VTA Benchmark
HomeVTA vs BTCDashboardTX ExplorerConsensusSIGHASH
Deep Technical Audit

Wallet Script + Signature Verification

This audit traces the boundary between wallet-created transactions, script construction, public keys/signatures and node-side verification. The goal is to distinguish what the wallet prepares from what consensus validation actually checks.

Wallet → Transaction

ARCHITECTURE

A wallet prepares transaction inputs, outputs and signing material; the network validates the resulting transaction independently.

Script Verification

SOURCE PATH

The reviewed VTA validation path reaches script/signature checks through CheckInputs().

Wallet-Specific Tests

EVIDENCE GAP

A complete release-pinned wallet signing test corpus still needs to be executed.

Wallet → Network Verification Flow

Walletkeys + UTXOs Build Transactionvin / vout / scripts Signdigest + ECDSA Node ValidationCheckInputs Script EngineCHECKSIG / flags Consensus boundary Wallet software can create a transaction, but node-side validation decides whether its inputs satisfy the required scripts. The reviewed path includes input existence/spent checks, script verification and signature checks. Verified source path CheckInputs → script checks P2SH + STRICTENC flags reviewed. Remaining evidence Wallet signing and script test vectors need exact release/commit pinning.

Audit Matrix

AreaFindingStatus
Transaction signing boundaryThe wallet prepares/signs transactions, while node validation independently verifies transaction inputs and scripts.Architecture
CheckInputs()The reviewed VTA CheckInputs() path checks input validity, scripts/signatures and amounts.Source verified
STRICTENCThe reviewed mempool/input path calls CheckInputs() with SCRIPT_VERIFY_P2SH | SCRIPT_VERIFY_STRICTENC.Source verified
CHECKSIGThe VTA script engine contains a CHECKSIG verification path.Source verified
CHECKMULTISIGThe VTA script engine contains a CHECKMULTISIG verification path.Source verified
Signature hashSignature verification is connected to the legacy transaction signature-hash mechanism.Architecture verified
Wallet key storageThis page does not inspect or expose wallet.dat, private keys, seed phrases or user balances.Security boundary
Wallet signing test vectorsNo independent release-pinned wallet signing corpus was executed in this package.Not measured
Modern witness verificationSegWit/Taproot behavior is not assumed without VTA-specific source evidence.Not established

Recommended Test Corpus

A. P2PKH valid signature
B. P2PKH wrong signature
C. Wrong public key
D. Changed input amount / prevout
E. Changed output under SIGHASH_ALL
F. SIGHASH_NONE output variation
G. SIGHASH_SINGLE paired-output test
H. ANYONECANPAY input variation
I. CHECKMULTISIG valid / invalid cases
J. P2SH valid / invalid redeem script
K. Non-canonical signature encoding
L. Non-canonical public-key encoding
Security note: This audit is source/documentation focused. It does not request or expose wallet credentials, private keys, seed phrases, wallet.dat contents or balances.
VTA-specific conclusions are limited to reviewed source paths and previously verified audit evidence. Exact wallet behavior should be tested against a pinned VTA Core release and reproducible vectors.