Repository navigation
Reject altered leading zero bytes in BTC addresses - #540
Open
Plastic-time wants to merge 1 commit into
Open
Plastic-time wants to merge 1 commit into
Plastic-time wants to merge 1 commit into
Conversation
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Removing the initial
1from the valid address1BvBMSEYstWetqTFn5Au4m4GFg7xJaNVN2currently leaves a string thatbtc_address()still accepts. Adding or removing a leading1from1111111111111111111114oLvT2is also accepted.The Base58 decoder currently returns an integer, discarding leading zero bytes, and the caller then pads it to 25 bytes. Different input strings therefore become the same bytes before checksum verification. Each leading
1must represent a zero byte, as in Bitcoin Core's Base58 decoder.This change returns the decoded bytes with those leading zeroes preserved and requires exactly 25 bytes before checking the checksum. Tests reject all three altered addresses and retain valid P2PKH, P2SH, testnet and zero-payload cases.
Validation on Python 3.12.14:
git diff --check: passed.The Python 3.11, 3.13 and 3.14 test matrix was not run locally.