Can Bitcoin scripting be used for double spending attacks? A standard Bitcoin transaction deposits coins into an address and then, using Bitcoin's scripting language, states that whoever wants to spend this output must be in possess of the private key corresponding to that address.

However, it's possible to deviate from this base template to create more complex transactions, where other conditions must be met in order to spend the transaction output.

Is it possible to create a transaction where a sum is deposited into an address, but only the owner of another private key is allowed to spend it? I'm not a Bitcoin scripting expert, but this looks at least possible.

In this case, can such a crafted transaction be used to mount a double-spending attack, where address A sends sum X to address B, but after the transaction is completed address A retains ownership of the sum and can send it elsewhere, while address B can actually do nothing about it even if the sum is credited to its balance?

How would a standard wallet treat such a transaction? Would it even recognize there's something strange going on, or would it blindly display that X BTC entered address B, regardless of the transaction script?



Edit:

Sorry, I was misled by how sites such as blockchain.info display transactions: a transaction doesn't actually contain any "output address", it only contains outputs which state the conditions necessary to spend them; the "output address" is computed by checking which address's signature is requested by the output script; thus it's impossible to "send money to address B" without actually placing address B in the output script.

However, the question somewhat remains: could a transaction be crafted to fool a wallet into telling its user "I received X BTC" while someone else can actually claim the sum using another private key?
What you're describing is a contradiction of terms. If a sum of money is deposited into an address, that means that only that address's private key can spend the money.

Maybe you could craft a non-standard transaction and tell people it's giving address B's owner permission to spend it, but if people look closely enough at the transaction, they'll be able to tell that it's really address C (and not B)'s owner that can spend it. There's no way around this: the transaction output is public, as is the implementation of how it works.

So if the question is: can you fool software X with a non-standard transaction? Perhaps, it would depend on finding a bug (or other less-than-ideal situation) in the software in question. (for example, if you craft a transaction that can be spent by address B or C, maybe the wallet owning B will say it has the balance, and if he doesn't transfer it again before you do, then you can "steal back" the money that way) However, I'd treat any non-standard transactions as highly suspect.