search

brunoerg / bitcoinfuzz

Differential Fuzzing of Bitcoin implementations and libraries
31 stars 11 forks source link

miniscript_string: crash with `or_d(dv:0,0)` #39

Open brunoerg opened 2 months ago

brunoerg commented 2 months ago

or_d(dv:0,0) is sane for Bitcoin Core (IsSane() returns true) but fails for rust-miniscript due to "fragment «or_d(dv:0,0)» requires its left child be a unit (outputs exactly 1 given a satisfying input)".

brunoerg commented 2 months ago

friendly ping: @apoelstra

apoelstra commented 2 months ago

Neat. Yep, looks like d is supposed to be a unit in a Taproot context, but we have it unconditionally set to false.

This is actually likely to be a really annoying bug because currently our type properties do not know the script context.

cc @sanket1729