Why does Miniscript add an extra size check for hash preimage comparisons?

Question

When I input the following miniscript into https://bitcoin.sipa.be/miniscript/:

and(pk(claimant_pk),sha256(H))

I get the following Script:

<claimant_pk> OP_CHECKSIGVERIFY OP_SIZE <20> OP_EQUALVERIFY OP_SHA256 <H>
OP_EQUAL

Why does Miniscript add this size check? Is there a safety concern or some ability for a malicious ScriptSig/ScriptWitness to skip the OP_SHA256 opcode?

Answer 1

This is to avoid a preimage too large to be claimed by one of the parties in a contract.

For instance without this check it would be possible to create a Lightning HTLC that is only claimable by a preimage whose size is larger than the maximum standard witness stack element size. An attacker cooperating with a miner would be able to claim the HTLC onchain on both sides of the attacked node: on the sender side with the "success" transaction (containing the preimage) included in a block by a cooperating miner and on the receiver side after timeout since the Lightning node wouldn't have been able to broadcast the non-standard "success" transaction through the P2P network.

Another example is a cross-chain atomic swap, to avoid a preimage to be valid on one chain but not another with more restrictive size limits. For instance without the size check an atomic swap between chain A which restricts witness stack elements to (say) 50 bytes and chain B which restricts them to 51 bytes could be made non-claimable on A by using a 51 bytes preimage.

As a side effect this makes sure the witness size for satisfying this script can be accurately calculated. (You would otherwise need to take into account the preimage may be as large as the maximum witness stack element size.)

A pull request adding some rationale for this check on Pieter Wuille's website was recently merged. (EDIT: the rationale is now available on the website, at the bottom of the "Translation table" section.)