For certain Bech32 strings, deleting or inserting a single character produces a string that is still valid
Overview
For certain Bech32 strings, deleting or inserting just a single character can produce a string that is still valid when tested against the reference implementations.
Implementations Tested
Cases
There appear to be two main cases:
-
Insertion: if a valid Bech32 string has the suffix
p, inserting a singleqcharacter immediately before thepwill produce another valid Bech32 string. -
Deletion: if a valid Bech32 string has the suffix
qp, removing theqcharacter will produce another valid Bech32 string.
These production rules can apparently be applied repeatedly, either by deleting many q characters, or by inserting many q characters, producing a valid Bech32 string after each step.
Examples
The string ii2134hk2xmat79tp is a valid Bech32 string, with:
- human-readable part
ii2 - data part
34hk2xm - checksum
at79tp
Insertion
By inserting one or more q characters immediately before the final p character, we can produce more strings that are valid Bech32 strings:
ii2134hk2xmat79tqpii2134hk2xmat79tqqpii2134hk2xmat79tqqqpii2134hk2xmat79tqqqqp
Deletion
Conversely, by deleting one or more q characters located immediately before a final p character, we can go the other way. The following are all valid Bech32 strings:
eyg5bsz1l2mrq5ypl40hqqqpeyg5bsz1l2mrq5ypl40hqqpeyg5bsz1l2mrq5ypl40hqpeyg5bsz1l2mrq5ypl40hp
Outstanding Question
It's currently unknown to us whether this is a property of the specification itself, or merely a feature of the reference implementations that we tested.
Background
We ran a suite of property tests against a modified version of the reference implementation, designed to simulate simple user errors such as omitting a character from, or inserting an extra character into, pseudo-randomly generated Bech32 strings.