The Sigma BRC draft (BRC-304 in opldotdev/BRCs#1, §4.2) requires that for BRC77-algorithm instances, verifiers check that the identity public key embedded in the BRC-77 SignedMessage envelope corresponds to the tape's address field. An instance whose embedded key does not match the claimed address is invalid.
The current implementation does not perform this check. In src/index.ts, verify() for BRC77 returns SignedMessage.verify(msgHash, sigBytes, recipientPrivateKey) directly — envelope validity only. The address field is never compared against the envelope's sender key, so a valid BRC-77 envelope produced by key X verifies even when the tape claims address(Y).
For BSM the binding is inherent (address recovery), so only the BRC77 path is affected.
Suggested fix: after envelope verification, derive the P2PKH address from the envelope's embedded identity public key and require equality with the parsed address field; return false on mismatch.
Flagged during BRC drafting; tracked as a needs-review point in the PR description.
The Sigma BRC draft (BRC-304 in opldotdev/BRCs#1, §4.2) requires that for
BRC77-algorithm instances, verifiers check that the identity public key embedded in the BRC-77 SignedMessage envelope corresponds to the tape'saddressfield. An instance whose embedded key does not match the claimed address is invalid.The current implementation does not perform this check. In
src/index.ts,verify()for BRC77 returnsSignedMessage.verify(msgHash, sigBytes, recipientPrivateKey)directly — envelope validity only. Theaddressfield is never compared against the envelope's sender key, so a valid BRC-77 envelope produced by key X verifies even when the tape claims address(Y).For BSM the binding is inherent (address recovery), so only the BRC77 path is affected.
Suggested fix: after envelope verification, derive the P2PKH address from the envelope's embedded identity public key and require equality with the parsed
addressfield; return false on mismatch.Flagged during BRC drafting; tracked as a needs-review point in the PR description.