MIME-Version: 1.0
References: <CAAQdECCH=YOcu4g6Ku1_G4CnRg6rsaFPFPwbABx9aZin9A8+2A@mail.gmail.com>
 <Y+JWLsc80gxL4kpG@camus> <Y+KUAlsPc8ohPecb@camus>
In-Reply-To: <Y+KUAlsPc8ohPecb@camus>
From: "Russell O'Connor" <roconnor@blockstream.com>
Date: Tue, 7 Feb 2023 13:35:12 -0500
Message-ID: <CAMZUoK=u2114uv0Uc0u_RVMBv-cq-gJiNxiyOk_T_xxTYO0Ghw@mail.gmail.com>
To: Andrew Poelstra <apoelstra@wpsoftware.net>, 
 Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Content-Type: multipart/alternative; boundary="0000000000001f8a8405f4206984"
Subject: Re: [bitcoin-dev] Unenforceable fee obligations in multiparty
 protocols with Taproot inputs
Precedence: list

--0000000000001f8a8405f4206984
Content-Type: text/plain; charset="UTF-8"

There is a bug in Taproot that allows the same Tapleaf to be repeated
multiple times in the same Taproot, potentially at different Taplevels
incurring different Tapfee rates.

The countermeasure is that you should always know the entire Taptree when
interacting with someone's Tapspend.


On Tue, Feb 7, 2023 at 1:10 PM Andrew Poelstra via bitcoin-dev <
bitcoin-dev@lists.linuxfoundation.org> wrote:

>
> Some people highlighted some minor problems with my last email:
>
> On Tue, Feb 07, 2023 at 01:46:22PM +0000, Andrew Poelstra via bitcoin-dev
> wrote:
> >
> > <snip>
> >
> > [1] https://bitcoin.sipa.be/miniscript/
> > [2] In Taproot, if you want to prevent signatures migrating to another
> >     branch or within a branch, you can use the CODESEPARATOR opcode
> >     which was redisegned in Taproot for exactly this purpose... we
> >     really did about witness malleation in its design!
>
> In Taproot the tapleaf hash is always covered by the signature (though
> not in some ANYONECANPAY proposals) so you can never migrate signatures
> between tapbranches.
>
> I had thought this was the case, but then I re-confused myself by
> reading BIP 341 .... which has much of the sighash specified, but not
> all of it! The tapleaf hash is added in BIP 342.
>
> >
> >     If you want to prevent signatures from moving around *within* a
> >     branch,
> >
>
> And this sentence I just meant to delete :)
>
>
> --
> Andrew Poelstra
> Director of Research, Blockstream
> Email: apoelstra at wpsoftware.net
> Web:   https://www.wpsoftware.net/andrew
>
> The sun is always shining in space
>     -Justin Lewis-Webster
>
> _______________________________________________
> bitcoin-dev mailing list
> bitcoin-dev@lists.linuxfoundation.org
> https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev
>

--0000000000001f8a8405f4206984
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>There is a bug in Taproot that allows the same Taplea=
f to be repeated multiple times in the same Taproot, potentially at differe=
nt Taplevels incurring different Tapfee rates.</div><div><br></div><div>The=
 countermeasure is that you should always know the entire Taptree when inte=
racting with someone&#39;s Tapspend.<br></div><div dir=3D"ltr"><br></div><b=
r><div class=3D"gmail_quote"><div dir=3D"ltr" class=3D"gmail_attr">On Tue, =
Feb 7, 2023 at 1:10 PM Andrew Poelstra via bitcoin-dev &lt;<a href=3D"mailt=
o:bitcoin-dev@lists.linuxfoundation.org">bitcoin-dev@lists.linuxfoundation.=
org</a>&gt; wrote:<br></div><blockquote class=3D"gmail_quote" style=3D"marg=
in:0px 0px 0px 0.8ex;border-left:1px solid rgb(204,204,204);padding-left:1e=
x"><br>
Some people highlighted some minor problems with my last email:<br>
<br>
On Tue, Feb 07, 2023 at 01:46:22PM +0000, Andrew Poelstra via bitcoin-dev w=
rote:<br>
&gt; <br>
&gt; &lt;snip&gt; <br>
&gt; <br>
&gt; [1] <a href=3D"https://bitcoin.sipa.be/miniscript/" rel=3D"noreferrer"=
 target=3D"_blank">https://bitcoin.sipa.be/miniscript/</a><br>
&gt; [2] In Taproot, if you want to prevent signatures migrating to another=
<br>
&gt;=C2=A0 =C2=A0 =C2=A0branch or within a branch, you can use the CODESEPA=
RATOR opcode<br>
&gt;=C2=A0 =C2=A0 =C2=A0which was redisegned in Taproot for exactly this pu=
rpose... we<br>
&gt;=C2=A0 =C2=A0 =C2=A0really did about witness malleation in its design!<=
br>
<br>
In Taproot the tapleaf hash is always covered by the signature (though<br>
not in some ANYONECANPAY proposals) so you can never migrate signatures<br>
between tapbranches.<br>
<br>
I had thought this was the case, but then I re-confused myself by<br>
reading BIP 341 .... which has much of the sighash specified, but not<br>
all of it! The tapleaf hash is added in BIP 342.<br>
<br>
&gt; <br>
&gt;=C2=A0 =C2=A0 =C2=A0If you want to prevent signatures from moving aroun=
d *within* a<br>
&gt;=C2=A0 =C2=A0 =C2=A0branch,<br>
&gt;<br>
<br>
And this sentence I just meant to delete :)<br>
<br>
<br>
-- <br>
Andrew Poelstra<br>
Director of Research, Blockstream<br>
Email: apoelstra at <a href=3D"http://wpsoftware.net" rel=3D"noreferrer" ta=
rget=3D"_blank">wpsoftware.net</a><br>
Web:=C2=A0 =C2=A0<a href=3D"https://www.wpsoftware.net/andrew" rel=3D"noref=
errer" target=3D"_blank">https://www.wpsoftware.net/andrew</a><br>
<br>
The sun is always shining in space<br>
=C2=A0 =C2=A0 -Justin Lewis-Webster<br>
<br>
_______________________________________________<br>
bitcoin-dev mailing list<br>
<a href=3D"mailto:bitcoin-dev@lists.linuxfoundation.org" target=3D"_blank">=
bitcoin-dev@lists.linuxfoundation.org</a><br>
<a href=3D"https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-dev" =
rel=3D"noreferrer" target=3D"_blank">https://lists.linuxfoundation.org/mail=
man/listinfo/bitcoin-dev</a><br>
</blockquote></div></div>

--0000000000001f8a8405f4206984--