sbtc-developer-release: [sBTC DR] Withdraw on testnet via sbtc bridge fails

Expected Behavior

A withdraw leads to successful burn operation on the sBTC contract

Actual Behaviour

The burn fails, see because the stacks address recovered from the users signature is different from the address they signed with. This leads to the contract trying to burn from an address with zero balance which fails in ft-burn? wth error U1.

Steps to Reproduce

Initiate a withdraw via the bridge
Ensure Romeo is connected and running
Monitor the stacks explorer for the burn transaction

Notes

This is probably a bug in the bridge signing code - raising here for visibility
should be easy to check this by sending an sbct-cli withdraw to the same peg wallet.

About this issue

Original URL
State: closed
Created 9 months ago
Comments: 27 (11 by maintainers)

Most upvoted comments

Perfect, yeah a nice message is important. Thanks 🙏🏻

In future updates structured data might be cool as well, or some form of nonce/similar to avoid replays

janniks on Oct 13, 2023

I just had a successful withdraw through bridge

not sure what going on here. I made one change, switched encoding the amount to use Miller lib…

	///const amountBuf = amountToBigUint64(amount, 8);
	const amountBytes = P.U64BE.encode(BigInt(amount));

i’ll send a few more to see if this is consistent.

radicleart on Oct 12, 2023

It worked on deven because both systems bridge/romeo were happy with encoding and decoding the message data. but they disagreed on how the message to be signed was encoded - as hex string or as bytes. They both treat it as string now !

radicleart on Oct 13, 2023

Yes - PR and branch here origin/266-change-message-format

radicleart on Oct 13, 2023

@janniks romeo and sbtc js changed

friedger on Oct 13, 2023

https://github.com/stacks-network/sbtc/blob/937456c334d9681606aaf9e769c44563fece9102/sbtc-core/src/operations/op_return/withdrawal_request.rs

I did already try taking leaving the recovery byte at end. 😞

radicleart on Oct 12, 2023

@radicleart lmk how I can help, I made some alterations to the code until it matched the CLI (in most cases) and to get devenv to work

janniks on Oct 12, 2023

The tool by @radicleart shows sbtc owner ST26DPVMSN4JN55Q7R5TZDWH3S4HSH348KVRF4A6

Lagoon/Leather Wallet shows STQA8RK9TFS3GP9AF6XGHDN77V12R63TKY96PPD2 (https://explorer.hiro.so/txid/0x7196a2599393f3ffeca1762ad6546c7766cbe7a388fdc933e54733283a7c05c9?chain=testnet)

Expected was ST1ZA396YZ6T06JRCVKGQ115QFHC9TQNR1C32201C

friedger on Oct 12, 2023