What does a double spend (CVE-2018-17144) look like if I gettransaction it?

You could use $ getblock <blockhash> 2 or $ getrawtransaction <tx-hash> 2.

Here is a transaction that exploited this bug on testnet: fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59

$ bitcoin-cli -testnet getrawtransaction fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59
    {
      "txid": "fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59",
      "hash": "fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59",
      "version": 1,
      "size": 403,
      "vsize": 403,
      "weight": 1612,
      "locktime": 0,
      "vin": [
        {
          "txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
          "vout": 1,
          "scriptSig": {
            "asm": "3045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e3[ALL] 0455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8",
            "hex": "483045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8"
          },
          "sequence": 4294967295
        },
        {
          "txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
          "vout": 1,
          "scriptSig": {
            "asm": "304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da3773[ALL] 0455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8",
            "hex": "47304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da377301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8"
          },
          "sequence": 4294967295
        }
      ],
      "vout": [
        {
          "value": 0.09900000,
          "n": 0,
          "scriptPubKey": {
            "asm": "OP_DUP OP_HASH160 c8b876680fef08df5278a9df92df7e30b83cbb71 OP_EQUALVERIFY OP_CHECKSIG",
            "hex": "76a914c8b876680fef08df5278a9df92df7e30b83cbb7188ac",
            "reqSigs": 1,
            "type": "pubkeyhash",
            "addresses": [
              "mypGR6pDS85nidXk3DoHZCNBuYd6WBhzgU"
            ]
          }
        }
      ],
      "hex": "0100000002d9bf9d812cfc91e3ff3b7f68e85269f64e7825de0fa61ff9dde117c73b72086a010000008b483045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8ffffffffd9bf9d812cfc91e3ff3b7f68e85269f64e7825de0fa61ff9dde117c73b72086a010000008a47304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da377301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8ffffffff01e00f9700000000001976a914c8b876680fef08df5278a9df92df7e30b83cbb7188ac00000000",
      "blockhash": "00000000eba3f43a8624750f39e4520a1678c0dbdf8707bfa4854a12fbf086c5",
      "confirmations": 0,
      "time": 1537995498,
      "blocktime": 1537995498
    }

Is it distinguishable from a normal, non double-spend?

You will notice the input is listed twice in the 'vin':

"txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
"vout": 1,

That is considered a double spend.

Does the wallet being queried have to know about both the addresses spent to, in order to show anything out of the ordinary?

The wallet would have to be watching the associated addresses or it probably wouldn't have that transaction stored. Even if it's a full node, you can only get the tx by txid if you have indexed the blockchain using -txindex flag.

JBaczuk

Posted 2018-10-17T17:33:40.213

Reputation: 6 172

You see in that json where you have vin.vout twice, and theyre both 1. Is it always this way? While idly browsing the block explorer rich list for a coin I've got some old hodlings, I noticed this: https://chainz.cryptoid.info/funk/tx.dws?1211915.htm - is that also this same exploit? The txid is repeated over and over, but the vout is different, unlike your example

– Caius Jard – 2018-10-23T19:54:16.390

If only the vout is different, then it is a different output from the same transaction – JBaczuk – 2018-10-28T00:53:38.830

So I need to chase the transaction outputs back to find ones with the same vout? – Caius Jard – 2018-10-28T07:51:48.267

If you're looking for a double spend, yes. A transaction output is identified uniquely by it's txid and vout together. This is because transactions can have multiple outputs. – JBaczuk – 2018-10-28T16:00:53.967

Ok, so in that tx I linked (https://chainz.cryptoid.info/funk/tx.dws?1211915.htm) all those vout are different so they’re legitimately different inputs to that transaction.. BUT if I go back another step and view the transaction they were outputs in (https://chainz.cryptoid.info/funk/tx.dws?1211349.htm) this one has tens of identical txid/vout so THAT is the transaction that exploited the bug?

– Caius Jard – 2018-10-28T18:25:35.313

1Yes, it appears so – JBaczuk – 2018-10-28T19:35:51.997

What does a double spend (CVE-2018-17144) look like if I gettransaction it?

Answers