outcast3k/coinbin

Javascript Bitcoin Wallet. Supports Multisig, Stealth, HD, SegWit, Bech32, Time Locked Addresses, RBF and more!

coinbin

A Open Source Browser Based Bitcoin Wallet. Version 1.7 beta by OutCast3k

Live version available at http://coinb.in/ or coinbin3ravkwb24f7rmxx6w3snkjw45jhs5lxbh3yfeg3vpt6janwqd.onion

Github URL: https://github.com/OutCast3k/coinbin/

Coinb.in supports a number of key features such as:

• Offline Compressed & uncompressed Address creation.
• Offline Multisignature Address creation.
• "In browser" Key (re)generation.
• Send and receive payments.
• Ability to decode transactions, redeem scripts and more offline.
• Build custom transactions offline.
• Sign transactions offline.
• Signatures are deterministic as per RFC 6979 (https://tools.ietf.org/html/rfc6979#section-3.2)
• Broadcast transactions.
• nLockTime support.
• Add custom data to transactions with the use of OP_RETURN.
• Support current Dark Wallet Stealth Address structure (as of version Alpha 7) for outputs.
• Brain wallet support.
• Compatible with bitcoin-qt
• An offical .onion address for tor users.
• Offline qrcode creator and scanning tool.
• HD (bip32) support.
• Supports altcoins such as litecoin.
• Replace by fee (RBF) Support.
• Segwit Support.
• Bech32 address support.
• Fee calculator - https://coinb.in/#fees
• Transaction rebuild support for RBF and double spending.

Donate to 33tht1bKDgZVxb39MnZsWa8oxHXHvUYE4G to see more development!

coinbin's Issues

signing maybe isn't working well?

Hi,
Just trying to sign some pretty simple transaction, one input - one a output, when I signing it its looks ok,
I get the HEX transaction on the green bar, and its says that the transaction was signed , but when I put it on the "verify" page the "Signed" symbol is on X, and when trying to broadcast it it says :
64: scriptsig-not-pushonly
The keys are 100% valid, and actually the signing page works good for me couple of days ago, but now it seems to have issues maybe.
Thanks.

Cannot broadcast multisig redeem tx

Error Error 16: mandatory-script-verify-flag-failed (Non-canonical DER signature)

when broadcasting although transaction verifies ok.

More details :

• https://counterpartytalk.org/t/redeem-multisig-dust-cannot-broadcast-mandatory-script-verify-flag-failed/2568
• bitcoin/bitcoin#9455

site down

http://coinb.in is down.

`newTimeLocked` redeem script uses wrong endianess for locktime

I want a locktime of 1472817600 (0x57c969c0), so I enter date/time 09/02/2016 05:00 (I'm in PDST) but the redeems script it generates starts:

0457c969c0

I would expect the locktime to be reversed:

04c069c957

https://en.bitcoin.it/wiki/Script tells me:

The stacks hold byte vectors. When used as numbers, byte vectors are interpreted as little-endian variable-length integers

When I try to submit the signed transaction to Bitcoin Core it complains:

error code: -26
error message:
64: non-mandatory-script-verify-flag (Negative locktime)

presumably because the 0xc0... value is interpreted as a negative. The 0xc0 should be the least significant byte, but it's being used as the most significant.

See this reddit post for an example of someone having trouble due to this bug.

Support for deterministic k for signatures?

Hi, I was wondering if you are planning to support RFC 6979?

If you are currently working on something, maybe I could help.

If not maybe I will try to implement it myself.

Won't let me send coins

I try to send coins and it either says the payment was confirmed and it doesn't send them, has an error, or generates a green colored textid. Have never had such an issue, please help thanks.

Please support multisig addresses in Outputs

Hi,
multisig addresses (3[...]) seem to be unsupported.

Thank you!

Carlo

Bitcoin sent, never went through

Hi I tried to deposit money to a bitcoin address on a website. I sent the amount to the address given, but the address only works for 15 minutes. The transaction expired, but the site still says the bitcoins went through (hash: de168c302faa6d22d4ac77e24758309fdd5d16a31330eb38ba000c94be101fb0). I contacted the website and they seem to think my "wallet provider" is holding the coins as a result of the transaction expiring. I trust the site and have used it before, not sure what the problem is. Could you guys have the coins? Thanks

bip44 key derivation path & unspent value check for each address in given indices

bip44 key derivation path like
m/44'/0'/0'/0/1337
as seen at https://bitcore.io/playground/#/hdkeys

and unspent value checking for each address in given indices.

Outputs in created transactions gets removed

Hi i just tried to make a transaction with coinb.in .

As you can see the outputs of the transaction get removed.

Support for Testnet

The interface doesn't recognize testnet addresses.

It wont broadcast testnet transactions.

When i create a transaction with testnet addresses, the addresses change from the one i have put in to one that start with "1".

I can't sign a transaction

I get as output (signed transaction) the same string I put as input:

I downloaded Coinb.in today from GitHub.

Best regards,
Carlo

Invalid Character

After submitting totally fine/normal stuff the codes throwing some invalid character error:

Development questions

Hello!

I'd like to help develop this wallet further (I've got some good ideas on what we could implement) to please add me on Skype - nightmare.artz or email me on [email protected]

Thanks!

Insert checks for infinity point / weakened (modded) keys?

While I was looking at entropy, I saw no checks for if the private key is <= 1 or >= secp256k1 curve order.

I know it's a 0.00000000000000...% chance...

It looks like if the private key is
0000000000000000000000000000000000000000000000000000000000000000
or
fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141
it throws an error for being the infinity point, and the new address boxes disappear.

Also, fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364142 and 0000000000000000000000000000000000000000000000000000000000000001 will give the generator point as the public key... (because it seems to mod the result)

I also just checked bitaddress.org and it seems to do the same...

I was wondering how brain wallets would handle it... and I couldn't find a single site that was checking.

I think adding a check for <= 1 or >= fffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141 should throw away the result and maybe re-hash it... or something...

I'm not sure how you'd want to do this... or even if you want to consider this 0.00000000000000000000000000000000000037% chance.

Remove dangerous "Custom Seed / Brain Wallet" feature

This feature results in coins being stolen.

Muliple inputs are available ? (CoinJoin like..)

There is an option to enter couple of inputs ,to create coinjoin transaction?
Tnx

QR code for donation.

A QR code for your donation address on - https://coinb.in/#about - would be good.

can not broadcast by using mobile or computer

Hi,
Usually, when I used my mobile phone to broadcast the BTC transaction via coinb.in ,
But suddenly, I can not broadcast BTC transactions anymore.
When I click submit, not TXID generated.

Please help me to solve my problems.

thank you.

Retreive Unspent outputs from Bitcoin Core REST API

Would be cool if one can get the UTXO from the Bitcoin Core REST API instead of using a 3rd party service:
https://github.com/bitcoin/bitcoin/blob/master/doc/REST-interface.md#query-utxo-set

Ones sendrawtransaction is implemented in the Bitcoin Core REST API you could run coinb.in with your own full node (or anyones full node that provides the REST API to the public).

Translation support

This website should allow multiple languages.

Signing multiple inputs

I know I can enter multiple inputs but when I get to the signature page I cannot for the life of me figure out how to add all the private keys and if they need to be in same order as the addresses. There is only one field "private key" and no clue how to enter in all the private keys. I can sign the multi input with any of the keys and get a valid transaction in green but what does that mean with say only one input key but four input addresses. Looks like a multi signature and I am signing one key only. I can sign the transaction. Then copy the signed one back to the top and sign another and continue until all signed. But there must be a way to put multiple signatures in the private key.

Confusion with transaction fee calculation

I used the Transaction tool with a redeem script to generate a transaction. The wallet in question had about 5mBTC in it. I entered a small amount to send, without paying close attention to the transaction fee, which I wrongly assumed was being calculated as a percentage of the amount being sent.

The transaction fee seems to be the difference of the entered amount and the total amount in the wallet. This ended up being about 1mBTC sent to the destination address, but with a 4mBTC transaction fee, meaning most of the contents of the wallet ended up being the fee for the transaction. I'm really glad I was toying with trivial amounts of BTC in this case, because something like 1BTC/4BTC would have been devastating.

I'm trying to understand this better. How much should a transaction fee be relative to the amount being sent, and what's preventing a more nuanced calculation taking place? I'm coming from Electrum where I happily and stupidly accept the fee presented and don't have to think about it too hard. (I used coinbin because I couldn't figure out how to sign/send transactions from multisig wallets created outside of Electrum.)

I get that it's ultimately on me to make sure everything is set correctly, but the default in this case seem a bit "dangerous". The assumption that any amount not being sent is intended to be the transaction fee is a huge assumption to me; I'm spending a partial amount because I want to save the rest. If nothing else, a fee that eclipses the amount should give me a red flag, as should fees above a certain percentage of the amount. But ideally we could calculate an optimal fee for the given amount.

support CHECKLOCKTIMEVERIFY

Would you consider making a the ability to create some P2SH redeem scripts using CHECKLOCKTIMEVERIFY (NOP2)

I was thinking two variants:

1 Take the standard multisig generator and turn into an IF clause that requires multisig conditions until the locktime expires, then a single address can sign. Something like

    IF
        <now + 3 months> CHECKLOCKTIMEVERIFY DROP
        <Lenny's pubkey> CHECKSIGVERIFY
        1
    ELSE
        2
    ENDIF
    <Alice's pubkey> <Bob's pubkey> 2 CHECKMULTISIG

2 Simple HODL,

`<expiry time> CHECKLOCKTIMEVERIFY DROP DUP HASH160 <pubKeyHash> EQUALVERIFY CHECKSIG`

3 Trustless payment HODL

    IF
        HASH160 <Hash160(encryption key)> EQUALVERIFY
        <publisher pubkey> CHECKSIG
    ELSE
        <expiry time> CHECKLOCKTIMEVERIFY DROP
        <buyer pubkey> CHECKSIG
    ENDIF

Possible bug?

If a script object is passed to coinjs.script() it causes this line to be executed:

else if (data instanceof coinjs.script) {
r.buffer = r.buffer;
}

Shouldn't it be "r.buffer = data.buffer;"? Or what's the intent here?

Making a transaction: N, Script, Change Addresses?

Hello,

How does change get handled when making a transaction using the New Transaction interface?

Also, any suggestion for what values to put for N and Script:

Thanks!

Add support for arbitrary P2SH scripts.

Was thinking of doing a pull request... then kept running into questions:

1. Do we verify the contents?
2. Do we make it an advanced option?
3. How do we allow them to create the scriptSig? (maybe add some marker to designate where any signatures should go if / when passed through the "sign" page.

... I also just played with having a secret option that removes the P2SH check and people could input their scriptSigs in hex directly into the raw transaction... (maybe that's just me haha)

Would like to know your thoughts on such a feature.

Maybe just doing a checkbox in advanced options that removes checks for the P2SH box and warn people that they're responsible for inserting their own scriptSig into the raw transaction or something.

Bitcoin not appearing in wallet!!

After having my bitcoins refunded to me in a canceled transaction via the Hansa Marketplace, My bitcoins never appeared in my wallet, even though they were refunded almost 20 hours ago. BlockCypher shows that they were successfully sent back to my wallet and there are 128 confirmations, but the bitcoins have yet to appear in my account. Please help!!!!!

Work with multichain

So I'm running my own private instance of multichain running the bitcoin protocol. Any easy way to fork this and connect it to the multichain API instead of bitcoin proper?

Transaction -> button Clear

Add button "Clear" to https://coinb.in/#newTransaction
This button clears all inputs and outputs and top input "Address, WIF key or Multisig Redeem Script".

sha1sum file doesn't have sum for css/bootstrap-datetimepicker.min.css

FYI. I just checked the sums on my download.

Make it possible to build A+(B or C) multisig scripts

I have a use case for a script that requires A's signature and either B or C's. I've created a $50 bounty, payable in BTC, for this at Bountify.co.

My use case is to allow mediators to be paid via a second address for a transaction so that the mediator is A and the buyer and seller are B and C. Even if this doesn't end up being used for this purpose there is obviously great utility in being able to build more complex redeem scripts.

Cannot see coins in wallet

I can see them on the blockchain but they do not show up in the wallet, they did at one time, now they're gone.

"Unexpected error, we couldn not process that transaction"

(For starters there is a typo, but that is not important.)
I get this very vague error no matter what, with my own hosted version on my private server AND with the official version. My bitcoins are currently stuck in an unusable wallet, I would appreciate any help because right now it feels like I have thrown away $200.
http://i.imgur.com/HT8VwKh.png

CheckLockTimeVerify totally doesn't work

It consistently says that "The Public key and/or date is invalid" while highlighting the public key box.

Public key: 1H8Cer35EMwkQabXAGpb23uBQNJVGWAoXs
Date: 07/17/2016 15:50

QRcode of signed transaction returns the unsigned one

• create a transaction
• verify the transaction
• sign the transaction with private key
• click the qrcode button
• scan the code with an independent codescanner

the output of the codescanner is identical to the unsigned transaction, instead of the signed one

Compressed vs. uncompressed

Would it be possible to have access to private key uncompressed in wallet?

Coin Control

I was able to load a multisig redeem script and drop the second input and create a transacrtion - but when i tried dropping the first input and spending the second i was unable to create the TX and got an error telling me one of the inputs was invalid - and it was showing the first blank input row in red and the second populated input row was in black and was fine ... so something is not quite right with the code

Create transaction doesn't work (from local source)

Unable to load address inputs if wallet opened from local copy. It shows the message "Retrieved unspent inputs from address ..." but inputs list is empty.

Transactions can be signed with invalid private keys

It is currently possible to sign raw multisig-transactions (from a "3..." address to any other) with the private key of the output(!) address. I have not checked if this applies to any transaction but it does apply to outgoing multisignature tx)

Obfuscated JavaScript prevents review

I've been reviewing Coinb.in, and like the approach and functionality.

In browsing the source code, I noticed several obfuscated JavaScript source files. For example, AES.js (there are others):

https://github.com/OutCast3k/coinbin/blob/master/js/aes.js

Obfuscation makes reviewing the code difficult. Are there any plans to replace these files with unobfuscated versions?

Question - BitPay's Insight-API?

I am porting coinb.in to PiggyCoin and it looks like the API coinb.in adheres to to retrieve transaction details and submit them to the network is BitPay's Insight-API. I just want to confirm that is in fact the case.

Creating a transaction when running locally not possible

Tried testing this to make some transactions using a multisig address. I was running it locally as opposed to using the hosted versions in order to feel secure. I noticed that some parts of this project make API requests in order to fetch data such as unspent inputs from a redeem script. Whilst I understand the need for doing this, when running the project locally every API request fails due to the same origin policy blocking the http request. Could a solution to this be found? Either by removing the need for API calls or finding a way to query the API without needing to breach the same origin policy, possibly?

Trim Public Keys when creating a multi-sig

I created a multi-sig adress i am unable to sign off on - as one of the keys i used had an extra space char on the end of it - which went un noticed until it was time to sign a transaction when i then found it could not be signed.

My mistake for not checking the key I know - but it would have been nice if coinb.in had warned me that a key was invalid or simply trimmed the white space at the end

Thanks

Coins Stuck in Coinb.in

Hello -- Having a bit of a problem, coins are not showing up in my wallet. They show in Blockr as being a positive balance, that is correct.

Any possible assistance?

Murph

Does the HD wallet generator work correctly?

Hello, it's very possible I am doing something wrong, but it seems the xpub's for the HD wallets aren't matching up with generated addresses. I did the following:

1. Click "New" from the top menu
2. Choose HD Address
3. Click "generate"
4. Click the arrow next to "xPub Address" to see derived addresses
5. Under the "Keys" heading select one off the "address"
6. Send tx to that address
7. Verify tx exists on blockchain.info (it does)

Now if I try to monitor the xpub for any transactions using Sentinel (app), or Bitcoin Balance (app) or Blockchain.info the transaction isn't shown.

Here is an example xpub and transaction:

XPUB

xpub661MyMwAqRbcEbtdUQeDpPvpTE9sNVXb5FEnJU1GTP3Rya9y1kSvh7GJwuub49ZfZYfgMKtbErkfGe58pjGHdHPoqqZydqJjqgcbju5Nq8D

TRANSACTION

1T5N1jnUnALY25TBqXCNgAsszWHJQucpj

Add Transaction Fee Check And Alert If Higher Than Normal / Lower Than Suggested

Currently coinbin will just put total of all the inputs as the transaction fee and recalculate when user change output field dynamically.

This is pretty good but might cause some trouble, when user make some typo mistake and forget to change the fee, the large fee will just be gone :(

One suggestion is that when the fee is higher / lower than suggested, pop up a confirm dialog and let user check that before making a transaction.

Verifier shows wrong number of signatures for P2SH multisig

Hey there,

when verifying a 4-of-5 P2SH multisig transaction, which has only 3 signatures, then the UI neverthess indicates there are 4 signatures (instead of 3):

Link to transaction

coins disappeared out of my wallet and an unconfirmed transaction in blockchain

My coins have disappeared out my wallet and I have unconfirmed transaction in blockchain from yesterday. PLEASE HELP!!

Support message signing

Right now the "Sign" tab only allows you to sign transactions. It would be great if it also allowed users to sign messages with their private keys. Many wallets don't offer this feature, so users are stuck exporting keys and using a tool like coinbin.