Developer Inserts 'Bug' in Bitcoin Ordinals—How Bad Is It?

There’s fresh controversy brewing in the Bitcoin Ordinals community after a developer under the moniker “Supertestnet” initiated a transaction that had no input or output, but is nevertheless seen as valid.

This resulted in the Ordinals’s inscription numbering system crashing, sparking concerns that the whole protocol may now be broken.

Ordinal inscriptions, also known as "proof of ownership" inscriptions, are essentially a way of attaching metadata to a specific Bitcoin transaction.

This metadata can include information about the digital asset being transferred, such as its title, description, and ownership details. So far, it's also been used for a wide array of on-chain media inscriptions including artwork, profile pictures, playable games, and video-based web apps.

Unlike Ethereum-based NFTs, which require the use of a separate token and smart contract to record ownership and transfer of digital assets, Ordinal inscriptions are recorded directly on the Bitcoin blockchain without the need for a sidechain or separate token.

The transaction in question, which did not include any satoshis (smallest unit of BTC), was found in block 788200.

“[The Ordinals protocol] validated the inscription (3492721) attached to the input, which sounds like a bug,” Ludo Galabru, staff engineer at Hiro Systems commented on the issue on GitHub. “Philosophically, the satoshi inscribed was transferred to the miner as a transaction fee, but was nevertheless inscribed by its previous owner.”

The Ordinals creator Casey Rodarmor agreed that “it shouldn't be possible to inscribe sats that you don't own,” suggesting the transaction is indeed a bug.

“However, fixing the bug by making [the Ordinals protocol] ignore this inscription would change inscription numbers after the curious transaction. I'm honestly not sure what to do!” added Rodarmor soon after the issue was found.

But is there an actual danger for the Ordinals protocol?

Bitcoin Ordinals under scrutiny

According to Danny Diekroeger, founder of Bitcoin Lightning platform Deezy, the bug doesn’t pose any risk to the Ordinals protocol itself.

“Personally, I think this is totally fine. In fact, I think inscription numbers were broken already early on anyway,” Diekroeger tweeted on Friday.

Supertestnet agreed that there’s no immediate danger to the protocol itself, although he is “not sure not sure what long-term consequences will be.”

“The short-term consequence was that the guys who were running indexing software had to fix the bug,” Supertestnet told Decrypt.

What actually happened and what prompted the Austin-based developer to run such an experiment, which Diekroeger described as “the first valiant attack on ordinal inscriptions?”

According to Supertestnet, it all started during a recent conference in Austin, where a hackathon was held and people were supposed to be coming up with projects, and the idea was born to try to make “some weird thing in Bitcoin and create a transaction that sends somebody zero Satoshis.”

“No one at the conference wanted to do that project, so I did something else. But afterward, I tried it and created one of these weird transactions and broadcasted it to a miner who mined it for me,” Supertestnet told Decrypt.

Calling himself the “breaker of jpegs,” Supertestnet not only inserted this bug into Ordinal explorers but also created a tool that lets other users increase the attack.

Yet, he also admitted that “it’s not entirely clear to me exactly what's happening right now.”

“Normally, when you create an inscription, you have to create a Bitcoin address that has some satoshis in it. And then you create an image that the software assigns to one of the satoshis in your Bitcoin address. But my Bitcoin address had zero satoshis in it. So it seems that it assigned it a negative number, which is weird by itself,” explained Supertestnet.

Despite that, when the software encountered this negative number it appears to have tried to give this inscription a number.

“It took that and then either made it the first satoshi in the block, which then belongs to the miner, or it put it in the previous transaction’s transaction fee, which then went to the miner. Either way, it definitely went to the miner like that's the inscription," Supertestnet said. "But that's not supposed to happen. You're not supposed to be able to inscribe somebody else's satoshis without their consent. So that's like a bug."

Things are “a little more complicated” for Ordinals explorers, according to the developer, because all the numbers after his inscription are off by one.

“If they decide to fix that, they will have to undo all the numbers that have been issued since then, like decrementing them all by one or by however many they're off by one now. But they might not fix it, or they may fix it for the future but all the previous ones are going to remain like they are.”

“I don't know what they'll do, maybe they’ll decide that it’s not important anymore and that it’s not the bug but a feature,” added Supertestnet.