Repository navigation
btc: require verified silent payment outputs - #190
Open
benma-agent wants to merge 2 commits into
Open
benma-agent wants to merge 2 commits into
benma-agent wants to merge 2 commits into
Conversation
Repeated literals keep test inputs and expected results readable. Exclude goconst from all _test.go files while retaining it for production code.
BTCSign could return successfully when the device omitted a generated silent payment script or skipped the output exchange entirely. In both cases the host skipped proof verification and left the original PSBT output script unchanged. Require a generated script for each silent payment output exchange, verify it before recording it, and reject completion unless every requested silent payment has a verified output. Reject generated silent payment data on ordinary outputs as well. Add regressions for omitted exchanges, missing or invalid proofs, duplicate output requests, and valid mixed outputs. Keep the shared firmware vectors unchanged and handle older firmware's acceptance of silent payment metadata on owned outputs in the Go runner, expecting the host to reject the missing script. Failed signing must leave PSBT signatures and output scripts unchanged.
benma-agent
force-pushed
the
benma-agent/fix-silent-payment-completeness
branch
from
October 4, 2026 08:24
4033c84 to
ec282be
Compare
benma
marked this pull request as ready for review
October 4, 2026 08:24
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BTCSign could succeed when the device omitted a generated silent payment script
or skipped the output exchange entirely. Require a verified generated script for
every requested silent payment before returning signatures, and reject generated
silent payment data on ordinary outputs.
Add regression coverage for omitted exchanges, missing or invalid proofs,
duplicate output requests, and valid mixed outputs. Keep the shared firmware
vectors unchanged and handle older firmware's acceptance of silent payment
metadata on owned outputs in the Go runner. Failed signing must leave PSBT
signatures and output scripts unchanged.
Includes commit ac372fc from #188 before the signing fix to disable goconst for
test files while retaining the rule for production code.