1

On the bitcoin-dev mailing list Russell O'Connor stated:

There is a bug in Taproot that allows the same Tapleaf to be repeated multiple times in the same Taproot, potentially at different Taplevels incurring different Tapfee rates.

The countermeasure is that you should always know the entire Taptree when interacting with someone's Tapspend.

Why is it a bug that a Taproot tree (Taptree) allows a leaf script (Tapleaf) to be repeated on multiple levels of the tree? If Taproot was (hypothetically) redesigned today would it address this bug and how?

Improve this question
4
  • 1
    Shouldn't you always want to know the entire Taptree anyway? Otherwise someone can sneak in a script that allows them to unilaterally spend the UTXO.
    – Vojtěch Strnad
    Commented Feb 9, 2023 at 12:29
  • @VojtěchStrnad: It is always hard to generalize when there are multiple use cases and multiple possible environments. You could say have a business where the CEO knows the entire tree and individual employees know individual Tapleaves so the CEO has access to all spending paths while individual employees only have access to a subset of spending paths. So I'd say generally yes but not "always".
    – Michael Folkson
    Commented Feb 9, 2023 at 12:32
  • If you're trusting a CEO not to steal the money, you can probably also trust them not to repeat a Tapleaf on multiple levels. Yes, it's technically a design flaw in Taproot but not one most people need to worry about.
    – Vojtěch Strnad
    Commented Feb 9, 2023 at 12:45
  • 1
    I agree generally. But the CEO might not be able to steal the money in this scenario, they might not even have any private keys. So you aren't trusting them in that sense. They are merely the only one who has full knowledge of the tree.
    – Michael Folkson
    Commented Feb 9, 2023 at 12:49

1 Answer 1

Reset to default
1

Why is it a bug that a Taproot tree (Taptree) allows a leaf script (Tapleaf) to be repeated on multiple levels of the tree?

It isn't necessarily a bug that a Taproot tree allows a leaf script to be repeated on multiple levels of the tree on construction and even if it was there would be no way to address this as the Taproot tree is only (partially) revealed at spending time. However it presents a malleability vector if at spending time the same Tapleaf can be spent from at multiple levels on the tree.

If Taproot was (hypothetically) redesigned today would it address this bug and how?

Yes if it was redesigned today it would at spending time require signing the entire Merkle path rather than just the Tapleaf. This doesn't prevent a Tapleaf from being repeated on Taptree construction but would prevent the same Tapleaf being spent from on a different level of the Taptree.

ghost43 stated on IRC:

If the Merkle path to the Tapleaf was signed it would not be interesting whether there is a duplicate Tapleaf in the tree. The issue is that as the Tapleaf path is not signed, if the Tapleaf is duplicated anyone with knowledge of the Taptree can "rebind" the spend to refer to the other matching Tapleaf. It is a sort of malleability. If the path to the leaf was signed this would not be possible.

Thanks to ghost43 and AJ Towns for answering this on IRC.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.