Security notes

These notes are not an audit.

Non-equivocation

Attestations commit to the next signing nonce. Conflicting signatures can expose the operator key.

The exposed anchor output key authorizes the earlier stake punishment leaf. The separate redemption key is derived from the unrevealed anchor internal key and is not reused in signatures intended to expose the punishment key.

Punishment signal

The configured stake duration is the earliest punishment maturity. Ordinary redemption matures 144 blocks later, giving observers a period in which a punishment can be mined and letting indexers distinguish punishment from redemption by the revealed tapscript.

A punishment-path spend can instead immediately redeposit into recognized stake outputs. It avoids reward disqualification only if it preserves stake value for the punished anchor: that anchor's total stake-output value is at least its total stake-input value. Outputs assigned to another anchor do not count. Any increase must come from other transaction inputs. This permits a no-rolling-delay rollover without early withdrawal; non-redeposit and reduced-value punishment spends remain slashes.

The path is an on-chain signal, not proof of who initiated it. An operator that still controls the anchor secret can deliberately spend the punishment leaf and self-punish.

Reorgs

Attestations carry Bitcoin header context, but consumers still need their own finality policy.

Limits

The prototype enforces size and cache limits. Treat API details as changing until the verifier and SDK stabilize.