P2SH secure spending. How?

Maybe my question is stupid, but

imagine that I'm trying to spend inputs from p2sh.

For example, p2sh scriptPubKey looks like:

OP_SHA256 4bf5122f344554c53bde2ebb8cd2b7e3d1600ad631c385a5d7cce23c7785459a OP_EQUAL

I know, that the SHA256(0x01) = 4bf5122f...85459a (hacker do not know that, until I broadcast tx)

So I broadcast transaction with the folowing scriptsig:

OP_1 (0x51)

Why hacker can't take this unconfirmed transaction, extract scriptsig, and replace outputs to his own outputs ?

Also, what to do, if RBF (replace-by-fee) flag is set?

Of course, I'm not talking about transactions with OP_CHECKSIG

Andrew

Posted 2018-12-17T15:13:04.803

Reputation: 161

Just to be technically correct, a P2SH scriptPubKeyis actuallyOP_HASH160 <scriptHash> OP_EQUAL`, see https://en.bitcoin.it/wiki/Transaction#Pay-to-Script-Hash

– JBaczuk – 2018-12-17T15:30:33.307

Yes, thank you. Is there any diff with HASH160, or problem the same ? – Andrew – 2018-12-17T15:37:28.630

It's not really relevant to the question, just for correctness. – JBaczuk – 2018-12-17T15:49:31.410

Answers

You're correct that anybody could just replace the outputs and take the funds for themselves. This script has no authorization needed on the spender's part, so once the redeemscript is known, it's practically become an anyone-can-spend script.

Assigning an RBF enabled sequence (or not) on the transaction makes no difference (perhaps only for relay policy), since any sequence set can also be replaced by anybody.

arubi

Posted 2018-12-17T15:13:04.803

Reputation: 1 460

Of course, I'm not talking about transactions with OP_CHECKSIG

I think this is the core of your misunderstanding. P2SH is not intended to be secure if you use an insecure script. It is simply a way to conveniently and cheaply producing an output with a policy and security that is equivalent to a script.

In practice, no script without a type of CHECKSIG operation will be secure, for the reasons you give yourself.

Pieter Wuille

Posted 2018-12-17T15:13:04.803

Reputation: 54 032