Critical vulnerability in the bip322 Rust crate: BIP-322 proofs for P2WPKH and P2SH-P2WPKH addresses could be forged with any attacker key. Full address-ownership bypass. Fixed in 0.0.11, affected versions yanked. If you verify Bitcoin address ownership, please upgrade now.
Affected:
P2WPKH: >= 0.0.6, < 0.0.11
P2SH-P2WPKH: >= 0.0.7, < 0.0.11
P2TR: not affected
All four public APIs hit the same vulnerable path: verify_simple, verify_simple_encoded, verify_full, verify_full_encoded.
The bug: the verifier read the public key from the user-supplied witness, then "checked" it against the same witness. pub_key WAS witness_pub_key. The check compared the key to itself. It could never fail.
Impact: pick any victim address + any message, build the BIP-322 challenge, sign with your own key -> accepted. No victim key, no interaction. App-level nonces don't help: the attacker signs the fresh challenge themselves. Complete "prove you own this address" bypass.
this one's embarrassing in the right way. the verifier read the pubkey out of the witness and then checked it against that same witness, so the key was comparing itself to itself and could never fail. the whole point of a bip322 proof is matching the key to the address, and you've got to derive that check from the address itself, never from input the prover hands you. glad they yanked the bad versions instead of just patching quietly
this one's embarrassing in the right way. the verifier read the pubkey out of the witness and then checked it against that same witness, so the key was comparing itself to itself and could never fail. the whole point of a bip322 proof is matching the key to the address, and you've got to derive that check from the address itself, never from input the prover hands you. glad they yanked the bad versions instead of just patching quietly