<p>This is a quite hard analysis to make. In general all alt-coins that are based on the concept of dynamic input-scripts and output-scripts are subject to transaction malleability. This is because anybody could change the input scripts of a transaction, by adding commands that wouldn't alter the validity of the script, but would alter its hash. For example adding OP_DROP will leave the stack exactly as before prior to scriptPubKey execution.</p>

CC BY-SA 3.0
2014-03-03T05:05:11.613Z
Why would any system allow to execute script that does not match it's hash ? What currencies do or do not not execute such scripts ?
alpav
CC BY-SA 3.0
2014-03-01T09:31:03.050Z
2014-03-01T09:31:03.050Z
Luca Matteis
<p>NXT is based on different code, so it is repaired there, Nxt doesn't have malleability vulnerability</p>

CC BY-SA 3.0
2014-03-01T16:09:50.997Z
This answer would benefit from a citation.
Murch
CC BY-SA 3.0
2014-03-01T19:47:08.033Z
So, now we got two opposing statements. Could either of you support their argument with some compelling evidence? ;) Perhaps some code references, or a developer statement supporting either stance?
Murch
CC BY-SA 3.0
2014-03-01T23:23:38.417Z
The Nxt code is in Java and was written from scratch, taking ideas off Bitcoin and from some other places - so the 1st part is definitely right. As for the 2nd (it lacks mall. vuln.) I've seen nothing in the public info for this coin that sustains or denies it. Will try contacting its creators
Joe Pineda
CC BY-SA 3.0
2014-03-01T09:56:59.053Z
2014-03-01T09:56:59.053Z
user14036
<p><a href="http://www.theguardian.com/technology/2014/feb/27/how-does-a-bug-in-bitcoin-lead-to-mtgoxs-collapse" rel="nofollow">Malleability</a> of Bitcoin protocol has contributed to major <a href="http://www.usatoday.com/story/money/markets/2014/02/28/bitcoin-mt-gox-collapse-japan/5891841/" rel="nofollow">losses</a> and represents uncomfortable risk to Bitcoin investors in addition to possibility of 51% attack that depends on <a href="https://ghash.io/ghashio_press_release.pdf" rel="nofollow">promise of biggest mining pool</a>.</p>

<p>Of course, any centralized exchange company can run away with depositors money, but, at least, currency protocol should be strong enough to not allow exchange company owners to blame losses on protocol and hackers.</p>

<p>Do <a href="http://www.wired.com/wiredenterprise/2014/01/ethereum/" rel="nofollow">Ethereum</a> or <a href="http://www.nxtcrypto.org/" rel="nofollow">NXT</a> or <a href="https://counterparty.co/" rel="nofollow">counterparty</a> or <a href="https://ripple.com/currency/" rel="nofollow">ripple</a> or <a href="http://mintcoin.cc/" rel="nofollow">mint</a> or <a href="http://coinmarketcap.com/all.html" rel="nofollow">any in top 10</a> have same vulnerability ?</p>

CC BY-SA 3.0
2014-03-01T08:37:02.577Z
The claim that transaction malleability caused Mt Gox's losses is controversial, to say the least.
David Schwartz
CC BY-SA 3.0
2014-03-01T08:46:57.693Z
related: [What is transaction Malleability?](https://bitcoin.stackexchange.com/questions/21994/what-is-transaction-malleability)
Murch
CC BY-SA 3.0
2014-03-01T10:52:43.930Z
@DavidSchwartz Would it be appropriate to say it was the weapon to commit the crime, aided by risky decisions from management?
Joe Pineda
CC BY-SA 3.0
2014-03-01T19:37:29.323Z
@JoePineda Apparently, Mt. Gox had lost a bunch of their money already in 2011 and had been operating on fractional reserve all this time. As far as I know, it isn't clear yet, how the money got lost in the first place. I collected a few links here: [Collecting questions related to Mt.Gox' insolvency](http://meta.bitcoin.stackexchange.com/q/538/5406)
Murch
CC BY-SA 3.0
2014-03-03T09:54:04.383Z
@Gracchus a) I don't see how that has anything to do with Transaction Malleability and b) whatever his motivation he has a point there, see my comment above yours.
Murch
CC BY-SA 3.0
2014-03-03T09:58:57.497Z
@alpav: Transaction malleability is only a problem to entities relying on unconfirmed transactions. When properly addressed it can at most lead to delays up to DDoS, but not loss. The problem was that the Mt.Gox software didn't address transaction malleability, even though the problem was known since 2011. However, by now it is even doubtful that it ever led to significant losses as Mt.Gox had been struggling and operating on a fractional reserve since 2011.
Murch
<security><exchanges><transaction-malleability><fraud>
What other currencies have same malleability vulnerability as Bitcoin?
alpav
# What other currencies have same malleability vulnerability as Bitcoin?

(Asked by: username_0 on 2014-03-01)

[Malleability](http://www.theguardian.com/technology/2014/feb/27/how-does-a-bug-in-bitcoin-lead-to-mtgoxs-collapse) of Bitcoin protocol has contributed to major [losses](http://www.usatoday.com/story/money/markets/2014/02/28/bitcoin-mt-gox-collapse-japan/5891841/) and represents uncomfortable risk to Bitcoin investors in addition to possibility of 51% attack that depends on [promise of biggest mining pool](https://ghash.io/ghashio_press_release.pdf).

Of course, any centralized exchange company can run away with depositors money, but, at least, currency protocol should be strong enough to not allow exchange company owners to blame losses on protocol and hackers.

Do [Ethereum](http://www.wired.com/wiredenterprise/2014/01/ethereum/) or [NXT](http://www.nxtcrypto.org/) or [counterparty](https://counterparty.co/) or [ripple](https://ripple.com/currency/) or [mint](http://mintcoin.cc/) or [any in top 10](http://coinmarketcap.com/all.html) have same vulnerability ?

**Tags:** security, exchanges, transaction-malleability, fraud

> **Comments:**
> **username_1**: The claim that transaction malleability caused Mt Gox's losses is controversial, to say the least.  
> **username_2**: related: [What is transaction Malleability?](https://bitcoin.stackexchange.com/questions/21994/what-is-transaction-malleability)  
> **username_3**: @username_1 Would it be appropriate to say it was the weapon to commit the crime, aided by risky decisions from management?  
> **username_2**: @username_3 Apparently, Mt. Gox had lost a bunch of their money already in 2011 and had been operating on fractional reserve all this time. As far as I know, it isn't clear yet, how the money got lost in the first place. I collected a few links here: [Collecting questions related to Mt.Gox' insolvency](http://meta.bitcoin.stackexchange.com/q/538/5406)  
> **username_2**: @Gracchus a) I don't see how that has anything to do with Transaction Malleability and b) whatever his motivation he has a point there, see my comment above yours.  
> **username_2**: @username_0: Transaction malleability is only a problem to entities relying on unconfirmed transactions. When properly addressed it can at most lead to delays up to DDoS, but not loss. The problem was that the Mt.Gox software didn't address transaction malleability, even though the problem was known since 2011. However, by now it is even doubtful that it ever led to significant losses as Mt.Gox had been struggling and operating on a fractional reserve since 2011.  

---

## 2 answers

### Answer by username_4 on 2014-03-01. Score: 2

This is a quite hard analysis to make. In general all alt-coins that are based on the concept of dynamic input-scripts and output-scripts are subject to transaction malleability. This is because anybody could change the input scripts of a transaction, by adding commands that wouldn't alter the validity of the script, but would alter its hash. For example adding OP\_DROP will leave the stack exactly as before prior to scriptPubKey execution.

> **Comments:**
> **username_0**: Why would any system allow to execute script that does not match it's hash ? What currencies do or do not not execute such scripts ?  

---

### Answer by username_5 on 2014-03-01. Score: 1

NXT is based on different code, so it is repaired there, Nxt doesn't have malleability vulnerability

> **Comments:**
> **username_2**: This answer would benefit from a citation.  
> **username_2**: So, now we got two opposing statements. Could either of you support their argument with some compelling evidence? ;) Perhaps some code references, or a developer statement supporting either stance?  
> **username_3**: The Nxt code is in Java and was written from scratch, taking ideas off Bitcoin and from some other places - so the 1st part is definitely right. As for the 2nd (it lacks mall. vuln.) I've seen nothing in the public info for this coin that sustains or denies it. Will try contacting its creators  

---

