bitcoin/script: use bitcoin varint encoder
What changed, and why it matters
This commit replaces a hand-written Bitcoin variable-length integer encoder with one from the well-known rust-bitcoin library. The old code appears to have been correct, so this is a code-quality and maintainability improvement rather than a fix for a known security bug. It reduces the chance of future mistakes by relying on a widely reviewed standard implementation.
No immediate action required. Treat as routine refactoring. If reviewing for a release, verify that the rust-bitcoin dependency version is pinned and that its VarInt serializer has not been modified by local patches.
Security signals we found
Replaces custom serialization with a standard library implementation
No change in encoding behavior observed in the diff
Original implementation matched Bitcoin VarInt specification
Potential reduction in future implementation risk
Evidence from the diff
The patch removes a local Rust implementation of Bitcoin’s VarInt serialization in serialize_varint() and delegates to bitcoin::consensus::encode::serialize(&VarInt(value)). The original local implementation handled all four VarInt ranges (0x00-0xFC, 0xFD+uint16, 0xFE+uint32, 0xFF+uint64) using little-endian encoding, which matches the Bitcoin specification. No behavioral change is expected. The change is a refactoring to use a maintained, audited dependency instead of custom code.
Changed components
src/rust/bitbox02-rust/src/hww/api/bitcoin/script.rsInspect captured patch +1 / −17
diff --git a/src/rust/bitbox02-rust/src/hww/api/bitcoin/script.rs b/src/rust/bitbox02-rust/src/hww/api/bitcoin/script.rs
index e4c2267..8c5389f 100644
--- a/src/rust/bitbox02-rust/src/hww/api/bitcoin/script.rs
+++ b/src/rust/bitbox02-rust/src/hww/api/bitcoin/script.rs
@@ -5,23 +5,7 @@ use alloc::vec::Vec;
/// Serialize a number in the VarInt encoding.
/// https://en.bitcoin.it/wiki/Protocol_documentation#Variable_length_integer
pub fn serialize_varint(value: u64) -> Vec<u8> {
- let mut out: Vec<u8> = Vec::new();
- match value {
- 0..=0xFC => out.push(value as _),
- 0xFD..=0xFFFF => {
- out.push(0xFD);
- out.extend_from_slice(&(value as u16).to_le_bytes());
- }
- 0x10000..=0xFFFFFFFF => {
- out.push(0xFE);
- out.extend_from_slice(&(value as u32).to_le_bytes());
- }
- _ => {
- out.push(0xFF);
- out.extend_from_slice(&value.to_le_bytes());
- }
- }
- out
+ bitcoin::consensus::encode::serialize(&bitcoin::consensus::encode::VarInt(value))
}
#[cfg(test)]
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.