[imikushin]

Why

A Scrolls signature covers only the output index and the script. check_scroll_outputs does not bind that signature to the spell transaction's first input, so a signed map can be reused on another transaction. A script Scrolls will never withdraw from can still count as a Scrolls output. This change puts that first input into the bytes Scrolls signs and the bytes the spell check verifies.

A coinbase spell's first input is the null outpoint. Every coinbase shares it, so one signed map would verify on every coinbase spell, and sign_tx would still derive the withdrawal key from the zero txid and the block height. Those outputs could not be withdrawn. Coinbase transactions cannot create Scrolls outputs.

What changed

The signed statement is CBOR of the creating transaction's first input and the script map. The canister and check_scroll_outputs both hash those bytes. A reused or foreign map is rejected. A map bound to this spell's first input passes.

check_scroll_outputs rejects a spell that declares Scrolls outputs when the first input filled from the hosting transaction is the null outpoint (all-zero txid, vout 0xffffffff). A coinbase spell with no Scrolls outputs still verifies. fill_scroll_outputs returns that error before it calls the canister. addresses refuses the null outpoint. sign_tx's existing coinbase spend path is unchanged.

The branch includes the Litecoin beaming work. host_scrolls still runs the signature check only for a Bitcoin host, and a Litecoin host that lists scroll outputs is rejected. The guest is rebuilt for that layout, this check, and the coinbase ban. Spell v16 has one program key, 0x00990da83b7a7a3e54273d6e5ec48763d6b7fa4228fbb0552e109ace394ead5e. There is no fallback key. The Groth16 verifying key stays the v15 key. The Solidity PROGRAM_VKEY matches this program key.

The stored Bitcoin spell has no inputs. The guest checks the spell before those inputs are stripped, and verification fills them back from the hosting transaction. That is why the check binds the hosting transaction, and why the coinbase ban reads that filled input. The note is docs/solutions/security-issues/scrolls-script-map-signature-unbound-from-first-input.md.

Scope

Bitcoin Scrolls output creation and the spell check that accepts those outputs. No app-specific case. No canister deploy.

Tradeoffs

The signed object does not grow a separate outpoint field. The spell already carries the first input, and proof verification fills that input from the hosting transaction before it checks the proof. A second copy would need its own equality check.

Canisters

scrolls_bitcoin_v15 (rpgc6-oqaaa-aaaak-qy3uq-cai) needs this wasm before a new client will accept its signatures. Do not upgrade scrolls_bitcoin_v14 (lmbwh-3qaaa-aaaak-qunha-cai). It still serves the v14 sign and address methods. scrolls_bitcoin_v16 has no id in canister_ids.json.

Verification

Before the fix, check_scroll_outputs_accepts_map_bound_to_the_spells_first_input failed with signature failed verification. check_scroll_outputs_rejects_a_reused_or_foreign_signed_map failed because an unbound signature returned Ok(true).

After the fix, those Scrolls tests passed, along with litecoin_host_rejects_listed_scroll_outputs, coinbase_spell_with_scroll_outputs_is_rejected, and coinbase_spell_without_scroll_outputs_still_passes_the_scroll_check. fill_scroll_outputs rejects a coinbase before calling the canister and allows a coinbase with no Scrolls outputs. addresses_rejects_the_null_coinbase_outpoint passes, and a block-height anchor is not treated as the null outpoint. cargo test --locked --manifest-path charms-proof-wrapper/vk/Cargo.toml passed 5 tests, including the Solidity program-key check. cached_sp1_vks_match_embedded and programs_run_in_zkvm passed on the rebuilt guest.

The committed guest bytes are the guest workflow rebuild of this source (145a220). Their git hashes match that run's worktree.

  

[Copilot]

🟡 Changes recommended

Normal prover builds still embed unchanged guest ELFs and keys, preserving the replay vulnerability and rejecting the canister’s new transaction-bound signatures.

1 open issue

• Commit rebuilt guest ELFs, verification keys, and generated constants · New

What changed in this PR

This PR binds Bitcoin Scrolls script signatures to the creating transaction’s first input, preventing signed script maps from being reused across transactions.

Changes:

• Shares transaction-bound CBOR serialization between the canister signer and client verifier.
• Adds regression tests for valid, unbound, and foreign-input signatures.
• Updates signature documentation and uploads rebuilt guest artifacts when CI fails.

File	Description
src/​tx/​scrolls_bitcoin.rs	Updates the signature-format documentation.
scrolls/​src/​scrolls_bitcoin/​src/​lib.rs	Signs script maps together with the first input.
scrolls/​src/​scrolls_bitcoin/​scrolls_bitcoin.did	Updates comments describing signed data; interface unchanged.
charms-data/​src/​lib.rs	Adds shared signature-preimage serialization and a binding test.
charms-client/​src/​lib.rs	Verifies transaction-bound signatures and adds regression tests.
.github/​workflows/​guests.yml	Uploads rebuilt guests and key files after CI failure.

_{Review effort: Balanced}

[greptile-apps]

Confidence Score: 5/5

[High impact] The PR appears safe to merge; no blocking findings remain.

Summary

Scrolls signatures now cover the creating transaction’s first input and its script map.

• Scrolls signatures now cover the first input and script map.
• Coinbase transactions cannot create Scrolls outputs.
• Version-16 proofs now use the rebuilt spell-checker key.
• The HTTP status conversion and test fixture keep the same behavior.

_{Reviews (7) · Last reviewed commit: "fix: record the v16 guest that rejects c..." · Reviewed by Greptile}