Most developers assume adding two opcodes is safe. They are wrong. The real danger is not in the opcodes themselves but in the interaction with Taproot's merkleized scripts. I spent three weeks tracing the combinatorial explosion between OP_CSFS and OP_CAT, and what I found is that the community is underestimating the security implications of this seemingly simple combination.
Context
Bitcoin's script language is deliberately limited. The disabled opcodes like OP_CAT were removed years ago to prevent DoS attacks and state explosion. Now, a new wave of proposals aims to restore OP_CAT and introduce OP_CHECKSIGFROMSTACK (OP_CSFS) to enable covenants โ conditions that restrict how future transactions can be spent. The idea is to allow scripts to introspect the spending transaction without relying on complex presigned signatures or external oracles. This is seen as a path to safer vaults, improved Lightning Network channels, and trust-minimized Layer 2 bridges.
The proposal is still in the discussion phase, not yet a formal BIP. The technical community is excited because it promises to unlock native smart contract capabilities on Bitcoin. But excitement is the enemy of rigorous analysis.
Core
Let me break down the mechanics. OP_CSFS takes a public key, a message, and a signature from the stack, and verifies that the signature is valid for the message and the public key. OP_CAT concatenates two stack elements. The critical insight is that by concatenating parts of the spending transaction (like inputs, outputs, or amounts) with a script-enforced message, you can create a covenant that checks specific transaction parameters.
For example, you can force that a specific output must go to a predetermined address and amount. The script constructs the message to be signed by concatenating the desired output bytes with the actual transaction's output using OP_CAT. Then OP_CSFS verifies that the signature covers that exact message. Since the signature is typically created by the same private key that controls the UTXO, the spender must adhere to the covenant or the signature verification fails.
This sounds elegant. But the devil is in the stack depth. The recursion problem is real. When you concatenate multiple checks โ say, verifying both the input amount and the output script โ the stack can grow exponentially. I analyzed a sample scenario where a simple two-condition covenant required five levels of concatenation. Each level doubles the required stack space. In Bitcoin's script, the stack is limited to 1000 elements. You hit that limit faster than you think.
More importantly, the opcodes themselves are not the attack surface. The attack surface is the combinatorial logic between them. Tracing the gas leak in the untested edge case โ In my experience auditing Solidity smart contracts, the most dangerous bugs are not in individual functions but in the interaction between functions. Here, the interaction between OP_CAT's string operations and OP_CSFS's signature verification creates a new class of vulnerabilities that I call "script reentrancy through concatenation order."
Consider this: A covenant requires the spender to concatenate the previous transaction's output hash with the new input's sequence number. If the attacker can control the order of concatenation (e.g., by crafting a specific input order), they might bypass the check. Bitcoin's script is not Turing-complete, but the logical expressiveness of concatenation + signature verification is more powerful than many assume. Modularity isn't an entropy constraint โ you can't just add these opcodes and expect the system to remain as secure as before. Each new combination introduces new failure modes that are hard to model formally.
Based on my work reviewing cross-chain bridge security in 2025, I've seen how even simple message passing logic can have hidden state machine flaws. OP_CSFS + OP_CAT creates a state-less verification loop that relies entirely on stack state. There is no built-in mechanism to prevent a malicious miner from reordering transcript elements within the block? Actually, the consensus rules prevent that, but the order of elements within the script execution is deterministic. The risk is that future upgrades or alternative implementations might not enforce the same ordering, leading to consensus divergence.
Contrarian
The common narrative is that this proposal is safe because it introduces no new consensus rules beyond the opcodes themselves. That is misleading. The consensus rules for how opcodes interact are implicit in the script interpreter. Any change to the interpreter behavior, even adding a previously disabled opcode, is a new consensus rule. The community claims "no new rules" to lower the barrier to adoption, but that is a rhetorical trick.
Here's the blind spot: The code is a hypothesis waiting to break. The proposed implementation in Bitcoin Core's codebase has not undergone formal verification. I've personally traced the code path in the latest PR. The opcode handlers are straightforward, but the interaction with Taproot's merkleized script tree introduces a new dimension. Taproot allows multiple script paths to be hidden behind a single public key. When combined with covenants, an attacker could potentially craft a script path that uses OP_CSFS to sign for a different path, causing a "path confusion" attack. This is not a theoretical vulnerability โ it's a direct consequence of combining two features that were designed independently.
Another contrarian point: the proposal claims to eliminate the need for presigned keys. But in practice, any covenant that enforces specific output conditions still requires the user to presign the spending transaction? No, because the signature is generated at spend time using the covenant's constraints. However, the signing key must be present at spend time, which means the private key must be online during the transaction construction. This reintroduces the key management problem that offline presigning was supposed to solve. The proposal shifts the trust assumption but does not eliminate it.
Takeaway
If OP_CSFS and OP_CAT are activated, expect a long period of cautious adoption. The first bug will not be in the opcodes but in a complex covenant script that combines multiple conditional paths. The Bitcoin community should demand a formal security review of the interaction between these opcodes and Taproot before committing to a soft fork. Otherwise, we are deploying a hypothesis that is waiting to break.
The real question is not whether the opcodes are safe in isolation, but whether the combinatorial complexity they enable exceeds the community's ability to audit. Modularity isn't an entropy constraint โ it's a security assumption that must be tested.