P2PKH scripts paying P2SH redeemScripts are shown in balance.

[STRML]

For example, there are many spam transactions on the blockchain that use a redeemScript in the P2PKH fashion:

OP_DUP OP_HASH160 <redeemScript> OP_EQUALVERIFY OP_CHECKSIG

This will not be redeemable by a P2SH address, because its script must be:

OP_HASH160 <redeemScript> OP_EQUAL

This is a critical bug IMO as balances on addresses are being reported incorrectly. Any services relying on an Insight service may incorrectly credit an address with a balance it is not actually able to spend.

We should be checking the version type of the address when crediting an output to ensure it is actually spendable.

[STRML]

Moved to bitpay/bitcore-lib#33

[STRML]

Found what seems to be the bug: the DB is indexing redeemScripts and PKHashes identically, so if they collide you will erroneously see a tx you can't spend.

This was part of an optimization effort that assumed that the rest of the script was not necessary (only the PKHash). This is not a safe assumption. Since we are matching script types via templating in bitcore-lib /~https://github.com/bitpay/bitcore-lib/blob/master/lib/script/script.js#L307, it is not necessary to hold onto the entire script, but we must hold onto the type.

/~https://github.com/bitpay/bitcore-node/blob/master/lib/services/address/index.js#L358

[STRML]

Pushing a fix shortly.

For an example of this bug, note the transaction credited to:

https://test-insight.bitpay.com/address/2MyJ6e284p15EJkFF6LsKSsfiU3jpNPYk5S

which is correct, but how it is also incorrectly credited to

https://test-insight.bitpay.com/address/mmZpwnnaTfgknuPt1gZEEDXqyAqdsxciTo

which is the corresponding P2PKH address.