feat: support BIP-322 P2WSH multisig signatures in auth by TaprootFreak · Pull Request #3637 · DFXswiss/api

TaprootFreak · 2026-04-28T22:42:41Z

Summary

Adds BIP-322 full signature verification for native P2WSH multisig addresses (bc1q… 62 chars) in the auth flow, so users can sign in with wsh(sortedmulti(t, …)) / wsh(multi(t, …)) wallets.
Wired in as a 4th attempt inside crypto.service.ts:verifyBitcoinBased, only when no message-prefix is set (Bitcoin mainnet) and the address passes strict P2WSH detection — existing P2WPKH/P2SH-P2WPKH/P2TR/legacy paths are untouched.
Scope intentionally narrow: only standard OP_M … OP_N OP_CHECKMULTISIG witness scripts with SIGHASH_ALL signatures. Miniscript / Taproot scripts / non-standard policies are rejected.

Implementation notes

Uses @dfx.swiss/bip322-multisig primitives (bip322MessageHash, buildToSpendTx, p2wshScriptPubKey) for BIP-322 tagged hash and to_spend transaction construction.
Uses bitcoinjs-lib Transaction.hashForWitnessV0 for BIP-143 sighash computation — no manual byte-level sighash assembly.
ECDSA verification via @noble/curves (already in deps).
BIP-322 simple signature format: base64-encoded witness stack as produced by any wallet that emits BIP-322 simple sigs.
Pubkey iteration follows the OP_CHECKMULTISIG convention (sigs in script-pubkey order, with replay-of-pk-index after a match).
Defensive typeof address !== 'string' guards on the public entry points, matching the precedent in bech32m.service.ts.

Client-side caveat

Sparrow Wallet's Sign/Verify Message dialog does not accept multisig wallets (hard-coded IllegalArgumentException, issue #193). Producing a BIP-322 simple signature for a multisig today requires either Bitcoin Knots signmessage, or building the BIP-322 to_sign PSBT externally and signing it through Sparrow's regular multisig PSBT flow. The backend code here is signing-tool-agnostic.

Test plan

bip322-p2wsh.util.spec.ts — 15 tests:
- 6× P2WSH address detection (incl. testnet / malformed / empty rejection)
- 3× structural negatives (empty / garbage / wrong address type)
- 3× synthetic 2-of-3 sortedmulti roundtrip sign+verify (3 message lengths)
- 1× rejects under-threshold (1 of 2 sigs)
- 1× rejects sig for different message
- 1× rejects sig from foreign key not in script
- 1× it.todo placeholder for a real wallet-produced fixture
crypto.service.spec.ts — 67 existing tests still green
type check / prettier / eslint
End-to-end: register a real 2-of-3 P2WSH multisig at /auth

Adds a pure verifier mirroring the backend implementation in DFXswiss/api#3637, exposed both as a standalone function (verifyBip322Signature) and as MultisigHDWallet.verifyMessage so the existing Sign/Verify Message screen works symmetrically: a signature produced by signMessage on one device can be verified on any device holding the same wallet (or just the address). Verifier algorithm: - strict P2WSH address detection (bc1q…, 62 chars, 32-byte program) - base64 → witness stack (varint-prefixed items) - last item must be the witness script; sha256 must match the bech32 program - script must be standard OP_M … OP_N OP_CHECKMULTISIG with 33-byte pubkeys - exactly M signatures + empty CHECKMULTISIG dummy - BIP-143 sighash over the synthetic to_spend / to_sign pair - ECDSA verify each sig against pubkeys in script order, sighash flag 0x01 Adds 7 tests covering: round-trip with signMessage, multiple message lengths (incl. unicode and 200-char), wrong-message rejection, wrong-address rejection, PSBT cross-device round-trip verification, malformed-input handling, and isP2wshAddress detection.

davidleomay · 2026-04-30T08:39:52Z

Can't we use the @dfx.swiss/bip322-multisig package here?

Replace ~140 lines of manual BIP-143 sighash construction and BIP-322 tagged-hash computation with primitives from @dfx.swiss/bip322-multisig (bip322MessageHash, buildToSpendTx, p2wshScriptPubKey) and bitcoinjs-lib Transaction.hashForWitnessV0. Eliminates: hashMessage, computeToSpendTxid, computeBip143Sighash, hash256, uint32LE, uint64LE, encodeVarInt, encodeVarBytes. Keeps: witness decoding, multisig script parsing, ECDSA verification. Test helpers also simplified using buildSortedMultisigScript and p2wshAddress from the package.

The 'verifySignature with offchainAddr' describe block was missing a fetch mock unlike the other two blocks. This caused getServerInfo() to make real HTTP calls to arkade.computer and delegate.arkade.money, timing out in CI after 5 seconds.

TaprootFreak · 2026-04-30T13:56:35Z

Done — refactored to use @dfx.swiss/bip322-multisig primitives (bip322MessageHash, buildToSpendTx, p2wshScriptPubKey) + bitcoinjs-lib Transaction.hashForWitnessV0 for the sighash. Eliminates ~140 lines of manual BIP-143/BIP-322 byte manipulation.

davidleomay · 2026-04-30T14:06:32Z

Can we remove this?

github-actions · 2026-04-30T14:06:57Z

⚠️ Unverified Commits (5)

The following commits are not signed/verified:

eb4e2bb refactor: use @dfx.swiss/bip322-multisig for BIP-322 P2WSH verification (Taproot Freak)
251b866 style: fix prettier formatting in spec file (Taproot Freak)
145ec2d fix: mock fetch in arkade offchainAddr test to prevent CI timeout (Taproot Freak)
6477b69 chore: add bitcoinjs-lib as direct dependency (Taproot Freak)
ca7a104 refactor: use @dfx.swiss/bip322-multisig verify, remove custom util (Taproot Freak)

How to sign commits

# SSH signing (recommended)
git config --global gpg.format ssh
git config --global user.signingkey ~/.ssh/id_ed25519.pub
git config --global commit.gpgsign true

# Re-sign last commit
git commit --amend -S --no-edit
git push --force-with-lease

TaprootFreak · 2026-04-30T15:05:37Z

Verification is being moved into the @dfx.swiss/bip322-multisig package so this file can be removed entirely: DFXswiss/packages#175

Once that's merged and published (0.2.0-beta.1), the API import changes to:

import { isP2wshAddress, verifyBip322P2wshSignature } from '@dfx.swiss/bip322-multisig';

And bip322-p2wsh.util.ts + its spec get deleted.

Import isP2wshAddress and verifyBip322P2wshSignature directly from the package instead of a local util file. Deletes bip322-p2wsh.util.ts and its spec.

guggero · 2026-06-16T13:24:45Z

Found this PR while looking into options for integrating DFX into our app (with two use cases in our mind currently: BTC buy into Arkade, BTC buy into Taproot or Multisig wallet).
I just wanted to let you know that I pushed hard on BIP-322 and was able to get it to a "Complete" state (out of draft, finally). There was a small change in that each format now has a human-readable prefix.
And the proper signing procedure for multisig is now specified as well.
But that means your bip322-multisig implementation would require some updates too (as well as the bip322-js library used on the validator side).

I did create btcutil-js that is a WASM wrapper around the Golang implementation in btcd (which is currently the most "official" reference implementation and source of the test vectors in the BIP repository).
Perhaps it would be worth switching to that library, which would then support (or at least assist) both signing and validating?

Adds a pure verifier mirroring the backend implementation in DFXswiss/api#3637, exposed both as a standalone function (verifyBip322Signature) and as MultisigHDWallet.verifyMessage so the existing Sign/Verify Message screen works symmetrically: a signature produced by signMessage on one device can be verified on any device holding the same wallet (or just the address). Verifier algorithm: - strict P2WSH address detection (bc1q…, 62 chars, 32-byte program) - base64 → witness stack (varint-prefixed items) - last item must be the witness script; sha256 must match the bech32 program - script must be standard OP_M … OP_N OP_CHECKMULTISIG with 33-byte pubkeys - exactly M signatures + empty CHECKMULTISIG dummy - BIP-143 sighash over the synthetic to_spend / to_sign pair - ECDSA verify each sig against pubkeys in script order, sighash flag 0x01 Adds 7 tests covering: round-trip with signMessage, multiple message lengths (incl. unicode and 200-char), wrong-message rejection, wrong-address rejection, PSBT cross-device round-trip verification, malformed-input handling, and isP2wshAddress detection.

TaprootFreak added 2 commits April 29, 2026 00:32

feat: support BIP-322 P2WSH multisig signatures in auth

e1f6ae4

fix: guard P2WSH address inputs against non-string values

098f25b

TaprootFreak requested a review from davidleomay as a code owner April 28, 2026 22:42

TaprootFreak requested a review from Danswar April 28, 2026 23:12

TaprootFreak mentioned this pull request Apr 28, 2026

feat: BIP-322 simple signature for native P2WSH multisig DFXswiss/btc-wallet#172

Draft

12 tasks

TaprootFreak mentioned this pull request Apr 29, 2026

feat: BIP-322 P2WSH Multisig Wallet-Connector (Sparrow-Integration) DFXswiss/services#1079

Open

8 tasks

davidleomay reviewed Apr 30, 2026

View reviewed changes

TaprootFreak added 3 commits April 30, 2026 15:09

style: fix prettier formatting in spec file

251b866

DFXswiss deleted a comment from github-actions Bot Apr 30, 2026

chore: add bitcoinjs-lib as direct dependency

6477b69

davidleomay reviewed Apr 30, 2026

View reviewed changes

Comment thread src/integration/blockchain/bitcoin/utils/bip322-p2wsh.util.ts Outdated

davidleomay Apr 30, 2026

Copy link
Copy Markdown

Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can we remove this?

TaprootFreak mentioned this pull request Apr 30, 2026

feat(bip322-multisig): add BIP-322 P2WSH signature verification DFXswiss/packages#175

Merged

refactor: use @dfx.swiss/bip322-multisig verify, remove custom util

ca7a104

Import isP2wshAddress and verifyBip322P2wshSignature directly from the package instead of a local util file. Deletes bip322-p2wsh.util.ts and its spec.

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

feat: support BIP-322 P2WSH multisig signatures in auth#3637

feat: support BIP-322 P2WSH multisig signatures in auth#3637
TaprootFreak wants to merge 7 commits into
developfrom
feat/bip322-p2wsh-multisig-auth

TaprootFreak commented Apr 28, 2026 •

edited

Loading

Uh oh!

davidleomay Apr 30, 2026

Uh oh!

TaprootFreak commented Apr 30, 2026

Uh oh!

davidleomay Apr 30, 2026

Uh oh!

github-actions Bot commented Apr 30, 2026 •

edited

Loading

Uh oh!

TaprootFreak commented Apr 30, 2026

Uh oh!

guggero commented Jun 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

TaprootFreak commented Apr 28, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Implementation notes

Client-side caveat

Test plan

Uh oh!

davidleomay Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

TaprootFreak commented Apr 30, 2026

Uh oh!

davidleomay Apr 30, 2026

Choose a reason for hiding this comment

Uh oh!

github-actions Bot commented Apr 30, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

⚠️ Unverified Commits (5)

Uh oh!

TaprootFreak commented Apr 30, 2026

Uh oh!

guggero commented Jun 16, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

TaprootFreak commented Apr 28, 2026 •

edited

Loading

github-actions Bot commented Apr 30, 2026 •

edited

Loading