AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 26 Bitcoin

Merge bitcoin/bitcoin#31734: miniscript: account for all `StringType` variants in `Miniscriptdescriptor::ToString()`

Public commit record

What the developer wrote

Authored by Ava Chow

91/100 · Strong
Merge bitcoin/bitcoin#31734: miniscript: account for all `StringType` variants in `Miniscriptdescriptor::ToString()`

28a4fcb03c0fb1cd5112eca1eb36dcb13e0b4ff2 test: check listdescriptors do not return a mix of hardened derivation marker (pythcoiner)
975783cb79e929260873c1055d4b415cd33bb6b9 descriptor: account for all StringType in MiniscriptDescriptor::ToStringHelper() (pythcoiner)

Pull request description:

In `MiniscriptDescriptor::ToStringHelper()` only the `StringType::Private` variant of the `type` argument was handled. This PR implements serializing w/ all variants of `StringType` & add a functional test for the descriptor triggering the related issue.

Closes #31694: previously when calling `listdescriptors` RPC on a wallet containing a taproot descriptor w/ a (miniscript) taptree, origins of internal key & taptree were serialized w/ differents hardened derivation markers:
- origin of the internal key were serialized w/ `StringType::Normalized` type (using `h` as marker)
- origins of taptree keys were serialized w/ `StringType::Private` type (using `'` as marker)

Note: Origins in segwit (`wsh()`) miniscript descriptors were also serialized w/ `StringType::Private` type (`'` marker) and are now serialized w/ `StringType::Normalized` type (`h` marker).

ACKs for top commit:
sipa:
Code review ACK 28a4fcb03c0fb1cd5112eca1eb36dcb13e0b4ff2
achow101:
ACK 28a4fcb03c0fb1cd5112eca1eb36dcb13e0b4ff2
rkrux:
Concept ACK 28a4fcb03c0fb1cd5112eca1eb36dcb13e0b4ff2

Tree-SHA512: 15d14000b5951ca69a64a05b9a0b138c48a07b81eaf2fa86b91ac20cc8735533355a787363c64ba88403dd8a56ef5232cba57d34bea80835a0f40774d62fbc2b
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit fixes a formatting inconsistency in how Bitcoin Core's wallet describes certain advanced 'miniscript' descriptors. When a user called the listdescriptors RPC, the same descriptor could contain a mix of 'h' and ''' markers for hardened derivation paths, depending on whether the key was inside a Taproot taptree or not. The patch makes the output uniform. It is a correctness/usability bug rather than a direct loss-of-funds vulnerability, but inconsistent descriptors can confuse downstream tools or users who compare or re-import descriptor strings.

Recommended action

Apply the patch. Verify that listdescriptors output for Taproot and wsh miniscript wallets uses a single hardened-derivation marker throughout. Review any tooling that parses descriptor strings to ensure it accepts both markers, since previously exported descriptors may contain the mixed style.

Security signals we found

01

Descriptor serialization inconsistency between hardened derivation markers ('h' vs "'")

02

Incorrect handling of StringType enum in MiniscriptDescriptor::ToStringHelper

03

Affected Taproot (tr()) and segwit (wsh()) miniscript descriptors

04

listdescriptors RPC output could contain mixed markers before fix

05

No memory corruption, consensus, or cryptographic flaw identified

Risk score

Why this scored 26/100

Our methodology →
Potential impact 4/30
Exploitability 3/25
Stealth signal 3/15
Affected reach 5/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.