bitcoindevkit / bitcoindevkit/bdk

`KeychainTxOutIndex` panics on overlapping descriptors (non-index-0 spk)

Open
#2,277 0 comments 0 reactions 0 assignees View on GitHub
bug
Dominant language
Rust
Stars
1.1k
Forks
483
Avg merge
20d 3h
Merged PRs (30d)
3

Description

**Describe the bug**
`insert_descriptor` only checks `DescriptorId` uniqueness (spk at index 0). A collision at any other index is accepted but the spk is never registered for the new keychain.

Debug: panics in insert_descriptor. Release: Ok(true), then reveal_next_spk panics.

Doesn't affect the stock two-keychain path (`wpkh(xpub/0/*)` + `wpkh(xpub/1/*)`). Hits any `KeychainTxOutIndex` with overlapping descriptors, e.g. watching a single address alongside its account (`wpkh(xpub/0/3)` + `wpkh(xpub/0/*)`), in either order. With the wildcard inserted second, early reveals work and the panic occurs at the colliding index.

**To Reproduce**
Run with `--release`:

```rust
use bdk_chain::keychain_txout::KeychainTxOutIndex;
use bdk_chain::miniscript::{Descriptor, DescriptorPublicKey};
use std::str::FromStr;

const XPUB: &str = "tpubD6NzVbkrYhZ4XgiXtGrdW5XDAPFCL9h7we1vwNCpn8tGbBcgfVYjXyhWo4E1xkh56hjod1RhGjxbaTLV3X4FyWuejifB9jusQ46QzG87VKp";

// K1's only spk == K0's spk at index 3 (within lookahead).
let k0 = Descriptor::::from_str(&format!("wpkh({XPUB}/0/*)")).unwrap();
let k1 = Descriptor::::from_str(&format!("wpkh({XPUB}/0/3)")).unwrap();

let mut idx = KeychainTxOutIndex::::new(25, true);
assert_eq!(idx.insert_descriptor(0, k0), Ok(true));
assert_eq!(idx.insert_descriptor(1, k1), Ok(true)); // accepted, but no spk registered for keychain 1
let _ = idx.reveal_next_spk(1); // panics: keychain_txout.rs:906 "we just inserted it"
```

**Expected behavior**
Behave as documented: first keychain to register an spk owns it, the other keychain keeps working, no panic in debug or release. Add tests for both insertion orders.

**Build environment**
- BDK tag/commit: acc06e53

**Which backend(s) are relevant (if any)?**
- [x] None / not backend-related (e.g. `bdk_chain`, `bdk_core`)

**Is this blocking production use?**
- [x] No

Contributor guide

Open the contributing guide

Research direction

Start in keychain_txout.rs at insert_descriptor and reveal_next_spk around the reported line 906, then trace how overlapping script pubkeys are registered. Add coverage for both descriptor insertion orders and verify that the first keychain owns the overlapping script, the other continues working, and neither debug nor release execution panics.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
76/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.