[bug]: Malformed STXO proof generated on asset spend

[ffranr]

@Liongrass reported this bug whilst testing v0.7.0-rc1:

• Attempted to send a grouped asset to a V2 group key tap address.
• Asset had been minted a little while back.
• Transfer failed on the sending node; receiving node did not receive anything.
• Logs from attempt:

2025-09-17 19:54:44.784 [INF] FRTR: Received to send request to 1 addrs: [2000000:TapAddr{specifier=AssetSpecifier(id=0000000000000000000000000000000000000000000000000000000000000000, group_pub_key=02875ce409b587a6656357639d099ad9eb08396d0dfea8930a45e742c81d6fc782), amount=2000000, script_key=034b6011daff352ec127a8734793efcff6bc50da7e68150a411f478a4019080f08}]
2025-09-17 19:54:44.785 [INF] FRTR: ChainPorter executing state: SendStateStartHandleAddrParcel
2025-09-17 19:54:44.825 [INF] FRTR: ChainPorter executing state: SendStateVirtualCommitmentSelect
2025-09-17 19:54:44.878 [INF] FRTR: Identified 4 eligible asset inputs for send of 2000000 to group_key=02875ce409b587a6656357639d099ad9eb08396d0dfea8930a45e742c81d6fc782, asset_id=, min_amt=2000000: [a13327d4b73be2057fae7cd999b7599a8d418df439b9a44f3adeac67b72ac307:0 a13327d4b73be2057fae7cd999b7599a8d418df439b9a44f3adeac67b72ac307:0 a13327d4b73be2057fae7cd999b7599a8d418df439b9a44f3adeac67b72ac307:0 a13327d4b73be2057fae7cd999b7599a8d418df439b9a44f3adeac67b72ac307:0]
2025-09-17 19:54:44.880 [INF] FRTR: Selected 1 asset inputs for send of 2000000 to AssetSpecifier(id=, group_pub_key=02875ce409b587a6656357639d099ad9eb08396d0dfea8930a45e742c81d6fc782)
2025-09-17 19:54:44.922 [INF] FRTR: ChainPorter executing state: SendStateVirtualSign
2025-09-17 19:54:44.922 [INF] FRTR: Generating Taproot Asset witnesses for send to: 024eb56b120f6d6b9fd50af497311589107dd96e0066230f77f427805c249a9334
2025-09-17 19:54:44.933 [ERR] FRTR: Error evaluating state (SendStateVirtualSign): unable to sign and commit virtual packet: unable to verify inclusion proof: error verifying proofs: invalid inclusion proof: error verifying v1 inclusion proof: error verifying STXO proof: missing asset proof
2025-09-17 19:54:44.933 [ERR] TRPC: [/taprpc.TaprootAssets/SendAsset]: unable to sign and commit virtual packet: unable to verify inclusion proof: error verifying proofs: invalid inclusion proof: error verifying v1 inclusion proof: error verifying STXO proof: missing asset proof

• Logs indicate that AssetProof field is not populated on STXO proof.
• Execution likely took the following code path:

taproot-assets/proof/append.go

Lines 209 to 229 in b21d5d2

	if proof.Asset.IsTransferRoot() && !cfg.NoSTXOProofs {
	stxoInclusionProofs := make(
	map[asset.SerializedKey]commitment.Proof,
	len(proof.Asset.PrevWitnesses),
	)
	for _, wit := range proof.Asset.PrevWitnesses {
	spentAsset, err := asset.MakeSpentAsset(wit)
	if err != nil {
	return nil, fmt.Errorf("error creating "+
	"altLeaf: %w", err)
	}
	// Generate an STXO inclusion proof for each prev
	// witness.
	_, stxoProof, err := params.TaprootAssetRoot.Proof(
	asset.EmptyGenesisID,
	spentAsset.AssetCommitmentKey(),
	)
	if err != nil {
	return nil, err
	}

• And then return here from the params.TaprootAssetRoot.Proof call:
  

  taproot-assets/commitment/tap.go

  Lines 491 to 496 in b21d5d2

  	// If the corresponding AssetCommitment does not exist, return the Proof
  	// as is.
  	assetCommitment, ok := c.assetCommitments[tapCommitmentKey]
  	if !ok {
  	return nil, proof, nil
  	}

[ffranr]

While digging into this bug, I noticed that the following erroneous change seems quite fundamental, yet surprisingly doesn't cause any tests to fail: #1810

[ffranr]

See also:

2025-09-18 21:12:19.471 [WRN] UNIV: encountered an error whilst syncing with server=(universe.ServerAddr) {
 ID: (int64) 2,
 addrStr: (string) (len=31) "universe.signet.laisee.org:8443",
 addr: (net.Addr) <nil>
}
: failed to execute sync: unable to register proofs: unable to register proofs: unable to batch verify issuance proofs: unable to verify proof (transfer-10907cc4e4525c565c5605c41031c09968e46b9e9f4eb0cf25b24d2d7a94e130 (asset_id=0000000000000000000000000000000000000000000000000000000000000000, group_key=875ce409b587a6656357639d099ad9eb08396d0dfea8930a45e742c81d6fc782, proof_type=transfer), outpoint=4cc78d1220c5547cf8321120471e3c5022a9d06c0df1bcfa1559a9a8e023d79b:0, scriptKey=02a207ba37828ba9f9aaacddcd2da3cdf30c1d6e2c2c74cdc620f4198088691334): error verifying proofs: invalid inclusion proof: error verifying v1 inclusion proof: error verifying STXO proof: missing asset proof

[Roasbeef]

Looking at that last log message, it looks like the minting transaction itself is what is missing the STXO proof.

We write the final proofs in storeMintingProof but at that point, all the non-chain information has already been committed.

EDIT: I thought it was an issuance proof rejected, but it's actually a transfer proof.

So perhaps somewhere along the way, minting proofs are missing an STXO commitment? That doesn't explain why we're only seeing this issue in an isolated instance though.

[Roasbeef]

Thinking about it more: IIUC, the send is failing as it declare that the input proof is invalid. Above we see where the proof was rejected as it was missing STXO information. These appear to be connected, in that if the issuance proof is invalid, then when we go to spend the input, we'd reject it as the proof itself is invalid.

However, we don't add STXO proofs for a newly minted asset. Right now we also don't piggy back normal transfers on minting transactions either.

EDIT: It's actually a transfer proof being rejected, not an issuance proof.