<p>The UTXO's scriptPubKey commits to the script(s) that are permitted for spending, so you can't just pick an OP_SUCCESSx script and spend with that - the coins have to be sent to an address that permits that (and no rational receiver would ever create such an address).</p>
<p>This is no different really from the fact that when spending an old style P2PKH address, you can't just substitute your own public key when spending. You must use the public key which has was committed to by the address.</p>

CC BY-SA 4.0
2021-08-18T21:02:07.783Z
2021-08-18T21:08:05.483Z
2021-08-18T21:08:05.483Z
Pieter Wuille
<p>If a script is automatically valid when an <code>OP_SUCCESS</code> opcode is called, what mechanism prevents a malicious actor from taking a random UTXO and creating a fake scriptsig with an <code>OP_SUCCESS</code> included?</p>

<script><input-script><opcodes>
What prevents OP_SUCCESS from being used nefariously?
Bertram Lund
# What prevents OP_SUCCESS from being used nefariously?

(Asked by: username_0 on 2021-08-18)

If a script is automatically valid when an `OP_SUCCESS` opcode is called, what mechanism prevents a malicious actor from taking a random UTXO and creating a fake scriptsig with an `OP_SUCCESS` included?

**Tags:** script, input-script, opcodes


---

## 1 answers

### Answer by username_1 on 2021-08-18. Score: 7 | Accepted answer

The UTXO's scriptPubKey commits to the script(s) that are permitted for spending, so you can't just pick an OP\_SUCCESSx script and spend with that - the coins have to be sent to an address that permits that (and no rational receiver would ever create such an address).

This is no different really from the fact that when spending an old style P2PKH address, you can't just substitute your own public key when spending. You must use the public key which has was committed to by the address.


---

