fix(key-wallet): refuse DIP-14 256-bit children in BLS and SLIP-10 derivation (#1051)

ExtendedBLSPrivKey / ExtendedBLSPubKey and ExtendedEd25519PrivKey hash the child index as u32::from(child), which maps every Normal256 / Hardened256 child to u32::MAX. A path with a 256-bit level therefore derived one key for every identifier at that level, with no error. DIP-14 defines 256-bit children for secp256k1 only, and dashbls / SLIP-10 have 32-bit indices, so these derivers now refuse such a child: InvalidDerivationPath for BLS (private and public), InvalidChildNumberFormat for Ed25519.

Co-authored-by: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

Author: PastaPastaPasta

key-wallet/src/derivation_bls_bip32.rs

@@ -224,6 +224,12 @@ impl ExtendedBLSPrivKey {
         child: ChildNumber,
         format: BlsScheme,
     ) -> Result<Self, Error> {
+        // DIP-14 256-bit children are defined for secp256k1 only; dashbls has
+        // no 256-bit index, and `u32::from` would collapse every one to the same key.
+        if child.is_256_bits() {
+            return Err(Error::InvalidDerivationPath);
+        }
+
         // Build the input data for HMAC, following dashbls
         // `ExtendedPrivateKey::PrivateChild` (extendedprivatekey.cpp)
         let mut input_data = Vec::new();
@@ -429,6 +435,10 @@ impl ExtendedBLSPubKey {
         if child.is_hardened() {
             return Err(Error::CannotDeriveFromHardenedPublic);
         }
+        // See `derive_priv_with_mode`.
+        if child.is_256_bits() {
+            return Err(Error::InvalidDerivationPath);
+        }
 
         // Build the input data for HMAC: public_key || index — matches
         // dashbls `ExtendedPublicKey::PublicChild`, whose fLegacy flag
@@ -1743,4 +1753,22 @@ mod tests {
         assert_eq!(key.depth, 0);
         assert_eq!(key.parent_fingerprint, Fingerprint::default());
     }
+
+    /// A 32-bit index cannot hold a DIP-14 256-bit child, so derivation refuses one instead of
+    /// deriving every such child to the same key.
+    #[test]
+    fn test_256_bit_children_are_refused() {
+        let master = master_from_seed64();
+        let hardened = ChildNumber::from_hardened_idx_256([0x35; 32]);
+        let normal = ChildNumber::from_normal_idx_256([0x35; 32]);
+
+        assert!(matches!(master.derive_priv(hardened), Err(Error::InvalidDerivationPath)));
+        assert!(matches!(master.derive_priv(normal), Err(Error::InvalidDerivationPath)));
+        assert!(matches!(
+            master.to_extended_pub_key().unwrap().derive_pub(normal),
+            Err(Error::InvalidDerivationPath)
+        ));
+        let path = DerivationPath::from(vec![ChildNumber::from_hardened_idx(9).unwrap(), hardened]);
+        assert!(matches!(master.derive_path(&path), Err(Error::InvalidDerivationPath)));
+    }
 }

key-wallet/src/derivation_slip10.rs

@@ -150,6 +150,11 @@ impl ExtendedEd25519PrivKey {
         if !child.is_hardened() {
             return Err(Error::NonHardenedNotSupported);
         }
+        // SLIP-10 indices are 32-bit; `u32::from` would collapse every DIP-14
+        // 256-bit child to the same key.
+        if child.is_256_bits() {
+            return Err(Error::InvalidChildNumberFormat);
+        }
 
         let mut hmac_engine: HmacEngine<sha512::Hash> = HmacEngine::new(self.chain_code.as_ref());
 
@@ -835,4 +840,21 @@ mod test {
         other_network.network = Network::Testnet;
         assert_ne!(master, other_network);
     }
+
+    /// SLIP-10 indices are 32-bit, so a DIP-14 256-bit child is refused instead of deriving every
+    /// such child to the same key.
+    #[test]
+    fn test_256_bit_children_are_refused() {
+        let master = ExtendedEd25519PrivKey::new_master(
+            Network::Mainnet,
+            &hex::decode(CASE_1_SEED).unwrap(),
+        )
+        .unwrap();
+        let child = ChildNumber::from_hardened_idx_256([0x35; 32]);
+        assert!(matches!(master.ckd_priv(child), Err(Error::InvalidChildNumberFormat)));
+        assert!(matches!(
+            master.derive_priv(&[ChildNumber::from_hardened_idx(9).unwrap(), child]),
+            Err(Error::InvalidChildNumberFormat)
+        ));
+    }
 }