Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

BlockchainTest: signature tampering tests pass on the hash check; Block.mine() is a no-op so signature verification is not tested

Open
  • Is something wrong?
#19 0 comments 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@tanujb03 is already working on this.

Since Oct 10, 2026.

  • #20 by @tanujb03 — open

Assessment

Difficulty
3/5
Estimated time
1-2 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Stale
Tech stack
java
Domain
testing

Research direction

Start in src/test/java/minichain/BlockchainTest.java, at tamperedAmountInvalidatesChain() and forgedSenderInvalidatesChain(), and read Block.mine(int) and the hash check at the top of Blockchain.isValid(). Re-mine the tampered block against a fresh hash so the signature check is reached. Done when the tests still pass with the hash check bypassed and fail once the signature check in isValid() is commented out. PR #20 is already open against this issue, so check it before starting.

Written by the indexing model from the issue text.

Description

good first issue tests

What I did

  1. Fresh checkout of main (commit 0e92205), ran tests with mvn test (all 18 pass).
  2. Checked the two tests in src/test/java/minichain/BlockchainTest.java that test tampering detection:
    • tamperedAmountInvalidatesChain()
    • forgedSenderInvalidatesChain()
  3. In both tests, after modifying a transaction in a block, the test calls: 
    tampered.mine(difficulty);
assertFalse(chain.isValid(), "Blockchain should be invalid because of tampered transaction");
  4. Examined Block.mine(int difficulty): 
    public void mine(int difficulty) {
    String target = "0".repeat(difficulty);
    while (!hash.startsWith(target)) {
        nonce++;
        hash = computeHash();
    }
}
  5. Tested mutation: in Blockchain.java, commented out the signature check: 
    // if (!tx.hasValidSignature()) return false;
    and ran mvn test.

What I expected
The README states:

"The system uses digital signatures to prevent forging transactions."

The tampering tests are intended to verify that digital signatures prevent forging transactions and detect altered amounts/senders even if someone re-mines the block to produce a valid proof-of-work hash. If signature verification is removed, the signature tampering tests should fail.

What happened instead
Even with signature verification completely deleted, both tests still pass (18/18 tests green).

Because the block was already mined, hash already starts with "0".repeat(difficulty). The loop condition !hash.startsWith(target) evaluates to false immediately on entry.
As a result:

  • Block.mine() exits without incrementing nonce or calling computeHash().
  • The block's stored hash remains the old hash from before tampering.
  • When chain.isValid() runs, it checks: 
    if (!current.getHash().equals(current.computeHash())) return false;
    and returns false right there because the stored hash does not match computeHash().
  • Execution never reaches the signature check loop at the bottom of isValid().

Additionally, in tamperedAmountInvalidatesChain(), the transaction modified (getTransactions().get(0)) is the mining reward transaction (from = "network"), which has no private key or signature check (hasValidSignature() returns true for network).

Environment

  • JDK 17 / 21, Maven
  • upstream/main (commit 0e92205)

I'd like to submit a PR to improve the test suite with proper re-mining so that signature verification is genuinely tested and isolated.

Dominant language
Java
Stars
0
Forks
3
Avg merge
16h 38m
Merged PRs (30d)
7

Getting set up

  • No Dockerfile or Docker Compose file
  • Has a pull request template
  • No contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from techcsispit/mini-chain

All issues in techcsispit/mini-chain

Similar issues

More Java issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.