Oddbean new post about | logout
 Someone recently lost 0.8 BTC after stepping on an option Sparrow probably shouldn't even have exposed.

https://m.primal.net/Krmc.png

Footguns everywhere. Tread lightly! 💣

https://m.primal.net/Krmd.png  
 Oh no 😬 
 😱👻😭 
 WTF? 
 Yikes. The lesson here is don't click shit that you don't understand. 
 Hey Derek, how would you be able to click as a man?

Might have a tell there, miss 
 This!   
 💯. And that dangerous shit shouldn't be clickable!

https://github.com/sparrowwallet/sparrow/commit/8d7308bc37fbf957c32fd9756086b35d9585740e 
 💯 Not understanding something doesn’t excuse shitty UI. Love Sparrow but that could absolutely use some fixing. 
 Agreed.. Sparrow is a great wallet with a lot of advanced options… sometimes unfortunately you have to decide if you’re responsible for protecting people from themselves. 
 Should have been a warning or something like [DANGER ZONE], feels bad 
 What does that option mean? 
 chat gtp 4O answer there- 
In the images you shared, the term "Sighash" refers to the "Signature Hash" or "Sighash" type used when signing Bitcoin transactions. This option determines which parts of the transaction are signed and, therefore, which parts can be modified later by others.

Here's what each option generally means:

1. **All (Recommended)**: This is the default and recommended setting. It signs all inputs and outputs, meaning the transaction cannot be altered in any way once signed.

2. **None**: This signs nothing. It allows anyone to modify both inputs and outputs, which is dangerous and not recommended for standard use, as it leaves your transaction completely insecure.

3. **Single**: This only signs one specific output, leaving other outputs and inputs open for modification by others. This is a specialized use case and is risky unless you know exactly what you're doing.

4. **All + Anyone Can Pay**: This signs all outputs, but allows anyone to add more inputs. It can be useful for certain complex transactions where multiple parties need to contribute to the transaction.

5. **None + Anyone Can Pay**: This doesn’t sign anything specific, but allows others to add inputs and outputs, which can be risky as it leaves the transaction open to manipulation.

6. **Single + Anyone Can Pay**: This only signs one output and allows other people to add inputs.

The "None" option, which was selected in the shared image, is dangerous for a typical user because it allows anyone to modify the transaction, including changing the recipient or the amount of Bitcoin being sent. This is likely what caused the 0.8 BTC loss mentioned in the post you shared.

It’s always advisable to stick with the recommended "All" unless you're doing advanced multi-party transactions and fully understand the risks involved with other options.  
 Isn't that option that ordinal guys use to snipe nfts on the mempool? 
 Absolutely terrible option, why is it even there? 
 I blame the UI more than the availability of functionality. 
 Absolutely. Even the basic placement under the default is problematic. 
 t-y Matt Carvalho 
 what does this option do?
nostr:nevent1qqszhue47ywms7h3ux4wg799fl46hx0jqhq29umjfqf9kr96wehuywcpz4mhxue69uhhyetvv9ujuerpd46hxtnfduhsygyxtd4a8r3zfqwytzdufvrq5rqvcycyl0w2ng8r8zx59qk63wur5gpsgqqqqqqs3cffy8 
 What does this mean? 
 I answered it above 🫡  
 In human speak 😅 
 He mistakenly selected SIGHASH_NONE when broadcasting his transaction.

This allows anyone to RBF his transaction and change the outputs.

A bot that steals inscriptions replaced his transaction and burned 0.79 BTC to mining fees.

Sparrow now has a warning, but IMO this options shouldn't even be clickable for single input transactions:

https://github.com/sparrowwallet/sparrow/commit/8d7308bc37fbf957c32fd9756086b35d9585740e 
 @craigraw do you have a “developer mode” or “danger zone” toggle that enables these pitfall toggles? 
 Pretty good bandaid for now. https://i.nostr.build/bF6oazsn0E7tzsqX.jpg  
 lol