AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 35 Bitcoin

Change PushBytes::read_scriptint to i32 return type

Public commit record

What the developer wrote

Authored by Mitchell Bagot

85/100 · Strong
Change PushBytes::read_scriptint to i32 return type

The PushBytes::read_scriptint function currently returns an i64 value.
This is due to values in scripts potentially reaching 5 bytes in size
after various operations (e.g. ADD) have been applied. Despite this,
the function implementation currently prevents any value greater than
32 bits in size from being returned.

Change read_scriptint to return an i32, and introduce read_cltv_scriptint
to read up to 5 byte values into an i64.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This commit changes a Bitcoin script number-reading function so it returns a 32-bit integer instead of a 64-bit one, and adds a separate function for reading the larger 5-byte numbers used by the CHECKLOCKTIMEVERIFY opcode. The change makes the API more accurately reflect what the code actually allows, and reduces the risk that callers accidentally treat a 5-byte value as a normal script number. It appears to be a defensive correctness fix rather than a response to an active exploit.

Recommended action

Review downstream callers of read_scriptint and read_scriptint_non_minimal to ensure they handle the new i32 return type correctly. Confirm that read_cltv_scriptint is used wherever 5-byte CLTV values are parsed. Consider whether this change warrants a semver bump because it alters public return types.

Security signals we found

01

API type narrowing to match actual accepted input range

02

Separation of normal script integers from CLTV-sized integers

03

Reduction of caller confusion between 4-byte and 5-byte script-number semantics

04

No new unsafe code, panics guarded by documented invariants

Risk score

Why this scored 35/100

Our methodology →
Potential impact 8/30
Exploitability 6/25
Stealth signal 5/15
Affected reach 7/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.