Mutability (Transaction Attribute), Made Famous by the Mt. Gox Incident
Malleability (a transaction property) is an attack in which the representation of a transaction is altered—without changing the sender or recipient—to modify the transaction hash.
In the past, Mt. Gox fell victim to this attack
, causing a major uproar with users claiming their transfers hadn’t been processed, couldn’t be confirmed, and wondering where their Bitcoin had gone. To carry out the attack, the attacker must ensure the transaction passes signature verification successfully so that miners will accept it and include it in a block.
The attacker retrieves a transaction that has not yet been added to a block, rewrites it into a signature script with the same meaning but a different syntax, and broadcasts this attack copy onto the network. If
a miner adds the attack copy to a block instead of the original transaction, the attack succeeds, and the original transaction is rejected as a double-spend and thus remains unincluded in the block.
Since the sender and recipient remain unchanged, the transfer is executed; however, because the user’s transaction is not included in the block, issues arise such as the transfer not appearing to have been made or the transaction being untraceable.
