search

kanzure / python-vaults

Prototype bitcoin vault: cold storage and theft minimization
53 stars 8 forks source link

Security Vulnerability in BIP_119 code #3

Open JeremyRubin opened 2 years ago

JeremyRubin commented 2 years ago

https://github.com/kanzure/python-vaults/blob/7adf99ce7c30169a6aa009f2c5275a96a1996c98/vaults/bip119_ctv.py#L92

This fragment likely requires a boundcheck. Otherwise, by passing in a witness stack which has <N+2> (or something similar?) H_attack which is under third party control could be used for CTV. To protect against this, OP_WITHIN should be added to the fragment I think.

@kanzure

kanzure commented 2 years ago

I'm not familiar with OP_WITHIN, where should it be added?

JeremyRubin commented 2 years ago

i think you want something like:

 redeemScript: TOALTSTACK <template0> <template1> <template n-1> FROMALTSTACK  DUP <N-1> OP_LESSTHANOREQUAL OP_VERIFY OP_ROLL OP_CTV (and then all the OP_DROPs)

because OP_ROLL fails with <0 we don't need a bottom bound.

This serves to both make the witness non-malleable but also prevents 'injecting' an extra template.