# Basic vault prototype using OP\_CAT

**URL:** <https://delvingbitcoin.org/t/basic-vault-prototype-using-op-cat/576>\
**Category:** Protocol Design\
**Created:** [February 15, 2024, 10:13pm UTC](https://delvingbitcoin.org/t/basic-vault-prototype-using-op-cat/576 "2024-02-15T22:13:48Z")\
**Posts on this page:** 1\
**Showing post:** 5

<div class="post-metadata">

**Author:** ![dgpv](https://delvingbitcoin.org/user_avatar/delvingbitcoin.org/dgpv/32/75_2.png) [@dgpv](https://delvingbitcoin.org/u/dgpv)\
**Post date:** [April 10, 2024, 5:09pm UTC](https://delvingbitcoin.org/t/basic-vault-prototype-using-op-cat/576/5 "2024-04-10T17:09:27Z")

</div>

> [@rijndael](#):
>
> We use the CAT-checksig technique to validate that the amount and scriptpubkey of the first input and first output are the same. We enforce that the second output is amount is exactly 546 sats, but we do not place any restrictions on the scriptpubkey. We also enforce that there are two inputs and two outputs.

I think that the covenant script does not actually enforce all that.

It enforces that the amount and scriptpubkey of first input is the same as the amount and scriptpubkey of the first output.

But It does not validate the sizes of the buffers - that means that `target_scriptpubkey_buffer` can contain extra data, for extra outputs.

The `fee_scriptpubkey_buffer` and `fee_amount_buffer` can contain extra data, too, for extra inputs.

If the `script_pubkey_buffer` contains extra data, it will interfere with calculation of `spent_scripts_single_hash` as that extra data will be taken as scriptpubkey data, while it will need to contain the amounts. But IIRC, non-standard taproot outputs are treated as anyone-can-spend by miners, so maybe some manipulation is possible here, too.

I think the script should have size checks added for the sizes of all the buffers, just in case.

---

_[View the full topic](https://delvingbitcoin.org/t/basic-vault-prototype-using-op-cat/576)._