<p>You could use <code>$ getblock &lt;blockhash&gt; 2</code> or <code>$ getrawtransaction &lt;tx-hash&gt; 2</code>.</p>

<p>Here is a transaction that exploited this bug on testnet: <a href="https://testnet.blockchain.info/tx/fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59" rel="nofollow noreferrer">fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59</a></p>

<pre><code>$ bitcoin-cli -testnet getrawtransaction fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59
    {
      "txid": "fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59",
      "hash": "fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59",
      "version": 1,
      "size": 403,
      "vsize": 403,
      "weight": 1612,
      "locktime": 0,
      "vin": [
        {
          "txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
          "vout": 1,
          "scriptSig": {
            "asm": "3045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e3[ALL] 0455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8",
            "hex": "483045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8"
          },
          "sequence": 4294967295
        },
        {
          "txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
          "vout": 1,
          "scriptSig": {
            "asm": "304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da3773[ALL] 0455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8",
            "hex": "47304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da377301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8"
          },
          "sequence": 4294967295
        }
      ],
      "vout": [
        {
          "value": 0.09900000,
          "n": 0,
          "scriptPubKey": {
            "asm": "OP_DUP OP_HASH160 c8b876680fef08df5278a9df92df7e30b83cbb71 OP_EQUALVERIFY OP_CHECKSIG",
            "hex": "76a914c8b876680fef08df5278a9df92df7e30b83cbb7188ac",
            "reqSigs": 1,
            "type": "pubkeyhash",
            "addresses": [
              "mypGR6pDS85nidXk3DoHZCNBuYd6WBhzgU"
            ]
          }
        }
      ],
      "hex": "0100000002d9bf9d812cfc91e3ff3b7f68e85269f64e7825de0fa61ff9dde117c73b72086a010000008b483045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8ffffffffd9bf9d812cfc91e3ff3b7f68e85269f64e7825de0fa61ff9dde117c73b72086a010000008a47304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da377301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8ffffffff01e00f9700000000001976a914c8b876680fef08df5278a9df92df7e30b83cbb7188ac00000000",
      "blockhash": "00000000eba3f43a8624750f39e4520a1678c0dbdf8707bfa4854a12fbf086c5",
      "confirmations": 0,
      "time": 1537995498,
      "blocktime": 1537995498
    }
</code></pre>

<blockquote>
  <p>Is it distinguishable from a normal, non double-spend?</p>
</blockquote>

<p>You will notice the input is listed twice in the 'vin':</p>

<pre><code>"txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
"vout": 1,
</code></pre>

<p>That is considered a double spend.</p>

<blockquote>
  <p>Does the wallet being queried have to know about both the addresses
  spent to, in order to show anything out of the ordinary?</p>
</blockquote>

<p>The wallet would have to be watching the associated addresses or it probably wouldn't have that transaction stored. Even if it's a full node, you can only get the tx by txid if you have indexed the blockchain using <code>-txindex</code> flag.</p>

CC BY-SA 4.0
2018-10-23T19:54:16.390Z
You see in that json where you have `vin.vout` twice, and theyre both 1. Is it always this way? While idly browsing the block explorer rich list for a coin I've got some old hodlings, I noticed this: https://chainz.cryptoid.info/funk/tx.dws?1211915.htm - is that also this same exploit? The txid is repeated over and over, but the vout is different, unlike your example
Caius Jard
CC BY-SA 4.0
2018-10-28T00:53:38.830Z
If only the vout is different, then it is a different output from the same transaction
JBaczuk
CC BY-SA 4.0
2018-10-28T07:51:48.267Z
So I need to chase the transaction outputs back to find ones with the same vout?
Caius Jard
CC BY-SA 4.0
2018-10-28T16:00:53.967Z
If you're looking for a double spend, yes. A transaction output is identified uniquely by it's txid and vout together. This is because transactions can have multiple outputs.
JBaczuk
CC BY-SA 4.0
2018-10-28T18:25:35.313Z
Ok, so in that tx I linked (https://chainz.cryptoid.info/funk/tx.dws?1211915.htm) all those vout are different so they’re legitimately different inputs to that transaction.. BUT if I go back another step and view the transaction they were outputs in (https://chainz.cryptoid.info/funk/tx.dws?1211349.htm) this one has tens of identical txid/vout so THAT is the transaction that exploited the bug?
Caius Jard
CC BY-SA 4.0
2018-10-28T19:35:51.997Z
Yes, it appears so
JBaczuk
CC BY-SA 4.0
2018-10-17T18:02:49.207Z
2018-10-18T00:26:15.970Z
2018-10-18T00:26:15.970Z
JBaczuk
<p>Just wondering what the output from gettransaction (or should I be using getblock?) would look like if I passed it a txid(or blockhash) that contained a set of transactions that exploited the double spend bug CVE-2018-17144? Is it distinguishable from a normal, non double-spend? Does the wallet being queried have to know about both the addresses spent to, in order to show anything out of the ordinary?</p>

<bitcoin-core><doublespend>
What does a double spend (CVE-2018-17144) look like if I gettransaction it?
Caius Jard
# What does a double spend (CVE-2018-17144) look like if I gettransaction it?

(Asked by: username_0 on 2018-10-17)

Just wondering what the output from gettransaction (or should I be using getblock?) would look like if I passed it a txid(or blockhash) that contained a set of transactions that exploited the double spend bug CVE-2018-17144? Is it distinguishable from a normal, non double-spend? Does the wallet being queried have to know about both the addresses spent to, in order to show anything out of the ordinary?

**Tags:** bitcoin-core, doublespend


---

## 1 answers

### Answer by username_1 on 2018-10-17. Score: 2

You could use `$ getblock <blockhash> 2` or `$ getrawtransaction <tx-hash> 2`.

Here is a transaction that exploited this bug on testnet: [fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59](https://testnet.blockchain.info/tx/fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59)

```
$ bitcoin-cli -testnet getrawtransaction fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59
    {
      "txid": "fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59",
      "hash": "fb7a8658ec015133e36e2cf7ddf7e8c887c3a5becec2f30f24ebfe43e72f4b59",
      "version": 1,
      "size": 403,
      "vsize": 403,
      "weight": 1612,
      "locktime": 0,
      "vin": [
        {
          "txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
          "vout": 1,
          "scriptSig": {
            "asm": "3045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e3[ALL] 0455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8",
            "hex": "483045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8"
          },
          "sequence": 4294967295
        },
        {
          "txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
          "vout": 1,
          "scriptSig": {
            "asm": "304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da3773[ALL] 0455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8",
            "hex": "47304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da377301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8"
          },
          "sequence": 4294967295
        }
      ],
      "vout": [
        {
          "value": 0.09900000,
          "n": 0,
          "scriptPubKey": {
            "asm": "OP_DUP OP_HASH160 c8b876680fef08df5278a9df92df7e30b83cbb71 OP_EQUALVERIFY OP_CHECKSIG",
            "hex": "76a914c8b876680fef08df5278a9df92df7e30b83cbb7188ac",
            "reqSigs": 1,
            "type": "pubkeyhash",
            "addresses": [
              "mypGR6pDS85nidXk3DoHZCNBuYd6WBhzgU"
            ]
          }
        }
      ],
      "hex": "0100000002d9bf9d812cfc91e3ff3b7f68e85269f64e7825de0fa61ff9dde117c73b72086a010000008b483045022100e412610b2e2b8370f2eda0cf29fe19c2a4ea35191d8b42656e81bc97026b229e022046ff1df7293f8dbc3efd95b125ebf679a4a68e8de2265990ef7553f1060dc9e301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8ffffffffd9bf9d812cfc91e3ff3b7f68e85269f64e7825de0fa61ff9dde117c73b72086a010000008a47304402206fa6ef6c0727ecf8d40b2b4648a93b084396c9819d20a3300e83ac4d110589e8022060c78d44db1d5b5babd1629c55d8058643d11a14da933b4bc5f7a8a2a7da377301410455fd1c1a6cbfb25b5bba1cf6f850de00d79852be3de51e50c0da683613303c533d079e147dfe07ce4d40df2b776b35184698d14fa107a61e0976b0d9416880c8ffffffff01e00f9700000000001976a914c8b876680fef08df5278a9df92df7e30b83cbb7188ac00000000",
      "blockhash": "00000000eba3f43a8624750f39e4520a1678c0dbdf8707bfa4854a12fbf086c5",
      "confirmations": 0,
      "time": 1537995498,
      "blocktime": 1537995498
    }

```

> Is it distinguishable from a normal, non double-spend?

You will notice the input is listed twice in the 'vin':

```
"txid": "6a08723bc717e1ddf91fa60fde25784ef66952e8687f3bffe391fc2c819dbfd9",
"vout": 1,

```

That is considered a double spend.

> Does the wallet being queried have to know about both the addresses
> spent to, in order to show anything out of the ordinary?

The wallet would have to be watching the associated addresses or it probably wouldn't have that transaction stored. Even if it's a full node, you can only get the tx by txid if you have indexed the blockchain using `-txindex` flag.

> **Comments:**
> **username_0**: You see in that json where you have `vin.vout` twice, and theyre both 1. Is it always this way? While idly browsing the block explorer rich list for a coin I've got some old hodlings, I noticed this: https://chainz.cryptoid.info/funk/tx.dws?1211915.htm - is that also this same exploit? The txid is repeated over and over, but the vout is different, unlike your example  
> **username_1**: If only the vout is different, then it is a different output from the same transaction  
> **username_0**: So I need to chase the transaction outputs back to find ones with the same vout?  
> **username_1**: If you're looking for a double spend, yes. A transaction output is identified uniquely by it's txid and vout together. This is because transactions can have multiple outputs.  
> **username_0**: Ok, so in that tx I linked (https://chainz.cryptoid.info/funk/tx.dws?1211915.htm) all those vout are different so they’re legitimately different inputs to that transaction.. BUT if I go back another step and view the transaction they were outputs in (https://chainz.cryptoid.info/funk/tx.dws?1211349.htm) this one has tens of identical txid/vout so THAT is the transaction that exploited the bug?  
> **username_1**: Yes, it appears so  

---

