fbueller, thanks heaps for you long and details response!
> Usually your bitcoin core will rebroadcast transactions which have not confirmed. It will do this indefinitely unless you remove the tx from your wallet.
[...]
If some malleability bot is in on the network, your transaction ID could actually be different. So maybe you logged the TxID after one confirmation to create a raw transaction later - your TxID could be incorrect, because block B with the txid you first heard about was orphaned, but block A, where your tx was malleated was actually in the chain with most difficulty.
Ok, So I guess this means that your bitcoin client want notice that the transaction was confirmed, and may retransmit it again in error. Which is the so called malleability attack.
https://en.bitcoin.it/wiki/Transaction_Malleability(Also I notice that some of the links in
https://en.bitcoin.it/wiki/Bitcoin_Improvement_Proposals are broken, e.g. BIP0062, which would have been relevant here - not sure how to report problems though)
Interesting website, seems to do a much better job of showing the scripts then other websites.
Does seem possible to crash it though, for instance, going to
http://webbtc.com/address/1CjPR7Z5ZSyWk6WtXvSFgkptmpoi4UM9BC - the first address I clicked on - comes up with the error "Too many outputs for this address (12958)"
scriptPubKey sets the constraints on the recipient on how they are receiving the money. It is how clients learn about transactions which are theirs. How would your client know that an invalid scriptPubKey was intended for you before the pubkey-hash was messed up? You couldn't do this over the network, the main way clients learn about transactions.
Oh, ok, maybe this was a false assumption I made. I thought the transaction output included the destination address too, but maybe that is not the case, it is only the script that decides who can spend it. Which would make more sense, and reading the bitcoin protocol specification seems to confirm this.
https://en.bitcoin.it/wiki/Protocol_specificationHow do websites, such as webbtc, display the output address? I am guessing they must parse the script and find the hash value. Does that even make sense? e.g. is it possible to take the hash from output script, say 024a0102c5952538e6aab7cddb9e2659bd47e206, and turn that into a bitcoin address of 1D71GZ463FU4accU2GAdz9DT1XoLGqPWK?
Which in turn will presumably mean that if the websites display the destination address (hopefully they do confirm that it is the standard script), this means that the output is definitely spendable if you have the corresponding private key (except, of course, PIP0013/p2sh addresses).