FUZZ=rpc in utxoupdatepsbt Assertion `tweaked' failed in SignMuSig2 #34201

maflcko commented at 8:14 AM on January 5, 2026: member

$ echo 'dXR4b3VwZGF0ZXBzYnRcIHBzYnT/AQCjICAgIAMgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAAIP///yAgICAgICAgICAgICAgICAgICAgICAgICAgICD///8gICAgIAAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgIP////////8gACAgICADICAgICAgICADICAgICAgICAg
ICAAICAgICAgICAAICAgIAABASsg/yAgICAgICJRICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgIhoCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClAiAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg
ICAgICAgICAgICAgICD/ICAgICAgICAgICAgICAgICAgICAgAAAAAAAA7f//ICAgIA==' | base64 --decode > /tmp/crash


$ FUZZ=rpc ./bld-cmake/bin/fuzz /tmp/crash
INFO: Running with entropic power schedule (0xFF, 100).
INFO: Seed: 2426494106
INFO: Loaded 1 modules   (402716 inline 8-bit counters): 402716 [0x561fca7217f8, 0x561fca783d14), 
INFO: Loaded 1 PC tables (402716 PCs): 402716 [0x561fca783d18,0x561fcada8ed8), 
./bld-cmake/bin/fuzz: Running 1 inputs 1 time(s) each.
Running: /tmp/clusterfuzz-testcase-minimized-rpc-4681957738086400
script/sign.cpp:321 bool SignMuSig2(const BaseSignatureCreator &, SignatureData &, const SigningProvider &, std::vector<unsigned char> &, const XOnlyPubKey &, const uint256 *, const uint256 *, SigVersion): Assertion `tweaked' failed.

Found by https://issues.oss-fuzz.com/u/3/issues/473123279?pli=1

Originally posted by @maflcko in #29675 (review)

maflcko added this to the milestone 31.0 on Jan 5, 2026

maflcko added the label Fuzzing on Jan 5, 2026

maflcko added the label RPC/REST/ZMQ on Jan 5, 2026

rkrux commented at 9:26 AM on January 5, 2026: contributor

Is this a valid PSBT? I get the following error when I try to decode it.

➜  ~ bitcoincli decodepsbt dXR4b3VwZGF0ZXBzYnRcIHBzYnT/AQCjICAgIAMgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAAIP///yAgICAgICAgICAgICAgICAgICAgICAgICAgICD///8gICAgIAAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIP////////8gACAgICADICAgICAgICADICAgICAgICAgICAAICAgICAgICAAICAgIAABASsg/yAgICAgICJRICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIhoCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAClAiAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICD/ICAgICAgICAgICAgICAgICAgICAgAAAAAAAA7f//ICAgIA==
error code: -22
error message:
TX decode failed Invalid PSBT magic bytes: unspecified iostream_category error

maflcko commented at 10:05 AM on January 5, 2026: member

This is a fuzz input, if you want the psbt, you can add a `std::cout<<request.params[0].get_str()<<'\n'; to the rpc. This will give:

utxoupdatepsbt cHNidP8BAKMgICAgAyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAAg////ICAgICAgICAgICAgICAgICAgICAgICAgICAgIP///yAgICAgACAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg/////////yAAICAgIAMgICAgICAgIAMgICAgICAgICAgIAAgICAgICAgIAAgICAgAAEBKyD/ICAgICAgIlEgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiGgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACECICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAAAAAAAAA=

rkrux commented at 10:10 AM on January 5, 2026: contributor

Oh interesting, thanks for clarifying.

rkrux commented at 11:05 AM on January 5, 2026: contributor

I think what's happening here is that invalid pubkeys are passed as MuSig2 aggregate and participants. I've updated PR #34010 by adding the test case from this issue.

The decoded PSBT from this input #34201 (comment):

<details open> <summary>decode PSBT on master that doesn't throw error but the above linked PR will</summary>

➜  src git:(master) ✗   bitcoincli decodepsbt cHNidP8BAKMgICAgAyAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgIAAg////ICAgICAgICAgICAgICAgICAgICAgICAgICAgIP///yAgICAgACAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAg/////////yAAICAgIAMgICAgICAgIAMgICAgICAgICAgIAAgICAgICAgIAAgICAgAAEBKyD/ICAgICAgIlEgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAiGgIAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAACECICAgICAgICAgICAgICAgICAgICAgICAgICAgICAgICAAAAAAAAA=
{
  "tx": {
    "txid": "78aa55eafa6998eede2cfbde74e07b971c848d5e087033de9f0c934ed59ad775",
    "hash": "78aa55eafa6998eede2cfbde74e07b971c848d5e087033de9f0c934ed59ad775",
    "version": 538976288,
    "size": 163,
    "vsize": 163,
    "weight": 652,
    "locktime": 538976288,
    "vin": [
      {
        "txid": "2020202020202020202020202020202020202020202020202020202020202020",
        "vout": 538976288,
        "scriptSig": {
          "asm": "",
          "hex": ""
        },
        "sequence": 4294967072
      },
      {
        "txid": "20ffffff20202020202020202020202020202020202020202020202020202020",
        "vout": 538976288,
        "scriptSig": {
          "asm": "",
          "hex": ""
        },
        "sequence": 538976288
      },
      {
        "txid": "ffffffff20202020202020202020202020202020202020202020202020202020",
        "vout": 553648127,
        "scriptSig": {
          "asm": "",
          "hex": ""
        },
        "sequence": 538976288
      }
    ],
    "vout": [
      {
        "value": 23148855308.18453536,
        "n": 0,
        "scriptPubKey": {
          "asm": "[error]",
          "desc": "raw(202020)#a84sa0nu",
          "hex": "202020",
          "type": "nonstandard"
        }
      },
      {
        "value": 23148855308.18453536,
        "n": 1,
        "scriptPubKey": {
          "asm": "",
          "desc": "raw()#58lrscpx",
          "hex": "",
          "type": "nonstandard"
        }
      },
      {
        "value": 23148855308.18453536,
        "n": 2,
        "scriptPubKey": {
          "asm": "",
          "desc": "raw()#58lrscpx",
          "hex": "",
          "type": "nonstandard"
        }
      }
    ]
  },
  "global_xpubs": [
  ],
  "psbt_version": 0,
  "proprietary": [
  ],
  "unknown": {
  },
  "inputs": [
    {
      "witness_utxo": {
        "amount": 23148855308.18510624,
        "scriptPubKey": {
          "asm": "1 2020202020202020202020202020202020202020202020202020202020202020",
          "desc": "addr(bcrt1pyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqsqm5s4vx)#uxtlp4pp",
          "hex": "51202020202020202020202020202020202020202020202020202020202020202020",
          "address": "bcrt1pyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqszqgpqyqsqm5s4vx",
          "type": "witness_v1_taproot"
        }
      },
      "musig2_participant_pubkeys": [
        {
          "aggregate_pubkey": "020000000000000000000000000000000000000000000000000000000000000000",
          "participant_pubkeys": [
            "022020202020202020202020202020202020202020202020202020202020202020"
          ]
        }
      ]
    },
    {
    },
    {
    }
  ],
  "outputs": [
    {
    },
    {
    },
    {
    }
  ]
}

</details>

Also, I get "Access is denied to this issue" error when I open this link. How can I see this issue?

Found by https://issues.oss-fuzz.com/u/3/issues/473123279?pli=1

achow101 referenced this in commit d6a6afd955 on Jan 5, 2026

maflcko closed this on Jan 6, 2026