core/Cargo.toml (1)

10-10: New crate wired into the core crate
Non-optional defuse-bip322 means every downstream consumer now builds this crate. If build size or compile time is a concern, consider gating it behind a feature (similar to other *_connect crates). Otherwise LGTM.

bip340/src/lib.rs (1)

1-4: Crate root minimal but complete
Re-exporting all items from the double and tagged modules is fine for a small utility crate. If the public surface grows, consider explicit exports to avoid namespace pollution.

core/src/payload/multi.rs (1)

56-57: Add documentation for BIP-322 variant.

The TODO comment indicates missing documentation for the new BIP-322 variant. This should be completed to maintain consistency with other well-documented variants.

-    // TODO: docs
-    Bip322(SignedBip322Payload),
+    /// BIP-322: The standard for Bitcoin generic message signing.
+    /// For more details, refer to [BIP-322](https://github.com/bitcoin/bips/blob/master/bip-0322.mediawiki).
+    Bip322(SignedBip322Payload),

Would you like me to open an issue to track this documentation task?

bip322/src/der.rs (2)

49-53: Add validation for canonical DER length encoding.

The current implementation doesn't validate against non-canonical length encodings. According to DER rules, the length should be encoded in the shortest possible form. For example, a length of 127 should use short form (0x7F), not long form (0x81 0x7F).

Consider adding validation to reject non-canonical encodings:

 let mut length = 0usize;
 for &byte in bytes.iter().take(len_bytes + 1).skip(1) {
     length = (length << 8) | usize::from(byte);
 }
+
+// Validate canonical encoding - no leading zeros except for single zero byte
+if len_bytes > 1 && bytes[1] == 0 {
+    return None; // Non-canonical: leading zero
+}
+
+// Validate minimal encoding - could have used short form
+if len_bytes == 1 && length <= 127 {
+    return None; // Non-canonical: should use short form
+}

---

245-273: Consider adding test cases for edge conditions.

The test suite is comprehensive but could benefit from additional edge cases:

#[test]
fn test_parse_der_ecdsa_signature_trailing_data() {
    // Signature with extra bytes after valid content
    let invalid_der = vec![
        0x30, 0x06, // SEQUENCE, length 6  
        0x02, 0x01, 0x01, // INTEGER, length 1, value 0x01 (R)
        0x02, 0x01, 0x02, // INTEGER, length 1, value 0x02 (S)
        0xFF, // Extra byte
    ];
    assert_eq!(parse_der_ecdsa_signature(&invalid_der), None);
}

#[test]
fn test_parse_der_length_non_canonical() {
    // Length 127 encoded in long form (should use short form)
    let non_canonical = vec![0x81, 0x7F];
    // Currently passes but should fail with canonical validation
    assert_eq!(parse_der_length(&non_canonical), Some((127, 2)));
}

bip322/README.md (1)

139-154: Example code references undefined function.

The example uses witness_from_signature_data() which is not defined in the codebase. Consider providing a complete example or clearly marking this as pseudo-code.

 // Create a BIP-322 payload
+// Note: This is a simplified example. In practice, you would parse the witness
+// data from the actual BIP-322 signature format.
 let payload = SignedBip322Payload {
     address: "bc1q9vza2e8x573nczrlzms0wvx3gsqjx7vavgkx0l".parse()?,
     message: "Hello Bitcoin!".to_string(),
-    signature: witness_from_signature_data(signature_bytes),
+    signature: Witness::from_stack(vec![signature_bytes, public_key_bytes]),
 };

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

bip322/src/der.rs (1)

160-220: The total length validation concern has been properly addressed.

The implementation now includes comprehensive validation (lines 209-217) that ensures:

• The actual content length matches the declared total length
• No trailing data exists after the signature
• The total bytes consumed match the input length

This addresses the previous review comment about preventing malformed signatures with trailing garbage data.

bip322/src/bitcoin_minimal.rs (3)

286-321: The zero-filled array issue has been properly addressed.

The to_address_data() method now correctly returns Result<AddressData, AddressError> and uses ok_or(AddressError::MissingRequiredData) instead of unwrap_or with zero arrays. This ensures missing cryptographic data is handled explicitly and safely.

---

831-908: Witness data serialization has been properly implemented.

The consensus_encode method now correctly serializes witness data:

• Detects witness data presence (line 836)
• Writes witness marker and flag bytes (0x00, 0x01) when needed
• Serializes witness stacks for all inputs after the outputs

This addresses the previous concern about missing witness data serialization for segwit transactions.

---

996-1111: BIP-143 segwit v0 sighash algorithm has been correctly implemented.

The segwit_v0_encode_signing_data_to method now properly implements the BIP-143 specification:

• Writes all 10 required fields in the correct order
• Uses helper methods to compute hashPrevouts, hashSequence, and hashOutputs
• Correctly serializes sighash type as a 4-byte little-endian integer
• Includes proper bounds checking for input_index

This addresses the previous concern about incorrect BIP-143 implementation.

bip322/src/der.rs (1)

210-210: Fix formatting issue.

Run cargo fmt to fix the formatting issue on this line.

bip322/src/bitcoin_minimal.rs (1)

833-833: Fix formatting issues throughout the file.

Run cargo fmt to fix the formatting issues at multiple lines flagged by static analysis.

Also applies to: 888-888, 1035-1035, 1066-1066, 1079-1079, 1091-1091

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

bip322/src/der.rs (1)

289-300: Consider adding tests with realistic ECDSA signature sizes.

The current tests use minimal values (R=0x01, S=0x02) which are good for structural validation. Consider adding tests with realistic Bitcoin signature sizes where R and S are typically 32-33 bytes each, to ensure the parsing handles real-world signatures correctly.

Example test case:

#[test]
fn test_parse_der_ecdsa_signature_realistic_size() {
    // Realistic 71-byte DER signature (common in Bitcoin)
    let realistic_der = vec![
        0x30, 0x45, // SEQUENCE, length 69
        0x02, 0x21, // INTEGER, length 33 (R with leading zero for sign)
        0x00, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11,
        0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
        0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22,
        0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99, 0xaa, 0xbb,
        0x02, 0x20, // INTEGER, length 32 (S)
        0x11, 0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88,
        0x99, 0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11,
        0x22, 0x33, 0x44, 0x55, 0x66, 0x77, 0x88, 0x99,
        0xaa, 0xbb, 0xcc, 0xdd, 0xee, 0xff, 0x11, 0x22,
    ];
    
    let result = parse_der_ecdsa_signature(&realistic_der);
    assert!(result.is_some());
    let (r, s) = result.unwrap();
    assert_eq!(r.len(), 33);
    assert_eq!(s.len(), 32);
}

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

bip322/src/lib.rs (1)

607-2563: LGTM! Comprehensive test coverage with excellent edge case handling.

The test suite thoroughly covers address parsing, transaction structure, error conditions, Unicode handling, and network validation. The inclusion of official BIP-322 test vectors is particularly valuable.

Consider adding integration tests with real Bitcoin signatures to validate the complete signing and verification flow end-to-end. This could be done by:

1. Using known test vectors with real signatures from BIP-322 reference implementations
2. Or integrating with a Bitcoin signing library in tests to generate valid signatures

Example test structure:

#[test]
fn test_real_signature_verification() {
    // Test vector from BIP-322 reference implementation
    let test_vector = SignedBip322Payload {
        address: "bc1q...".parse().unwrap(),
        message: "Hello World".to_string(),
        signature: Witness::from_stack(vec![
            hex!("30440220..."), // Real DER signature
            hex!("02..."),      // Real public key
        ]),
    };
    
    let recovered_pubkey = test_vector.verify();
    assert!(recovered_pubkey.is_some(), "Real signature should verify");
    // Verify the recovered pubkey matches expected
}

bip322/src/bitcoin_minimal.rs (1)

351-406: Consider returning Result from script_pubkey() to avoid panics.

The method uses expect() calls that could panic if required data is missing. While the documentation states to call to_address_data() first, this creates a potential footgun.

Consider making this method return Result<ScriptBuf, AddressError>:

-pub fn script_pubkey(&self) -> ScriptBuf {
+pub fn script_pubkey(&self) -> Result<ScriptBuf, AddressError> {
     match self.address_type {
         AddressType::P2PKH => {
-            let pubkey_hash = self.pubkey_hash.expect("P2PKH address missing pubkey_hash");
+            let pubkey_hash = self.pubkey_hash.ok_or(AddressError::MissingRequiredData)?;
             // ... rest of implementation
-            ScriptBuf { inner: script }
+            Ok(ScriptBuf { inner: script })
         }
         // ... other cases
     }
 }

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

bip322/src/lib.rs (4)

68-172: Critical: Incorrect sighash algorithm for P2PKH and P2SH addresses.

This is a duplicate of a previous critical issue. The implementation uses segwit v0 sighash algorithm for all address types, but P2PKH and P2SH should use the legacy sighash algorithm. The compute_message_hash method (lines 353-377) only implements segwit v0 sighash computation.

---

422-441: Critical: Missing redeem script validation for P2SH addresses.

This is a duplicate of a previous critical issue. The P2SH verification extracts the redeem script but never validates it. According to BIP-322, you must verify that HASH160(redeem_script) == script_hash from the address and execute the redeem script to validate the signature.

---

443-463: Critical: Missing witness script validation for P2WSH addresses.

This is a duplicate of a previous critical issue. The witness script is extracted but never validated or executed. You need to validate that the witness script hash matches the address and execute the script according to BIP-322.

---

465-491: Critical: Limited signature format support.

This is a duplicate of a previous critical issue. The implementation only accepts raw 64-byte signatures and recovery IDs 0-1, but Bitcoin signatures are typically in DER format and recovery IDs should range from 0-3.

bip322/src/lib.rs (2)

943-949: Fix unnecessary closure usage.

The static analysis tool correctly identified an unnecessary closure. The unwrap_or_else can be replaced with unwrap_or since you're providing a constant value, not calling a function.

-            address: "bc1q9vza2e8x573nczrlzms0wvx3gsqjx7vavgkx0l"
-                .parse()
-                .unwrap_or_else(|_| Address {
-                    address_type: AddressType::P2WPKH,
-                    pubkey_hash: Some([1u8; 20]),
-                    witness_program: None,
-                }),
+            address: "bc1q9vza2e8x573nczrlzms0wvx3gsqjx7vavgkx0l"
+                .parse()
+                .unwrap_or(Address {
+                    address_type: AddressType::P2WPKH,
+                    pubkey_hash: Some([1u8; 20]),
+                    witness_program: None,
+                }),

---

512-605: Note: Limited script execution capabilities.

The execute_redeem_script and execute_witness_script methods only support simple P2PKH-style scripts. This is documented as a limitation with plans for "full Bitcoin script interpreter" in the future. For production use, consider implementing more comprehensive script validation.

bip322/src/bitcoin_minimal.rs (2)

344-399: Consider making script_pubkey() return Result to avoid panics.

While the documentation states to call to_address_data() first, the expect() calls in script_pubkey() could still panic if callers don't follow this convention.

Consider returning Result<ScriptBuf, AddressError>:

-pub fn script_pubkey(&self) -> ScriptBuf {
+pub fn script_pubkey(&self) -> Result<ScriptBuf, AddressError> {
     match self.address_type {
         AddressType::P2PKH => {
-            let pubkey_hash = self.pubkey_hash.expect("P2PKH address missing pubkey_hash");
+            let pubkey_hash = self.pubkey_hash.ok_or(AddressError::MissingRequiredData)?;
             // ... rest of implementation
-            ScriptBuf { inner: script }
+            Ok(ScriptBuf { inner: script })
         }
         // ... similar changes for other variants
     }
 }

This would provide consistent error handling throughout the API.

---

1138-1200: Good test coverage for core functionality.

The existing tests properly verify NEAR SDK integration, BIP340 compatibility, and basic address parsing. The use of rstest for parameterized testing is excellent.

Consider adding tests for:

• Error conditions in address parsing (invalid checksums, wrong lengths)
• Edge cases in transaction encoding
• Sighash computation with different transaction structures
• Script generation for all address types

This would provide more comprehensive coverage of the module's functionality.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

bip322/src/lib.rs (4)

71-175: Critical: Incorrect sighash algorithm still not fixed.

All hash computation methods delegate to the same compute_message_hash function (lines 360-384), which only implements segwit v0 sighash algorithm. This is incorrect for P2PKH and P2SH addresses, which should use the legacy sighash algorithm according to BIP-322.

The issue identified in previous reviews has not been addressed.

---

360-384: Critical: Sighash algorithm issue persists.

The compute_message_hash method still only implements segwit v0 sighash algorithm for all address types. This is the same critical issue identified in previous reviews that remains unaddressed.

P2PKH and P2SH addresses require legacy sighash algorithm, not segwit v0.

---

463-483: Critical: P2WSH witness script validation still missing.

The witness script is extracted (line 472) but never validated or executed. This is the same critical security issue identified in previous reviews that remains unaddressed.

According to BIP-322, you must:

1. Verify that SHA256(witness_script) matches the witness program
2. Execute the witness script to validate the signature

---

485-511: Critical: Limited signature format support persists.

The signature recovery method still has the same limitations identified in previous reviews:

1. Only accepts raw 64-byte signatures (line 492), not DER format
2. Only tries recovery IDs 0-1 (line 497), should be 0-3 for Bitcoin standard

This limits compatibility with real Bitcoin signatures.

bip322/src/bitcoin_minimal.rs (1)

1138-1200: Good foundation but consider expanding test coverage.

The existing tests properly validate core functionality including NEAR SDK SHA256 compatibility, BIP340 tagged hashing, and basic address parsing. However, consider adding tests for:

• Error conditions in address parsing (invalid checksums, wrong lengths, unsupported formats)
• Transaction encoding/decoding round-trips
• Sighash computation with known test vectors
• Edge cases in witness program validation
• Script pubkey generation for all address types

The current tests provide a solid foundation, but more comprehensive coverage would increase confidence in the implementation's correctness across all supported scenarios.

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

bip322/src/error.rs (2)

40-41: Document the UnsupportedWitnessVersion variant for consistency and clarity

All other variants have helpful doc comments. Add a brief description and reference to BIPs 173/350 for v0 vs. v1+ rules.

-    UnsupportedWitnessVersion,
+    /// Unsupported witness version (e.g., v1+ which requires Bech32m per BIP-350).
+    /// See BIP-173/BIP-350 for valid combinations and encoding rules.
+    UnsupportedWitnessVersion,

---

52-61: Minor copy edit: capitalize “Bech32” in error message

Matches common usage and your other capitalization patterns.

-            Self::InvalidBech32 => write!(f, "Invalid bech32 encoding"),
+            Self::InvalidBech32 => write!(f, "Invalid Bech32 encoding"),

bip322/Cargo.toml (1)

18-22: Confirm necessity of runtime base64

base64 = "0.22" is included in both dependencies and dev-dependencies. If the crate itself doesn’t use base64 at runtime (only tests/tools do), consider moving it exclusively to [dev-dependencies] to keep the runtime surface smaller.

If helpful, I can scan the crate for base64 usage and propose a tidy-up.

bip322/validate_unisat_vector.py (6)

15-29: Strengthen Bech32 parsing and avoid bare except

• Validate witness version (expect 0 for P2WPKH/P2WSH).
• Support both 20 (P2WPKH) and 32 (P2WSH) lengths if desired.
• Replace bare except: with except Exception as e: and log for visibility.

 def parse_bech32_address(address):
     """Parse bech32 address to get witness program"""
     # Simple bech32 parsing (for P2WPKH)
     import bech32
     
     try:
         hrp, data = bech32.bech32_decode(address)
-        if hrp == 'bc' and data:
-            # Convert from 5-bit to 8-bit
-            decoded = bech32.convertbits(data[1:], 5, 8, False)
-            if decoded and len(decoded) == 20:
-                return bytes(decoded)
-    except:
-        pass
+        if hrp != 'bc' or not data:
+            return None
+        version = data[0]
+        if version != 0:
+            # Only v0 (Bech32) supported in this simplified parser
+            return None
+        # Convert from 5-bit to 8-bit
+        decoded = bech32.convertbits(data[1:], 5, 8, False)
+        if not decoded:
+            return None
+        # Accept P2WPKH (20) or P2WSH (32) witness program sizes
+        if len(decoded) in (20, 32):
+            return bytes(decoded)
+    except Exception as e:
+        print(f"bech32 parse error: {e}")
     return None

---

6-10: Remove unused import

unhexlify is unused.

-import base64
-import hashlib
-from binascii import hexlify, unhexlify
+import base64
+import hashlib
+from binascii import hexlify

---

101-124: Stub returns True; consider at least checking HASH160 when available

This function currently always returns True, which can mask invalid cases. If hashlib.new('ripemd160') is available, you can compute HASH160 to compare with the witness program. Otherwise, make the placeholder explicit with a FIXME to avoid accidental reliance.

I can provide a small fallback-based implementation that uses hashlib.new('ripemd160') when present and degrades gracefully otherwise.

---

147-159: Avoid f-strings without placeholders

This f-string has no placeholders, which linters flag.

-        print(f"✓ Address parsed successfully")
+        print("✓ Address parsed successfully")

---

165-179: Remove or use the unused variable and avoid unused imports for availability checks

• recovered_pubkey is assigned but not used.
• For availability checks, prefer importlib.util.find_spec over importing modules you don’t use (avoids F401).

-    recovered_pubkey = recover_pubkey_from_signature(message_hash, signature_bytes)
+    _ = recover_pubkey_from_signature(message_hash, signature_bytes)
@@
-    try:
-        import bech32
-        print("✓ bech32 library available")
-    except ImportError:
-        print("✗ bech32 library not available - run: pip install bech32")
+    import importlib.util
+    if importlib.util.find_spec("bech32"):
+        print("✓ bech32 library available")
+    else:
+        print("✗ bech32 library not available - run: pip install bech32")
@@
-    try:
-        import ecdsa
-        print("✓ ecdsa library available")
-    except ImportError:
-        print("✗ ecdsa library not available - run: pip install ecdsa")
+    if importlib.util.find_spec("ecdsa"):
+        print("✓ ecdsa library available")
+    else:
+        print("✗ ecdsa library not available - run: pip install ecdsa")

---

54-100: Placeholder recovery routine

The recovery function prints diagnostics and returns None. That’s fine for an exploratory script, but call it out as a deliberate stub to avoid confusion. If you want parity with the comprehensive script, consider factoring common bits or guarding with a “--verbose” flag.

Happy to help replace this with a concrete secp256k1 recovery using coincurve or bitcoinlib if acceptable for your environment.

bip322/validate_unisat_comprehensive.py (4)

15-29: Harden Bech32 parsing and avoid bare except

As in the vector script, validate witness version and length, and avoid bare except.

 def parse_bech32_address(address):
     """Parse bech32 address to get witness program"""
     import bech32
     
     try:
         hrp, data = bech32.bech32_decode(address)
-        if hrp == 'bc' and data:
-            # Convert from 5-bit to 8-bit
-            decoded = bech32.convertbits(data[1:], 5, 8, False)
-            if decoded and len(decoded) == 20:
-                return bytes(decoded)
-    except:
-        pass
+        if hrp != 'bc' or not data:
+            return None
+        version = data[0]
+        if version != 0:
+            return None
+        # Convert from 5-bit to 8-bit
+        decoded = bech32.convertbits(data[1:], 5, 8, False)
+        if not decoded:
+            return None
+        if len(decoded) in (20, 32):
+            return bytes(decoded)
+    except Exception as e:
+        print(f"bech32 parse error: {e}")
     return None

---

6-10: Remove unused import

unhexlify is unused.

-import base64
-import hashlib
-from binascii import hexlify, unhexlify
+import base64
+import hashlib
+from binascii import hexlify

---

53-180: Trim unused imports and variables in recovery path

• possible_public_keys_from_signature and Key are imported but unused.
• point is assigned but not used.
• Consider consolidating recovery logic or gating heavy debug under a verbosity switch.

-        import ecdsa
-        from ecdsa.curves import SECP256k1
-        from ecdsa.ecdsa import possible_public_keys_from_signature
+        import ecdsa
+        from ecdsa.curves import SECP256k1
@@
-            from bitcoinlib.encoding import hash160
-            from bitcoinlib.keys import Key
+            from bitcoinlib.encoding import hash160
@@
-                            point = Point(SECP256k1.curve, x, y, order)
+                            _ = Point(SECP256k1.curve, x, y, order)

---

201-206: Avoid f-strings without placeholders

Minor linter cleanup.

-        print(f"✓ Address parsed successfully")
-        print(f"Expected witness program: {hexlify(witness_program).decode()}")
+        print("✓ Address parsed successfully")
+        print(f"Expected witness program: {hexlify(witness_program).decode()}")

bip322/src/transaction.rs (2)

49-54: Nit: clarify the comment about script length; it’s 1 opcode + 1 push length + 32 bytes

The comment says “2 opcodes + 32 bytes message hash” but the second byte is the push length (0x20), not an opcode.

Apply this diff to make the comment precise:

-                let mut script = Vec::with_capacity(34); // 2 opcodes + 32 bytes message hash
-                script.push(OP_0); // Push empty stack item
-                script.push(32u8); // Push 32 bytes
+                let mut script = Vec::with_capacity(34); // OP_0 + push(32) + 32-byte message hash
+                script.push(OP_0); // push empty stack item
+                script.push(32u8); // next 32 bytes are pushed as data

---

154-161: Txid vs wtxid nuance; consider documenting or enforcing no-witness serialization

The txid in Bitcoin is the double-SHA256 of the non-witness serialization. With your current approach, if a Transaction ever carries non-empty witnesses, consensus_encode may produce the segwit-serialization (marker/flag + witness), yielding a wtxid instead of a txid. In this module you only build empty-witness transactions, so it’s fine, but the helper is generic and could be reused.

At minimum, document that tx must have empty witnesses or implement a non-witness encoder to make it bulletproof.

Apply this diff to document the constraint:

-/// Computes the transaction ID (TXID) by double SHA256 hashing the serialized transaction.
+/// Computes the transaction ID (TXID) by double SHA256 hashing the serialized transaction.
+/// NOTE: Assumes no witness data is present in `tx`. If any input carries a non-empty witness,
+/// this would hash the segwit serialization (wtxid) rather than the legacy txid.

bip322/src/verification.rs (1)

98-107: Rename local buffer to avoid shadowing the compressed parameter

The local compressed Vec shadows the compressed: bool parameter. Rename to improve readability and avoid confusion.

Apply this diff:

-        let mut compressed = Vec::with_capacity(33);
-        compressed.push(0x02);
-        compressed.extend_from_slice(&raw_pubkey[..32]);
+        let mut comp_buf = Vec::with_capacity(33);
+        comp_buf.push(0x02);
+        comp_buf.extend_from_slice(&raw_pubkey[..32]);
 
         let mut response = Vec::with_capacity(2);
-        response.push(defuse_near_utils::digest::Hash160::digest(&compressed).into());
+        response.push(defuse_near_utils::digest::Hash160::digest(&comp_buf).into());
 
-        compressed.as_mut_slice()[0] = 0x03;
-        response.push(defuse_near_utils::digest::Hash160::digest(&compressed).into());
+        comp_buf.as_mut_slice()[0] = 0x03;
+        response.push(defuse_near_utils::digest::Hash160::digest(&comp_buf).into());

bip322/src/lib.rs (1)

65-76: API naming mismatch: with_compact_signature does not enforce compact-only

The constructor parses either compact or full signatures via from_str. Either tighten the API to ensure compact-only, or rename the constructor to avoid confusion.

Two options:

• Enforce compact-only:

-        let signature = Bip322Signature::from_str(signature_base64)?;
+        let signature = Bip322Signature::from_str(signature_base64)?;
+        if !matches!(signature, Bip322Signature::Compact { .. }) {
+            return Err(Bip322Error::InvalidFormat);
+        }

• Or rename the constructor (requires call-site updates):

-    pub fn with_compact_signature(
+    pub fn with_parsed_signature(

bip322/src/hashing.rs (1)

145-154: P2WSH not supported here; accept witness script input instead of panicking

Panicking on P2WSH will be surprising if higher layers ever request a P2WSH sighash. Consider accepting the witness script as an argument (or wiring through from signature parsing) and computing the BIP-143 preimage accordingly. At minimum, document the unsupported state.

Minimal doc update:

-            Address::P2WSH { .. } => {
+            Address::P2WSH { .. } => {
                 // For P2WSH, the scriptCode must be the witness script itself.
                 // It is not derivable from the address; you'll need the script provided.
-                // If you don't support general P2WSH here, you can return a hash that will
-                // never verify, or panic with a clear message.
+                // This helper currently does not support providing the witness script.
+                // Upstream should compute segwit v0 sighash with the witness script
+                // available from the signature and not call this path.
                 panic!("compute_segwit_v0_sighash: P2WSH requires the witness script (not derivable from address)")
             }

Preferred signature change (follow-up PR):

• Add a variant compute_segwit_v0_sighash_with_script(to_spend, to_sign, witness_script: &[u8]).
• Dispatch to it when Address::P2WSH is used.

bip322/src/tests.rs (1)

335-353: Test description mismatch: 65-byte is a valid compact signature length

The test name/message imply an invalid signature length, but a 65-byte (r||s||recid) is the expected compact size. The failure here is due to signature content, not its length. Adjust wording to avoid confusion.

Apply this diff:

-    fn test_signature_verification_invalid_signature_length() {
+    fn test_signature_verification_invalid_signature_content() {
@@
-        let invalid_signature = [0u8; 65]; // Valid 65-byte signature (but empty, so will fail)
+        let invalid_signature = [0u8; 65]; // Valid length, invalid content (all zeros)
@@
-            "Invalid signature length should fail verification"
+            "Invalid signature content should fail verification"

bip322/src/signature.rs (2)

85-87: Be more tolerant to base64 input variants (no padding).

Wallets sometimes produce base64 without padding. Consider a fallback to STANDARD_NO_PAD before failing.

-        let decoded = general_purpose::STANDARD.decode(s)?;
+        let decoded = match general_purpose::STANDARD.decode(s) {
+            Ok(b) => b,
+            Err(e) => {
+                // tolerate missing padding
+                general_purpose::STANDARD_NO_PAD
+                    .decode(s)
+                    .map_err(|_| Bip322Error::InvalidBase64(e))?
+            }
+        };

---

88-96: Avoid panicking in FromStr; return a typed error for invalid 65-byte input.

Even if length-checked, expect is unnecessary in parsing untrusted data. Return InvalidCompactSignature instead of panicking.

-        if decoded.len() == 65 {
-            let sig_bytes: [u8; 65] = decoded.try_into().expect("Invalid signature length"); // Should never fail
-            return Ok(Bip322Signature::Compact {
-                signature: sig_bytes,
-            });
-        }
+        if decoded.len() == 65 {
+            let mut sig_bytes = [0u8; 65];
+            sig_bytes.copy_from_slice(&decoded);
+            return Ok(Bip322Signature::Compact { signature: sig_bytes });
+        }

bip322/src/bitcoin_minimal.rs (3)

15-17: Doc mismatch: code supports P2SH/P2WSH but docs say “supports only P2PKH/P2WPKH”.

Keep the module-level docs in sync with current capabilities to avoid confusion.

Suggested edit:

• Replace “MVP Focus: Supports only P2PKH and P2WPKH” with a note that P2SH and P2WSH are also supported now.

Also applies to: 23-24

---

425-431: Same here: avoid const fn for ScriptBuf::new().

For consistency and portability, make this a regular constructor.

-impl ScriptBuf {
-    pub const fn new() -> Self {
-        Self { inner: Vec::new() }
-    }
+impl ScriptBuf {
+    pub fn new() -> Self {
+        Self { inner: Vec::new() }
+    }

---

393-395: Avoid unwrap() in address parsing; map errors explicitly.

Parsing “bc” is infallible, but unwrap() is unnecessary in critical parsing code.

-    if hrp != Hrp::parse("bc").unwrap() {
+    if Hrp::parse("bc").map_err(|_| AddressError::InvalidBech32)? != hrp {
         return Err(AddressError::InvalidBech32);
     }

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

bip322/src/signature.rs (2)

373-387: Do not return zero-filled placeholder keys for compressed pubkeys

Fabricating [0u8; 64] on “validation success” is dangerous and can leak fake key material downstream. Return None unless you can produce a real key.

Apply this diff:

             ParsedPublicKey::Compressed(compressed) => {
                 // Validate compressed public key against address
                 if crate::verification::validate_compressed_pubkey_matches_address(
                     compressed, address,
                 ) {
-                    // Validation succeeded, but we cannot provide uncompressed format
-                    // This indicates a successful verification but inability to decompress
-                    // For now, we'll create a placeholder uncompressed key to indicate success
-                    // TODO: Implement proper decompression or change API to accept compressed keys
-                    Some([0u8; 64]) // Placeholder indicating successful validation
+                    // We should not fabricate key bytes.
+                    // TODO: either decompress or change API to accept compressed keys.
+                    None
                 } else {
                     None
                 }
             }

---

450-473: Fix Bitcoin Signed Message hash: missing CompactSize(prefix) before the prefix

Without writing the CompactSize length of the prefix prior to the prefix, standard wallet signatures won’t verify.

Apply this diff:

         // Create the full message with prefix and length
         let mut full_message = Vec::new();
-        full_message.extend_from_slice(prefix);
+        // Write CompactSize length of the prefix first
+        Self::encode_varint(prefix.len() as u64, &mut full_message);
+        full_message.extend_from_slice(prefix);

         // Add message length as proper varint
         Self::encode_varint(message_bytes.len() as u64, &mut full_message);

bip322/src/bitcoin_minimal.rs (1)

517-595: Consensus encoding uses write(...); switch to write_all(...) to avoid partial writes

Write::write is allowed to perform partial writes. For consensus serialization this is unsafe and can produce truncated encodings depending on the writer.

Apply the pattern below throughout this function (illustrative subset):

-        // Version (4 bytes, little-endian)
-        len += writer.write(&self.version.to_le_bytes())?;
+        // Version (4 bytes, little-endian)
+        writer.write_all(&self.version.to_le_bytes())?;
+        len += 4;
@@
-        if has_witness {
-            len += writer.write(&[0x00])?; // Marker byte
-            len += writer.write(&[0x01])?; // Flag byte
-        }
+        if has_witness {
+            writer.write_all(&[0x00, 0x01])?; // Marker and flag
+            len += 2;
+        }
@@
-            len += writer.write(&input.previous_output.txid.0)?;
-            len += writer.write(&input.previous_output.vout.to_le_bytes())?;
+            writer.write_all(&input.previous_output.txid.0)?;
+            writer.write_all(&input.previous_output.vout.to_le_bytes())?;
+            len += 32 + 4;
@@
-            len += writer.write(&input.script_sig.inner)?;
+            writer.write_all(&input.script_sig.inner)?;
+            len += input.script_sig.inner.len();
@@
-            len += writer.write(&input.sequence.to_le_bytes())?;
+            writer.write_all(&input.sequence.to_le_bytes())?;
+            len += 4;
@@
-            len += writer.write(&output.value.to_le_bytes())?;
+            writer.write_all(&output.value.to_le_bytes())?;
+            len += 8;
@@
-            len += writer.write(&output.script_pubkey.inner)?;
+            writer.write_all(&output.script_pubkey.inner)?;
+            len += output.script_pubkey.inner.len();
@@
-                    len += writer.write(witness_item)?;
+                    writer.write_all(witness_item)?;
+                    len += witness_item.len();
@@
-        len += writer.write(&self.lock_time.to_le_bytes())?;
+        writer.write_all(&self.lock_time.to_le_bytes())?;
+        len += 4;

Alternatively, drop manual len tracking and return Ok(()), since deterministic lengths can be recomputed by callers when needed.

tests/src/utils/crypto.rs (1)

16-17: Prefer borrowing over owning for message parameter in test Signer

Taking message: &str avoids an allocation and matches other signer methods that accept payloads by reference/value. Low impact in tests but cleaner.

bip322/src/signature.rs (1)

84-98: Be explicit about accepted compact formats and recovery IDs

Currently only 65-byte base64 signatures are accepted as “compact”. Many wallets emit DER-encoded signatures. If wallet compatibility is a goal, consider supporting DER + recovery-ID derivation, or clarify that only Bitcoin Core-style 65-byte compact signatures are accepted.

Would you like a follow-up patch to support DER parsing and recovery ID search (0..=3)?

bip322/src/bitcoin_minimal.rs (2)

11-23: Docs out of date: module already supports P2SH and P2WSH

The “MVP Focus” section claims only P2PKH/P2WPKH support, but the code implements P2SH and P2WSH too. Update to reflect current capabilities.

---

386-416: Bech32 HRP validation: avoid unwrap and use a constant HRP

Minor: replace Hrp::parse("bc").unwrap() with a compile-time parse or checked parse once to avoid potential panics in future refactors.

Example:

// top-level
const MAINNET_HRP: Hrp = Hrp::parse_unchecked("bc");
// ...
if hrp != MAINNET_HRP { return Err(AddressError::InvalidBech32); }

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

bip322/src/verification.rs (4)

58-66: Fix array-to-slice comparison and validate P2WPKH witness program format.

Current comparison uses [u8; 20] == &[u8], which is brittle. Also validate segwit v0 20-byte program.

-        Address::P2WPKH { witness_program } => {
-            let computed_hash: [u8; 20] =
-                defuse_near_utils::digest::Hash160::digest(compressed_pubkey).into();
-            computed_hash == witness_program.program.as_slice()
-        }
+        Address::P2WPKH { witness_program } => {
+            // Validate program: v0 and 20 bytes
+            if witness_program.version != 0 || witness_program.program.len() != 20 {
+                return false;
+            }
+            let computed_hash: [u8; 20] =
+                defuse_near_utils::digest::Hash160::digest(compressed_pubkey).into();
+            &computed_hash[..] == witness_program.program.as_slice()
+        }

---

82-88: Fix array-to-slice comparison and validate P2WSH witness program format.

Ensure v0/32-byte program and compare slices.

-        Address::P2WSH { witness_program } => {
+        Address::P2WSH { witness_program } => {
+            if witness_program.version != 0 || witness_program.program.len() != 32 {
+                return false;
+            }
             let pubkey_hash: [u8; 20] =
                 defuse_near_utils::digest::Hash160::digest(compressed_pubkey).into();
             let witness_script = build_witness_script(&pubkey_hash);
             let computed_script_hash = env::sha256_array(&witness_script);
-            computed_script_hash == witness_program.program.as_slice()
+            &computed_script_hash[..] == witness_program.program.as_slice()
         }

---

165-167: Fix P2WPKH raw recovered pubkey path: slice comparison and program validation.

Add v0/20-byte check and compare as slices.

-    computed_pubkey_hash[0] == witness_program.program.as_slice()
-        || computed_pubkey_hash[1] == witness_program.program.as_slice()
+    if witness_program.version != 0 || witness_program.program.len() != 20 {
+        return false;
+    }
+    &computed_pubkey_hash[0][..] == witness_program.program.as_slice()
+        || &computed_pubkey_hash[1][..] == witness_program.program.as_slice()

---

205-223: Fix slice comparisons and add P2WSH format checks (raw pubkey path).

Align with compressed path: validate (v0, 32 bytes) and compare slices.

-    let computed_script_hash = env::sha256_array(&witness_script);
-    if computed_script_hash == witness_program.program.as_slice() {
+    if witness_program.version != 0 || witness_program.program.len() != 32 {
+        return false;
+    }
+    let computed_script_hash = env::sha256_array(&witness_script);
+    if &computed_script_hash[..] == witness_program.program.as_slice() {
         return true;
     }
@@
-    let computed_script_hash = env::sha256_array(&witness_script);
-    if computed_script_hash == witness_program.program.as_slice() {
+    let computed_script_hash = env::sha256_array(&witness_script);
+    if &computed_script_hash[..] == witness_program.program.as_slice() {
         return true;
     }
@@
-    let computed_script_hash = env::sha256_array(&witness_script);
-    computed_script_hash == witness_program.program.as_slice()
+    let computed_script_hash = env::sha256_array(&witness_script);
+    &computed_script_hash[..] == witness_program.program.as_slice()

bip322/README.md (1)

75-87: Clarify P2SH support scope (legacy vs nested SegWit).

For P2SH, verification depends on the redeem script, which is not derivable from the address alone. The code path currently cannot infer nested P2SH-P2WPKH from the address and needs data from the signature/witness to compute the correct sighash. Please add a short note in README explaining that:

• P2SH-P2WPKH is supported via full signatures (redeem script contained within the signature).
• Legacy P2SH redeem scripts are only supported where the redeem script can be reconstructed (e.g., P2PKH template), otherwise caller must provide it.

bip322/src/hashing.rs (2)

94-107: P2SH with legacy sighash likely incorrect scriptCode.

compute_legacy_sighash() uses to_spend.output[0].script_pubkey as script_code. For P2SH with legacy signing, the scriptCode should be the redeem script, not the P2SH scriptPubKey. If you keep this function generic, add a note/assertion preventing its use for P2SH, or accept an explicit script_code parameter.

-    let script_code = &to_spend.output.first().expect("to_spend should have output").script_pubkey;
+    let script_code = &to_spend
+        .output
+        .first()
+        .expect("to_spend should have output")
+        .script_pubkey;
+    // Note: For P2SH legacy sighash, script_code must be the redeem script (not the P2SH script_pubkey).
+    // Callers should pass the correct script_code via a context-aware API.

---

102-105: Avoid panics in library code; return errors instead.

The .expect(...) calls will panic on malformed inputs. Prefer returning a Result from the hash computation functions and propagating errors to callers, especially since this can run in contract contexts where panics are costly.

Also applies to: 169-171

bip322/src/tests.rs (3)

296-316: Test name/comment mismatch: not actually testing “wrong witness type”.

The test constructs a P2PKH address with a zeroed compact signature. It doesn’t construct a mismatched witness type. Consider renaming the test or updating the scenario to build a full-format signature with an incompatible witness.

-fn test_signature_verification_wrong_witness_type() {
+fn test_signature_verification_invalid_compact_signature() {

---

340-361: Misleading test name: length is valid; content is invalid.

65 bytes is the correct length for a compact signature. Either rename the test or provide an invalid-length signature (e.g., 64 bytes) to actually test length handling.

- fn test_signature_verification_invalid_signature_length() {
+ fn test_signature_verification_invalid_signature() {
@@
-    let invalid_signature = [0u8; 65]; // Valid 65-byte signature (but empty, so will fail)
+    // Invalid: wrong size to exercise length validation
+    let invalid_signature = [0u8; 64];

---

535-576: Strengthen “working vectors” test to fail on unexpected failures.

Currently failures only log and don’t fail the test. If these are meant to be “working”, assert success so regressions are caught. If you want a softer guardrail, at least count failures and assert they’re zero.

-                match payload.verify() {
-                    Some(_pubkey) => {
-                        println!("✓ Working vector {i} verified successfully");
-                    }
-                    None => {
-                        println!(
-                            "✗ Working vector {i} failed verification (might need implementation fixes)"
-                        );
-                        // Don't panic here since we might have implementation issues to fix
-                    }
-                }
+                assert!(
+                    payload.verify().is_some(),
+                    "Working vector {i} failed verification: {}",
+                    vector.description
+                );

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.

bip322/README.md (1)

11-16: Clarify dependency claim to avoid misleading readers

"Zero-dependency cryptography" can be interpreted as “no dependencies,” yet the crate uses bs58, bech32, and base64 (as correctly listed below). Recommend rewording to “No external crypto libraries” and call out minimal, non-crypto encoding deps.

Apply this diff:

- - **🛡️ Production Ready**: Zero-dependency cryptography using only NEAR SDK host functions
+ - **🛡️ Production Ready**: No external crypto libraries — all cryptography uses NEAR SDK host functions

bip322/src/verification.rs (4)

156-167: Validate witness program format and compare slices in P2WPKH (recovered key path)

Add version/length checks and avoid array-to-slice equality pitfalls.

Apply this diff:

 fn validate_p2wpkh_address(
     recovered_pubkey: &[u8; 64],
     witness_program: &crate::bitcoin_minimal::WitnessProgram,
 ) -> bool {
+    // Enforce segwit v0 P2WPKH (20-byte program)
+    if witness_program.version != 0 || witness_program.program.len() != 20 {
+        return false;
+    }
     // P2WPKH addresses always use compressed public keys, so two possibilities,
     // depending on the y coordinate parity
     let computed_pubkey_hash = compute_pubkey_hash160_all(recovered_pubkey, true);
 
-    computed_pubkey_hash[0] == witness_program.program.as_slice()
-        || computed_pubkey_hash[1] == witness_program.program.as_slice()
+    &computed_pubkey_hash[0][..] == witness_program.program.as_slice()
+        || &computed_pubkey_hash[1][..] == witness_program.program.as_slice()
 }

---

197-223: Validate witness program format and compare slices in P2WSH (recovered key path)

Ensure v0/32-byte program and slice-to-slice comparisons to prevent accidental matches.

Apply this diff:

 fn validate_p2wsh_address(
     recovered_pubkey: &[u8; 64],
     witness_program: &crate::bitcoin_minimal::WitnessProgram,
 ) -> bool {
+    // Enforce segwit v0 P2WSH (32-byte program)
+    if witness_program.version != 0 || witness_program.program.len() != 32 {
+        return false;
+    }
     // Try uncompressed first
     let pubkey_hash = compute_pubkey_hash160_all(recovered_pubkey, false);
     let witness_script = build_witness_script(&pubkey_hash[0]);
     let computed_script_hash = env::sha256_array(&witness_script);
 
-    if computed_script_hash == witness_program.program.as_slice() {
+    if &computed_script_hash[..] == witness_program.program.as_slice() {
         return true;
     }
 
     // Try compressed next
     let pubkey_hash = compute_pubkey_hash160_all(recovered_pubkey, true);
 
     let witness_script = build_witness_script(&pubkey_hash[0]);
     let computed_script_hash = env::sha256_array(&witness_script);
-    if computed_script_hash == witness_program.program.as_slice() {
+    if &computed_script_hash[..] == witness_program.program.as_slice() {
         return true;
     }
 
     let witness_script = build_witness_script(&pubkey_hash[1]);
     let computed_script_hash = env::sha256_array(&witness_script);
-    computed_script_hash == witness_program.program.as_slice()
+    &computed_script_hash[..] == witness_program.program.as_slice()
 }

---

101-121: P2PKH/uncompressed hash160 is wrong (missing 0x04 prefix)

Bitcoin’s uncompressed pubkey serialization is 65 bytes: 0x04 || X(32) || Y(32). Hashing the bare 64-byte X||Y yields the wrong hash160 and breaks P2PKH matches for uncompressed keys.

Apply this diff:

 fn compute_pubkey_hash160_all(raw_pubkey: &[u8; 64], compressed: bool) -> Vec<[u8; 20]> {
@@
-    vec![defuse_near_utils::digest::Hash160::digest(raw_pubkey).into()]
+    // Uncompressed serialization: 0x04 || X(32) || Y(32)
+    let mut uncompressed = Vec::with_capacity(65);
+    uncompressed.push(0x04);
+    uncompressed.extend_from_slice(raw_pubkey);
+    vec![defuse_near_utils::digest::Hash160::digest(&uncompressed).into()]
 }

---

56-89: Strengthen P2WPKH/P2WSH checks for compressed key path (validate version/length; compare slices)

Currently compares arrays to slices directly and doesn’t validate witness program version/length. Add explicit checks and slice-to-slice equality.

Apply this diff:

 pub fn validate_compressed_pubkey_matches_address(
     compressed_pubkey: &[u8; 33],
     address: &Address,
 ) -> bool {
     match address {
         Address::P2PKH { pubkey_hash } => {
             let computed_hash: [u8; 20] =
                 defuse_near_utils::digest::Hash160::digest(compressed_pubkey).into();
-            computed_hash == *pubkey_hash
+            computed_hash == *pubkey_hash
         }
         Address::P2WPKH { witness_program } => {
+            // Enforce segwit v0 P2WPKH format (20-byte program)
+            if witness_program.version != 0 || witness_program.program.len() != 20 {
+                return false;
+            }
             let computed_hash: [u8; 20] =
                 defuse_near_utils::digest::Hash160::digest(compressed_pubkey).into();
-            computed_hash == witness_program.program.as_slice()
+            &computed_hash[..] == witness_program.program.as_slice()
         }
         Address::P2SH { script_hash } => {
             let pubkey_hash: [u8; 20] =
                 defuse_near_utils::digest::Hash160::digest(compressed_pubkey).into();
@@
             let computed_script_hash: [u8; 20] =
                 defuse_near_utils::digest::Hash160::digest(&witness_program).into();
             computed_script_hash == *script_hash
         }
         Address::P2WSH { witness_program } => {
+            // Enforce segwit v0 P2WSH format (32-byte program)
+            if witness_program.version != 0 || witness_program.program.len() != 32 {
+                return false;
+            }
             let pubkey_hash: [u8; 20] =
                 defuse_near_utils::digest::Hash160::digest(compressed_pubkey).into();
             let witness_script = build_witness_script(&pubkey_hash);
             let computed_script_hash = env::sha256_array(&witness_script);
-            computed_script_hash == witness_program.program.as_slice()
+            &computed_script_hash[..] == witness_program.program.as_slice()
         }
     }
 }

bip322/src/signature.rs (3)

38-45: Doc mismatch: Compact uses classic Bitcoin message hashing, not BIP-340 tagged hash

Implementation hashes using “Bitcoin Signed Message” double-SHA256, not BIP-340 tagged hash. Update docs for accuracy.

Apply this diff:

     /// Simple/Compact signature format (65 bytes: recovery + r + s).
     ///
-    /// This is the standard Bitcoin message signing format used by most wallets.
-    /// For BIP-322 simple signatures, the message is hashed directly with BIP-340
-    /// tagged hash, not through transaction construction.
+    /// This is the standard Bitcoin message signing format used by most wallets.
+    /// For compact signatures, the message is hashed using the classic Bitcoin
+    /// Signed Message format (double SHA256 over
+    /// CompactSize(len(prefix)) + prefix + CompactSize(message.len()) + message),
+    /// not through transaction construction.

---

452-478: Bitcoin Signed Message hash missing CompactSize length of the prefix (signatures won’t verify)

The hash must include CompactSize(len("Bitcoin Signed Message:\n")) before the prefix. Without it, standard compact signatures from wallets won’t verify.

Apply this diff:

     /// Compute standard Bitcoin message signing hash.
     ///
     /// This follows the Bitcoin Core format:
-    /// Hash = SHA256(SHA256("Bitcoin Signed Message:\n" + varint(message.len()) + message))
+    /// Hash = SHA256(SHA256(CompactSize(len(prefix)) + prefix
+    ///     + CompactSize(message.len()) + message))
     fn compute_bitcoin_message_hash(message: &str) -> [u8; 32] {
         use defuse_near_utils::digest::DoubleSha256;
         use digest::Digest;
 
         // Bitcoin message signing format
         let prefix = b"Bitcoin Signed Message:\n";
         let message_bytes = message.as_bytes();
 
         // Create the full message with prefix and length
         let mut full_message = Vec::new();
-        full_message.extend_from_slice(prefix);
+        // Add CompactSize(len(prefix)) followed by the prefix
+        Self::encode_varint(
+            u64::try_from(prefix.len()).unwrap_or(0),
+            &mut full_message,
+        );
+        full_message.extend_from_slice(prefix);
 
         // Add message length as proper varint
         Self::encode_varint(
             u64::try_from(message_bytes.len()).unwrap_or(0),
             &mut full_message,
         );
 
         full_message.extend_from_slice(message_bytes);
 
         // Double SHA256 hash
         DoubleSha256::digest(&full_message).into()
     }

---

374-386: Do not return zero-filled “placeholder” keys; remove fabricated key material

Returning [0u8; 64] on success for compressed keys is unsafe and can be misused as valid key material. Either decompress or return None; consider evolving the API to return a typed enum later.

Apply this diff:

             ParsedPublicKey::Compressed(compressed) => {
                 // Validate compressed public key against address
                 if crate::verification::validate_compressed_pubkey_matches_address(
                     compressed, address,
                 ) {
-                    // Validation succeeded, but we cannot provide uncompressed format
-                    // This indicates a successful verification but inability to decompress
-                    // For now, we'll create a placeholder uncompressed key to indicate success
-                    // TODO: Implement proper decompression or change API to accept compressed keys
-                    Some([0u8; 64]) // Placeholder indicating successful validation
+                    // Validation succeeded, but we cannot provide uncompressed format.
+                    // TODO: Implement decompression or change API to return a typed enum
+                    None
                 } else {
                     None
                 }
             }

Note: This will impact tests that currently expect Some(..) for compressed keys. If you prefer, I can draft a follow-up PR to introduce:

• RecoveredKey enum { Uncompressed([u8;64]), Compressed([u8;33]) }
• Wire it through SignedPayload::PublicKey.

bip322/src/bitcoin_minimal.rs (1)

527-605: Use write_all and deterministic length accounting in consensus encoding

Write can be partial; consensus serialization should use write_all and explicit byte counts. Prevents truncated encodings with non-buffered writers.

Apply this diff pattern throughout the function:

-        // Version (4 bytes, little-endian)
-        len += writer.write(&self.version.to_le_bytes())?;
+        // Version (4 bytes, little-endian)
+        writer.write_all(&self.version.to_le_bytes())?;
+        len += 4;
@@
-        if has_witness {
-            len += writer.write(&[0x00])?; // Marker byte
-            len += writer.write(&[0x01])?; // Flag byte
-        }
+        if has_witness {
+            writer.write_all(&[0x00, 0x01])?; // Marker + flag
+            len += 2;
+        }
@@
-            len += writer.write(&input.previous_output.txid.0)?;
-            len += writer.write(&input.previous_output.vout.to_le_bytes())?;
+            writer.write_all(&input.previous_output.txid.0)?;
+            writer.write_all(&input.previous_output.vout.to_le_bytes())?;
+            len += 32 + 4;
@@
-            len += writer.write(&input.script_sig.inner)?;
+            writer.write_all(&input.script_sig.inner)?;
+            len += input.script_sig.inner.len();
@@
-            len += writer.write(&input.sequence.to_le_bytes())?;
+            writer.write_all(&input.sequence.to_le_bytes())?;
+            len += 4;
@@
-            len += writer.write(&output.value.to_le_bytes())?;
+            writer.write_all(&output.value.to_le_bytes())?;
+            len += 8;
@@
-            len += writer.write(&output.script_pubkey.inner)?;
+            writer.write_all(&output.script_pubkey.inner)?;
+            len += output.script_pubkey.inner.len();
@@
-                    len += writer.write(witness_item)?;
+                    writer.write_all(witness_item)?;
+                    len += witness_item.len();
@@
-        len += writer.write(&self.lock_time.to_le_bytes())?;
+        writer.write_all(&self.lock_time.to_le_bytes())?;
+        len += 4;

Optional: drop len tracking and return Ok(()) — callers rarely need the byte count.

</blockquote></details>

</blockquote></details>

<details>
<summary>🧹 Nitpick comments (2)</summary><blockquote>

<details>
<summary>bip322/src/tests.rs (1)</summary><blockquote>

`340-361`: **Test name/message are misleading (length is valid; content is invalid)**

This test feeds a 65-byte signature (valid compact length) filled with zeros. The failure is due to invalid signature data, not length. Rename for clarity to avoid confusion when triaging failures.

Apply this diff:

```diff
-    fn test_signature_verification_invalid_signature_length() {
+    fn test_signature_verification_invalid_signature() {
@@
-        let invalid_signature = [0u8; 65]; // Valid 65-byte signature (but empty, so will fail)
+        let invalid_signature = [0u8; 65]; // Valid length, invalid content (all zeros), should fail
@@
-            "Invalid signature length should fail verification"
+            "Invalid signature should fail verification"

bip322/src/bitcoin_minimal.rs (1)

13-17: Docs out of sync with implementation (P2SH/P2WSH are already supported)

Design principles say “Supports only P2PKH and P2WPKH,” but this module implements P2SH and P2WSH too. Update to reflect current scope.

Apply this diff:

-//! 3. **MVP Focus**: Supports only P2PKH and P2WPKH for Phase 2-3
+//! 3. **MVP Focus**: Supports P2PKH, P2SH, P2WPKH, and P2WSH (mainnet)

Configuration used: CodeRabbit UI
Review profile: CHILL
Plan: Pro

💡 Knowledge Base configuration:

• MCP integration is disabled by default for public repositories
• Jira integration is disabled by default for public repositories
• Linear integration is disabled by default for public repositories

You can enable these sources in your CodeRabbit configuration.