Issues · diybitcoinhardware/embit · GitHub

Labels Milestones

Bare Miniscript `multi(k, ...)` with duplicate pubkeys passes `verify()` and `compile()`

#142

· Nuhiat-Arefin opened

on Jul 3, 2026

`Descriptor.from_string()` accepts invalid or arbitrary descriptor checksum suffixes instead of rejecting them

#141

· Nuhiat-Arefin opened

on Jun 30, 2026

`Descriptor.from_string()` accepts invalid brace-wrapped single-leaf taptrees like `tr(KEY,{pk(KEY)})`

#140

· Nuhiat-Arefin opened

on Jun 30, 2026

Bare Miniscript multi(...) accepts more than 20 pubkeys and compiles anyway

#139

· Nuhiat-Arefin opened

on Jun 28, 2026

Exponential-time Miniscript.compile() on shallow nested v: wrappers (algorithmic-complexity DoS)

#138

· Nuhiat-Arefin opened

on Jun 28, 2026

Unbounded recursion: deeply nested miniscript raises raw RecursionError across parse, type-check and compile (DoS)

#137

· Nuhiat-Arefin opened

on Jun 27, 2026

`Descriptor.from_string()` rejects valid mixed multipath descriptors with `DescriptorError: All branches should have the same length`

#136

· Nuhiat-Arefin opened

on Jun 26, 2026

BIP32: Missing seed bit-length validation in master key generation

#127

· kuliq23 opened

on May 18, 2026

Package Hardening Plan

#114

· miketlk opened

on Mar 31, 2026

BIP32 path parsing inconsistencies: negative indices, hardened overflow and input validation

#113

· kuliq23 opened

on Mar 25, 2026

get_network() doesn't recognize testnet4 chain (Bitcoin Core 28.0+)

#108

· al-munazzim opened

on Feb 6, 2026

Document secp256k1 wrapper function behaviors

#106

· FreeOnlineUser opened

on Jan 8, 2026