Old transactions in the blockchain After a lot of reasearch on the net, I still can figure out if the following idea is relevant or not :

I know (or at least I think I know) that each transaction consume all the bitcoins present at the inputs addresses. So if a bitcoin address is in the inputs of a transaction, you don't have to look at all the transactions older than this one to know how much bitcoins there is for this address. That means that we could remove all these olders transactions from the blocks keeping only there hashes via the Merkle pruning trick. With time, the Merkle Trees in each old blocks will become smaller and smaller so that space can be spared.

I understand that it will erase forever a part of the transactions, but the number of bitcoins for each bitcoin address will remain correct and perhaps that's the price to pay to keep a managable blockchain.

Is there already some work in this direction ?
Is this a stupid idea ?

Thank you for your help

A transaction consumes all of the coins for the connected transaction outputs.  But a bitcoin address can have multiple transactions.  So even though one transaction is consumed, that doesn't mean the address doesn't have any other coins.

Your general idea, though, is correct.  You can remove a transaction once all of its outputs have been spent (a transaction can have more than one output, so you have to track each output).  This has been discussed and even implemented in alternate bitcoin clients.  I don't know if or when it might be implemented in the reference client (bitcoind/bitcoin-qt).

I have an implementation that I have been working on which uses a SQL database.  So far, it has processed the block chain up to August 2013 and there are 2,000,000 transactions with unspent outputs.  The database itself is around 1.2GB at the moment, so it is a significant saving over the full blockchain (15.1 GB on my system).  The drawback is you cannot supply the full blockchain to other nodes (I keep just the last 30 days).  So you would still need full nodes to provide the blockchain or download sites/torrents to allow a new node to get up to speed.


How do I get the temperature of my USB Miner? Is there an option I can pass when running the miner? ( CGMiner / BFGMiner )

How does one get the temperature of a USB Miner? ( In my case BitFury )

If your device has a temp sensor it will show in the API output and in the Text User Interface that is default when running at the command line


Adding fixed seed nodes as DNS doesn't seem to be available I am pretty new to bitcoin and I am trying to create a private blockchain by using bitcoind -regtest -daemon. But the executable stops, giving this message:

"Adding fixed seed nodes as DNS doesn't seem to be available"

Could anyone help me out with this issue ?

Thanks

The message means that no DNS seeds were found (which is normal, as regtest has no DNS seeds), and thus that it will fall back to its builtin list of fixed seed nodes (which regtest has 0 of).

In other words, the message is harmless and the artifact of DNS/seed logic that doesn't really apply to regtest.

Regtest is a private network for testing, so you don't want it to connect to any specific other node by default. If you want it to connect to others, use -connect, -addnode, -listen, etc.

I suspect it's not actually frozen, just not doing anything because it has no connections. In that case, it would still accept RPC commands fine.


Insufficient money, need xxxxxx Satoshis Trying to process a transaction out of my Multibit wallet, entering the key & the error message 'insufficient money' appears on the screen. I know that I need to add a transaction fee, which I am doing, however the number of Satoshis required increases at every attempt! For instance, the transaction will require 100250 Satoshis, so I will amend the amount being transferred to 100300 to compensate & allow for any fluctuation.

The warning then reappears stating it now requires 100500 Satoshis.
This cycle is continuing, I can't find a figure beg enough to get
ahead of the curve, without literally throwing my money away! Any help
would be appreciated, this has been frustrating me for some time now!

Seems others have had similar problems with that wallet

  they say the fee is like 0.0001 BTC but I had to make it 0.0005 or more BTC for it to send.

Support
Issue


Understanding assurance contract in bitcoin scripts I'm having a bit of trouble understanding example 3, the bit coin assurance contract on the bitcoin wiki(https://en.bitcoin.it/wiki/Contract) where senders choose to donate money only if 1000BTC total is raised. Here is the description of the assurance contract example:

An entrepreneur creates a new address and announces that the good will be created if at least 1000 BTC is raised. Anyone can contribute.
Each party wishing to pledge creates a new transaction spending some of their coins to the announced address, but they do not broadcast it. The transaction is similar to a regular transaction except for three differences: Firstly, there cannot be any change. If you don’t have any outputs of the right size, you must create one first by spending to one of your own addresses. Secondly, the input script signature is signed with SIGHASH_ALL | SIGHASH_ANYONECANPAY. Finally, the output value is set to 1000 BTC. Note that this is not a valid transaction because the output value is larger than the input value.
The transaction is uploaded to the entrepreneur's server, which saves it to disk and updates its count of how many coins have been pledged.
Once the server has enough coins, it merges the separate transactions together into a new transaction. The new transaction has a single output that simply spends to the announced address - it is the same as the outputs on each contributed transaction. The inputs to the transaction are collected from the contributed pledges.
The finished transaction is broadcast, sending the pledged coins to the announced address.

where each transaction is of the following form from bitcoin wiki(https://en.bitcoin.it/wiki/Transaction):

Input:
Previous tx: f5d8ee39a430901c91a5917b9f2dc19d6d1a0e9cea205b009ca73dd04470b9a6
Index: 0
scriptSig: 304502206e21798a42fae0e854281abd38bacd1aeed3ee3738d9e1446618c4571d10
90db022100e2ac980643b0b82c0e88ffdfec6b64e3e6ba35e7ba5fdd7d5d6cc8d25c6b241501

Output:
Value: 1000
scriptPubKey: OP_DUP OP_HASH160 404371705fa9bd789a2fcd52d2c580b65d35549d
OP_EQUALVERIFY OP_CHECKSIG

I'm having trouble understanding step 4. If the entraprenuer only ends up raising 500BTC and never meets their goal of raising 1000BTC why can't the entraprenuer change the output value to 500BTC, then broadcast the transaction and cash out anyway without each of the the sender's consent?

SIGHASH_ALL | SIGHASH_ANYONECANPAY signs the outputs. So the entrepreneur cannot change the output, as it would invalidate the signatures on all the inputs he received.

There is another way he can bypass this though - if he has 500 BTC himself (or can borrow that amount very briefly) - he can contribute that himself, getting away with raising only 500 BTC but still taking the coins. The only way around that is having some form of escrow that verifies the payments.


is it safe to share the indexes folder between computers? my understsanding is the indexes folder is created if you have tindex set to 1 and want to keep an index of all transactions. all of the material i've seen (bitcoin core documentation, on this site, etc) either:

says it's safe to copy only blocks + chainstate between computers
lists files + folders which are expressly unsafe to copy (ex. wallet.dat).

my understanding + intuition of the indexes folder (from docs + inspecting the files myself) is that it has no pii and should be safe to copy but i just wanted to confirm.

Yes, indexes is safe to copy. It only contains transaction data and is completely unrelated to the wallet. In fact, indexes used to be part of blocks so with older versions, if you had txindex=1, then copying blocks meant you also copied indexes. Only recently was this separated into its own folder in the datadir.


Bitcoin icon for .desktop file When I run bitcoin-qt from CLI I get a nice Bitcoin icon with distinct colors for main and testnet.

I want to create a .desktop file to run it from Gnome, how can I configure the icon to be the same?
I don't seem to find those icons on the release files to reference.

You can download the icons from the source repo at https://github.com/bitcoin/bitcoin/tree/master/share/pixmaps.


Is It Possible to Prove Ownership of Public Key Hash without Public Key? I am building a system where I would like the user to specify a public key hash of a wallet that they have control over in the event of tips, refunds, and/or otherwise needing to send value back to them.

From there, I would like to further provide a feature that lets the user verify that they own this hashed address.

If I understand correctly, they can prove this by signing a message that I send them, and then they could send the signature back to me along with the public key.

However, I also understand that exposing your public key is considered less than ideal.

So, I am curious if there is some solution somewhere that will allow me to verify ownership based on the hashed address alone, without the use of a public key.

I suppose that since this verification process is transient and will not be permanently stored in a public blockchain (or anywhere else), it is not as potentially harmful of a scenario (or rather, more "trustworthy" for the user).  However, I am wanting to be as mindful to their privacy and security as possible and provide them with the opportunity to verify their ownership to this hashed address in the least invasive way available.

Is it enough to simply state somewhere in the user interface that this verification process will not store the public key in any way?  This is all assuming a HTTPS connection, but of course the risk is that since bad actors will know that public keys are being transmitted, it opens up one more potential vector of possible attack.

Also, I am very much interested in other approaches that are preferred/known here, as well as any examples of other sites and/or services that have tackled this problem in an elegant way.

The simple answer is no.

A hashing algorithm is ment to be a one-way function. If it is possible to recreate the public key from the hash, this means that the hashing algorithm is broken.

However there is one aspect that you might find useful. For message signatures, bitcoin uses a custom encoding (compared to the DER encoded signature found in transactions).

Given a custom encoded message signature, the message and a public key hash, you can verify that the signature is correct. However, please note that this is because the custom encoded signature supports public key recovery. Therefore this results in the same security aspects as just supplying the public key, but with the benefit that the user does not need to specifically transfer the public key to you.

If you would like to test the custom encoded signatures, they are returned by the "signmessage" function in the bitcoin core client. They can then be verified by the "verifymessage" function, or by multiple online tools, such as this one:
https://blockexplorer.com/messages/verify


How to use Bitcoin software I just downloaded Bitcoin on ubuntu and started as per the instructions in the README file. But, cannot understand the terms "Label", "Address" or any other for adding a new address or sending bitcoins or anything.

Can anyone help ??

Thank You !!!

Bitcoin transaction has three important parts:

from address A
to address B
amount of bitcoins

If Bitcoin client broadcasts correctly formed transaction then the network knows that certain amount of bitcoins were sent from address A to address B.

If the owner of address B wants to send bitcoins to someone else he formes transaction that looks like this:

from address B
to address C
amount of bitcoins

You can have as many addresses as you want, but newly created address has zero bitcoins. You can buy bitcoins from someone e.g. Bitinstant or MtGox, and ask to send them to the newly created address. Once you have the bitcoins you can sell them or exchange for goods and services.

Label is just a description of an address that you can enter to help you remember, it won't be broadcasted to the network. For example, if you plan to receive bitcoins from MtGox and created a new address for that, then in label field you can enter "Bitcoins from MtGox".


Why is Bitcoin so susceptible to credit card fraud? I understand that you can't buy Bitcoins with a credit card due to massive fraud problems involving chargebacks. Why is Bitcoin more susceptible to this then the thousands of other businesses that take credit card payments for non-physical products (say, RPGNow, Bandcamp, iTunes and so on).

Bitcoin strongly enforces two concepts - high anonymity and no chargebacks.

Because of high anonymity, it is nearly impossible to be 100% certain who you are sending Bitcoins to. In the end, the Bitcoin address is just an arbitrary string of characters.

Because of no chargebacks, once you send someone Bitcoins, they are irreversibly theirs (assuming no double-spends and no 51% attack). You can't later recall the money you sent this way.

When someone would buy Bitcoins with a credit card, they could wait until the coins appear in their wallet, and then claim that their credit card was stolen used by someone else to purchase Bitcoins without their intent. They could get away with their chargeback claims, as it would be impossible for the seller to prove that they sold the coins legitimately to the person. Moreover, the seller wouldn't be able to get their Bitcons back due to "no chargebacks" rules.

What makes it different from services like iTunes and the like, is that the value of the Bitcoins is close to how much it costs the seller to aquire and sell them, whereas iTunes' costs are marginal. For example, buying a 1$ song from iTunes would mean that they have to probably spend less than a penny processing everything and providing you content (logging transaction, letting you download the song, etc), whereas if you send 1$ in Bitcoins, you are sending about 1$ worth of goods. When iTunes gets charged back, they lose a penny and can still sell the song any amount of times. When a Bitcoin seller gets charged back, they lose a dollar and can't sell the same coins again.

Bitcoins can't be copied and distributed to multiple people at marginal cost, that's what makes chargebacks so costly for any potential sellers.


What is the difference between BTC and Bitcoin Core? To my understanding BTC and bitcoin core are the same, when mentioned against S2X/B2X. Is that the case? (Bitcoin Core is BTC in the post segwit2x world?)

Bitcoin Core is a specific implementation of the Bitcoin protocol, specifically the one in the Bitcoin GitHub Repository. It is the evolved version of the original client Satoshi wrote, in C++. It is also the reference implementation of Bitcoin.

But Bitcoin Core is not the only Bitcoin node software, there are others written in other programming languages and with other extra features, for example there is bcoin, btcd written in Go, Bitcoin Knots, Bitcore, etc.

When being compared to S2X, Bitcoin Core is sometimes used to refer to the Bitcoin protocol defined by the Bitcoin Core reference implementation - i.e. Bitcoin itself, to avoid confusion. Bitcoin Core is also sometimes used to refer to the developers of Bitcoin Core, but it must be noted that Bitcoin Core is not an organisation, it is a piece of software.


What happens to old transactions in case of a fork? I'm confused about forking. What happens to the 'old' version of a blockchain and related transactions/data in case of a fork. Can they still be deleted or does the new branch still depend on them to ensure continuity?

What happens to the 'old' version of a blockchain and related transactions/data in case of a fork. Can they still be deleted

In the case of a soft fork, historic data must be kept.  In the case of a hard fork, it's not strictly necessary to keep historic data but it is almost always retained.

Going in to a bit more detail: a soft fork changes the rules everyone follows in a backwards-compatible way by only making the rules more strict.  For example, miners have access to a field called the "coinbase" into which they used to be able to put any arbitrary series of 2 to 100 bytes; later a rule was added that specified in the BIP34 soft fork that the first few bytes of that field had to be the current block's height (distance from the first block).  This is more strict, so everyone who follows the new rule also automatically follows the old rules.  This is backwards compatible because anyone who followed the old rules and isn't already violating the new rules can continue to use their software as normal.

However, for that backwards compatibility to hold true, the data available in the block chain has to not only remain available but stay in basically the same format.  You can sometimes do tricks with that, as segwit did by moving signatures to a new field in transactions, but there's a limit to the scope of changes you can reasonably make.

For hard forks, there rules are changed in a backwards-incompatible way so everyone needs to upgrade anyway.  This gives you a blank slate upon which to make any change to the system you want.  Regarding old block chain history, what you can do is commit to the current state of the system and throw out all history used to arrive at that state.

For example, imagine Alice mines a bitcoin and then pays that bitcoin to Bob.  The block chain will include both the mining transaction and the payment transaction, but if everyone is upgrading anyway, it's simple to just say "Bob starts with 1 bitcoin" and throw away Alice's mining transaction.

If you were to throw away historic data and keep just the current state after a Bitcoin hard fork, you could reduce the current block chain size by about 98%, down to just a few gigabytes.

However, I'm not aware of any hard fork of Bitcoin or an altcoin that ever threw out the historic data and simply committed to the current state.  I don't know why that's the case.


How can I buy Bitcoins with Australian Dollars? Please! I just want to get them! How hard does it have to be? I've spent some 5 hours today trying to figure it out. I am in Australia.

This question answers the more general question "How do you obtain Bitcoins?"  Most commonly, people use a Bitcoin exchange to exchange local currency for Bitcoins.

Here is a list of exchanges split by currency and whether they're currently active or not.


How do I reward a miner who made a block I like? Some decisions miners make are reflected in the blocks they solve.  Is it possible to send those miners some extra BTC without knowing who they are?  It seems obvious that you could just send some coin to the receiving address in the coinbase transaction, but usually, that address is for a large group of people.  Since the extra BTC is intended for only the one who made the decision, sending to the coinbase address doesn't work.

A friend of mine said something to me like this: When you're in a mining pool, if yours is the machine that finds the solution to a block, then you get a much larger reward than everyone else.  If this is true, then I would expect that the receiving address that gets the largest piece of a transaction that spends the total reward for a particular block is the address to which this "Thanks for mining the way you mine" reward would go.  Can anyone confirm that this is the case, or identify cases in which it isn't true?

I would very much like a tool people could use to thank miners for particular decisions.  I could write it myself or pay someone else to do it.  I'll promise right now to send one bitcoin to anyone who provides such a tool.

It seems obvious that you could just send some coin to the receiving address in the coinbase transaction, but usually, that address is for a large group of people.

For pools that payout via the generation transaction (cf. this one), it is not one address "for a large group of people," so you could not "send some coin to the receiving address" because there's not just one. (Generation transactions have no inputs by definition.)

Check with the particular pool (e.g., Eligius pool lists the winning miner in a column entitled "Contributor" here). Oftentimes they say who mined the block, and you can send them BTC directly.

Not all pools pay the miners via the generation transaction, but some do (Eligius and P2Pool were a few of the first to).

  When you're in a mining pool, if yours is the machine that finds the solution to a block, then you get a much larger reward than everyone else.

That's up to the rules of the particular mining pool. See this comparison of the different pools' reward strategies.


Where can I download a snapshot of the Lightning network topology? I want to study the properties of the Lightning network graph. Is there a way to obtain a reasonably fresh snapshot containing nodes and channels (say, in JSON format)? There are multiple explorers available (e.g. listed in this question), but AFAIK none of them provides the underlying data for download.

(I could just launch my own node and query the data with allnodes / allchannels or a similar command, but that requires synching a non-pruned full node, which I'm trying to avoid at the moment.)

UPD: 1ML does provide some JSON (look for the JSON button on various pages). For example, https://1ml.com/testnet/node?json=true gives the JSON description of the top 50 nodes. I haven't found the way to get this data for all nodes though.

UPD2: a related question: Obtaining Lightning network graph data.

As far as I know currently noone explicitly provides this dataset / snapshot. However romperts recksplorer works with providing this dataset from lnd to the browser and have javascript visualize it. so you could do: wget https://rompert.com/networkgraphv2 but that is a little bit dirty.

The "easiest" way to achieve what you are looking for by doing it properly is probably to extract gossipd from lightningd. As you know c Lightning has this darmonized architecture so there gossipd should be able to run standalone, peer with nodes and download sync the network graph.

I might be interested in helping to run gossipd as a standalone tool. We could also just implement the gossip protocol ourselves as that part of lightning is pretty standalone.

Hope these two suggestions help


Has the PoW algorithm changed? I am in a graduate program in Software Engineering and have recreated the mining programs in Python and Ruby, as well as computing the Merkle Root, etc..

I have been randomly chosing blocks from Bitcoin to test my algo(s).  I notice that my nonce and current block hash finder works upto a certain point.  It seems that it works upto about block 400,000, circa 2015... but fails beyond this point.  Did they tweak the mining algorithms around that time?  Should there be another data point?

I have these data points:

previous hash
merkle root
difficulty
version
time in unix
nonce: (this is what the program searches for and puts out the nonce and current block hash, if found)

As I mentioned it confirms and "mines" the blocks up to about block 400,000... but fails afterwards.

Some enlightenment is appreciated.

I will take the suggestion above and post the answer for others.

As mentioned I am a noob at looking into the bitcoin and blockchain.  My interest is the programming code behind the cryptocurrencies and the various blockchain implementations.

When I was backtesting the correctness of my code, which I did in Python and Ruby, I discovered that it wasn't working at a certain point.  I wasn't sure at which block #, where it was failing until I tightened up the test and discovered it was at that block #410000.  A simple look at the data, I realized that either the mining algorithm changed slightly for difficulty or something in the inputs wasn't correct, so I isolated all the inputs and realized that it was the VERSION field that changed.

Of course, I know nothing about the different versions of the blocks, nor the forking behaviors yet... it wasn't clear until the poster provided the link that confirmed to me that the versions had changed, thus throwing off my program.  But I can easily tweek it to adapt to the version field, now that I realize it is not as hardcoded as the other fields.

One thing that I noticed, and I am not a probabilities expert, but the nonce values seem to land in the 9 or 10-digit range... so when a miner is searching for the nonce, I would assume that the miner does not need to start the search at 0.... but rather 100000000 and increment, it seems the time to calculate is reduced substantially.

My next step is I'd like to analyze the range of nonce values and see if they fall within a certain spectrum of values and where they cluster, whether 9 or 10-digit lengths. It's all just curious analysis.

My goal to all of this is the create a fully running program that pulls all of the blockchain, and dynamically confirm the blocks(merkle roots and header hashes), store the info in a csv file.  The point is for me to learn to scrape, process and analyze the results just to find any irregularities, or randomness if that's the case... just from curiousity sakes.

As a pet project, I am going to create a blockchain-distributed ledger for a friend who has a PhD in food safety and security, and see where it goes from there.


How come importing the bootstrap.dat to Bitcoin Core takes so long? So I downloaded and installed BitCoin Core X64 v0.9.3 from https://bitcoin.org/en/download.

I then downloaded the linked bootstrap.dat torrent and after it downloaded the bootstrap.dat, I moved it into the root of the Bitcoin program folder.

I started the program, and here I am, about 20 hours later and its still synchronizing with network... I've got about 4 weeks left to go.

I noticed in my Bitcoin program folder, my bootstrap.dat file has now been renamed to bootstrap.dat.old.

I'm just curious if this in normal for the time it's taking to sync a downloaded bootstrap file. Not to mention running my CPU at 70% the entire time.

My PC is an AMD 8-core with 16GB RAM, and internet with 50mbps down and 25mbps up speed.

Thanks for any advice.

When you bootstrap the database of your Bitcoin Core, the bootstrap.dat contains all the data necessary to build the database, but your computer will still build the database from ground up, verifying each and every transaction of each block. So, compared to the regular synchronization you just save the downloading of individual blocks. Once the bootstrap.dat is renamed to bootstrap.dat.old it has been completely imported and can be safely deleted.

Now, in your case, the bootstrap.dat was probably a few weeks old, and your computer is getting the remaining blocks through regular synchronization. It will download one block, verify all content, update the database, and repeat, until the it has caught up to the current state of the network.

For the whole process the bottleneck is usually the CPU, as it's mostly computation, or the harddisk i/o. The necessary download speed is much less than 50mb/s, though it is quicker in total if all data is already available on the computer. It is common for this process to take hours to days.

As Jannes and David pointed out in the comments, synchronization performance will generally be improved with the upcoming 0.10 version due to the introduction of headers-first synchronization.


Do receiving addresses expire on Multibit? Okay so I have tried Resetting Blockchain and Transactions plenty of times. The only thing is I used an old receiving address that I used about 2 months ago. Do these addresses expire? Can they only be used once? I don't know. I'm not too good at this. Here is my Wallet: http://puu.sh/8CBpT.png Here is the blockchain of my receiving address: https://blockchain.info/address/12EFht1oW3h2ybNYP2NrJKF26oPicFs8mM Is there any way to retrieve my bitcoin? Do you guys have any answers? I have looked everywhere on google and I have gotten nowhere.

But to answer the question: addresses do NOT expire. Not in Multibit, not in cold storage, not online (unless the site retired and you do not have an offline private key or wallet), nor any other wallet software. They can be used unlimited amount of times, so that's not the problem either. The problem your face is probably in Multibit. You can try to backup the .wallet or .key, and import it in another wallet software, or delete/reinstall Multibit.


where can i do a testnet Lightning Network Reverse Submarine Swap? i have Testnet LN Node,
i have created a wallet,
i have send on-chain funds to that wallet
i have connected to several peers
i have created several channels, all of these are outgoing one side funded channels,

i want to do a reverse submarine swap, i mean Pay in LN and receive in BTC

LN --> BTC

this site offers the other way https://submarineswaps.org/

the purpose of these is to reverse a channel, or the half capacity of channel to be ready to receive LN payments.

of course i could just spend money, but the idea is to reverse the channel without loosing money (loosing is simulated as its in testnet)

thanks

you can try sideshift.ai or zigzag.io the first one supports testnet but is still invoite only. For zigzag.io I think this service is only offered on mainnet.


Byzantine Fault Tolerance Threshold of Bitcoin: 1/2 or 1/3? (Edited) According to this answer: https://bitcoin.stackexchange.com/a/58908/41513 a Byzantine Fault Tolerant (BFT) consensus threshold is 1/3.

On the other hand, there is a common belief that Bitcoin network is secure till majority of mining power (i.e. more than 1/2) is honest, that means Byzantine Fault Tolerant threshold of Bitcoin network is 1/2.

Which threshold is correct? 1/3 or 1/2 ?

It depends on what you're actually asking. Bitcoin doesn't exist within the normal model of BFT consensus so in one sense the answer is mu.

Under conventional assumptions Bitcoin will converge on a stable history if honest participants have a majority hashpower. But the arguments given as to why you could expect this hashpower majority assumption to hold are essentially economic.

You can show under some models, at least, that if the behavior of hashpower is governed by short term profitability, that if attackers control more than a third then they can make it more profitable for the profit seeking rest to essentially cooperate. See selfish-mining for an example (the exact threshold for selfish-mining depends on the attacker's communication advantage, which is one of the reasons that block propagation and worst case block propagation speeds are a concern). This doesn't contradict the above because it requires that the miners be profit-maximizing rather than honest... but it is a fair argument in light of the economic arguments for the existence of hashpower to begin with.

Interestingly, if you assume that hashpower increases exponentially forever for both the defenders and the attackers ( e.g. you take Moore's law to be an actual physical law ) then any attacker that maintains any constant fraction of the hashpower will 'eventually' replace the chain with probability 1, including tiny fractions like 0.001%.  This isn't an actual weakness, however, because the resulting time that the attacker would have to persist while getting no income from their attack quickly turns into trillions of years for sensible numbers, but it's interesting to think about as just an example of how different from BFT consensus Bitcoin is.

See also PoW 51% attack vs. BFT 1/3 attack?


Magic numbers BIG-LITTLE endian I'm long time really confused about LITTLE/BIG endian encoding. With regard to bitcoin when you check protocol documentation here it says that btc magic number as send over the wire 0xF9BEB4D9 which has to be as RFC1700 specifies BIG ENDIAN.

However in this thread, one answer states that 0xF9BEB4D9 is little endian encoded.

Can soemone explain, please?

Byte sequences have no endianness, numbers do. Satoshi didn't say that clients must send that number, but the byte sequence. Arbitrarily, he chose to use the little-endian byte sequence, corresponding to his number. He didn't disobey RFC1700 because he didn't say that is derived by serializing his number.


Does this explanation of the security of an electrum seed check out? The explanation in question is given here and reproduced below as well:

Electrum currently use the same wordlist as BIP39 (2048 words). A typical seed has 12 words, which results in 132 bits of entropy in the choice of the seed.
Following BIP39, 2048 iterations of key stretching are added for the generation of the master private key. In terms of hashes, this is equivalent to adding an extra 11 bits of security to the seed (2048=2^11).
From the point of view of an attacker, the constraint added by imposing a prefix to the seed version hash does not decrease the entropy of the seed, because there is no knowledge gained on the seed phrase. The attacker still needs to enumerate and test 2^n candidate seed phrases, where n is the number of bits of entropy used to generate the seed.
However, the test made by the attacker will return faster if the candidate seed is not a valid seed, because the attacker does not need to generate the key. This means that the imposed prefix reduces the strength of key stretching.
Let n denote the number of entropy bits of the seed, and m the number of bits of difficulty added by key stretching: m = log2(stretching_iterations). Let k denote the length of the prefix, in bits.
On each iteration of the attack, the probability to obtain a valid seed is p = 2^-k
The number of hashes required to test a candidate seed is: p * (1+2^m) + (1-p)*1 = 1 + 2^(m-k)
Therefore, the cost of an attack is: 2^n * (1 + 2^(m-k))
This can be approximated as 2^(n + m - k) if m>k and as 2^n otherwise.
With the standard values currently used in Electrum, we obtain: 2^(132 + 11 - 8) = 2^135. This means that a standard Electrum seed is equivalent, in terms of hashes, to 135 bits of entropy.

Is the assumption that 2048 rounds of key stretching add 11 bits to the security of the seed correct? Is the overall explanation correct?

Yes it is correct. Bruteforcing n bits with 2048 rounds of hmac for each attempt is equivalent to bruteforcing n +  11 bits but only requiring one round of hmac for each attempt. They are equivalent because the rounds of work required to determine each secret (n bits vs n + 11 bits) are identical.


data confidentiality on blockchain How does blockchain promise data confidentiality when the data is not encrypted?

Or data confidentiality is not part of blockchain feature?

The traditional answer for Bitcoin to this question is "pseudonymity, not anonymity".

All the data published on the blockchain is necessary for the world to validate that transactions are valid, no theft occurs, no money is being printed, ... but not more. In particular, there are no identities on the chain, and reuse of (otherwise visible) addresses is discouraged.

Of course, this is a very brittle and delicate balance. It turns out that it is in fact very hard to publish enough to let the world validate, but simultaneously not reveal enough to leak substantial portions of information.

Systems like Monero and Zcash go a step further. They "encrypt" certain portions of the transaction data, but include a complicated mathematical proof that the encrypted data is still valid. This lets them hide amounts, and the links between transactions. However, such techniques come with their own tradeoffs in performance, bandwidth, and scalability in general.


Lightning: How would I make a monthly payment to a utility company, etc I see a number of deep theory questions and highly detailed answers for questions about fraud, opening channels, etc. What I cannot find is a simple explanation of how one would go about doing something as mundane as making a monthly payment.

The concept of opening a channel with a balance seems to imply that any amount I'd want to send will have to be allocated up front. Is there no way to add funds periodically, as one would normally do for paying bills? The existing answer here is hypothetical and seems lacking. It seems there are a some still quite shallow proposals, if there's any validity to the link in the comment on the question...

It seems that the expectation is that there will be an intermediary that I keep a large amount of funds with, and I would then use that central channel as a hub... true?

Finally, bonus kudos if you can explain what's up with the common 'Alice and Bob both add 1/2 BTC to a channel' example. I can't fathom what the real world transaction model that is supposed to represent. I can't quite grasp when I would ever use a two sided account; my transactions almost always go one direction. I realize now that the current (or recent) Lightning implementation only funds from one source, but that example is so common that it wasn't until reading the answer here that I realized this.

I'm looking for an answer that explains how I'd go about sending a payment to a hypothetical (mythical?) cutting edge utility company. I expect there are at least two answers - one where the utility company and I create a 'direct' channel, and another where I 'reuse' ('pay through') a channel I happen to have with a central hub. Any answer must assume I'm a normal person who can't pay more than one month at a time.

when reading your question - for the third time now :-) - I always come to the conclusion, that payment channels (with locktime, or nowadays with CLTV/CSV) would be the solution. They are used for quite some time, and they are uni-directional. The typical publisher model. You order a newspaper, send money, and get the newspaper for the next year. But two things against it: one would also have to do a deposit, and you are asking especially for Lightning...

  what's up with the common 'Alice and Bob both add 1/2 BTC to a
  channel' example?

the real world model might not be the one that you expect for a retail user, but gives a clue: Andreas describes in his book "Mastering Bitcoin" a scenario, where two exchanges manage funds, one in India, the other in USA. Both have users that transact somehow buying funds in different countries. So they want to transfer certain amounts cross border, and one exchange is Alice, the other Bob. Another business example I have is in my own environment: I am having a partner in Africa, and I am based in Europe. There are many people coming from Africa to buy goods in Europe, sell it in Africa, convert the money back to Euros, and restart the business travel. With more and more exchanges in Africa I am hoping that we can get rid of the FIAT exchanges (ten years down the road...) It is too expensive, even latest bitcoin fees in December were cheaper.
Anyhow, at the same time there are many people from Africa working in Europe, sending money "home". So these funds cross each other: business from Africa to Europe, and money for the families from Europe to Africa (and the FIAT world earns fees twice). The payment channel is supporting this in an optimal way.

  I'm looking for an answer that explains how I'd go about sending a
  payment to a hypothetical (mythical?) cutting edge utility company:

Well, as this is all too new, maybe it still needs some time. But in bitcointalk there are some "utility" discussions:

opening one side channel in Lightning:

a long discussion of use cases (car dealer and salary):

and some more (grocery and landlord).

  It seems that the expectation is that there will be an intermediary
  that I keep a large amount of funds with, and I would then use that
  central channel as a hub... true?

At the current point in time, from what I have read and understood (with my little bit of imagination), yes.


How do I get credentials on the bitcoin network? I'm setting up an LND node so I can learn about Lightning Networks. I apparently need a set of user credentials so that I can connect to the network.

How do I get the credentials that I need to set this up? Is it possible for an average user who is just trying to learn about LND?

Ideally I would like to connect to the main net, so that I can connect my Zap wallet to it.

I have to fill in these values in the config:

bitcoind.rpcuser=bitcoind_rpc_user_string
bitcoind.rpcpass=bitcoind_rpc_password_string

Also can someone explain these settings to me:

bitcoind.zmqpubrawblock=tcp://127.0.0.1:18501
bitcoind.zmqpubrawtx=tcp://127.0.0.1:18502

Is 127.0.0.1 ok to leave for these values?

Thanks

I have to fill in these values in the config:
  bitcoind.rpcuser=bitcoind_rpc_user_string
  bitcoind.rpcpass=bitcoind_rpc_password_string

These are user defined, and used to authenticate and communicate with your full node. There is no authentication to the network, anyone is free to join.

You’ll want to define a username and password in your bitcoind bitcoin.conf file, and then input them here so that lnd can connect to your node.

  Also can someone explain these settings to me:
  bitcoind.zmqpubrawblock=tcp://127.0.0.1:18501
  bitcoind.zmqpubrawtx=tcp://127.0.0.1:18502
  Is 127.0.0.1 ok to leave for these values?

ZMQ allows lnd and bitcoind to exchange info through a socket connection (getting new info about blocks and transactions). If the nodes (lnd, bitcoind) are on the same machine you can leave the address as the localhost (127.0.0.1).


Bitcoin payout based on real-life event Just starting to learn bitcoin scripting. Can someone explain how to pay out based on some real-life event?
I currently test from the command line with bitcoind -regtest

Bitcoin can't directly check the outcome of real-life events. However, it is possible to make conditional transactions with the help of third parties. This can be achieved with multisignature addresses. A multisignature address is an address which is controlled by several different people. To spend the money from such address, signatures from specific number of those people is required. For example, to spend from a 2-of-3 multisignature address, at least two of the three owners must agree on a transaction.

How can this be used to make conditional payments? Well, there are three parties: the sender, the recipient and the party which determines the outcome of the event, which we will call the oracle. The oracle provides a public key which corresponds to the event which is the condition of the payment. If the event happens, the oracle would reveal the corresponding private key, so anyone would be able to use it to make signatures.

Now, suppose that the sender sends his money to a 2-of-3 multisignature address with the owners being himself, the recipient and the public key provided by the oracle. Until the oracle reveals his private key, the recipient can only spend the money with the assistance of the sender. Afterward, the recipient can use the key revealed by oracle to spend the money as he wishes.

This scheme, however, has a few problems. Firstly, if the event doesn't happen, the sender can only take his money back with the assistance of the recipient. Secondly, if the event does happen, the sender can take his money back if the recipient is not fast enough to move it first. The first problem can be solved by having the recipient sign a transaction returning money back to the sender before the sender broadcasts the first transaction. Here is an example of how this feature can be used. The second problem can be solved by using more complex script than 2-of-3. For example, it is possible to make a script which lets the money to be spent by sender+recipient and recipient+oracle, but not sender+oracle.

By the way, when doing research on this question, I found an actual website which offers to reveal private keys based on the outcome of real-life events.


What do you think about "squashing" the blockchain? So for some time i was thinking about a process where you "squash" the blockchain.
This would reduce its size significantly while maintaining integrity.
The process would look like this:

Summarize all transactions to a certain block
Throw away adresses with a balance of 0
Create a new genesis block containing all adresses that have a positive balance

Would this be possible?
What do you think about this?
Ps: Im new to blockchain and this community. So please dont be too harsh :)

Running a full node allows a user to independently verify the state of the bitcoin network. In order to verify the state of the network, the full node will run through every transaction in every block, and this is only possible if the full node has access to all of the data that comprises the network's history.
If you 'squash' (compress) this information, then the necessary verification cannot take place. Given a compressed piece of data, it does not seem possible to verify the validity of the uncompressed data (according to whatever rules), without having the uncompressed data itself. So instead you would need to trust that someone else had verified this data before it was compressed, and doing so would be counter to the goals of the bitcoin network (ie allowing every user to independently verify the network state).
Further, the blockchain record is not well-suited for compression.

Throw away adresses with a balance of 0
Create a new genesis block containing all adresses that have a positive balance

The bitcoin network does not keep track of address balances, it keeps track of UTXOs.
Note that you can run a full node with pruning enabled, so that old blocks will be discarded from your local storage after verification has been completed.


How spending same coins both at BCC and BTC blockchains prevented? ------X--.---------- BTC Blockchain
              \
               .--------- BCC Blockchain

Let's say that we have some BTC coins from a transaction at block X. And, there are two blockchains now. Is spending these coins at both blockcoins prevented? Are there any BTC/BCC cross check for double spending?

This is from their FAQ.

Bitcoin Cash transactions use a new flag SIGHASH_FORKID, which is non standard to the legacy blockchain.  This prevents Bitcoin Cash transactions from being replayed on the Bitcoin blockchain and vice versa.


Is there a simple reference implementation of ECDSA algorithms? I'm using Node.js's elliptic library to do some signing on my app, but there is some chance I'll migrate it to another language. That library is kinda big and not easy to port, so, I wonder, is there a reference, siple implementation of ECDSA algorithms (key generation, signing and recovery) anywhere?

I wrote the Ruby ECDSA gem and I would say the code is pretty simple.  That was one of my main goals.

https://github.com/DavidEGrayson/ruby_ecdsa


Does my Electrum wallet become less secure if I keep generating seeds until I see one I like the look of? Let's say I want to create a new electrum seed... I didn't like the initial seed words, since I want to remember them and these didn't look too appealing. Looking "too random" for my taste. When I repeat this process like 100 times, chances are that I like the combination then more, because it looks "less random" or "more logical to me" (looking like a short story being summarized) which is easier to remember.

Is doing this insecure? Do I increase my risk of randomly creating a not-so-random seed by redoing the seed creation until I get a seed that I like?

Yes, this does reduce your security. The fact that the seed words were generated randomly becomes meaningless if you use a non-random process to select the seed that you actually use. For instance, it is entirely possible (though very unlikely) that a random password generator would generate a phrase such as "Columbus sailed the ocean blue in 1492". You might say gee, what luck - that is a great password to remember, I'll use that one. Yet, a password cracker that tries meaningful phrases before moving on to random strings will be able to crack this password in the initial phase, even though the probability of randomly generating such a phrase is the same as for any other character string of the same length.


How can a wager with SatoshiDICE be proven to be fair? What steps will let a person manually verify that the DICE roll was fair?

[Going to answer this one myself.]

Unlike games of chance where you need to trust a machine or a human, SatoshiDICE's results are verifiable, thanks to cryptography, once the secret is released (the next day).

This can be verified without needing any software installed.  Here's how:

So for your wagers from Jul 10, 2012 (UTC), get the secret from:

http://satoshidice.com/secretlist.php

That has been released, and it is:

ctygmtZjw7xTnLou7u9cWVYiOd79xAMJK5aJJBBD3w2Su8vGMHPDwP1f4O1eBPek

Then create the SHA-256 hash of that secret with:

http://md5online.eu/3,sha-256

Which yields:

d75e37bc91915af566276e34624e7477c2a6771fb7898bc4dd1b30ccc0022cfe

Then verify that the resulting hash from that jives with the has from hash.keys for Jul 10, 2012:

https://s3-eu-west-1.amazonaws.com/satoshidice/hash.keys

So next you grab the transaction ID for your transaction (from the Transactions tab of Bitcoin.org client, or using BlockChain.info).

Then plunk those values in ... for Text to convert, paste the Transaction ID, and for Shared Secret Key use the secret for the day that you verified above.

http://hash.online-convert.com/sha256-generator

After you click Calculate hash, you'll get a hex string in the results.  The first four alphanumeric characters is the hex representation of your lucky number (from 0000 through ffff hex, or in decimal, 0 through 65,535 decimal).  You can convert those values to decimal here:

http://www.binaryhexconverter.com/hex-to-decimal-converter

So if you had bet the "less than 8,000" wager and your lucky number was 8,000 or higher, ... that specific wager didn't win.

As long as the hashes to the secrets are known in advance (and they are, that hash.keys was published in April, a copy of which has been archived here) you can always verify if you should have gotten a winning payout or not:

https://raw.github.com/sgornick/satoshidice/master/hash.keys


Will hashing bytes from /dev/urandom yield a secure private key? From what I've read, a Bitcoin private key is a 32 byte long integer. I take this to mean that to have a valid private key, all I need is 32 random bytes and that, by extension, running

dd if=/dev/urandom bs=1 count=128 | sha256sum

will give me a perfectly secure private key.

Is this correct or have I missed something important?

Short answer: If you are using /dev/urandom as your source of entropy, there is no need to run sha256sum to hash the data. Instead you can use the random data directly to form your key:

dd if=/dev/urandom of=/home/jsmith/private.key bs=1 count=32

Long answer:

The reasoning behind this recommendation is that /dev/urandom is already designed to produce high quality, unpredictable, unbiased random data. Indeed, the most common way to implement such an RNG is to feed raw entropy sources into a cryptographically secure random number generator (CSRNG) algorithm or a cryptographically secure hash function (like SHA-256).

What you are doing by sending urandom's data into sha256sum is almost entirely pointless. If urandom is working correctly, your procedure does not buy you any extra security. If urandom is compromised (e.g. outputting only a few possible sequences), then sha256sum cannot rescue you either, because the hash of a few different sequences is only a few different hashes. However if urandom were unpredictable but badly biased (say it generates 90% zeros and 10% ones), then sha256sum-ing this crappy entropy would help - but this situation is unimaginable for a proper RNG implementation.

To respond to kasperd's comment:

  Due to the internals of SHA256, the resulting key would be slightly stronger if you used count=119. Having count be a multiple of 64 is the worst you can do in terms of entropy of the final output. The optimal values for the input length is 55 plus a multiple of 64, so 55, 119, 183 are good values. But of course what is much more important than the count you specify is the security of the computer you use to generate and store the key.

This assertion is false, but the reason is not entirely obvious. How the SHA-256 algorithm works is that takes an input message, pads it to a block boundary with some specific numbers, then combines the hash state with each block in sequence.

Suppose S0 is the initial state, Bi is the ith message block after padding, and H(S, B) is the hash algorithm's compression function. Then we calculate, S1 = H(S0, B0), next S2 = H(S1, B1), etc. until all blocks are processed.

The non-obvious fact, however, is that H is an invertible function when B is known. In other words, we can calculate S0 = H−1(S1, B0). Hence we can say that H takes a 512-bit block B and uses it to permute a 256-bit state vector S into another 256-bit state vector Sʹ.

Because of this fact, it doesn't matter if the last block being hashed is highly predictable. If the previous blocks are unpredictable, then the state S will be effectively scrambled by hashing these blocks. Because the block compression function H is invertible, it can't "collapse" multiple states into one state, thus hashing a predictable block will not undo the state scrambling from previous blocks.


How does Peercoin (or other PoS) prevent timestamp forging effecting hash attempts or random minting? I understand that every second the timestamp & potential transactions is hashed.

I guess there exists a "start time" on the block chain we can't roll the clock before because transactions with timestamps already exist on the chain.  But could we roll back say just a few minutes? Could this gain us anything?

Anyway, even if we can't roll back in time, could we edit the program to try as many hashes as possible every second.  For example, suppose we try 100 times to hash instead of once, for a given second, we then broadcast the block.  Would other nodes on the network accept the block, even though it will be a little late?  Do other nodes on the network use some API to get the actual time? Surely the system must allow a fudge factor to account for the latencies?

Even if they do reject, what about this: time is 5 seconds past six, we then repeatedly try to hash the 10 second timestamp - we get 5 whole seconds to do this.  If we succeed and no one else has, we can broadcast the block.

Basically, in the PoW system it's provably impossible to gain an advantage without buying more hardware - a node can tamper with code and clocks as much as they want, they won't get an advantage.  It's not clear to me how PoS systems are protected, since they must rely on code integrity & clocks?

Similarly could minting be tricked? If it uses a random number generator, where does this random number come from? Can it be forged?

I'm a technical guy, so happy for fully technical explanations - no holding back! :)

The general problems you are describing are inherent flaws in PoS, but you've caught onto some of the basic principles that are going to impact the security and integrity of the cryptosystem.

  Anyway, even if we can't roll back in time, could we edit the program to try as many hashes as possible every second. For example, suppose we try 100 times to hash instead of once, for a given second, we then broadcast the block.

This is known as stake grinding.

The selection of the next signer in the block chain is almost always (this varies by implementation) directly or indirectly deterministic based on the previous block information. As there is nothing inherently preventing a person from resigning previous blocks as much as they like, they can continue until the head of the chain also assigns them to be the next signer of a block as well. Under this attack either one person gains a vastly inflated amount of power over the chain, or if everybody is attempting to stake grind it breaks down to a particularly inefficient proof of work system with badly described properties.

Proof of Stake altcoins generally attempt to solve this by making the signer selection RNG seed come from earlier in the chain, say a thousand blocks prior to the head, with the idea that it is impossible for someone to influence the outcome from that far back in time.

  I guess there exists a "start time" on the block chain we can't roll the clock before because transactions with timestamps already exist on the chain. But could we roll back say just a few minutes? Could this gain us anything?

This is known as costless simulation.

The system again falls to the simple fact that there is nothing inherently hard about resigning blocks. Given some coins at the start of the block chain (owned, stolen, "empty" wallets purchased), in a proof of stake system an attacker can simply rebuild the entire chain to the present day with themselves as the only participant. Given the option of two chains (in this case, the attacking and main chain), a client has no way of knowing which if either they should be trusting as real.

Proof of Stake altcoins often attempt to solve this by having centralized "checkpoints" which prevent the chain from deviating, though one could argue against this system being decentralized at all. Others simply have nodes in the network refuse to reorganize to other chains after a certain amount of time, which doesn't protect new users joining the network and being presented with false chains. Ethereum PoS will attempt a "phone a friend" system, where users are prompted to contact other network participants out of band and manually confirm that they are on the same main block chain.

Section 6.4 of A Treatise on Altcoins covers these topics in a little more depth.


Is there a way to access Ethereum Smart Contract's variables by name in JavaScript? Say I have a simple smart contract:

contract Simple {
    string32 message;

    function Simple() {
        message = "Hello world!";
    }
}

How can I easily access the message variable by name in JavaScript? It looks like there is some way to map functions into JS, but variables appear to only be accessible through a complicated way:

var storageObject = web3.eth.storageAt(contractAddress);
document.getElementById('fullName').innerText = web3.toAscii(storageObject['0x']) + ' ' + web3.toAscii(storageObject['0x01']);

Note that this question has been automatically mapped to reddit and answered there.

If you declare your state variables as public, a function to read their values will be automatically created by the compiler ("accessor function"). If you use the rich interface provided by web3.js, you can create a javascript contract object and just call message() on that to get the respective value.

For arrays and mappings, the compiler will generate a function that has additional arguments which correspond to the indexes. For example, for a variable mapping(uint => uint[]) public data; the function will be equivalent to function data(uint x, uint y) constant returns (uint) { return data[x][y]; }.


Over-reporting miner? I'm running the puddinpop rpcminer-opencl.exe that came with Guiminer. I'm running it with crazy settings -gpugrid=128 -gputhreads=256 -aggression=14 on a FirePro 2270 workstation card, and it's reporting about 20 GH/s which I understand is not even remotely possible. I assume something went wrong and all my hashes are broken somehow, but how do I troubleshoot this?

Update: The same miner works fine on one of my other machines. I did find this output on the console:

Build program rval=0
build STATUS:
build LOG:C:\Users\Sean\AppData\Local\Temp\OCLF1AC.tmp.cl(51): warning: attribute "vec_type_hint" ignored
__kernel __attribute__((vec_type_hint(uint))) WORKGROUP void opencl_process(__global opencl_in *in, __global opencl_out *out, const uint loops, const uint bits)
^
Create kernel rval=0
Done allocating OpenCL resources for (128,256)
Finding best configuration step end (128,256) 6ms  prev best=9223372036854775807ms
Done allocating OpenCL resources for (16,16)

So the warning is odd, but also that last extra (16,16) line doesn't show up on my other machine that works.

Update 2: With "crazy" settings I get no shares. If I run with no options, it reports 10 MH/s and seems to get about one share every 10 minutes. So somehow changing the settings makes it generate no shares at all!

I agree, that 15W card should calculate hashes slower than anything listed at  https://en.bitcoin.it/wiki/Mining_hardware_comparison - 20MH/s sounds about right.  You probably misread the units (1GH = 1000MH), or the software has a bug and miswrote them.


Are trades done on exchanges added to blocks? I found a few answers to this question here, here, and here, but my doubts weren't cleared.
Are trades done on exchanges added to blocks? Or are they only added once you withdraw the funds to your own wallet? If this is the case, how does the exchange decide on transaction fees?
Based on the above posts the answer to the first question seems to be "no". Most exchanges seem to work off-block. Now, is it possible that as a buyer one may be buying bitcoins that don't actually exist? How is this controlled?
If I misunderstood and all transactions made on exchanges are confirmed into a block, who sets the fees?
Any good articles or pieces out there to learn about the work behind the scenes of exchanges? I can't seem to find anything that addresses this.

Are trades done on exchanges added to blocks?

No.

Or are they only added once you withdraw the funds to your own wallet?

Yes.

If this is the case, how does the exchange decide on transaction fees?

Fees for trading are just a property of the exchange, transaction fees on Bitcoin transactions for withdrawals are just their choice to make. They might absorb that cost, or pass it on to the user depending on the exchange.

Now, is it possible that as a buyer one may be buying bitcoins that don't actually exist? How is this controlled?

It isn't controlled at all, you trust that the exchange actually has something to sell. There's no way of knowing if they actually do or not as a client or an outsider. They might be a complete sham, might hold only a portion of the funds they claim to, or they might be completely legitimate.


Is there a way to estimate the price based on the blockchain? Suppose I need a rough estimate of the current value of BTC in USD, is there anything in the blockchain that could be used for that? For example, is there some kind of correlation between block difficulty vs price, number of transaction vs price, etc?

I wrote a bitcoin price theory is about a correlation of number of bitcoin addresses
(from blockchain) and the bitcoin price, with a law of networking use like the metcalfe law.

here I posted my study about your question

https://bitcointalk.org/index.php?topic=441336.0


How much does it effectively cost to purchase currency at an exchange? If I buy crypto-currency at, for example, Kraken, how much does it effectively cost me to buy it and move it to another wallet or exchange?

Essentially, you have to factor in 3 fees in a purchase:

1. Deposit fee (if applicable)

This is usually a fee for wire transfers, and from my experience is only relevant if you deposit cash across economic zones, albeit this is slowly reducing to 'anywhere to asia', or outside of the SEPA zone.

Kraken charges 5€ per wire transfer, SEPA transfers are free as of the time of writing this post.

2. Trade fee

This fee depends on 2 factors:

Your current trade volume tier, which you can find at the top right of your account on the Kraken webpage. This is calculated in fiat currency, and based on the traded volume in the past 30 days.
The order type you buy your currency with. A Taker fee is charged, if you buy using 'market' orders - that means you'll get the best available price on the market for the volume of currency you'd like to buy/sell.
If you buy using any other order type, you'll be charged the maker fee. You'll notice that the taker fee is higher than the maker fee - this is because it is assumed that buying via market orders takes away liquidity from the market (there are less offers available), whereas limit and other order types add liquidity to the market (it adds to the offers available on the market).*

*It is worth noting that some exchanges still charge you the taker fee, despite quoting using limit orders - this usually happens if you quote an existing order, causing your order to resolve instantly. Bitstamp is such one example. After checking back with Kraken, this is also the case at Kraken.com.

3. Withdrawal Fee (if applicable)

This fee is charged with any withdrawal you make from your account. On Kraken, this fee is 0.0005 BTC for BitCoin, and 0.02 LTC for LiteCoin withdrawals. Additional fees are charged if you use BitGo, which adds an additional 0.1% cost to your withdrawal. In cases where you may need your BitCoins fast, this may be worth it. You can check on the fees for other currency on their respective withdrawal page on your Kraken Account's website under the Funding tab.

Bringing it all together

This put all together leaves you with the following (slightly unwieldy) formula to calculate your actual cost of purchasing currency at Kraken:

(Deposit Fee) + (Order Volume * Quote Price) + ((Order Volume * Quote Price) * Transaction Fee) + (Withdrawal Fee * Quote Price)

Please keep in mind that your bank and any recipient you send your currency to may also charge you fees; these will have to be factored in as well.

Trade safe!

Example:

You'd like to buy 1 Bitcoin @ 500€, deposit via bankwire, use a market order and transfer it via BitGo Instant. Your Trade Volume Tier is 1.

Deposit Fee = 5€

Order Volume = 1

Quote Price = 500€

Transaction Fee = 0.0026 (or 0.26%)

Withdrawal Fee = (0.0005BTC + (Order Volume * 0.001)) * Quote Price

Gives you this:

(5€) + (500€ * 1) +  ((500€ * 1) * 0.0026) + ((0.0005 + 0.001 * 1)) * 500€) = 507.05 €


Multi coin won't sync error mac osx When i open Multibit it tries to sync then says error, unable to load block chain. I can't figure it out. Don't know what to do about it.

Close Multibit
Navigate to /Users/<username>/Library/Application Support/Multibit
Rename multibit.spvchain to multibit2.spvchain
Restart Multibit


walletnotify and transaction malleability To monitor inbound payments for a web wallet, I plan to use walletnotify to record the transaction IDs, then on each blocknotify I will check the number of confirmations for each pending transaction.

Obviously everyone is thinking about transaction malleability right now, so my question is this: in the event that the transaction ID is changed, or a block containing the transaction is orphaned etc - will I get another walletnotify with the changed TxId?

Yes. You receieve a walletnotify for every transaction your wallet sees that is relevant to it. Once when it is first seen, and once when it is seen in a block (first confirmation). These two may coincide, in which case you only get the confirmation one.

For mutated transactions, you will see a first one that never confirms (and in 0.9 will get a "-1" confirmations marker), and a second transaction that does confirm.


Is BitCoin Mining Basically a Game? Do the Solved Math Equations do Anything? So I've been trying to learn about bitcoin, I'm a kid. It is really confusing. Is BitCoin basically a game since you solve math equations for money? And also, do the math equations do anything or are they just random and because you solve them, you get a reward for your intelligence?

Yes, its kinda like solving really hard math equations.

Mostly done by specificaly made machines like this one:
Antminer S9

But this video explains it all https://www.youtube.com/watch?v=GmOzih6I1zs


What's the easiest way to import a balance from a paper wallet private key (non-QR code) to coinbase? I tried using BRD, but it only accepts QR Code imports.

Use wallet which supports key import. This could be at least Electrum (desktop & mobile).

There are also another wallets supporting so called "sweeping". I can remember precisely that Blockchain.com has this option but I strongly not recommend to use their wallet.

Just now, I've checked that Samourai Wallet can import private key via QR as soon as allows typing it manually.I don't see the same function in Green Wallet.

That's enough options I think.


What prevents a miner to be ignored by the other participants? What prevents that certain miners and the blocks they can contribute to the chain are not ignored? What do the other participants in the network gain from  accepting their answers to the puzzle?

Bitcoin miners are anonymous. There’s no identifying information in blocks that could be used to censor a particular participant. The attributions for miners shown on block explorers are guesswork presented as fact.


BTC transaction cost vs fees According to https://ethereum.stackexchange.com/questions/11/how-do-ethereums-transaction-fees-compare-to-bitcoin current BTC transaction fees vary anywhere from $0.01 to $0.09 USD.

But according to https://blockchain.info/charts/cost-per-transaction and Can it really be true that the Bitcoin system consumes almost $1.000.000 in electricity per day? BTC costs $14 per transaction.

That's a huge difference, 3 orders of magnitude. Shouldn't be the same (or similar at least) transaction cost and transaction fee? What I am doing wrong?

Miners also get a 12.5 BTC reward per block, which is roughly $7,500 at current prices. This is the main reason miners are willing to spend so much to mine a block. The transaction fees themselves don't add up to very much when compared to the actual block reward, usually.

The mining subsidy slowly fades away, however. Every 4 years, the amount of new bitcoins created in a block gets cut in half. At a certain point, either there will be more transactions paying fees, more fees in the same amount of transactions, or mining will become less expensive (or some combination of the three).

I should note that the cost of a transaction is not really $14. The actual cost to send the transaction bytes to peers and save the data on disk is fairly minimal for any individual miner.


When we can agree on mempool sorting order, we can just confirm first n-transactions that are at least 10 mins old. What's missing? When we can agree on a mempool sorting order, we can just confirm first n-transactions (or 80% of transactions) that are at least 10 minutes old.  Then, we can transfer (broadcast) the block header and a hash to the set of all confirmed transactions.

Just consider this as an aggressive version of BIP152, compact blocks.

This kind of method will work for transactions of any size; both confirming 10 transactions and 1 million transactions are the same.

What's missing? Why are we not doing 'confirmation' like this?

For example, if we have 1000 transactions in a mempool (sorted), 900 transactions are at least 10 minutes old, and we're confirming the first 720 transactions.

This may not be a perfect or complete solution, but we just need to find,

Sort order; fee, size, etc.
Transaction age; say, 10 min
Confirm size; say, confirm first 80%

Note:
Sort order is based on f(trxn-meta-data; fee, input, output, etc.), transaction age is used as a filter. Another filter is first x% of the set.

Your answer assumes different nodes can have a consistent view of the mempool. If that were the case, we wouldn't need a blockchain at all, whose sole purpose is establishing consistency between different nodes' view of history.

The reason this is not possible is due to the laws of physics. A transaction tx1 broadcast in Australia, which conflicts with a simultaneously-created transaction tx2 broadcast in Alaska cannot be both included in a block. However, nodes in the rest of Asia will see tx1 first, and nodes in the rest of North America will see tx2 first. Which of those two is legitimate?

There is no solution to that problem, as due to general relativity, the concept of 'first' depends on one's frame of reference. A proof-of-work controlled blockchain solves this problem by accepting that not all nodes need to immediately agree on which of those transactions is accepted, and instead make economics force miners to make a choice between the to candidates.

Despite not having a guarantee for consistency between mempools, there is of course a very strong overlap. This overlap is exploited in many of the proposed efficient relay protocols, including the Relay Network, IBLT, Block network coding (and Compact Blocks which you reference).


Is it still possible to recover Multibit Classic wallet from multibit.key file? I have the file mulibit.key (long string starting with U2FsdGVkX19E+pw) and password.
Cannot find the Multibit Classic wallet to import the key and export to Electrum...
Tried to decrypt the key with
openssl enc -d -p -aes-256-cbc -a -in multibit.key -out key.txt -pass pass:Mypassword
but got only such response:
*** WARNING : deprecated key derivation used.
Using -iter or -pbkdf2 would be better.
salt=44FA9C205936F29D
key=8E260D08EE31BB97AB7544D70BC41535369
iv =B6B2A8A90712B2393DDF8
bad decrypt
140404139345280:error:06065064:digital envelope routines:EVP_DecryptFinal_ex:bad decrypt:crypto/evp/evp_enc.c:588

EDIT WITH FULL ANSWER:
The problem was different version of open ssl... After adding flag -md md5 my multibit.key get encrypted! So I could enter the private key into Electrum wallet
openssl enc -d -p -aes-256-cbc -md md5 -a -in multibit.key  -out key.txt  -pass 'pass:myPassword'

did you try the -md5 flag, the openssl decryption changed a few years back and the md5 flag should solve it


How can I connect to bitcoin-qt client with public ip address I used the bitcoin client but i want to connect to it using public ip adress not localhost.

From that machine i could reach bitcoin using localhost but when I am using public ip address with the ports required it is not working.

Firewall is down on that machine.

I added this line to bitcoin.conf

allowrpc=mypublicaddress

Also my debug window I see these two lines

2014-06-05 15:04:43 AddLocal(mylocalAddress:18333,1)
2014-06-05 15:04:44 AddLocal(myPublicAdress:18333,4)

You need to forward the port if you're in a LAN.

You need to add the IP of the server who is making the JSON-RPC call to the bitcoin.config file such as below:

rpcallowip= IPMakingTheRequest


Not able to use bitcoin/bitcoin.hpp the libbitcoin library seems to have been installed just fine.
but the following code can't seem to include bitcoin/bitcoin.hpp

#include<bitcoin/bitcoin.hpp>
#include<iostream>
using namespace bc;
int main() {
    block_type blk = genesis_block();
    std::cout<<encode_hex(hash_block_header(blk.header))<<std::endl;
    return 0;
}

Error:

g++ -o test test.cpp $(pkg-config --cflags --libs libbitcoin)
test.cpp: In function ‘int main()’:
test.cpp:5:5: error: ‘block_type’ was not declared in this scope
     block_type blk = genesis_block();
     ^~~~~~~~~~
test.cpp:5:5: note: suggested alternative: ‘clock_t’
     block_type blk = genesis_block();
     ^~~~~~~~~~
     clock_t
test.cpp:6:45: error: ‘blk’ was not declared in this scope
     std::cout<<encode_hex(hash_block_header(blk.header))<<std::endl;
                                             ^~~
test.cpp:6:45: note: suggested alternative: ‘brk’
     std::cout<<encode_hex(hash_block_header(blk.header))<<std::endl;
                                             ^~~
                                             brk
test.cpp:6:27: error: ‘hash_block_header’ was not declared in this scope
     std::cout<<encode_hex(hash_block_header(blk.header))<<std::endl;
                           ^~~~~~~~~~~~~~~~~
test.cpp:6:16: error: ‘encode_hex’ was not declared in this scope
     std::cout<<encode_hex(hash_block_header(blk.header))<<std::endl;
                ^~~~~~~~~~

Try adding the -std=c++11 flag.

I had the same problem and the following worked for me:

g++ -std=c++11 -o test test.cpp $(pkg-config --cflags --libs libbitcoin)


Bitcoin Core Offline Reinstallation It is possible to reinstall Bitcoin Core Offline? I copied all the files to my external HDD. I use Ubuntu. Thanks

if you have tar.gz file do like that to extract files:

tar xzf bitcoin-0.14.2-x86_64-linux-gnu.tar.gz

install it

sudo install -m 0755 -o root -g root -t /usr/local/bin bitcoin-0.14.2/bin/*

finally, run it

bitcoind -daemon

if you mean by "you copied all the files" that you copied .bitcoin directory so do like that after the previous step:

mkdir ~/.bitcoin

move the files you copied to this directory and execute

bitcoind -daemon


How do I broadcast an "alert" message to the network I am curious about how to broadcast an alert. I  know that this is possible because the system to send alerts has been shut down and this probably won't work, but I am curious about how I can broadcast an "alert" using bitcoin-cli.

You can't. bitcoin-cli has never had the capability to send alerts. It is not possible for a user to push out an alert from any Bitcoin Core node.

Alerts were sent by using a specially modified version of Bitcoin Core which had the particular alert to be sent hard coded into it. Developers have to modify Bitcoin Core and include the alert code in a local build every time they wanted to send an alert.


What is ExtraNonce2? I'm reading about the Stratum protocol where miners contribute to pools.  Specifically there is a "mining.submit" method -- https://en.bitcoin.it/wiki/Stratum_mining_protocol, in which I miner will submit a share for consideration.  The details on this doc are a little sparse.  Specifically, what is the "ExtraNonce2" value they describe as being submitted back to the pool?

The extra nonce is a value in the coinbase transaction which miners will increment in addition to incrementing the nonce in the block header so that there are more possible hashes that can be tried with a given set of transactions.

The ExtraNonce2 is specifically the part of the extra nonce that the miner is changing while performing work for the pool. There is also an ExtraNonce1 which the pool provides to the miner. That ExtraNonce1 is typically used as an identifier.


How to restore my Copay / BitPay Wallet? I started using Copay in 2015 and got some Bitcoins. Sold some coins, and then stop use the app. Now Bitcoin price is up again, and try to reach my Wallet but I can not import, though I  know the 12 word. What I am doing wrong? This is my address I get originally my payment:
1DpmSrg9Bur2VhiMqEu4gYnA28gaM7ZVjp
I tried recover: https://bitpay.github.io/copay-recovery/
No success. I tried different Addres Gap, 40, 80, 100, 120: No success.
I tried import with different derivation path listed here, no success: https://walletsrecovery.org
Do you have any idea more?
Seems cold paper based wallet are still more secure, right?
Do you know, is it any process I can detect Derivation Path from existing address, and transaction started on it?

[EDIT]
Here is the logs of transactions:

I tried recover: https://bitpay.github.io/copay-recovery/ [...] No success.

I don't know why you put your recovery phase into a website. That seems a very risky thing to have done. The distinction between github.com and github.io is also something I'd find a concern that would make me hesitate.
A message like There are no record of your wallet on our servers. makes it sound like recovery of a custodial wallet but wasn't the Copay wallet non-custodial?
I would worry that having typed my recovery phrase into a website, someone will have already stolen any money.

What I would have done is download the Bitpay wallet app from the Google play store (after checking very carefully that the app authors are listed as Bitpay) and use that software's wallet "recovery" features. I would not use "import".
If the balance showed zero, I would check for recent transactions moving the money away.


Private keys importing in format got by dumpprivkey I backed up my private keys this way: Opened my peerunity wallet (bitcoin-qt fork), opened Debug window, issued dumpprivkey  and I got my private key. Then, I wrote it on a piece of paper (!). Now, I would like to recover it. The wallet was encrypted at the time of dumping priv key. I have the key I used to encrypt it. Is privkey on my paper encrypted somehow? Peerunity is not accepting it when I'm trying to importprivkey. (tried it repeatedly)

I'm not familiar with Peerunity but here is how things work in bitcoin-qt, which is probably similar unless Peerunity changed something.

importprivkey accepts exactly the same format output by dumpprivkey.  The dumped private key is not encrypted in any way (if the walled was encrypted, you had to give the passphrase before dumping so that it could be decrypted).

The most likely explanation is that you wrote down the key incorrectly.  Private keys usually include a checksum so that errors can be detected immediately, and that seems to be what is failing here.  It shouldn't matter that the wallet is out of sync; importing a key doesn't need access to the network (though you will need to sync with the network to get an up-to-date balance).

If you made a mistake when writing down the key, you may be able to do something similar to the approach in the question Can you help me fix this address? to try changing a few characters at a time in hopes of recovering the correct key.


Getting current Bitcoin Fees from Command LIne? I have a shell script, that fetches current bitcoin fees from https://bitcoinfees.21.co/ with this command:

curl -sS -L --insecure https://bitcoinfees.21.co/api/v1/fees/recommended

When I run this command from (Central-) Europe, I never encountered an issue. Now I am in Africa, and obviously there is JavaScript injected by Cloudflare, asking for a Captcha. This prevents to get the values with a  shell script (command line). Is there a way around it, or are there other services for an overview of fees for BTC?

If you have a running instance of Bitcoin Core, you can use estimatesmartfee to get a fee rate estimate.


Is the label of an address visible for another people? Is the label of an address visible for another people  ?


How to instantly give people a pre-filled wallet to introduce them to Bitcoin? As a Bitcoin evangelist I like to introduce Bitcoin to my friends, and if possible even get them involved by having them own a few coins themselves.
The settlement of a personal debt through Bitcoin would be the perfect excuse to give someone their first coins. Who hasn't balanced expenses with their friends after a night on the town? Why not gain some new Bitcoin users in the process!
So, is there a way to securely set someone up with a new wallet and transfer some BTC to that wallet at the same time, without requiring any action from the receiving party?Ideally, the BTC.USD exchange rate is taken into account because such debts are unlikely to be denominated in BTC already.
Imagine the following conversation taking place:

Alice: I've paid the restaurant $100. So Bob, you now owe me $50.
Bob: Is it OK if I pay in Bitcoins?
Alice: Sure, but how does that work?
Bob: Don't worry, I'll just [PERFORM_MAGIC] so you'll have the equivalent amount of BTC in a brand new wallet straight away.

I can think of the following (slow, complex, frustration-prone) process to substitute PERFORM_MAGIC with:

Bob emailing some custom instructions telling Alice to install a
Bitcoin client
Alice following these instructions and possibly
having problems with the process
Alice emailing Bob her receiving
address
Bob transferring the coins to Alice.

Is there a way that requires less interaction, preferably accessible from my phone?

I would suggest starting a wallet at My Wallet (blockchain.info).

It's dead simple, all you have to provide is a password
You don't have to enter any personal info about the person that you want to give the wallet to.
As opposed to e.g. Instawallet your friend can change that password so that you no longer have access to the wallet.
It is "mobile friendly" so you can do it from your phone, as you requested
It has a sleek and professional look so it won't scare away new users


What does this transaction script mean? I was looking for scripts on the blockchain to test my program, and I encountered a weird scriptPubKey in this tx that I couldn't understand.

The opcodes are

pk1 = 02085C6600657566ACC2D6382A47BC3F324008D2AA10940DD7705A48AA2A5A5E33
pk2 = 03F5D0FB955F95DD6BE6115CE85661DB412EC6A08ABCBFCE7DA0BA8297C6CC0EC4
hash1 = D68DF9E32A147CFFA36193C6F7C43A1C8C69CDA530E1C6DB354BFABDCFEFAF3C
hash2 = F531F3041D3136701EA09067C53E7159C8F9B2746A56C3D82966C54BBC553226

OP_PUSHDATA <pk1>
OP_CHECKSIG
OP_SWAP

OP_PUSHDATA <pk2>
OP_CHECKSIG
OP_SWAP

3 OP_PICK
OP_SHA256
OP_PUSHDATA <hash1>
OP_EQUAL

3 OP_PICK
OP_SHA256
OP_PUSHDATA <hash2>
OP_EQUAL

OP_BOOLAND

4 OP_PICK
OP_SIZE OP_NIP
OP_PUSHDATA 0x20
OP_PUSHDATA 0x22
OP_WITHIN

OP_BOOLAND

3 OP_PICK OP_NIP
OP_PUSHDATA 0x20
OP_PUSHDATA 0x22
OP_WITHIN

OP_BOOLAND

OP_IF

3 OP_PICK
OP_SIZE OP_NIP

3 OP_PICK
OP_SIZE OP_NIP

OP_EQUAL
OP_PICK

OP_ELSE
OP_BOOLAND
OP_ENDIF

I tried to somehow decipher it, and this is the pseudocode in my understanding

bool pk_script(dat1, dat2, sig1, sig2) {
    if (sha256(dat1) == hash1 &&
        sha256(dat2) == hash2 &&
        size(dat1) == 32 or 33 &&
        size(dat2) == 32 or 33) {
        if (size(dat1) == size(dat2)) {
            return checksig(sig2, pk2);
        } else {
            return checksig(sig1, pk1);
        }
    } else {
        return checksig(sig1, pk1) && checksig(sig2, pk2);
    }
}

If this is correct, I can't understand what the condition of the main if is trying to do, nor can I see the meaning of the first branch.

The output was spent in this tx which only pushes two empty strings and two signatures in the scriptSignature.

Could anyone please explain what's the meaning of the rest of the script besides checking the validity of two signatures?

Trying to see, how this tx was successfully confirmed (in 2013) in the blockchain should reveal the secret of this script. The previous comments give already an idea, what the script is doing, but doesn't explain all. So I try to decompose further.
Assumption is, that sigscript of the spending tx goes to stack, then followed on top by the pubkey script. To verify the signature, the previous funding tx would need to be converted to an unsigned tx, so I remove the sig from orig tx, replace it with pubkey script, and change input script length:

 01000000 01 A214A2DAF91691AFDD491FD00D894EB3301E35BC18B5554B14E12843037E954C (<-- reverse hex !)
  00000000
  23         (<-- length is decimal 35 Bytes, reversed, hex 0x23)
  2102085C6600657566ACC2D6382A47BC3F324008D2AA10940DD7705A48AA2A5A5E33AC7C2103F5D0FB955F95DD6BE6115CE85661DB412EC6A08ABCBFCE7DA0BA8297C6CC0EC4AC7C5379A820D68DF9E32A147CFFA36193C6F7C43A1C8C69CDA530E1C6DB354BFABDCFEFAF3C875379A820F531F3041D3136701EA09067C53E7159C8F9B2746A56C3D82966C54BBC553226879A5479827701200122A59A5379827701200122A59A6353798277537982778779679A68 (<-- placed pkscript here into sigscript section)
  00000000   (<-- interestingly, Sequence is not FFFFFFFF)
 01 C06C3C0000000000 23 21039DC85F5FE062D4EEF0470FA96D4BBCFFF0096C62042333CD05AD491536560443AC DA538652

which is serialized and double sha256 hashed:

01000000014c957e034328e1144b55b518bc351e30b34e890dd01f49ddaf9116f9daa214a200000000B52102085C6600657566ACC2D6382A47BC3F324008D2AA10940DD7705A48AA2A5A5E33AC7C2103F5D0FB955F95DD6BE6115CE85661DB412EC6A08ABCBFCE7DA0BA8297C6CC0EC4AC7C5379A820D68DF9E32A147CFFA36193C6F7C43A1C8C69CDA530E1C6DB354BFABDCFEFAF3C875379A820F531F3041D3136701EA09067C53E7159C8F9B2746A56C3D82966C54BBC553226879A5479827701200122A59A5379827701200122A59A6353798277537982778779679A680000000001c06c3c00000000002321039dc85f5fe062d4eef0470fa96d4bbcfff0096c62042333cd05ad491536560443acda53865201000000

4eb4dccd727e81315a9ff801c205efc62635471cf8668e42c1c8aebfb51500a3

This double sha256 hash, pubkeys and sig (from the spending tx) matches with these pubkeys:

  ssig1:
  30450221009a29101094b283ae62a6fed68603c554ca3a624b9a78d83e8065edcf97ae231b02202cbed6e796ee6f4caf30edef8f5597a08a6be265d6601ad92283990b55c038fa
  pubkey in HEX:
  03F5D0FB955F95DD6BE6115CE85661DB412EC6A08ABCBFCE7DA0BA8297C6CC0EC4
  pubkey in PEM:
  MDYwEAYHKoZIzj0CAQYFK4EEAAoDIgAD9dD7lV+V3WvmEVzoVmHbQS7GoIq8v859oLqCl8bMDsQ=
  double sha256:
  4eb4dccd727e81315a9ff801c205efc62635471cf8668e42c1c8aebfb51500a3

  ssig2:
  3044022045d08719828fbd93e49c9223e63f4d2dab2de6c568e1faa2cccb33adf2575d2c02200c00126cb0105275040a963d91e45460147e40451b590485cf438606d3c784cf
  pubkey in HEX:
  02085C6600657566ACC2D6382A47BC3F324008D2AA10940DD7705A48AA2A5A5E33
  pubkey in PEM:
  MDYwEAYHKoZIzj0CAQYFK4EEAAoDIgACCFxmAGV1ZqzC1jgqR7w/MkAI0qoQlA3XcFpIqipaXjM=
  double sha256:
  4eb4dccd727e81315a9ff801c205efc62635471cf8668e42c1c8aebfb51500a3

Quick verification with openssl (hence the pubkey in PEM format):

sig=30450221009a29101094b283ae62a6fed68603c554ca3a624b9a78d83e8065edcf97ae231b02202cbed6e796ee6f4caf30edef8f5597a08a6be265d6601ad92283990b55c038fa
pk=03F5D0FB955F95DD6BE6115CE85661DB412EC6A08ABCBFCE7DA0BA8297C6CC0EC4
hash=4eb4dccd727e81315a9ff801c205efc62635471cf8668e42c1c8aebfb51500a3
printf $( echo $hash | sed 's/[[:xdigit:]]\{2\}/\\x&/g' ) > tmp_utx_dsha256.hex
echo "MDYwEAYHKoZIzj0CAQYFK4EEAAoDIgAD9dD7lV+V3WvmEVzoVmHbQS7GoIq8v859oLqCl8bMDsQ=" > cat pubkey.pem
printf $( echo $sig | sed 's/[[:xdigit:]]\{2\}/\\x&/g' ) > tmp_sig.hex
openssl pkeyutl <tmp_utx_dsha256.hex -verify -pubin -inkey pubkey.pem -sigfile tmp_sig.hex

OK, the part for the signature is clear. So looking further at the pkscript, I'll try to decode:

pubkey1  21 02085C6600657566ACC2D6382A47BC3F324008D2AA10940DD7705A48AA2A5A5E33 AC 7C
pubkey2  21 03F5D0FB955F95DD6BE6115CE85661DB412EC6A08ABCBFCE7DA0BA8297C6CC0EC4 AC 7C
         53 79 A8
hash1    20 D68DF9E32A147CFFA36193C6F7C43A1C8C69CDA530E1C6DB354BFABDCFEFAF3C
         87 53 79 A8
hash2    20 F531F3041D3136701EA09067C53E7159C8F9B2746A56C3D82966C54BBC553226
         87 9A 54 79 82 77
         01 20
         01 22
         A5 9A 53 79 82 77
         01 20
         01 22
         A5 9A 63 53 79 82 77 53 79 82 77 87 79 67 9A 68

The problem I see is, that your statement somehow doesn't seem to match:

if (sha256(dat1) == hash1 &&
    sha256(dat2) == hash2 &&
    size(dat1) == 32 or 33 &&
    size(dat2) == 32 or 33) {
    if (size(dat1) == size(dat2)) {
       return checksig(sig2, pk2);
    } else {
       return checksig(sig1, pk1);
    }

The stack would look after sigscript:

[ssig2]
[ssig1]
[0x00]
[0x00]

And on top the pkscript would follow:

21: OP_DATA_0x21:        length compressed Public Key (X9.63 form, 33 Bytes)
    02085C6600657566:ACC2D6382A47BC3F:324008D2AA10940D:D7705A48AA2A5A5E:33
    corresponding bitcoin address is:   152q849uVmoB5oRcZ4d4tJHyRuB6FPB9Hz
AC: OP_CHECKSIG:         sig must be a valid sig for hash and pubkey

--  this would check the pubkey1 against ssig2, remove pubkey and [ssig2] from stack, and leave [TRUE] on stack

7C: OP_SWAP:             top two items on stack are swapped

--  this would swap [ssig1][TRUE], so [ssig1] is on top of stack

21: OP_DATA_0x21:        length compressed Public Key (X9.63 form, 33 Bytes)
    03F5D0FB955F95DD:6BE6115CE85661DB:412EC6A08ABCBFCE:7DA0BA8297C6CC0E:C4
    corresponding bitcoin address is:   1BaJ2fYiAVnZC73MtX1LsyJBtXNZWDSkt6
AC: OP_CHECKSIG:         sig must be a valid sig for hash and pubkey

--  this would check the pubkey2 against ssig1, remove pubkey and [ssig1] from stack,
    and leave [TRUE] on stack
    [0x00][0x00][TRUE][TRUE]

7C: OP_SWAP:             top two items on stack are swapped

--  this would swap [TRUE][TRUE], reason is unclear

53: OP_3:                the number 3 is pushed onto stack

--  top stack element is "3"
    [0x00][0x00][TRUE][TRUE][0x53]

79: OP_PICK:             item n back in stack is copied to top

--  this would pop 1 element from stack, and bring [0x00] to the top of stack:
    [0x00][0x00][TRUE][TRUE][0x00]

A8: OP_SHA256:           input is hashed using SHA-256
20: OP_Data:             next 32 bytes is data to be pushed on stack
    D68DF9E32A147CFF:A36193C6F7C43A1C:8C69CDA530E1C6DB:354BFABDCFEFAF3C
87: OP_Equal:            Returns 1 if inputs are equal, 0 otherwise

--  hashed the [0x00] value, put OP_DATA on top, and compare it. OP_EQUAL pops two
    elements from stack. This would give [FALSE] on the stack. Stack status:
    [0x00][0x00][TRUE][TRUE][FALSE]

53: OP_3:                the number 3 is pushed onto stack
79: OP_PICK:             item n back in stack is copied to top

--  this would pick the [TRUE] value ??

A8: OP_SHA256:           input is hashed using SHA-256
20: OP_Data:             next 32 bytes is data to be pushed on stack
    F531F3041D313670:1EA09067C53E7159:C8F9B2746A56C3D8:2966C54BBC553226
87: OP_Equal:            Returns 1 if inputs are equal, 0 otherwise

--  hashed the [0x00] value, put OP_DATA on top, and compare it. OP_EQUAL pops two elements from stack. This would give [FALSE] on the stack. Stack status: [0x00][0x00][TRUE][TRUE][FALSE][FALSE]

-- interestingly, this hash would match to sha256(hash) provided in the funding tx, as mentioned in the previous comment. I stop further evaluation of the script here. My understanding is, that we have seen the spending script with two hex 0x00 values, followed by sigs. This does not match the pseudo code? Maybe more like this:

if (sig1 == TRUE &&
    sig2 == TRUE &&
    sha256(dat1) == hash1 &&
    sha256(dat2) == hash2 &&
    size(dat1) == 32 or 33 &&
    size(dat2) == 32 or 33)
    ...

However: I have somewhere an "off by one" at the second hash value (F531F3041D313670...). It should be OP_4 or OP_5 (instead of OP_3) to reach to one of the provided hash images. With the value 3 the OP_PICK would copy [TRUE] (from the sig verification) on top, instead the hash image at position 4 or 5...

I didn't follow the next opcodes, there are more conditions. Also sequence number is "00000000" (not "FFFFFFFF"), and LockTime is "DA538652" (decimal ), which is bigger than 500'000'000, meaning a unix timestamp. This translates to a date: Fr 15 Nov 2013 18:03:22 CET. The tx appeared in the blockchain on 2013-11-15 17:13:23.

So in summary I think, this tx was structured in a way, that someone gave out a keyword with the tx to a second party, and you needed to be able to sign and "know" the keyword. A type of multisig, yes. And, it could not be spent before a certain point in time (the tx would be kept in mempool, but we cannot see this anymore). Else only the owner would be able to spend the tx...

There is probably more to it, I leave it to the experts to decode the remaining part :-)


how to calculate transaction bytes of a x BTC? x=0.2 i have read : How to calculate transaction size before sending

but i will not understand what are in and out.
as describe in this link in=40 and out=16

what does it mean???

i will send only one address to 0.20BTC of 1BTC account.
please describe this transaction size.

In the simplest typical case, you'll have one input and two outputs (the recipient, and change). So in=1 and out=2. According to the linked formula, the transaction size will be about 160+2*34+10 = 258 bytes. It does not depend on how many bitcoins you are sending.

However, if the money you are sending came from many different sources, you will have many inputs and the transaction will be bigger. Again, this does not depend on the amount of money, but on the complexity of your wallet's history.


Filter transactions by time on a given address Is there an API that will list all transactions made on a given wallet address with the ability to filter by date? I prefer nodejs, but open to other suggestions.

Not exactly what you were looking for but there's a site that does exactly this, check it out.

https://goochain.net/

Filter on dates/ find adresses with partial numbers etc.


A Bitcoin locking script to force a certain payment to the receiver? Is there a way to use Bitcoin script to force payment for the receiver?
I do not mind if it's a non-standard transaction, just curious if Bitcoin script itself allows expression of something like that.
For example, is it possible to write a locking script such that:

Alice sends 1 BTC to Bob
But Bob can ONLY spend if Bob sends 0.5 BTC to Carol in the next transaction

No, that is not possible, and doing so can be problematic.
Such scripts would need the ability to inspect the spending transaction and this is currently not allowed or possible; the script interpreter does not have access to other parts of the transaction.
Furthermore, if implemented naively, this could allow for widespread censorship and centralized control of Bitcoin. In essence, such scripts could be written to require that transactions do not send money to some blacklisted addresses, and at the same time require that all receivers in that transaction also have this same requirement. This could lead to services blacklisting some addresses, and then forcing their users to also blacklist those addresses when they withdraw from the exchange. And the recursive nature of that means that all subsequent transactions also have the same blacklist.


What's the segwit transaction serialization "flag" field for? According to bip 141, the segwit transaction serialization format (used to compute the wtxid) is:

[nVersion][marker][flag][txins][txouts][witness][nLockTime]

The bip mentions that the flag field MUST currently be 0x01. What's the purpose of this field? Is it some kind of upgrading mechanism of the serialization format?

Found it in bip 144:

  Rationale for the 0x01 flag byte in between: this will allow us to easily add more extra non-committed data to transactions (like txouts being spent, ...). It can be interpreted as a bitvector.

So the 0x01 flag is indicating that the witness data should be included in the (bip144) transaction serialization.