📅 Original date posted:2023-02-07
🗒️ Summary of this message: A bug in Taproot allows the same Tapleaf to be repeated multiple times, incurring different Tapfee rates. Always know the entire Taptree when interacting with someone's Tapspend.
📝 Original message:There is a bug in Taproot that allows the same Tapleaf to be repeated
multiple times in the same Taproot, potentially at different Taplevels
incurring different Tapfee rates.
The countermeasure is that you should always know the entire Taptree when
interacting with someone's Tapspend.
On Tue, Feb 7, 2023 at 1:10 PM Andrew Poelstra via bitcoin-dev <
bitcoin-dev at lists.linuxfoundation.org> wrote:
>
> Some people highlighted some minor problems with my last email:
>
> On Tue, Feb 07, 2023 at 01:46:22PM +0000, Andrew Poelstra via bitcoin-dev
> wrote:
> >
> > <snip>
> >
> > [1] https://bitcoin.sipa.be/miniscript/
> > [2] In Taproot, if you want to prevent signatures migrating to another
> > branch or within a branch, you can use the CODESEPARATOR opcode
> > which was redisegned in Taproot for exactly this purpose... we
> > really did about witness malleation in its design!
>
> In Taproot the tapleaf hash is always covered by the signature (though
> not in some ANYONECANPAY proposals) so you can never migrate signatures
> between tapbranches.
>
> I had thought this was the case, but then I re-confused myself by
> reading BIP 341 .... which has much of the sighash specified, but not
> all of it! The tapleaf hash is added in BIP 342.
>
> >
> > If you want to prevent signatures from moving around *within* a
> > branch,
> >
>
> And this sentence I just meant to delete :)
>
>
> --
> Andrew Poelstra
> Director of Research, Blockstream
> Email: apoelstra at wpsoftware.net
> Web: https://www.wpsoftware.net/andrew
>
> The sun is always shining in space
> -Justin Lewis-Webster
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev at lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20230207/57930553/attachment.html>;
Russell O'Connor [ARCHIVE] /
npub1dw…8plrw
2023-06-07 23:19:27
in reply to nevent1q…p5ju
Author Public Key
npub1dw88wd5gqsqn6ufxhf9h03uk8087l7gfzdtez5csjlt6pupu4pwsj8plrwPublished at
2023-06-07 23:19:27Event JSON
{
"id": "ab58106809a9dbfa89df3171077a3cb0696f850a6ab029e850d9d6ec3adc6f17",
"pubkey": "6b8e77368804013d7126ba4b77c7963bcfeff909135791531097d7a0f03ca85d",
"created_at": 1686179967,
"kind": 1,
"tags": [
[
"e",
"1cb271826c48de88a6304ac8ffedd6340167a6ad4b82c11ba779c915dfc4192e",
"",
"root"
],
[
"e",
"5922dd2175886bc4a15a148bf097bcd99ca160a14a720205b45c25c1423a53b8",
"",
"reply"
],
[
"p",
"ee55eb03423bd4db01d5c92ad434d52c602d9da1de37ed37cc5bf7d2a13a4cab"
]
],
"content": "📅 Original date posted:2023-02-07\n🗒️ Summary of this message: A bug in Taproot allows the same Tapleaf to be repeated multiple times, incurring different Tapfee rates. Always know the entire Taptree when interacting with someone's Tapspend.\n📝 Original message:There is a bug in Taproot that allows the same Tapleaf to be repeated\nmultiple times in the same Taproot, potentially at different Taplevels\nincurring different Tapfee rates.\n\nThe countermeasure is that you should always know the entire Taptree when\ninteracting with someone's Tapspend.\n\n\nOn Tue, Feb 7, 2023 at 1:10 PM Andrew Poelstra via bitcoin-dev \u003c\nbitcoin-dev at lists.linuxfoundation.org\u003e wrote:\n\n\u003e\n\u003e Some people highlighted some minor problems with my last email:\n\u003e\n\u003e On Tue, Feb 07, 2023 at 01:46:22PM +0000, Andrew Poelstra via bitcoin-dev\n\u003e wrote:\n\u003e \u003e\n\u003e \u003e \u003csnip\u003e\n\u003e \u003e\n\u003e \u003e [1] https://bitcoin.sipa.be/miniscript/\n\u003e \u003e [2] In Taproot, if you want to prevent signatures migrating to another\n\u003e \u003e branch or within a branch, you can use the CODESEPARATOR opcode\n\u003e \u003e which was redisegned in Taproot for exactly this purpose... we\n\u003e \u003e really did about witness malleation in its design!\n\u003e\n\u003e In Taproot the tapleaf hash is always covered by the signature (though\n\u003e not in some ANYONECANPAY proposals) so you can never migrate signatures\n\u003e between tapbranches.\n\u003e\n\u003e I had thought this was the case, but then I re-confused myself by\n\u003e reading BIP 341 .... which has much of the sighash specified, but not\n\u003e all of it! The tapleaf hash is added in BIP 342.\n\u003e\n\u003e \u003e\n\u003e \u003e If you want to prevent signatures from moving around *within* a\n\u003e \u003e branch,\n\u003e \u003e\n\u003e\n\u003e And this sentence I just meant to delete :)\n\u003e\n\u003e\n\u003e --\n\u003e Andrew Poelstra\n\u003e Director of Research, Blockstream\n\u003e Email: apoelstra at wpsoftware.net\n\u003e Web: https://www.wpsoftware.net/andrew\n\u003e\n\u003e The sun is always shining in space\n\u003e -Justin Lewis-Webster\n\u003e\n\u003e _______________________________________________\n\u003e bitcoin-dev mailing list\n\u003e bitcoin-dev at lists.linuxfoundation.org\n\u003e https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev\n\u003e\n-------------- next part --------------\nAn HTML attachment was scrubbed...\nURL: \u003chttp://lists.linuxfoundation.org/pipermail/bitcoin-dev/attachments/20230207/57930553/attachment.html\u003e",
"sig": "9072de719393c60aa7a4025cffd115b93e9356924ca7607722946bd665b60d090439872425245a88a0c849690b9bbac410d3cd05f9535f5c99e22f1d1b08028d"
}