rust-bitcoin / rust-bitcoin/rust-miniscript
Key Translation Duplicate Check Safety Hole
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 426
- Forks
- 200
- Avg merge
- 7d 17h
- Merged PRs (30d)
- 8
Description
When translating keys in a given policy/miniscript, translating:
and(pk(A), pk(B))
with F: { A -> X, B -> X }
creates
and(pk(X), pk(X))
bypassing the check that no duplicate/repeated keys are used.
Fixing this requires changing from a function to a bijective map of some kind, either by tracing the function as it's used or switching the type externally to some kind of map.
cc @apoelstra @sanket1729, creating an issue for this to track fixing it
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by tracing how key translation is represented and where duplicate or repeated keys are checked. Reproduce the and(pk(A), pk(B)) example with both keys mapped to X, then ensure the completed change rejects the translated duplicate rather than allowing it through.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- rust
- Domain
- cryptography, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100