Bug in addmultisigaddress #16009

I found a bug in addmultisigaddress command in bitcoin-cli when answering a question on stackexchange. By default, addmultisigaddress should generate P2SH-segwit which is the default address type for the wallet. However, since segwit does not support uncompressed public keys, the addmultisigaddress command will generate legacy P2SH address when an uncompressed public key is involved. Below, I compare the two methods of generating a multisig address. It seems, addmultisigaddress is generating a random address in the first case. For P2SH-Segwit address, you will have to take the hash160 of 0x00 (version) + 0x89 (bytes to push) + redeem script and encode it with prefix of 0x05. In that case you get address which is 3KaAcNuHny4NELsr2bgQe2MVpn5LfnHtHr as compared to 36ULucjWUTrDvaJzCyhFoVbDoNS6Zum2Du which is generated.

bitcoin-cli addmultisigaddress 1 '["045897fee25bd7c5692510b2f50fcae9aa20fbc4d49d59814f4c7fdb5c4bc6eb1c0ce382458f9588e922e0d509ed8d34856787380075b00418b02e0bf7c652ef9d","02ac46c6d74d15e60f4f1035ff07ef740aca1d68d55ba0b8d336a73d7a35858831","0224a4dc5620714a9ecf67a09583d1e4c04f5bedb8ecea99028da05bb15a2a7e07"]'
{
  "address": "36ULucjWUTrDvaJzCyhFoVbDoNS6Zum2Du",
  "redeemScript": "5141045897fee25bd7c5692510b2f50fcae9aa20fbc4d49d59814f4c7fdb5c4bc6eb1c0ce382458f9588e922e0d509ed8d34856787380075b00418b02e0bf7c652ef9d2102ac46c6d74d15e60f4f1035ff07ef740aca1d68d55ba0b8d336a73d7a35858831210224a4dc5620714a9ecf67a09583d1e4c04f5bedb8ecea99028da05bb15a2a7e0753ae"
}

bitcoin-cli createmultisig 1 '["045897fee25bd7c5692510b2f50fcae9aa20fbc4d49d59814f4c7fdb5c4bc6eb1c0ce382458f9588e922e0d509ed8d34856787380075b00418b02e0bf7c652ef9d","02ac46c6d74d15e60f4f1035ff07ef740aca1d68d55ba0b8d336a73d7a35858831","0224a4dc5620714a9ecf67a09583d1e4c04f5bedb8ecea99028da05bb15a2a7e07"]'
{
  "address": "3GiimyxF1R5VixfBFAbQZbuy9EesD2r6n1",
  "redeemScript": "5141045897fee25bd7c5692510b2f50fcae9aa20fbc4d49d59814f4c7fdb5c4bc6eb1c0ce382458f9588e922e0d509ed8d34856787380075b00418b02e0bf7c652ef9d2102ac46c6d74d15e60f4f1035ff07ef740aca1d68d55ba0b8d336a73d7a35858831210224a4dc5620714a9ecf67a09583d1e4c04f5bedb8ecea99028da05bb15a2a7e0753ae"
}

Things get interesting when you shift the uncompressed public key to the last position (and it should ONLY be last in the ordering). In that case addmultisigaddress would generate the legacy P2SH address as shown below.

bitcoin-cli addmultisigaddress 1 '["02ac46c6d74d15e60f4f1035ff07ef740aca1d68d55ba0b8d336a73d7a35858831","0224a4dc5620714a9ecf67a09583d1e4c04f5bedb8ecea99028da05bb15a2a7e07","045897fee25bd7c5692510b2f50fcae9aa20fbc4d49d59814f4c7fdb5c4bc6eb1c0ce382458f9588e922e0d509ed8d34856787380075b00418b02e0bf7c652ef9d"]'
{
  "address": "35RZ8AHKWGGbNcRDaCUtznSVnPRWGqVPJu",
  "redeemScript": "512102ac46c6d74d15e60f4f1035ff07ef740aca1d68d55ba0b8d336a73d7a35858831210224a4dc5620714a9ecf67a09583d1e4c04f5bedb8ecea99028da05bb15a2a7e0741045897fee25bd7c5692510b2f50fcae9aa20fbc4d49d59814f4c7fdb5c4bc6eb1c0ce382458f9588e922e0d509ed8d34856787380075b00418b02e0bf7c652ef9d53ae"
}

bitcoin-cli createmultisig 1 '["02ac46c6d74d15e60f4f1035ff07ef740aca1d68d55ba0b8d336a73d7a35858831","0224a4dc5620714a9ecf67a09583d1e4c04f5bedb8ecea99028da05bb15a2a7e07","045897fee25bd7c5692510b2f50fcae9aa20fbc4d49d59814f4c7fdb5c4bc6eb1c0ce382458f9588e922e0d509ed8d34856787380075b00418b02e0bf7c652ef9d"]'
{
  "address": "35RZ8AHKWGGbNcRDaCUtznSVnPRWGqVPJu",
  "redeemScript": "512102ac46c6d74d15e60f4f1035ff07ef740aca1d68d55ba0b8d336a73d7a35858831210224a4dc5620714a9ecf67a09583d1e4c04f5bedb8ecea99028da05bb15a2a7e0741045897fee25bd7c5692510b2f50fcae9aa20fbc4d49d59814f4c7fdb5c4bc6eb1c0ce382458f9588e922e0d509ed8d34856787380075b00418b02e0bf7c652ef9d53ae"
}

I think this should be closed in favor of #16011.

It's nothing too important, but I just find quite unfair that you opened this issue saying "I found a bug", without any reference to me, my posts, and @achow101 . I opened #16011 a couple of hours ago, without noticing that you had already opened this one some hours before (I checked yesterday if there were other issues related to this and there was still nothing).

Personally, I waited until now just to be sure and do more checks on the issue, and also because I wrote two emails to the dev list but the second one for some reason was never broadcasted.

Yeah, that was my bad. I referenced stackexchange and wanted to embed the question link in it, but it slipped out of my mind in the end and I submitted without it.

Closing in favour of #16011, as that author there has also submitted a PR in #16012.