rust-bitcoin / rust-bitcoin/rust-miniscript

Key Translation Duplicate Check Safety Hole

Open
#238 8 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
426
Forks
200
Avg merge
7d 17h
Merged PRs (30d)
8

Description

When translating keys in a given policy/miniscript, translating:

and(pk(A), pk(B))

with F: { A -> X, B -> X }

creates

and(pk(X), pk(X))

bypassing the check that no duplicate/repeated keys are used.

Fixing this requires changing from a function to a bijective map of some kind, either by tracing the function as it's used or switching the type externally to some kind of map.

cc @apoelstra @sanket1729, creating an issue for this to track fixing it

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing how key translation is represented and where duplicate or repeated keys are checked. Reproduce the and(pk(A), pk(B)) example with both keys mapped to X, then ensure the completed change rejects the translated duplicate rather than allowing it through.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
cryptography, security
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.