (from my browser), they will only be able to steal my coins if they also spoof my login? But I guess, if they manage to read my private key, they will be also able to read my email + password?
If this is truly the case, what is the value proposition of BitGo's multi-sig beyond the fact that there is less of a chance of someone "guessing" both of my private keys?

The multisig is supposed to provide a form of 2FA where you will need something else (e.g. Google authenticator code) in order to actually spend the coins (i.e. for BitGo to sign the transaction).


text:
Bitcoin Core Wallet doesn't accept my passphrase
I am using Bitcoin Core Wallet .21 and have encrypted my wallet.
When I try to send some coins it asks for the passphrase, which it says is incorrect.
I have only ever used one of two passphrases and I have copied and pasted these each time using notepad (upper and lower cases), but it rejects my passphrase every time. There is nothing wrong with my passphrase, I know my passphrase is correct.
Are there any circumstances under which the wallet would behave like this?
I have used old backup files of my wallet, but get the same message.
Could my wallet be corrupt and if so can it be repaired anyway?

Are there any circumstances under which the wallet would behave like this?

If your passphrase contains non-ASCII characters, then you could have an encoding issue. I would try typing in the pass-phrase rather than cutting it out of Notepad and pasting it.
Unicode has multiple normalisation forms and this is another thing that could theoretically trip up software.

Could my wallet be corrupt ...

Yes, but your backups show the same result. If you successfully used the passphrase anytime after making a backup it is very unlikely that wallet corruption is the cause.

... and if so can it be repaired anyway?

No-one can tell you that. Repairing an encrypted file is improbable.

Nope. They were all ascii characters. I used the notepad copy/paste to avoid spelling mistakes.
Encryption is definitely worth keeping well away from.
If the damned wallet had it's own login password, then I would never have encrypted the wallet in the first place.
Two thumbs down for the Bitcoin Core Wallet...

@JackB encryption is the only way to secure your wallet. Simply asking for a password when opened (like Excel does, IIRC) is extremely insecure as you could just use another piece of software to directly read your keys. It is likely you have simply forgotten the correct password and are using the wrong one.

This may help: https://bitcoin.stackexchange.com/questions/3313/are-there-bitcoin-password-crackers-i-can-use-to-recover-forgotten-passwords


text:
What is the relationship between the three possible X coordinates corresponding to a Y coordinate?
Every possible X coordinate on secp256k1 has two corresponding Y coordinates, one of which is the negation of the other. I've also been told that every possible Y coordinate has three corresponding X coordinates (due to the fact that the field size p = 1 mod 3). Is there also a nice relationship between them? Given a point on the curve, how can I obtain the other two points with the same Y coordinate?

Yes, there is!
For a given Y coordinate y, if on the curve, the three corresponding X coordinates are the cube roots of y2 - 7. If you have any such cube root y0, then multiplying it with a cube root of 1 gives you another cube root - for the simple reason that (y0 ∛1)3 = y03(∛1)3 = y031 = y03.
Modulo p = 2256-232-977 (the secp256k1 field size), the three cube roots of 1 are:

1 (obviously)
60197513588986302554485582024885075108884032450952339817679072026166228089408
55594575648329892869085402983802832744385952214688224221778511981742606582254

This is exactly analogous to what's going on for the corresponding Y coordinates given an X coordinate; only there the different Y coordinates are related by multiplication with square roots of 1, namely 1 and -1 = p-1.


text:
Transferring all funds from a custodial service over Lightning Network
This is the third time (meaning three different services) something like this has happened to me: A custodial service holds a small amount of my bitcoin. When I want to withdraw all funds to my own Lightning node, the transaction fails with an error message that looks a little like this:

You don't have enough balance to pay the route fees, try a lower amount.

Usually what follows is that I manually lower the amount to send and a dust amount is left in my account which I never withdraw.
What's the problem here? Is it not possible to implement a "send all" function that would deduct the fees from the total amount?

I have observed the same behavior and I think a "send all" function should be possible to build but is just not  implemented. It is a little bit tricky as the actual routing fees depend on the path / route and might change a bit with every attempt and are not known before the payment settles. But of course a custodial service could work with a fee budget that slightly overpays the fees in order to introduce a better user experience.

Cross-posting your own relevant proposal from the lightning-dev mailing list: https://lists.linuxfoundation.org/pipermail/lightning-dev/2022-August/003674.html


text:
Is the Taproot script tree commitment quantum safe?
If an attacker in posession of a quantum computer can break the ECDLP, they can of course spend every Taproot output using the key path. However, do they also have the ability to construct a valid control block and spend using the script path with a script of their own choosing?

This was answered by Pieter Wuille on Delving Bitcoin:

As long as SHA256 remains preimage resistant, script path spends
remain secure (obviously only under the assumption the script itself
isn’t vulnerable to a DL break).


text:
a question on bitcoin transaction
I would like to know whether these statements are true.
"Say a Bitcoin market participant should choose to sell a large volume of the currency. Because each transaction is broadcast to a network that is — by design and necessity — public and publicly observable, the entire market could become privy to such an event."

The public network would see only that a transaction occurred - that a large amount of Bitcoin was transferred from one address (or set of addresses) to another.  There wouldn't be any way to be sure, from that information alone, that the transaction was actually a sale, rather than the same owner just moving the coins to a different address (e.g. for cold storage).  One also couldn't necessarily know who the owner or recipient of the coins was.  If the coins were spread across many addresses, you couldn't even be sure they all belonged to the same person.
So I'd say that statement is false.


text:
decentralized cryto currency without block time
Block time or delay is often a problem in Bitcoin. Then would it be possible to develop a decentralized cryto currency with zero delay/block time? Any reference will be appreciated.

This doesn't make sense - if the block time were zero, there'd be infinity blocks per second, and you'd need infinity bytes of data transfer and storage per second to keep track of them all.

I mean that each transaction will form a block. My question is rather whether it is possible to avoid delay or is it inherently impossible in decentralized crypo currency system.

The problem is that if blocks are created very rapidly, it is likely that many get created simultaneously and don't form a chain.  It gets much harder for the network to settle on a chain, and harder to ensure that all desired blocks are included in it.  Also, if each block needs some proof of work, that takes time to produce, so in that sense delay is inevitable.

Is it true that the first problem is more like bookkeeping and common with other systems (like Visa)? Then for the second problem, is it ever possible to have any proof of work system (different from bitcoin system) without delay?

A delay of some kind is unavoidable.
Say you see some transaction, say Alice sending a unit to Bob. Before you can accept that transaction as reliable, you need to be sure that everyone will not eventually agree that Alice sent that unit to Charlie first.
Alice can compose a transaction sending to Bob and a transaction sending that same unit to Charlie. She can send half of the nodes one transaction and half of the nodes the other. It will always take some time for the system to agree on which of those two transactions to execute and to assure itself that there isn't some third transaction, also sending that same unit, that won't be agreed on.
That agreement will necessarily take some time as nodes have to talk to each other. You can avoid it by having a designated master whose word is law, but it's not clear how that could be decentralized. Among other problems, you need to detect the failure of the master and change the master. Which means you need to make sure that others know the master didn't fail -- because just because you think the master is working doesn't mean the master's messages are getting to others.
You also need to protect against the master telling half the nodes to accept the transaction to Charlie and half the nodes to accept the transaction to Bob. If they don't make sure the master is honest, then the system is, again, not decentralized.


text:
Public and private keys
How to generate public and private keys? And how to use that keys to send and receive bitcoins without using any wallet?

do you want a technical explanation (algorithms etc) or do you just want to know a tool which generates you keypairs?

got this from the appendix in Andreas' book "Mastering Bitcoin":

The Python library pycoin, ... is a Python-based library that supports
  manipulation of bitcoin keys and transactions, even supporting the
  scripting language enough to properly deal with nonstandard
  transactions. The pycoin library supports both Python 2 (2.7.x) and
  Python 3 (after 3.3) and comes with some handy command-line utilities,
  ku and tx.

and next chapter:

Bitcoin Explorer (bx) is a command-line tool that offers a variety of
  commands for key management and transaction construction. It is part
  of the libbitcoin bitcoin library.

There are a plethora of tools on the market, which allow to create the keys, the tx and even send the tx to the network.
Using these tools without a wallet application, from the command line, you can create a bitcoin address, you can send transactions, and you can see amounts on you address. However you cannot "receive" bitcoins, there is not directly  such concept. You would present your public key to someone, who then sends you some Satoshis might be a better description.
I have created my own set of shell scripts, which allow to do the same (for learning purposes). Shamelessly selfmarketing :-)  https://github.com/pebwindkraft/trx_cl_suite.
I highly recommend Andreas' book, it is online and in many languages available, and provides a proper overview of the underlyings of bitcoin.

It would not be possible to do a transaction just with the help of public and private keys without making use of any wallets or Simple Payment Verification (SPV) node.
Basically public and private keys could be generated yourself easily. But bitcoin network needs something more than a public key to represent it as bitcoin node address.
Once you create a random 256 bit (64 digit hexa characters) private key, public key could be computed by using Eliptical Curve Cryptography.
Once you have the private key (PK), you have to hash it using SHA and RIPEMD to get a 160 bit payload.
SHA-256( RIPEMD-160(PK)). This payload is combined with version code and checksum. Finally, they are Base-58 encoded to get the bitcoin address which is the identity of your node.
If you do not wish to use any available wallets, you can create your own bitcoin SPV node where you can have control over your own private key and create a new key whenever you like.
Here are some reference links:
Create a bitcoin address
Bitcoin SPV

If you just want to receive and send bitcoin without using any wallet you could generate public/private key using this open source website: bitaddress.org

Just send some bitcoins to generated public key and share the private key with the person who going to spend this bitcoins.
they can spend the bitcoins using bitcoin-core application, electrum or blockchian.info


text:
Paid the seller but did not receive my Bitcoin
I bought my bitcoins from Remitano, the support team said it's been released but it's already 2 days I still haven't receive anything.
The following is my e-wallet : 17PvSJNcr8giYNDivs5z1CFiXYvV8Lh4NA
And the transaction is as below.
https://blockexplorer.com/tx/c0c40897b9a1c4d10c8c6ee692a7d6e4a475658fb4d8d451fd0d926ba4127a46
Can anyone tell me how can I solve this?

We can't help you. If that company (never heard of it) does not deliver it probably means they ran away with your money.

Checking the 17PvS.. address, there are a number of transactions in and out. It is perhaps worth mentioning that by design, bitcoin addresses should be used just once, to help protect your financial privacy.
The transaction ID you linked is for a transaction that has been confirmed, if the funds are not appearing in your wallet then I would guess that either your wallet is out of sync with the network, or someone has hacked your wallet and stolen the coins. Considering the 17PvS.. has outgoing transactions after the transaction you linked, I fear the latter may be the case for you.
(Also, for what its worth, I would not use blockexplorer.com. They have decided to refer to bitcoin cash as bitcoin, which makes using their site very confusing. In my answer I assume you are using bitcoin, and not bitcoin cash)

I would second that comment on blockexplorer.com, the site was bought out and switched to bicoin cash, which is massively confusing as you say.

Thanks guys for your time! Does that mean there is nothing else i can do to retrieve them?

If you do not control the addresses the coins were transferred to (after leaving 17PvS...), then you will have to contact whoever owns that address and ask for them back. There is no other way, transactions are not reversible or refundable.

how do I contact that person? Any way I can know who is that person?

You would have to find that info out for yourself, identity is not built into The blockchain. If it wasn’t you that moved the coins, chances are it was a malicious actor so unfortunately they are likely gone. Sorry for your loss :(


text:
Bitcoin reference code
I sold Bitcoin using USD wallet and the transaction was completed. I received a reference code but I have no clue on what to do to get the money from what I sold on Bitcoin. How do I get cashed out after I have sold? I'm definitely a novice.

Sold where/how?

if it was at an atm, and you got given a receipt to redeem. you usually have to wait for a confirmation in which the operating company of that machine will text you when time to redeem or you can keep checking yourself on blockchain.info if it has at least 2 confirmations. once you're ready to redeem, just scan the QR code into the ATM and voila.


text:
How to give IP to my node on the Bitcoin Lightning Network
I want to give Ip address to my new node . I have got the pubkey for my node , on the lightning.exe application ,but could not set IP address to my node so that it can be seen publicly on the site "https://explorer.acinq.co/#/faq". I have already created 4 channels also but need way to enter IP address.

You shouldn't spam with the same question. https://bitcoin.stackexchange.com/questions/69868/how-to-set-up-a-node-on-testnet-of-lightning-network-on-the-world-map

Congratulations on getting your Lightning Node up!
To get your server's external IP, you could try the following command/service:
$ curl -s http://whatismyip.akamai.com/

The response will be your external IP. For example 123.123.123.123.

Example Configuration for C-Lightning
Once you have the external IP, add it to the Lightning configuration. You can set the IP with the ipaddr command as follows:
$ lightningd --ipaddr=123.123.123.123

Note: You may need to stop lightningd before making this change.
Additionally, you can set the 'ip' property in the '.lightning/config' file.

Better to use a static IP or a hostname if you can.

Thanks, @surjikal. I completely agree, using a hostname provides coverage for a bunch of situations. However, I'm not sure that hostnames are currently supported. Are you able to confirm that hostnames work with C-Lightning?

I am not sure either, it would be cool but maybe there's some security issue with hostnames.. good question for IRC.


text:
Address that can pay "commission"?
There is a use case where person A needs to send person B, .9 BTC.  Person C, who set up the transaction, should get .1 BTC as commission.
I know this is possible to do with a traditional "bitcoin wallet" by creating a transaction with two payees.  The problem is that for usability reasons, the payment needs to be "bip-21" compatible, which basically means it has to be of the form bitcoin:<address>[?amount=<amount>][?label=<label>][?message=<message>] which only allows for one output address.
So my question is, is there a way to make some "intermediary" address that will forward .9 to A and .1 to C?  Or is there some other way to do this within the constraints of bip-21?

yes.  i'm wondering if there is a way to hack it by doing something with an address that i setup instead of relying on the client wallet?

This is not possible.
The Bitcoin protocol (currently) has no affordances to control what a recipient can do with coins they receive.


text:
Is it possible that malicious bitcoin wallet providers provide pre-generated private-keys for users?
We trust wallets like Ledger, Trezor, and etc. We believe the math that the randomly generated private keys are safe. But could it be possible that the private keys you thought are “generated” are actually provided and already stored in the database?
Imagine I am the cold wallet company, and I pre-generated like one trillion private keys secretly and saved them in my own database. For each wallet chip, I carefully choose 100 private keys and write them into the chip, and mark the keys in my database as used. When a user received the wallet and tries to generate a private key, the program in the chip just picks one of the 100 keys I wrote in. No one knows whether the keys are really generated or given by the wallet provider.
When I’ve already sold enough wallets, I can iterate all the used private keys and steal all my customs bitcoins.
That sounds practical and horrible. I am using a wallet but I cannot convince myself that my private key really belongs to me. Is that scenario possible? Is there any way to guarantee that the private key is not saved by others when the wallet is not open source?
Thank you.

You can verify the legitimacy of Coinkite's Coldcard key generation, assuming that you've used Coldcard's feature of generating the entropy for the seed words by throwing dice (the key generated will be based on your dice throws and so wasn't surreptitiously built into the card).
The web page https://coldcardwallet.com/docs/verifying-dice-roll-math gives details on how you can verify that the Coldcard honestly generated your seed words and key from your dice throws.
I should mention that I haven't actually carried out the verification, but it looks doable.  (Just be sure that you never enter the dice throws, seed words, private keys, etc., on any Internet-connected device, and never attach the Coldcard itself to the Internet or to any Internet-connected device.)

In some cases you can generate your own 12 or 24-word seed phrase using open-source software on an isolated computer and use that phrase in the hardware devices recovery mode.
For example

The recovery phrase to restore private keys from. BIP39/BIP44 recovery phrases are supported.

You should also, with some work, be able to independently verify that transactions generated by the device are indeed using public keys derived from that seed phrase.
In wouldn't characterise this as easy but it seems feasible to me.

One of the main points of cryptocurrencies is that you should not under any circumstances be able to calculate some else’s private keys.
Your only way to get it would be to find the sender and probably threaten them with bodily harm until they give it to you. Or find some security weakness that allows you to access their computer and steal the key from them, hoping that it’s not encrypted.


text:
What is the main purpose of the idea PASSPHRASE (25th word)?
I understand that the 25th word is to protect your assets when your 24 seed phrases are compromised. But I have some questions:

If I use a simple word as the 25th word, it will be easily brute force attacked. So is it useless unless I set the 25th word very long (20+ chars) and memorize it using my brain?

Or the situation is like this. The address with only 24 words has a small amount of crypto that you can lose. When someone gets your seed phrases, they think those are all your assets and did not realize you hide most of your crypto in the address protected by your passphrase. In this case, does it mean that I should not let anyone know I have a hidden wallet with 24+1 words?

Personally I would never let anyone know I had any knowledge of crypto at all.
But yes the "deniability wallet" against the $5 wrench attack is one aspect.
The BIP39 passphrase should be secure, not anything you choose yourself, it can be as long and complex as you like, even another whole mnemonic or Diceware sequence.
It creates a whole new Account-Wallet seed.
Should be backed up to a separate cryptosteel in a different location from your main mnemonic.


text:
Is passphrase (the 25th word) using open source algorithms? Can I recover the passphrase on any hardware wallets?
Many hardware wallets provide the passphrase function that allows you to protect your assets even if your 24 seed phrases are compromised. But I worry that the different companies use different passphrase algorithms. Let's say I store my Bitcoin on Ledger using 24 words + passphrase and 10 years later, Ledger company does not exist. Can I recover my wallet to other hardware wallets?

Most wallets use the same algorithm, as it is an open standard, BIP-39.
A notable exception is Electrum, which uses a similar, but slightly different mechanism. This is publicly documented and can be reproduced by others.


text:
Mining stale low-difficulty blocks as a DoS attack
A DoS attack vector against a bitcoin node I haven't really seen mentioned anywhere is mining a stale chain in a low-difficulty era (say right after the genesis block), ideally with a lot of expensive operations like signature checks.
This answer mentions that in Bitcoin Core only blocks with "a chance to be part of the best chain are actually downloaded and stored", how exactly is that chance quantified? And how do other node implementations deal with this attack vector?

Block downloading proceeds in two phases. While they do happen mostly concurrently, it's easier to think of them as separate steps:

First, block headers are downloaded from peers, and verified for syntactic correctness, and proof-of-work according to the difficulty adjustment rules. All headers today (june 2022) are less than 60 MiB together.

The total amount of work in every headers chain received is computed (roughly equal to the sum of the difficulties of the blocks in it), as a metric for how much work was needed to produce it. This metric cannot be faked. Once this value is high enough(*), the blocks along that chain are fetched from possible multiple peers simultaneously, and verified in order of height, once they arrive.

(*) Now, what is enough work?

First of all, if we already have a chain of blocks (not just headers) that were validated and accepted, we only download blocks along headers chains whose total work is at least as much as the total work in the currently accepted chain. This is because any headers chain whose total work is less than our accepted chain will clearly never actually beat our currently accepted chain.
Secondly, during the initial synchronization, when there is no (long) accepted chain already, a threshold "minchainwork" (configurable, but the default is hardcoded in the Bitcoin Core software, and updated on every release) is used. No blocks are downloaded along a chain whose total work isn't at least as much as minchainwork.

So if an attacker were to construct a low-difficulty stale chain with lots of expensive signature checks, then nodes might end up downloading and verifying the corresponding headers. But those headers would never beat minchainwork (on initial sync), or the real already-accepted chain (on later sync), and thus the blocks along it would never be downloaded even, let alone validated.

Bitcoin determines the best chain by choosing the one with the most work. As "work" is a bit nebulous, it is specifically determined using a metric called "chainwork". Chainwork is just the expected number of hashes required to produce all of the blocks in the chain. It is calculated by computing the expected number of hashes required to produce the block, and that is added to the chainwork of the previous block. As such, chainwork can only increase.
Bitcoin Core's assumevalid mechanism also includes a minimum chainwork value. This is set to be the chainwork of the assumevalid block. Any chain that Bitcoin Core accepts will have to have a chainwork greater than this value.
With the minimum chainwork, Bitcoin Core can filter out low difficulty chains. As it does headers first sync, it will download the block headers for the low work chain, see that its chainwork is less than the minimum chainwork, and not download the blocks for that chain. It will additionally disconnect the peer that advertised that chain to it.

Is this low difficulty chain filter really just tied to assumevalid? What if I run Bitcoin Core with -assumevalid=0?

No, it has its own option, -minimumchainwork.

I see, thanks! I assume other node implementation also use a hardcoded minimum chain work?

@VojtěchStrnad I would not necessarily assume that and would check each individually.


text:
How do I maintain a continuously updated copy of a local mempool?
Let's say I want to build a database of transactions that is continuously being updated from a locally running Bitcoin Core node using JSON-RPC and ZeroMQ. My concern is how to make it robust against chain reorganizations and other events where transactions might get dropped.
If I restrict myself only to confirmed transactions, it seems simple enough to just listen for new blocks, and in the event of a reorganization, rollback all transactions confirmed at a specific height and reapply the new chaintip.
However, it gets more complicated if I also want to include unconfirmed transactions. Then for every new transaction (whether in the mempool or in a block) I need to check if it conflicts with one or more unconfirmed transactions and remove those. Bitcoin Core already does this, but other than publishing the new transaction in a rawtx ZeroMQ event it gives no indication that an unconfirmed transaction was dropped.
So, is there a simple way to maintain a mirror of Bitcoin Core's mempool?
Some ideas:

Call the getrawmempool RPC every 30 seconds or so to get the current state of the mempool. This has the advantage of being very simple, but it's inefficient and it means the mirror will lag behind.
Maintain an index of all outputs that are spent by transactions currently in the mempool, and check every new transaction against it. However, I'm not sure this covers every case where a transaction needs to be dropped, and it certainly doesn't cover transactions dropped due to -maxmempool and -mempoolexpiry.

There are two methods to do this: ZMQ and Tracepoints.
The zmqpubsequence can be used to notifications for all mempool events. See the PR and test for more information. It was designed specifically for the mempool mirroring use case.
The other method is tracepoints, but this requires applying a currently draft PR. Tracepoints work similarly to ZMQ in that your program will use a tracepoints interface and wait for notifications.

@1440000bytes Good point, forgot that zmqpubsequence was added. I've updated the answer.

I you want a project example which keeps a continuous updated copy of a mempool you can check https://github.com/mempoolexplorer/mempoolexplorer


text:
Why channel closed automatically
I got this message:
I tried looking in the logs. Just prior to the channel closing, seems like
there was a temporary network issue and the re-establishment message wasn't
received by your node. Waited 5 minutes for a reply before our nodes retried
(successfully) to re-connect. But I guess by then it was too late, the channel
was already closed. What do you logs say?
Log Summary:
12:33    Received re-establishment message from remote side for channel
12:38:02 Disconnecting 220.133.223.206:9735, reason: Peer 220.133.223.206:9735 no answer for 5m0s -- disconnecting
12:38:04 Established connection to: 220.133.223.206:9735
12:39    CNCT: Unprompted commitment broadcast for ChannelPoint
Longer log summary
2019-02-13 12:33:01.877 [INF] HSWC: Received re-establishment message from remote side for channel(624919015402f01fd46d6c0d57a3ac23ed33dc411c6f6b395c117867fba0b4fc:0)
====
How can I figure out whats going on?

I don't understand your question. Could you elaborate?

Possible duplicate of Why is my LND node closing channels?

Rene, you are the expert, I don't understand it at all. I have no idea what I can do. Its a pitty, since only this channel seemed to contribute to collected fees. The link only tells me it can happen, but does not explain me how to defeat it.


text:
How to upgrade bitcoind in docker?
I am running the docker version for c-lightning 0.7
On a raspberry I need to clone the blockchain, but it needs version 0.17.1
Looking at the docker-compose.yml file I see:
version: "3"
services:
  bitcoind:
    image: nicolasdorier/docker-bitcoin:0.16.3
    container_name: bitcoind
    ...

How can I upgrade to 0.17.1?

Nicolas' docker-bitcoin image has 0.17.0 tag available, so changing that image to that version should just work:
version: "3"
services:
  bitcoind:
    image: nicolasdorier/docker-bitcoin:0.17.0
    container_name: bitcoind
    ...