BitcoinKit Library does not support SEGWIT addresses starting with "3…" (total loss 1 BTC)

[joreleg]

Important this library does not support SEGWIT addresses starting with "3…"
let toAddrData = try? BitcoinAddress(legacy: addressToSend)
Will generate the wrong address if you input "3…" address in it

The wrong script implemented inside the library to decode the address line started with "3"
The same script is correct for "1…" addresses.

Use breakpoint inside library to debug:

(lldb) po Base58Check.encode(pubKeyHash.dropFirst())
“AfDbgcJsVhgcn9cXYJSw8q47LJGA6KJGK”
(lldb) po Base58Check.encode(pubKeyHash)
“3BMEXE6kRQ24hwr3edy3MmBzFraync7nEF”

The first symbol is dropped inside the library at pubKeyHash that leads to an inability to get the right address.

Please be aware.

Transactions affected with the bug:

1. TOTAL LOSS >0.5+ BTC
   Supposed receivers address: 3BMEXE6kRQ24hwr3edy3MmBzFraync7nEF
   Real transactions accrued:
   https://insight.bitpay.com/tx/553034891d36bac02740f1e88045b006606121c181c8a14aebd28e012bdc273d
   https://insight.bitpay.com/tx/f4e490f20e3dfeea7b4a1a44d72d2e9258bcbb6a2dcb9b41170a4d9d7c98b0d8
   https://insight.bitpay.com/tx/20b1b571d8b4f3d49d4f9b4499047d47994d8f9872bd5e41b8bafb9e53b4f655
   https://insight.bitpay.com/tx/adfd4540b07a8dc2502eec89cb119ca8d9b5c2e65240ee788200ba6cabd84751
   https://insight.bitpay.com/tx/3887c69a5c9d5a009de2ad64d72e17e02b28031cde953f158069e83d3428bd35
   https://insight.bitpay.com/tx/2e4bb0a307b30610e4548ef9683396156fd032cd025f138022c13fa29247ac92
   https://insight.bitpay.com/tx/2e4bb0a307b30610e4548ef9683396156fd032cd025f138022c13fa29247ac92
   https://insight.bitpay.com/tx/59dbd8e23f53730fb9a77dd7948f6e4d8bb92cca774851b42631e1841a7035af

2. TOTAL LOSS >0.5+ BTC
   Supposed receivers address: 3QU6Dm9QiPDgnCj7oVwjF5EG1VHnAyQjKE
   Real transactions accrued:
   https://insight.bitpay.com/tx/1f9351228c52292da1c500dc90d1ccdcad261a85d67b8fe47b127bb46162fe28
   https://insight.bitpay.com/tx/e2cf69d4d68772e854966f9d174529395b5a7eadb9244b845da3c5beaf4c4d5b

Environment

• BitcoinKit