# CVE-2024-38365 public disclosure (btcd \`FindAndDelete\` bug)

**URL:** <https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184>\
**Category:** Implementation\
**Tags:** announcement\
**Created:** [October 10, 2024, 9:02am UTC](https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184 "2024-10-10T09:02:17Z")\
**Posts on this page:** 1\
**Showing post:** 8

<div class="post-metadata">

**Author:** ![ariard](https://delvingbitcoin.org/letter_avatar_proxy/v4/letter/a/c67d28/32.png) [@ariard](https://delvingbitcoin.org/u/ariard)\
**Post date:** [October 15, 2024, 12:00pm UTC](https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184/8 "2024-10-15T12:00:07Z")

</div>

Right, unless you’re using an `OP_CODESEPARATOR` the signature should commit to the `scriptCode`. Though there is still the possibility that the signature is invalid w.r.t the `scriptCode` and the script execution still valid.

What if you have : \<invalid\_sig+noise\> \<invalid\_sig\> \<OP\_CHECKSIG\> \<OP\_SIZE\> \<length\_invalid\_sig+noise\> OP\_EQUALVERIFY.

In my understanding, core’ should only remove 1 instance of \<invalid\_sig\>, fails on the CHECKSIG (though `NULLFAIL` policy only) and then succeed on the OP\_SIZE. On the other hand, non-upgraded btcd should remove the 2 instances of \<invalid\_sig\> (as invalid\_sig+noise contains the invalid\_sig) and fails the OP\_SIZE + OP\_EQUALVERIFY.

---

_[View the full topic](https://delvingbitcoin.org/t/cve-2024-38365-public-disclosure-btcd-findanddelete-bug/1184)._