Safer Challenge

Open
#4 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
5/5
Estimated time
Over a week
Newbie friendliness
25/100
Issue type
Feature
Clarity
Needs clarification
Activity status
Stale
Tech stack
rust

Research direction

No files, tests, or entry points are mentioned. Start by locating how the proof-of-reserve tool constructs and verifies its challenge, then review the Bitcoin Core signmessage reference and the broader proof context. Done requires a decided approach for domain separation, challenge/message terminology, and replay-safety scope.

Written by the indexing model from the issue text.

Description

I haven't checked the code but from your explanations it seemed like the "challenge" could be a valid Bitcoin transaction such that the input being signed for does actually exist.

Just like the Bitcoin Core signmessage API the "challenge" could be prepended with magic bytes that is guaranteed to not be a prefix of a transaction. In Bitcoin Core that's "Bitcoin Signed Message:\n" (but I'm missing the argument why that wouldn't be a valid prefix).

Additionally, I'd suggest to rename "challenge" to "message" for now. "Challenge" implies that it is provided by the verifier. Message implies nothing, so it has at least the same caveats as signmessage. Making the proofs actually non-replayable would require looking into the bigger context in which the proof-of-reserve tool is used.

Dominant language
Rust
Stars
50
Forks
10
PR merge metrics
No merged PRs in 30d

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from ElementsProject/reserves

All issues in ElementsProject/reserves

Similar issues

More Rust issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.