Antminer X9
Monero ASIC Miner
1000KH
HASHRATE
2.47W/KH
EFFICIENCY
2470W
POWER
£861.31
EST. MONTHLY
205
DAYS
EST. ROI
This guide explains BIP 146 signature malleability in plain English. It covers the problem behind the BIP, why it matters and whether the proposal is part of Bitcoin today.
TL;DR
- What it is: BIP 146 proposed two consensus rules, LOW_S and NULLFAIL, to address remaining ECDSA signature-encoding malleability. It targeted witness transaction identifiers and compact-block efficiency after strict DER encoding.
- Why it matters: BIP 146 documented two precise malleability controls but is a closed proposal. Its concepts remain important for testing, while current enforcement must be established from deployed consensus rules and exact spend context.
- Current position: The BIP is Closed; related rules were handled through other deployed consensus changes, so operators must not cite BIP 146 itself as an active deployment.
BIP 146 signature malleability in simple English
BIP 146 signature malleability: BIP 146 did not activate as its own proposal. Later SegWit and Taproot rules incorporate related canonicality and signature-failure behaviour in specific contexts.
Simple example
A node operator is checking BIP 146 signature malleability. Current validation must be traced to deployed BIPs and source, not inferred from the title or a historical implementation branch.
Key terms in plain English
- BIP:
- Bitcoin Improvement Proposal: a document describing a proposed rule, standard or process. Its status must be checked separately.
- Consensus:
- The shared rules full nodes use to decide whether blocks and transactions are valid.
- Mempool:
- A node’s changing local collection of valid, unconfirmed transactions.
- Taproot:
- A Bitcoin upgrade that added new signature and script options for spending outputs.
- Node:
- A computer running Bitcoin software that checks data and communicates with other peers.
Inherent ECDSA malleability
For a valid ECDSA signature pair, replacing S with the curve-order complement can produce another valid signature. LOW_S restricts accepted S values to the lower half of the order, selecting one canonical side. Key ownership is not required to perform the high-to-low transformation.
Failing-signature malleability
CHECKSIG and CHECKMULTISIG historically pushed false for many invalid signatures, allowing arbitrary failing encodings in branches that expected failure. NULLFAIL requires a signature that fails verification to be an empty byte array, excepting the historical multisig dummy handling as specified.
txid and wtxid effects
SegWit removes witness data from txid, protecting unconfirmed descendants from third-party witness changes, but altered witness data changes wtxid. That can affect compact-block short identifiers and relay efficiency. The operational consequence is distinct from spending validity and transaction replacement.
Consensus versus policy
Low-S had appeared as standard relay policy before proposed consensus enforcement. Policy reduces what ordinary nodes relay; consensus defines valid blocks. Tests must submit through both mempool and explicit block construction to show the boundary and avoid assuming policy proves activation.
Script edge cases
NULLFAIL interacts with conditional scripts, multisignature stacks and empty vectors. A test suite needs valid low-S, valid high-S, invalid non-empty, invalid empty and multisig combinations, including branches where a failed check is intentional. Exact sighash and witness context must be fixed.
Closed status and deployment context
BIP 146 did not activate as its own proposal. Later SegWit and Taproot rules incorporate related canonicality and signature-failure behaviour in specific contexts. Current validation must be traced to deployed BIPs and source, not inferred from the title or a historical implementation branch.
Wallet and signer operations
Modern signers should produce canonical signatures appropriate to the spend type, but recovery and hardware validation must inspect actual bytes and script path. Never rewrite a signed transaction blindly; changing witness can affect wtxid, fee-bump tracking and counterpart protocols even when txid remains stable. Build a version-pinned evidence pack on an isolated node or protocol harness.
Frequently asked questions
What is the main point of BIP 146 signature malleability?
BIP 146 signature malleability: BIP 146 did not activate as its own proposal. Later SegWit and Taproot rules incorporate related canonicality and signature-failure behaviour in specific contexts.
For BIP 146 signature malleability, what should a beginner know about inherent ECDSA malleability?
For a valid ECDSA signature pair, replacing S with the curve-order complement can produce another valid signature.
For BIP 146 signature malleability, what should a beginner know about failing-signature malleability?
CHECKSIG and CHECKMULTISIG historically pushed false for many invalid signatures, allowing arbitrary failing encodings in branches that expected failure.
For BIP 146 signature malleability, what should a beginner know about txid and wtxid effects?
SegWit removes witness data from txid, protecting unconfirmed descendants from third-party witness changes, but altered witness data changes wtxid.
Conclusion
BIP 146 documented two precise malleability controls but is a closed proposal. Its concepts remain important for testing, while current enforcement must be established from deployed consensus rules and exact spend context.
Primary sources
Check the current specification status and the documentation for the exact implementation you operate before moving production funds or changing a mining node.
Join the ASIC Mining Discussion
Members can read and join the discussion
Log in to read comments from other miners. Create a free account if you would like to ask a question or share your experience.
Membership helps us protect the discussion from spam and keep answers useful.