While working on adapting Miniscript to Tapscript, i noticed signatures in Tapscript only commit to the leaf (i previously assumed they committed to the whole branch). It’s been discussed lately on the mailing list as well (1, 2). This means if the same script is used in two different leaves, a signature for one can be rebound to the other.
If one signed a transaction it shouldn’t matter what script path it used as long as the transaction itself didn’t change [0]. However, the possibility to change the script path used may cause two issues:
- It messes up with Miniscript’s malleability analysis (and is a malleability vector in itself).
- It allows to potentially hinder the confirmation of a transaction if the two leaves aren’t at the same height (h/t aj).
I don’t think 1. is a valid point. Miniscript’s analysis is about malleability from a third party that only gets to see a single satisfaction. The composition of the tree would not be known to the third party here, therefore they wouldn’t be able to malleate.
This leaves 2. which is more important in the context of presigned transactions, and in this case we’d expect protocol designers to take great care when designing the descriptors used so it would most likely not be an issue.
On the other hand it really is inexpensive to check, and AFAICT it serves no purpose to duplicate a leaf. So we could avoid a potential future footgun we didn’t anticipate for cheap? @sipa @achow101 @apoelstra @sanket1729 thoughts?
[0] Some may argue this doesn’t always hold, while it may be valid it’s imo out of scope here.
