Sunday, December 2, 2018

Coin splitting: beware the 'slow replay' attack

Recently, I noticed a BCH transaction from November 17 being replayed ten days later on BSV. From what I can tell, the transaction originally failed to replay due to locktime, as the BCH chain was ahead of BSV chain on that day. However just because the replay didn't happen right away, doesn't mean the replay can't happen later. I am not sure why the replay happened on November 27 in particular -- perhaps someone decided deliberately to try replaying everything, or, there was some kind of accidental rebroadcast event.

If you make a transaction on one chain, and it doesn't immediately appear on the other chain, don't assume that this means you are replay protected and that your coins are actually split. To be 100% sure that your coins are split, you must make conflicting transactions or otherwise have knowledge that the transaction history is not replayable. A conflicting transaction can be achieved by simply sending all your coin balance to yourself, on the other chain, as recommended in this guide for instance.

This kind of slow replay is most insidious when it happens indirectly. For example, the following hypothetical scenario:

  • Someone sends you some 'BCH only' dust. You check a block explorer: it exists only on the BCH chain.
  • You mix the dust with your BCH coins., resulting in another transaction whose output only exists on BCH chain.
  • You decide to not touch the BSV coins.
  • You wait 20 confirmations. You look on the BSV block explorer and see the transaction is not there on BSV chain. Everything looks OK.
  • You deposit your BCH at Bittrex.
  • Days later, you decide to move your BSV. However, it's gone!
  • You investigate, and it turns out the BCH-only dust given to you was based on a replayable history. Consequently, so was your mixing transaction and your deposit transaction. Some time after your deposit, someone had replayed the entire sequence of transactions.

The mistake here was the third step, where a conflicting BSV transaction was not made.


No comments:

Post a Comment