cashscript icon indicating copy to clipboard operation
cashscript copied to clipboard

Investigate checking UTXO sourceOutputs locking bytecode against provided unlocker

Open rkalis opened this issue 3 months ago • 1 comments

It is currently possible to run debugging where the added input UTXOs are from a different contract (or P2PKH address) than the unlocker used to unlock it.

In the libauth template generation we assume that the UTXO that gets unlocked is of the same "type" as the unlocker used to unlock it.

For P2PKH this means that the debugging will succeed even when using an incorrect SignatureTemplate. For contracts it likely means that debugging can succeed even when the provided UTXOs don't match the unlocker.

These kinds of transactions will still be rejected by the network, but currently they pass on MockNetworkProvider / .debug().

We might need to change UTXO typings to properly solve this.

rkalis avatar Sep 16 '25 09:09 rkalis

This issue was found while working on #323.

rkalis avatar Sep 16 '25 09:09 rkalis