CVE-2024-38365 public disclosure (btcd `FindAndDelete` bug)

The OP_CHECKSIG (or OP_CHECKMULTISIG) consume stack element so <invalid_sig> and pubkey are dropped from the remainder of the Script, as it is executed. Though yes, there might have been a misunderstanding, on how much btcd’s equivalent of FindAndDelete i.e removeOpcodeByData is really broken. Your initial description wasn’t that clear on that i.e “would remove any data push from the executed Script” which doesn’t say that data push removal was only stopping on currently executed OP_CHECKSIG, and not affecting further data push in the Script. Yes I can understand for the script kiddies.

More seriously than rambling on btcd brokeness, which is a wide subject, after re-checking and re-testing a lot of OP_CODESEPARATOR behaviors when used to spend SigVersion::Base in 27.x peers. Some behaviors are interesting, I’ll share it with you privately.