Date: Wed, 8 Feb 2023 14:00:48 +0000
From: Andrew Poelstra <apoelstra@wpsoftware.net>
To: Michael Folkson <michaelfolkson@protonmail.com>
Message-ID: <Y+OrEDooHlijDpJV@camus>
References: <CAAQdECCH=YOcu4g6Ku1_G4CnRg6rsaFPFPwbABx9aZin9A8+2A@mail.gmail.com>
 <Y+JWLsc80gxL4kpG@camus> <Y+KUAlsPc8ohPecb@camus>
 <CAMZUoK=u2114uv0Uc0u_RVMBv-cq-gJiNxiyOk_T_xxTYO0Ghw@mail.gmail.com>
 <VWZ9Dc2gIe0Y02yY3qSbjQTEPqwCm6YAtRzfNrIANBXCEJzr73SdxZT4LwBKDyriDfmDZyTlkKWtoZmVIUbYqqZUAeTMDLHUNFCBwR6hitQ=@protonmail.com>
MIME-Version: 1.0
Content-Type: multipart/signed; micalg=pgp-sha256;
 protocol="application/pgp-signature"; boundary="kQxarOc/A3GibG2Z"
Content-Disposition: inline
In-Reply-To: <VWZ9Dc2gIe0Y02yY3qSbjQTEPqwCm6YAtRzfNrIANBXCEJzr73SdxZT4LwBKDyriDfmDZyTlkKWtoZmVIUbYqqZUAeTMDLHUNFCBwR6hitQ=@protonmail.com>
Cc: Bitcoin Protocol Discussion <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Unenforceable fee obligations in multiparty
 protocols with Taproot inputs
Precedence: list


--kQxarOc/A3GibG2Z
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
Content-Transfer-Encoding: quoted-printable

On Wed, Feb 08, 2023 at 09:34:57AM +0000, Michael Folkson wrote:
> Hi Andrew
>=20
> > There is a bug in Taproot that allows the same Tapleaf to be repeated m=
ultiple times in the same Taproot, potentially at different Taplevels incur=
ring different Tapfee rates.
> >> The countermeasure is that you should always know the entire Taptree w=
hen interacting with someone's Tapspend.
>=20
> I wouldn't say it is a "bug" unless there is a remedy for the bug that wa=
sn't (and retrospectively should have been) included in the Taproot design.=
 In retrospect and assuming you could redesign the Taproot consensus rules =
again today would you prevent spending from a valid P2TR address if a repea=
ted Tapleaf hash was used to prove that a spending path was embedded in a T=
aproot tree? That's the only thing I can think of to attempt to remedy this=
 "bug" and it would only be a partial protection as proving a spending path=
 exists within a Taproot tree only requires a subset of the Tapleaf hashes.
>=20
> I only point this out because there seems to be a push to find "bugs" and=
 "accidental blowups" in the Taproot design currently. No problem with this=
 if there are any, they should definitely be highlighted and discussed if t=
hey do exist. The nearest to a possible inferior design decision thus far t=
hat I'm aware of is x-only pubkeys in BIP340 [0].
>=20

I'm actually not certain what Russell's referring to, but if it's indeed
possible to construct TapTrees where the "same" leafhash appears multiple
times at different heights, that's something unintended and which we
could've fixed by changing the Merkle structure. I don't even think
there would've been an efficiency tradeoff.

So I think it's totally reasonable to call such a thing a "bug".

--=20
Andrew Poelstra
Director of Research, Blockstream
Email: apoelstra at wpsoftware.net
Web:   https://www.wpsoftware.net/andrew

The sun is always shining in space
    -Justin Lewis-Webster


--kQxarOc/A3GibG2Z
Content-Type: application/pgp-signature; name="signature.asc"

-----BEGIN PGP SIGNATURE-----

iQEzBAEBCAAdFiEEkPnKPD7Je+ki35VexYjWPOQbl8EFAmPjqxAACgkQxYjWPOQb
l8E9iAf/XS7c3n9QLm6Kre4hyOLAv4+KZGSofL0fuMsIDReUSTkbGUZjjAiudWMa
8nsxZtnIhR/RrSncdG+xmJp4+q3wFnRtDbtihSoz0UXWZ6j9nT9J4/0ZNxxpo7pS
Zgllp86HkTZK2cWGmx9hhajaabbqAf9hjjqomJ1lMximn5FsUS0vy7P3T1nR2g3v
WTCBsWY8vuyZhSNy5YaUcO5LMiVmsIyWLiuIhE3PeA8LaXsaAnXo6YlqXB98oZ1w
2tizLszZ2PWxyMXunGJ0746XHIviL+aTR3RX6Wb0gIPWwBy0BwfG8PCXgATY5uLr
6+j6FB146S1vH4iaqfps/ODp6LWi7A==
=LChY
-----END PGP SIGNATURE-----

--kQxarOc/A3GibG2Z--