Merge commit from fork

* init

* pr comments

* simplify address type parsing

* changelog

* compare sighash types rather than raw bytes

* follow camel case for naming

* add vanilla upgrade handler for v4.1

* add v4.1 upgrade to mainnet

* cl

Author: SebastianElvis

CHANGELOG.md

@@ -40,6 +40,7 @@ The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/)
 ### Bug fixes
 
 - [GHSA-2fcv-qww3-9v6h](https://github.com/babylonlabs-io/babylon-ghsa-2fcv-qww3-9v6h/pull/1) Add unkown fields check on vote extension validation
+- [GHSA-xq4h-wqm2-668w](https://github.com/babylonlabs-io/babylon-ghsa-xq4h-wqm2-668w/pull/2) crypto: ensure BIP-322 signatures are using `SIGHASH_ALL` or `SIGHASH_DEFAULT`
 
 ## v4.0.0
 

app/include_upgrade_mainnet.go

@@ -9,6 +9,7 @@ import (
 	v22 "github.com/babylonlabs-io/babylon/v4/app/upgrades/v2_2"
 	v23 "github.com/babylonlabs-io/babylon/v4/app/upgrades/v2_3"
 	v4 "github.com/babylonlabs-io/babylon/v4/app/upgrades/v4"
+	v41 "github.com/babylonlabs-io/babylon/v4/app/upgrades/v4_1"
 )
 
 var WhitelistedChannelsID = map[string]struct{}{
@@ -24,6 +25,7 @@ var WhitelistedChannelsID = map[string]struct{}{
 // init is used to include v2.2 upgrade for mainnet data
 func init() {
 	Upgrades = []upgrades.Upgrade{
+		v41.Upgrade,
 		v4.Upgrade,
 		v23.Upgrade, // same as v3rc3 testnet
 		v22.Upgrade,

app/include_upgrade_testnet.go

@@ -13,13 +13,15 @@ import (
 	v23 "github.com/babylonlabs-io/babylon/v4/app/upgrades/v2_3"
 	v2rc4 "github.com/babylonlabs-io/babylon/v4/app/upgrades/v2rc4/testnet"
 	v4 "github.com/babylonlabs-io/babylon/v4/app/upgrades/v4"
+	v41 "github.com/babylonlabs-io/babylon/v4/app/upgrades/v4_1"
 	v4rc3 "github.com/babylonlabs-io/babylon/v4/app/upgrades/v4rc3/testnet"
 )
 
 // init is used to include v1 upgrade testnet data
 // it is also used for e2e testing
 func init() {
 	Upgrades = []upgrades.Upgrade{
+		v41.Upgrade,
 		v4rc3.Upgrade,
 		v4.Upgrade,
 		v23.Upgrade,

app/upgrades/v4_1/upgrade.go

@@ -0,0 +1,34 @@
+package testnet
+
+import (
+	"context"
+
+	store "cosmossdk.io/store/types"
+	upgradetypes "cosmossdk.io/x/upgrade/types"
+	"github.com/babylonlabs-io/babylon/v4/app/keepers"
+	"github.com/babylonlabs-io/babylon/v4/app/upgrades"
+	"github.com/cosmos/cosmos-sdk/types/module"
+)
+
+const UpgradeName = "v4.1"
+
+var Upgrade = upgrades.Upgrade{
+	UpgradeName:          UpgradeName,
+	CreateUpgradeHandler: CreateUpgradeHandler,
+	StoreUpgrades: store.StoreUpgrades{
+		Added:   []string{},
+		Deleted: []string{},
+	},
+}
+
+func CreateUpgradeHandler(mm *module.Manager, configurator module.Configurator, keepers *keepers.AppKeepers) upgradetypes.UpgradeHandler {
+	return func(ctx context.Context, plan upgradetypes.Plan, fromVM module.VersionMap) (module.VersionMap, error) {
+		// Run migrations before applying any other state changes.
+		migrations, err := mm.RunMigrations(ctx, configurator, fromVM)
+		if err != nil {
+			return nil, err
+		}
+
+		return migrations, nil
+	}
+}

crypto/bip322/bip322.go

@@ -2,6 +2,7 @@ package bip322
 
 import (
 	"crypto/sha256"
+	"fmt"
 
 	"github.com/btcsuite/btcd/btcec/v2"
 	"github.com/btcsuite/btcd/btcec/v2/schnorr"
@@ -139,11 +140,74 @@ func GetToSignTx(toSpend *wire.MsgTx) *wire.MsgTx {
 	return toSign
 }
 
-func Verify(
+// validateSigHashType validates that the witness uses an allowed SIGHASH type
+// according to BIP-322 specification.
+// For Taproot (P2TR): SIGHASH_DEFAULT (implicit, no byte) or SIGHASH_ALL (0x01)
+// For P2WPKH: SIGHASH_ALL (0x01)
+func validateSigHashType(witness wire.TxWitness, address btcutil.Address) error {
+	if len(witness) == 0 {
+		return fmt.Errorf("empty witness")
+	}
+
+	// The signature is always in the first element of the witness
+	sig := witness[0]
+	if len(sig) == 0 {
+		return fmt.Errorf("empty signature in witness")
+	}
+
+	script, err := txscript.PayToAddrScript(address)
+	if err != nil {
+		return err
+	}
+	if txscript.IsPayToTaproot(script) {
+		// For Taproot:
+		// - SIGHASH_DEFAULT: signature is 64 bytes (no sighash byte appended)
+		// - SIGHASH_ALL: signature is 65 bytes with 0x01 as the last byte
+		switch len(sig) {
+		case 64:
+			// SIGHASH_DEFAULT - valid
+			return nil
+		case 65:
+			// Must be SIGHASH_ALL (0x01)
+			sighash := txscript.SigHashType(sig[64])
+			if sighash != txscript.SigHashAll {
+				return fmt.Errorf("invalid sighash type for taproot: 0x%02x, expected SIGHASH_ALL (0x01) or SIGHASH_DEFAULT", sighash)
+			}
+			return nil
+		default:
+			return fmt.Errorf("invalid taproot signature length: %d, expected 64 (SIGHASH_DEFAULT) or 65 (with sighash byte)", len(sig))
+		}
+	} else if txscript.IsPayToWitnessPubKeyHash(script) {
+		// For P2WPKH: signature must end with SIGHASH_ALL (0x01)
+		// DER-encoded ECDSA signature format: 0x30 [total-length] 0x02 [R-length] [R] 0x02 [S-length] [S] [sighash]
+		// Minimum length is ~70 bytes for ECDSA + 1 byte sighash
+		if len(sig) < 9 {
+			return fmt.Errorf("signature too short for P2WPKH: %d bytes", len(sig))
+		}
+
+		// The last byte should be the sighash type
+		sighash := txscript.SigHashType(sig[len(sig)-1])
+		if sighash != txscript.SigHashAll {
+			return fmt.Errorf("invalid sighash type for P2WPKH: 0x%02x, expected SIGHASH_ALL (0x01)", sighash)
+		}
+		return nil
+	} else {
+		return fmt.Errorf("unsupported address type: %T", address)
+	}
+}
+
+// VerifyP2WPKHAndP2TR validates a BIP-322 signature for either a P2WPKH or Taproot (P2TR) address.
+func VerifyP2WPKHAndP2TR(
 	msg []byte,
 	witness wire.TxWitness,
 	address btcutil.Address,
-	net *chaincfg.Params) error {
+	net *chaincfg.Params,
+) error {
+	// First, validate that the witness uses allowed SIGHASH types
+	if err := validateSigHashType(witness, address); err != nil {
+		return fmt.Errorf("sighash validation failed: %w", err)
+	}
+
 	toSpend, err := GetToSpendTx(msg, address)
 	if err != nil {
 		return err

crypto/bip322/bip322_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/btcsuite/btcd/btcec/v2"
 	"github.com/btcsuite/btcd/btcutil"
 	"github.com/btcsuite/btcd/chaincfg"
+	"github.com/btcsuite/btcd/txscript"
 	"github.com/stretchr/testify/require"
 )
 
@@ -67,7 +68,7 @@ func TestBIP322_Verify(t *testing.T) {
 	witness, err := bip322.SimpleSigToWitness(emptyBytesSig)
 	require.NoError(t, err)
 
-	err = bip322.Verify(msg, witness, addressDecoded, net)
+	err = bip322.VerifyP2WPKHAndP2TR(msg, witness, addressDecoded, net)
 	require.NoError(t, err)
 }
 
@@ -84,7 +85,7 @@ func FuzzBip322ValidP2WPKHSignature(f *testing.F) {
 		witnessDecoded, err := bip322.SimpleSigToWitness(witness)
 		require.NoError(t, err)
 
-		err = bip322.Verify(
+		err = bip322.VerifyP2WPKHAndP2TR(
 			dataToSign,
 			witnessDecoded,
 			address,
@@ -107,7 +108,7 @@ func FuzzBip322ValidP2TrSpendSignature(f *testing.F) {
 		witnessDecoded, err := bip322.SimpleSigToWitness(witness)
 		require.NoError(t, err)
 
-		err = bip322.Verify(
+		err = bip322.VerifyP2WPKHAndP2TR(
 			dataToSign,
 			witnessDecoded,
 			address,
@@ -116,3 +117,126 @@ func FuzzBip322ValidP2TrSpendSignature(f *testing.F) {
 		require.NoError(t, err)
 	})
 }
+
+func FuzzBip322SigHashTypeP2WPKH(f *testing.F) {
+	// Add corpus entries: seed and sigHashType
+	// Valid SIGHASH types
+	f.Add(int64(1), uint8(0x01)) // SIGHASH_ALL - valid
+	// Invalid SIGHASH types
+	f.Add(int64(2), uint8(0x02)) // SIGHASH_NONE
+	f.Add(int64(3), uint8(0x03)) // SIGHASH_SINGLE
+	f.Add(int64(4), uint8(0x81)) // SIGHASH_ALL_ANYONECANPAY
+	f.Add(int64(5), uint8(0x82)) // SIGHASH_NONE_ANYONECANPAY
+	f.Add(int64(6), uint8(0x83)) // SIGHASH_SINGLE_ANYONECANPAY
+
+	f.Fuzz(func(t *testing.T, seed int64, sigHashTypeByte uint8) {
+		r := rand.New(rand.NewSource(seed))
+		privkey, err := btcec.NewPrivateKey()
+		require.NoError(t, err)
+
+		dataLen := r.Int31n(200) + 1
+		dataToSign := datagen.GenRandomByteArray(r, uint64(dataLen))
+
+		sigHashType := txscript.SigHashType(sigHashTypeByte)
+		address, witness, err := datagen.SignWithP2WPKHAddressWithSigHashType(
+			dataToSign,
+			privkey,
+			net,
+			sigHashType,
+		)
+
+		// btcd's WitnessSignature does not validate SIGHASH types during signing for P2WPKH
+		// It allows any SIGHASH type to be signed, leaving validation to script execution
+		// Therefore, signing should ALWAYS succeed regardless of SIGHASH type
+		require.NoError(t, err, "P2WPKH signing should always succeed with any sighash type, got error for 0x%02x: %v", sigHashTypeByte, err)
+
+		witnessDecoded, err := bip322.SimpleSigToWitness(witness)
+		require.NoError(t, err)
+
+		err = bip322.VerifyP2WPKHAndP2TR(
+			dataToSign,
+			witnessDecoded,
+			address,
+			net,
+		)
+
+		// BIP-322 requires SIGHASH_ALL for P2WPKH
+		// btcd allowed signing with any sighash type (no validation during signing)
+		// Our verification layer must enforce the BIP-322 requirement
+		if sigHashType == txscript.SigHashAll {
+			require.NoError(t, err, "BIP-322 should accept SIGHASH_ALL (0x01) for P2WPKH")
+		} else {
+			// btcd allowed signing, but our BIP-322 verification must reject
+			require.Error(t, err, "BIP-322 should reject sighash type 0x%02x for P2WPKH (only SIGHASH_ALL is allowed)", sigHashTypeByte)
+			require.Contains(t, err.Error(), "sighash validation failed")
+		}
+	})
+}
+
+func FuzzBip322SigHashTypeP2TR(f *testing.F) {
+	// Add corpus entries: seed and sigHashType
+	// Valid SIGHASH types
+	f.Add(int64(1), uint8(0x00)) // SIGHASH_DEFAULT - valid
+	f.Add(int64(2), uint8(0x01)) // SIGHASH_ALL - valid
+	// Invalid SIGHASH types
+	f.Add(int64(3), uint8(0x02)) // SIGHASH_NONE
+	f.Add(int64(4), uint8(0x03)) // SIGHASH_SINGLE
+	f.Add(int64(5), uint8(0x81)) // SIGHASH_ALL_ANYONECANPAY
+	f.Add(int64(6), uint8(0x82)) // SIGHASH_NONE_ANYONECANPAY
+	f.Add(int64(7), uint8(0x83)) // SIGHASH_SINGLE_ANYONECANPAY
+
+	f.Fuzz(func(t *testing.T, seed int64, sigHashTypeByte uint8) {
+		r := rand.New(rand.NewSource(seed))
+		privkey, err := btcec.NewPrivateKey()
+		require.NoError(t, err)
+
+		dataLen := r.Int31n(200) + 1
+		dataToSign := datagen.GenRandomByteArray(r, uint64(dataLen))
+
+		sigHashType := txscript.SigHashType(sigHashTypeByte)
+		address, witness, err := datagen.SignWithP2TrSpendAddressWithSigHashType(
+			dataToSign,
+			privkey,
+			net,
+			sigHashType,
+		)
+
+		// btcd's TaprootWitnessSignature validates SIGHASH types according to BIP 341
+		// Valid Taproot sighash types are: 0x00-0x03 (DEFAULT, ALL, NONE, SINGLE)
+		// and 0x81-0x83 (with ANYONECANPAY flag)
+		isValidTaprootSigHash := (sigHashTypeByte <= 0x03) ||
+			(sigHashTypeByte >= 0x81 && sigHashTypeByte <= 0x83)
+
+		if isValidTaprootSigHash {
+			// btcd should allow signing with any valid BIP 341 sighash type
+			require.NoError(t, err, "Signing with valid Taproot sighash type 0x%02x should succeed: %v", sigHashTypeByte, err)
+		} else {
+			// btcd should reject invalid sighash types during signing for Taproot
+			require.Error(t, err, "btcd should reject invalid Taproot sighash type 0x%02x during signing", sigHashTypeByte)
+			// Can't test our verification layer if btcd rejects during signing
+			return
+		}
+
+		witnessDecoded, err := bip322.SimpleSigToWitness(witness)
+		require.NoError(t, err)
+
+		err = bip322.VerifyP2WPKHAndP2TR(
+			dataToSign,
+			witnessDecoded,
+			address,
+			net,
+		)
+
+		// BIP-322 is more restrictive than BIP 341 for Taproot
+		// BIP 341 allows: 0x00-0x03, 0x81-0x83 (btcd validated this during signing)
+		// BIP-322 only allows: 0x00 (DEFAULT) and 0x01 (ALL)
+		// Our verification layer must reject all other sighash types
+		if sigHashType == txscript.SigHashDefault || sigHashType == txscript.SigHashAll {
+			require.NoError(t, err, "BIP-322 should accept SIGHASH_DEFAULT (0x00) and SIGHASH_ALL (0x01) for P2TR")
+		} else {
+			// btcd allowed signing (valid BIP 341), but our BIP-322 verification must reject
+			require.Error(t, err, "BIP-322 should reject sighash type 0x%02x for P2TR (even though it's valid in BIP 341)", sigHashTypeByte)
+			require.Contains(t, err.Error(), "sighash validation failed")
+		}
+	})
+}

testutil/datagen/pop.go

@@ -32,6 +32,25 @@ func SignWithP2WPKHAddress(
 	msg []byte,
 	privKey *btcec.PrivateKey,
 	net *chaincfg.Params,
+) (*btcutil.AddressWitnessPubKeyHash, []byte, error) {
+	return SignWithP2WPKHAddressWithSigHashType(msg, privKey, net, txscript.SigHashAll)
+}
+
+func SignWithP2TrSpendAddress(
+	msg []byte,
+	privKey *btcec.PrivateKey,
+	net *chaincfg.Params,
+) (*btcutil.AddressTaproot, []byte, error) {
+	return SignWithP2TrSpendAddressWithSigHashType(msg, privKey, net, txscript.SigHashDefault)
+}
+
+// SignWithP2WPKHAddressWithSigHashType creates a BIP-322 signature with a custom SIGHASH type for P2WPKH
+// This is useful for testing invalid SIGHASH types
+func SignWithP2WPKHAddressWithSigHashType(
+	msg []byte,
+	privKey *btcec.PrivateKey,
+	net *chaincfg.Params,
+	sigHashType txscript.SigHashType,
 ) (*btcutil.AddressWitnessPubKeyHash, []byte, error) {
 	pubKey := privKey.PubKey()
 
@@ -56,9 +75,9 @@ func SignWithP2WPKHAddress(
 
 	hashCache := txscript.NewTxSigHashes(toSign, fetcher)
 
-	// always use compressed pubkey
+	// Use the custom sigHashType parameter
 	witness, err := txscript.WitnessSignature(toSign, hashCache, 0,
-		toSpend.TxOut[0].Value, toSpend.TxOut[0].PkScript, txscript.SigHashAll, privKey, true)
+		toSpend.TxOut[0].Value, toSpend.TxOut[0].PkScript, sigHashType, privKey, true)
 
 	if err != nil {
 		return nil, nil, err
@@ -73,10 +92,13 @@ func SignWithP2WPKHAddress(
 	return witnessAddr, serializedWitness, nil
 }
 
-func SignWithP2TrSpendAddress(
+// SignWithP2TrSpendAddressWithSigHashType creates a BIP-322 signature with a custom SIGHASH type for P2TR
+// This is useful for testing invalid SIGHASH types
+func SignWithP2TrSpendAddressWithSigHashType(
 	msg []byte,
 	privKey *btcec.PrivateKey,
 	net *chaincfg.Params,
+	sigHashType txscript.SigHashType,
 ) (*btcutil.AddressTaproot, []byte, error) {
 	pubKey := privKey.PubKey()
 
@@ -101,9 +123,10 @@ func SignWithP2TrSpendAddress(
 
 	hashCache := txscript.NewTxSigHashes(toSign, fetcher)
 
+	// Use the custom sigHashType parameter
 	witness, err := txscript.TaprootWitnessSignature(
 		toSign, hashCache, 0, toSpend.TxOut[0].Value, toSpend.TxOut[0].PkScript,
-		txscript.SigHashDefault, privKey,
+		sigHashType, privKey,
 	)
 
 	if err != nil {

x/btcstaking/types/pop.go

@@ -202,7 +202,7 @@ func VerifyBIP322SigPop(
 		return err
 	}
 
-	if err := bip322.Verify(msg, witness, btcAddress, net); err != nil {
+	if err := bip322.VerifyP2WPKHAndP2TR(msg, witness, btcAddress, net); err != nil {
 		return err
 	}