feat: check for hash mismatch between the input hash and the computed hash from the taproot tree

Author: motorina0

src/payments/p2tr.js

@@ -122,6 +122,10 @@ function p2tr(a, opts) {
       if ((0, types_1.liftX)(pubkey) === null)
         throw new TypeError('Invalid pubkey for p2tr');
     }
+    if (a.hash && a.scriptsTree) {
+      const hash = (0, merkle_1.computeMastRoot)(a.scriptsTree);
+      if (!a.hash.equals(hash)) throw new TypeError('Hash mismatch');
+    }
     if (a.witness) {
       if (a.witness.length !== 1) throw new TypeError('Witness is invalid');
       // todo: recheck

test/fixtures/p2tr.json

@@ -375,6 +375,20 @@
         "pubkey": "ab610d22c801def8a1e02368d1b92018970eb52a729919705e8a1a2f60c750f5"
       }
     },
+    {
+      "description": "Hash mismatch between scriptsTree and hash",
+      "exception": "Hash mismatch",
+      "options": {},
+      "arguments": {
+        "internalPubkey": "9fa5ffb68821cf559001caa0577eeea4978b29416def328a707b15e91701a2f7",
+        "scriptsTree": [
+          {
+            "output": "83d8ee77a0f3a32a5cea96fd1624d623b836c1e5d1ac2dcde46814b619320c18 OP_CHECKSIG"
+          }
+        ],
+        "hash": "b76077013c8e303085e300000000000000000000000000000000000000000000"
+      }
+    },
     {
       "exception": "Invalid internalPubkey for p2t",
       "options": {},

ts_src/payments/p2tr.ts

@@ -133,6 +133,12 @@ export function p2tr(a: Payment, opts?: PaymentOpts): Payment {
         throw new TypeError('Invalid pubkey for p2tr');
     }
 
+    if (a.hash && a.scriptsTree) {
+      const hash = computeMastRoot(a.scriptsTree)
+      if (!a.hash.equals(hash))
+        throw new TypeError('Hash mismatch');
+    }
+
     if (a.witness) {
       if (a.witness.length !== 1) throw new TypeError('Witness is invalid');