[validation] Merkle root malleation should be caught by IsBlockMutated

1 files changed, 12 insertions, 1 deletions

diff --git a/src/validation.cpp b/src/validation.cpp
index e1133138df..120663bfc0 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -3833,7 +3833,18 @@ bool IsBlockMutated(const CBlock& block, bool check_witness_root)
     }
 
     if (block.vtx.empty() || !block.vtx[0]->IsCoinBase()) {
-        return false;
+        // Consider the block mutated if any transaction is 64 bytes in size (see 3.1
+        // in "Weaknesses in Bitcoin’s Merkle Root Construction":
+        // https://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20190225/a27d8837/attachment-0001.pdf).
+        //
+        // Note: This is not a consensus change as this only applies to blocks that
+        // don't have a coinbase transaction and would therefore already be invalid.
+        return std::any_of(block.vtx.begin(), block.vtx.end(),
+                           [](auto& tx) { return GetSerializeSize(TX_NO_WITNESS(tx)) == 64; });
+    } else {
+        // Theoretically it is still possible for a block with a 64 byte
+        // coinbase transaction to be mutated but we neglect that possibility
+        // here as it requires at least 224 bits of work.
     }
 
     if (!CheckWitnessMalleation(block, check_witness_root, state)) {