[phroi]

Why

RFC 0023 specifies the phase-2 witness field that names a deposit header's index in header_deps as a 64-bit unsigned little-endian integer, but it does not state the deployed script's effective range.

Molecule declares the segment pointer as uint8_t *:

// Bytes segment.
typedef struct {
    uint8_t                     *ptr;               // Pointer
    mol_num_t                   size;               // Full size
} mol_seg_t;

The deployed DAO script requires an eight-byte field but assigns its dereferenced pointer directly to the index:

  mol_seg_t type_bytes_seg = MolReader_Bytes_raw_bytes(&type_seg);
  if (type_bytes_seg.size != 8) {
    return ERROR_ENCODING;
  }

  *index = *type_bytes_seg.ptr;

Dereferencing a uint8_t * reads one byte. Index 256 is encoded as 0x0001000000000000, but the script reads its first byte as index 0. When header_deps[0] is not the intended deposit header, the script loads the wrong header and validation fails.

Minimal Proof

#include <inttypes.h>
#include <limits.h>
#include <stdint.h>
#include <stdio.h>

int main(void) {
  uint8_t input_type[8] = {0x00, 0x01, 0, 0, 0, 0, 0, 0};
  uint8_t *ptr = input_type;
  uint64_t rfc_index = 0;

  for (size_t i = 0; i < sizeof(input_type); i++) {
    rfc_index |= (uint64_t)input_type[i] << (i * CHAR_BIT);
  }

  size_t script_index = *ptr;
  printf("pointee width: %zu bits\n", sizeof(*ptr) * CHAR_BIT);
  printf("RFC index: %" PRIu64 "\n", rfc_index);
  printf("script index: %zu\n", script_index);
}

$ cc -std=c11 -Wall -Wextra -pedantic proof.c -o proof
$ ./proof
pointee width: 8 bits
RFC index: 256
script index: 0

Keep up the Great Work,
Phroi %97