AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 34 Bitcoin

bitcoin: remove `From<Message>` for `TapSighash`

Public commit record

What the developer wrote

Authored by jrakibi

68/100 · Adequate
bitcoin: remove `From<Message>` for `TapSighash`

The `Message` type is specific to ECDSA and should not be used for Taproot
sighashes. Taproot sighashes are just 32 bytes long.
With these changes, `From<Message>` is only used for legacy and SegWit v0
sighashes, not for Taproot
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit removes a convenience conversion that let developers accidentally treat a Taproot transaction digest as an ECDSA-style message. It is a defensive API cleanup: it makes the library's types more precise so users cannot pass a Taproot sighash through an ECDSA-specific wrapper. There is no direct bug being fixed, but the change prevents a class of future misuse where a Taproot signature could be computed over a wrongly-wrapped hash.

Recommended action

Review downstream code that may have relied on `From<Message>` for `TapSighash` or on `Psbt::sighash_taproot` returning a `Message`; update to use `TapSighash` and `to_byte_array()`. No urgent security deployment is required, but include in the next regular release to improve API safety.

Security signals we found

01

API misuse prevention: removes conversion of Taproot sighash into ECDSA-specific Message type

02

Type narrowing: TapSighash no longer implements From<Message>

03

All Taproot signing call sites now pass raw 32-byte sighash to Schnorr signing functions

04

No functional change to signature hash computation or verification logic

Risk score

Why this scored 34/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 4/15
Affected reach 6/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.