miniscript: correct and_v() properties
What the developer wrote
Authored by Antoine Poinsot
miniscript: correct and_v() properties
and_v() must never be 'd'. This is not a bug fix since this was
unreachable in valid Miniscripts: the first sub of an and_v() must be of
type V, which conflicts with (i.e. never has) property 'd'.
What changed, and why it matters
This commit tightens the internal type-checking rules for a Bitcoin script feature called Miniscript. Specifically, it removes a property ('d', meaning 'dissatisfiable') from the logical 'and_v()' fragment because that property could never actually occur in valid Miniscripts. The commit message explicitly says this is not a bug fix because the old rule was unreachable in valid inputs, so there is no known way to exploit it.
Treat as a low-risk correctness/maintenance patch. No urgent security action is indicated by the commit or message. Reviewers may want to confirm that no invalid Miniscript construction path could reach the old rule, consistent with the commit message's claim.
Security signals we found
Type-system correction in Miniscript property computation
Removal of unreachable 'dissatisfiable' property for and_v() fragment
No input validation or memory-safety change
Evidence from the diff
In src/script/miniscript.cpp, the ComputeType function for the and_v() fragment previously computed the ‘d’ (dissatisfiable) property as the conjunction of the ‘d’ properties of both subexpressions (x & y & ‘dmz’). The patch removes ‘d’ from that conjunction (x & y & ‘mz’). The commit message states this is a correction, not a bug fix, because valid Miniscripts require the first sub of and_v() to be of type V, which is incompatible with property ‘d’, making the old ‘d’ computation unreachable.
Changed components
src/script/miniscript.cppMiniscript and_v() fragment type computationInspect captured patch +1 / −1
diff --git a/src/script/miniscript.cpp b/src/script/miniscript.cpp
index f04291af..6dc154a8 100644
--- a/src/script/miniscript.cpp
+++ b/src/script/miniscript.cpp
@@ -144,7 +144,7 @@ Type ComputeType(Fragment fragment, Type x, Type y, Type z, const std::vector<Ty
(y & "KVB"_mst).If(x << "V"_mst) | // B=V_x*B_y, V=V_x*V_y, K=V_x*K_y
(x & "n"_mst) | (y & "n"_mst).If(x << "z"_mst) | // n=n_x+z_x*n_y
((x | y) & "o"_mst).If((x | y) << "z"_mst) | // o=o_x*z_y+z_x*o_y
- (x & y & "dmz"_mst) | // d=d_x*d_y, m=m_x*m_y, z=z_x*z_y
+ (x & y & "mz"_mst) | // m=m_x*m_y, z=z_x*z_y
((x | y) & "s"_mst) | // s=s_x+s_y
"f"_mst.If((y << "f"_mst) || (x << "s"_mst)) | // f=f_y+s_x
(y & "ux"_mst) | // u=u_y, x=x_y
Why this scored 28/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.