<p>The easiest way to malleate a transaction is to just change the signature from Low-S to High-S and vice versa.</p>

CC BY-SA 3.0
2017-06-13T19:54:47.970Z
2017-06-13T19:54:47.970Z
Ava Chow
<p>Let's say I am a node. A transaction has been relayed to me, and one of the <code>scriptSig</code> fields is:</p>

<p><code>&lt;sig&gt; &lt;pubKey&gt;</code></p>

<ol>
<li><p><strong>What is the easiest way for me to malleate this transaction?</strong></p>

<ul>
<li>For example, could I just add a "dummy" opcode to it, like this: <code>OP_NOP &lt;sig&gt; &lt;pubKey&gt;</code>?</li>
</ul></li>
<li><p>Also, are certain types of scriptSig easier to malleate than others?</p></li>
</ol>

<p>Basically, I'm interested in the most practical way a third party might go about malleating a transaction.</p>

CC BY-SA 3.0
2017-06-13T20:15:22.107Z
I don't believe adding a dummy opcode would work.  You can't change the payload of the transaction at all without invalidating the signature - that's a key property of any usable digital signature algorithm.  Instead, you have to keep the payload the same, but modify the format of the signature itself.
Nate Eldredge
CC BY-SA 3.0
2017-08-12T21:08:26.637Z
Adding a dummy opcode would actually be valid, however the result would be non-standard at least in Bitcoin Core.
Pieter Wuille
<transaction-malleability>
What's the easiest way for a third party to malleate a transaction?
inersha
# What's the easiest way for a third party to malleate a transaction?

(Asked by: username_0 on 2017-05-08)

Let's say I am a node. A transaction has been relayed to me, and one of the `scriptSig` fields is:

`<sig> <pubKey>`

1. **What is the easiest way for me to malleate this transaction?**

   * For example, could I just add a "dummy" opcode to it, like this: `OP_NOP <sig> <pubKey>`?
2. Also, are certain types of scriptSig easier to malleate than others?

Basically, I'm interested in the most practical way a third party might go about malleating a transaction.

**Tags:** transaction-malleability

> **Comments:**
> **username_1**: I don't believe adding a dummy opcode would work.  You can't change the payload of the transaction at all without invalidating the signature - that's a key property of any usable digital signature algorithm.  Instead, you have to keep the payload the same, but modify the format of the signature itself.  
> **username_2**: Adding a dummy opcode would actually be valid, however the result would be non-standard at least in Bitcoin Core.  

---

## 1 answers

### Answer by username_3 on 2017-06-13. Score: 1 | Accepted answer

The easiest way to malleate a transaction is to just change the signature from Low-S to High-S and vice versa.


---

