From 529eaa1f3a45f6922acb72309f92e9c85de1b832 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 18 Aug 2026 15:20:26 +0200
Subject: [PATCH 1/9] test: ruff format for feature_sighash_rangeproof.py

---
 test/functional/feature_sighash_rangeproof.py | 53 ++++++++++---------
 1 file changed, 28 insertions(+), 25 deletions(-)

diff --git a/test/functional/feature_sighash_rangeproof.py b/test/functional/feature_sighash_rangeproof.py
index 88fb226e1a..a2f20824f5 100755
--- a/test/functional/feature_sighash_rangeproof.py
+++ b/test/functional/feature_sighash_rangeproof.py
@@ -8,36 +8,35 @@
 """
 
 import struct
-from test_framework.test_framework import BitcoinTestFramework
+
+from test_framework import util
 from test_framework.address import base58_to_byte
+from test_framework.blocktools import add_witness_commitment
+from test_framework.key import ECKey
+from test_framework.messages import (
+    CBlock,
+    from_hex,
+    tx_from_hex,
+)
 from test_framework.script import (
-    hash160,
-    LegacySignatureHash,
-    SegwitV0SignatureHash,
-    SIGHASH_ALL,
-    SIGHASH_RANGEPROOF,
-    CScript,
-    CScriptOp,
     OP_CHECKSIG,
     OP_DUP,
     OP_EQUALVERIFY,
     OP_HASH160,
+    SIGHASH_ALL,
+    SIGHASH_RANGEPROOF,
+    CScript,
+    CScriptOp,
+    LegacySignatureHash,
+    SegwitV0SignatureHash,
+    hash160,
 )
-from test_framework.key import ECKey
-
-from test_framework.messages import (
-    CBlock,
-    tx_from_hex,
-    from_hex,
-)
-
-from test_framework import util
+from test_framework.test_framework import BitcoinTestFramework
 from test_framework.util import (
     assert_equal,
     assert_raises_rpc_error,
 )
 
-from test_framework.blocktools import add_witness_commitment
 
 def get_p2pkh_script(pubkeyhash):
     """Get the script associated with a P2PKH."""
@@ -112,7 +111,7 @@ def prepare_tx_signed_with_sighash(self, address_type, sighash_rangeproof_aware,
 
         # Prepare the keypair we need to re-sign the tx.
         wif = self.nodes[1].dumpprivkey(addr)
-        (b, v) = base58_to_byte(wif)
+        (b, _v) = base58_to_byte(wif)
         privkey = ECKey()
         privkey.set(b[0:32], len(b) == 33)
         pubkey = privkey.get_pubkey()
@@ -235,12 +234,12 @@ def run_test(self):
         # - the tx is not accepted in the mempool and
         # - the tx is accepted if manually mined in a block
         for address_type in ADDRESS_TYPES:
-            self.log.info("Pre-activation for {} address".format(address_type))
+            self.log.info(f"Pre-activation for {address_type} address")
             tx = self.prepare_tx_signed_with_sighash(address_type, False, False)
             self.assert_tx_standard(tx, False)
             self.assert_tx_valid(tx, True)
 
-            self.log.info("Pre-activation for {} address (with issuance)".format(address_type))
+            self.log.info(f"Pre-activation for {address_type} address (with issuance)")
             tx = self.prepare_tx_signed_with_sighash(address_type, False, True)
             self.assert_tx_standard(tx, False)
             self.assert_tx_valid(tx, True)
@@ -257,25 +256,29 @@ def run_test(self):
         # Test that the use of SIGHASH_RANGEPROOF is legal and standard
         # after activation.
         for address_type in ADDRESS_TYPES:
-            self.log.info("Post-activation for {} address".format(address_type))
+            self.log.info(f"Post-activation for {address_type} address")
             tx = self.prepare_tx_signed_with_sighash(address_type, True, False)
             self.assert_tx_standard(tx, True)
             self.assert_tx_valid(tx, True)
 
-            self.log.info("Post-activation for {} address (with issuance)".format(address_type))
+            self.log.info(f"Post-activation for {address_type} address (with issuance)")
             tx = self.prepare_tx_signed_with_sighash(address_type, True, True)
             self.assert_tx_standard(tx, True)
             self.assert_tx_valid(tx, True)
 
+            # Post-activation, the wallet default must set SIGHASH_RANGEPROOF.
+            self.log.info(f"Post-activation default sighash for {address_type} address")
+            self.assert_default_sign_commits_rangeproof(address_type, expect_rangeproof=True)
+
         # Ensure that if we then use the old sighash algorithm that doesn't hash
         # the rangeproofs, the signature is no longer valid.
         for address_type in ADDRESS_TYPES:
-            self.log.info("Post-activation invalid sighash for {} address".format(address_type))
+            self.log.info(f"Post-activation invalid sighash for {address_type} address")
             tx = self.prepare_tx_signed_with_sighash(address_type, False, False)
             self.assert_tx_standard(tx, False)
             self.assert_tx_valid(tx, False)
 
-            self.log.info("Post-activation invalid sighash for {} address (with issuance)".format(address_type))
+            self.log.info(f"Post-activation invalid sighash for {address_type} address (with issuance)")
             tx = self.prepare_tx_signed_with_sighash(address_type, False, True)
             self.assert_tx_standard(tx, False)
             self.assert_tx_valid(tx, False)

From 6a531c262670f421af23fcfb95a8b090135553df Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 18 Aug 2026 15:32:43 +0200
Subject: [PATCH 2/9] script: add SIGHASH_ALL_WITH_RANGEPROOF and
 DefaultSighashType; strip rangeproof bit for Taproot signing

Add a named default constant SIGHASH_ALL_WITH_RANGEPROOF (SIGHASH_ALL |
SIGHASH_RANGEPROOF) and a DefaultSighashType() helper that selects the
default pre-Taproot sighash based on whether SIGHASH_RANGEPROOF is active
for the target chain.

Strip the 0x40 (SIGHASH_RANGEPROOF) bit when computing Schnorr
signatures, since the BIP341-style sighash always commits to rangeproofs
and rejects the bit. This keeps SIGHASH_ALL_WITH_RANGEPROOF a valid
universal default for both pre-Taproot and Taproot signing.
---
 src/script/interpreter.h   |  9 +++++++++
 src/script/sign.cpp        | 18 ++++++++++++++++--
 src/script/sign.h          | 14 ++++++++++++++
 src/test/sighash_tests.cpp | 18 ++++++++++++++++++
 4 files changed, 57 insertions(+), 2 deletions(-)

diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index b1a510bd62..1189f0838e 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -39,6 +39,15 @@ enum
     // ELEMENTS:
     // A flag that means the rangeproofs should be included in the sighash.
     SIGHASH_RANGEPROOF = 0x40,
+
+    // ELEMENTS:
+    // The default sighash used by wallets/tools when signing pre-Taproot
+    // (BASE/WITNESS_V0) inputs on chains where SIGHASH_RANGEPROOF is active.
+    // This commits to the output rangeproofs, closing the pre-Taproot
+    // rangeproof (witness) malleability gap. Note this must only be used once
+    // dynafed (which enables SCRIPT_SIGHASH_RANGEPROOF) is active for the target
+    // chain; otherwise the resulting signatures are non-standard and invalid.
+    SIGHASH_ALL_WITH_RANGEPROOF = SIGHASH_ALL | SIGHASH_RANGEPROOF,
 };
 
 /** Script verification flags.
diff --git a/src/script/sign.cpp b/src/script/sign.cpp
index cea4ee1732..9db8ce7abb 100644
--- a/src/script/sign.cpp
+++ b/src/script/sign.cpp
@@ -38,6 +38,15 @@ MutableTransactionSignatureCreator::MutableTransactionSignatureCreator(const CMu
 {
 }
 
+int DefaultSighashType(bool sighash_rangeproof_active)
+{
+    // When SIGHASH_RANGEPROOF is active for the chain, default to committing to
+    // rangeproofs for pre-Taproot inputs. The 0x40 bit is stripped for Taproot
+    // signing (see CreateSchnorrSig), so this is a safe universal default.
+    // Otherwise fall back to SIGHASH_DEFAULT (== SIGHASH_ALL for pre-Taproot).
+    return sighash_rangeproof_active ? SIGHASH_ALL_WITH_RANGEPROOF : SIGHASH_DEFAULT;
+}
+
 bool MutableTransactionSignatureCreator::CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& address, const CScript& scriptCode, SigVersion sigversion, unsigned int flags) const
 {
     assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0);
@@ -85,12 +94,17 @@ bool MutableTransactionSignatureCreator::CreateSchnorrSig(const SigningProvider&
         execdata.m_tapleaf_hash_init = true;
         execdata.m_tapleaf_hash = *leaf_hash;
     }
+    // ELEMENTS: SIGHASH_RANGEPROOF is a pre-Taproot-only flag; the BIP341-style
+    // sighash always commits to rangeproofs and rejects the 0x40 bit. Strip it so
+    // that a universal default of SIGHASH_ALL_WITH_RANGEPROOF still produces valid
+    // Taproot signatures.
+    const int taproot_hashtype = nHashType & ~SIGHASH_RANGEPROOF;
     uint256 hash;
-    if (!SignatureHashSchnorr(hash, execdata, m_txto, nIn, nHashType, sigversion, *m_txdata, MissingDataBehavior::FAIL)) return false;
+    if (!SignatureHashSchnorr(hash, execdata, m_txto, nIn, taproot_hashtype, sigversion, *m_txdata, MissingDataBehavior::FAIL)) return false;
     sig.resize(64);
     // Use uint256{} as aux_rnd for now.
     if (!key.SignSchnorr(hash, sig, merkle_root, {})) return false;
-    if (nHashType) sig.push_back(nHashType);
+    if (taproot_hashtype) sig.push_back(taproot_hashtype);
     return true;
 }
 
diff --git a/src/script/sign.h b/src/script/sign.h
index 5820080f08..f98a89a7f9 100644
--- a/src/script/sign.h
+++ b/src/script/sign.h
@@ -107,4 +107,18 @@ bool IsSegWitOutput(const SigningProvider& provider, const CScript& script);
 /** Sign the CMutableTransaction */
 bool SignTransaction(CMutableTransaction& mtx, const SigningProvider* provider, const std::map<COutPoint, Coin>& coins, int sighash, const uint256& hash_genesis_block, std::map<int, bilingual_str>& input_errors);
 
+/**
+ * ELEMENTS: Return the default sighash type to use when the caller did not
+ * specify one. When SIGHASH_RANGEPROOF is active for the target chain, the
+ * default commits to output rangeproofs (SIGHASH_ALL_WITH_RANGEPROOF for
+ * pre-Taproot inputs); otherwise the historical default (SIGHASH_DEFAULT, which
+ * is equivalent to SIGHASH_ALL for pre-Taproot) is used so that signatures stay
+ * standard and valid on chains where dynafed is not active.
+ *
+ * Note: for Taproot inputs the sighash byte's rangeproof bit is ignored (the
+ * BIP341-style sighash always commits to rangeproofs), so this default is only
+ * meaningful for BASE/WITNESS_V0 signing.
+ */
+int DefaultSighashType(bool sighash_rangeproof_active);
+
 #endif // BITCOIN_SCRIPT_SIGN_H
diff --git a/src/test/sighash_tests.cpp b/src/test/sighash_tests.cpp
index 5db1987c7f..90760b93cb 100644
--- a/src/test/sighash_tests.cpp
+++ b/src/test/sighash_tests.cpp
@@ -8,6 +8,7 @@
 #include <hash.h>
 #include <script/interpreter.h>
 #include <script/script.h>
+#include <script/sign.h>
 #include <serialize.h>
 #include <streams.h>
 #include <test/data/sighash.json.h>
@@ -208,4 +209,21 @@ BOOST_AUTO_TEST_CASE(sighash_from_data)
         BOOST_CHECK_MESSAGE(sh.GetHex() == sigHashHex, strTest);
     }
 }
+
+// ELEMENTS: verify the default sighash selection helper.
+BOOST_AUTO_TEST_CASE(sighash_default_type)
+{
+    // The named constant sets both the ALL and RANGEPROOF bits.
+    BOOST_CHECK_EQUAL(SIGHASH_ALL_WITH_RANGEPROOF, SIGHASH_ALL | SIGHASH_RANGEPROOF);
+    BOOST_CHECK(SIGHASH_ALL_WITH_RANGEPROOF & SIGHASH_RANGEPROOF);
+
+    // When rangeproof signing is not active, fall back to SIGHASH_DEFAULT
+    // (== SIGHASH_ALL for pre-Taproot); do not set the rangeproof bit.
+    BOOST_CHECK_EQUAL(DefaultSighashType(/*sighash_rangeproof_active=*/false), SIGHASH_DEFAULT);
+    BOOST_CHECK((DefaultSighashType(false) & SIGHASH_RANGEPROOF) == 0);
+
+    // When active, default to committing to rangeproofs.
+    BOOST_CHECK_EQUAL(DefaultSighashType(/*sighash_rangeproof_active=*/true), SIGHASH_ALL_WITH_RANGEPROOF);
+    BOOST_CHECK((DefaultSighashType(true) & SIGHASH_RANGEPROOF) == SIGHASH_RANGEPROOF);
+}
 BOOST_AUTO_TEST_SUITE_END()

From be15b0698bf8c6d35a296698b700d6f502418122 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 18 Aug 2026 15:32:48 +0200
Subject: [PATCH 3/9] node: expose Chain::isSighashRangeproofActive()
 (tip-based dynafed check)

Add a Chain interface method that reports whether SIGHASH_RANGEPROOF is
active for signing at the current chain tip, mirroring the mempool
standardness check (DeploymentActiveAfter for DEPLOYMENT_DYNA_FED). This
is the live-tip gating source used by the wallet and wallet-backed RPC to
decide the default pre-Taproot sighash.
---
 src/interfaces/chain.h  | 7 +++++++
 src/node/interfaces.cpp | 8 ++++++++
 2 files changed, 15 insertions(+)

diff --git a/src/interfaces/chain.h b/src/interfaces/chain.h
index 4676ce5b4e..565db756b6 100644
--- a/src/interfaces/chain.h
+++ b/src/interfaces/chain.h
@@ -208,6 +208,13 @@ class Chain
     //! Check if transaction is RBF opt in.
     virtual RBFTransactionState isRBFOptIn(const CTransaction& tx) = 0;
 
+    //! ELEMENTS: Check whether SIGHASH_RANGEPROOF is active for signing at the
+    //! current chain tip (i.e. dynafed, which enables SCRIPT_SIGHASH_RANGEPROOF,
+    //! is active). Used to decide the default pre-Taproot sighash so that we only
+    //! commit to output rangeproofs when doing so yields standard, valid
+    //! signatures.
+    virtual bool isSighashRangeproofActive() = 0;
+
     //! Check if transaction is in mempool.
     virtual bool isInMempool(const uint256& txid) = 0;
 
diff --git a/src/node/interfaces.cpp b/src/node/interfaces.cpp
index c6b9c4d446..1c690ff457 100644
--- a/src/node/interfaces.cpp
+++ b/src/node/interfaces.cpp
@@ -668,6 +668,14 @@ class ChainImpl : public Chain
         LOCK(m_node.mempool->cs);
         return IsRBFOptIn(tx, *m_node.mempool);
     }
+    bool isSighashRangeproofActive() override
+    {
+        // Mirror the mempool standardness check in MemPoolAccept: dynafed being
+        // active after the current tip enables SCRIPT_SIGHASH_RANGEPROOF, which
+        // is what makes SIGHASH_RANGEPROOF signatures standard and valid.
+        LOCK(::cs_main);
+        return DeploymentActiveAfter(chainman().ActiveChain().Tip(), chainman(), Consensus::DEPLOYMENT_DYNA_FED);
+    }
     bool isInMempool(const uint256& txid) override
     {
         if (!m_node.mempool) return false;

From 2d625d4be5f7f537795cc0d1379ae8dfff275890 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 18 Aug 2026 15:32:54 +0200
Subject: [PATCH 4/9] chainparams: add SighashRangeproofActiveByParams() for
 offline gating

Add a CChainParams helper that decides, from chain parameters alone
(without a chain tip), whether SIGHASH_RANGEPROOF can be assumed active.
This is true when dynafed is configured ALWAYS_ACTIVE, or on liquidv1
where dynafed is height-activated (not the ALWAYS_ACTIVE sentinel) but is
long since active on the live chain. This is the chainstate-less gating
source used by elements-tx.

Add a unit test covering liquidv1 (active by chain type, nStartTime !=
ALWAYS_ACTIVE), liquidv1test (active via ALWAYS_ACTIVE override), and
regtest (inactive).
---
 src/kernel/chainparams.h      | 15 +++++++++++++++
 src/test/validation_tests.cpp | 24 ++++++++++++++++++++++++
 2 files changed, 39 insertions(+)

diff --git a/src/kernel/chainparams.h b/src/kernel/chainparams.h
index 4b584810a1..daab37858c 100644
--- a/src/kernel/chainparams.h
+++ b/src/kernel/chainparams.h
@@ -144,6 +144,21 @@ class CChainParams
     std::string GetChainTypeString() const { return m_chain_type.chain_name; }
     /** Return the chain type */
     ChainTypeMeta GetChainTypeMeta() const { return m_chain_type; }
+    /**
+     * ELEMENTS: Whether SIGHASH_RANGEPROOF can be assumed active for this chain
+     * from the chain parameters alone (i.e. without inspecting the current tip).
+     * Used by offline tooling such as elements-tx that has no chainstate to
+     * decide the default sighash. This is true when dynafed (which enables
+     * SCRIPT_SIGHASH_RANGEPROOF) is configured ALWAYS_ACTIVE (e.g. elementsregtest
+     * with dynafed enabled, or liquidv1test), or on liquidv1 where dynafed is
+     * height-activated (nStartTime is a block height, not the ALWAYS_ACTIVE
+     * sentinel) but is long since active on the live chain.
+     */
+    bool SighashRangeproofActiveByParams() const
+    {
+        return consensus.vDeployments[Consensus::DEPLOYMENT_DYNA_FED].nStartTime == Consensus::BIP9Deployment::ALWAYS_ACTIVE
+            || m_chain_type.chain_type == ChainType::LIQUID1;
+    }
     /** Return the list of hostnames to look up for DNS seeds */
     const std::vector<std::string>& DNSSeeds() const { return vSeeds; }
     const std::vector<unsigned char>& Base58Prefix(Base58Type type) const { return base58Prefixes[type]; }
diff --git a/src/test/validation_tests.cpp b/src/test/validation_tests.cpp
index d7333bd0ae..2d07198cb8 100644
--- a/src/test/validation_tests.cpp
+++ b/src/test/validation_tests.cpp
@@ -364,4 +364,28 @@ BOOST_AUTO_TEST_CASE(block_malleation)
     }
 }
 
+// ELEMENTS: the offline (chainstate-less) SIGHASH_RANGEPROOF gating used by
+// elements-tx must treat liquidv1 as known-active even though dynafed there is
+// height-activated rather than ALWAYS_ACTIVE.
+BOOST_AUTO_TEST_CASE(sighash_rangeproof_by_params_test)
+{
+    // liquidv1: dynafed is height-activated (nStartTime = 1000000), NOT the
+    // ALWAYS_ACTIVE sentinel, but must be treated as active by params.
+    const auto liquidv1 = CreateChainParams(*m_node.args, ChainType::LIQUID1);
+    BOOST_CHECK(liquidv1->GetConsensus().vDeployments[Consensus::DEPLOYMENT_DYNA_FED].nStartTime
+                != Consensus::BIP9Deployment::ALWAYS_ACTIVE);
+    BOOST_CHECK(liquidv1->SighashRangeproofActiveByParams());
+
+    // liquidv1test: overrides dynafed to ALWAYS_ACTIVE, so it is active by params
+    // via the ALWAYS_ACTIVE branch (independent of the liquidv1 chain-type check).
+    const auto liquidv1test = CreateChainParams(*m_node.args, ChainType::LIQUID1TEST);
+    BOOST_CHECK_EQUAL(liquidv1test->GetConsensus().vDeployments[Consensus::DEPLOYMENT_DYNA_FED].nStartTime,
+                      Consensus::BIP9Deployment::ALWAYS_ACTIVE);
+    BOOST_CHECK(liquidv1test->SighashRangeproofActiveByParams());
+
+    // regtest: dynafed never active by default; must be inactive by params.
+    const auto regtest = CreateChainParams(*m_node.args, ChainType::REGTEST);
+    BOOST_CHECK(!regtest->SighashRangeproofActiveByParams());
+}
+
 BOOST_AUTO_TEST_SUITE_END()

From e5bd24e6d8784e84877288c63610823bd38b7006 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 18 Aug 2026 15:33:00 +0200
Subject: [PATCH 5/9] wallet: default to rangeproof-committing sighash when
 dynafed active

Change the wallet's default pre-Taproot sighash to commit to output
rangeproofs when dynafed is active at the current tip, closing the
pre-Taproot rangeproof (witness) malleability gap. Route the default
through DefaultSighashType(chain().isSighashRangeproofActive()) in
CWallet::SignTransaction and in the signrawtransactionwithwallet /
walletprocesspsbt RPCs when the caller does not supply a sighash.
Explicit user-supplied sighash types are left untouched.
---
 src/wallet/rpc/spend.cpp | 12 ++++++++++--
 src/wallet/wallet.cpp    |  2 +-
 src/wallet/wallet.h      |  1 +
 3 files changed, 12 insertions(+), 3 deletions(-)

diff --git a/src/wallet/rpc/spend.cpp b/src/wallet/rpc/spend.cpp
index 393d04787e..cd86d18b0c 100644
--- a/src/wallet/rpc/spend.cpp
+++ b/src/wallet/rpc/spend.cpp
@@ -1050,7 +1050,11 @@ RPCHelpMan signrawtransactionwithwallet()
     LOCK(pwallet->cs_wallet);
     EnsureWalletIsUnlocked(*pwallet);
 
-    int nHashType = ParseSighashString(request.params[2]);
+    // ELEMENTS: when no sighash is specified, default to committing to
+    // rangeproofs if SIGHASH_RANGEPROOF is active at the current tip.
+    int nHashType = request.params[2].isNull()
+        ? DefaultSighashType(pwallet->chain().isSighashRangeproofActive())
+        : ParseSighashString(request.params[2]);
 
     CMutableTransaction mtx;
     if (!DecodeHexTx(mtx, request.params[0].get_str())) {
@@ -1755,7 +1759,11 @@ RPCHelpMan walletprocesspsbt()
     }
 
     // Get the sighash type
-    int nHashType = ParseSighashString(request.params[2]);
+    // ELEMENTS: when no sighash is specified, default to committing to
+    // rangeproofs if SIGHASH_RANGEPROOF is active at the current tip.
+    int nHashType = request.params[2].isNull()
+        ? DefaultSighashType(pwallet->chain().isSighashRangeproofActive())
+        : ParseSighashString(request.params[2]);
 
     // Don't sign, just fill data.
     bool bip32derivs = request.params[3].isNull() ? true : request.params[3].get_bool();
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index ef13356416..52b7abd704 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -2306,7 +2306,7 @@ bool CWallet::SignTransaction(CMutableTransaction& tx) const
         coins[input.prevout] = Coin(wtx.tx->vout[input.prevout.n], prev_height, wtx.IsCoinBase());
     }
     std::map<int, bilingual_str> input_errors;
-    return SignTransaction(tx, coins, SIGHASH_DEFAULT, input_errors);
+    return SignTransaction(tx, coins, DefaultSighashType(chain().isSighashRangeproofActive()), input_errors); // ELEMENTS
 }
 
 bool CWallet::SignTransaction(CMutableTransaction& tx, const std::map<COutPoint, Coin>& coins, int sighash, std::map<int, bilingual_str>& input_errors) const
diff --git a/src/wallet/wallet.h b/src/wallet/wallet.h
index 62dcc74989..d55ad56b90 100644
--- a/src/wallet/wallet.h
+++ b/src/wallet/wallet.h
@@ -702,6 +702,7 @@ class CWallet final : public WalletStorage, public interfaces::Chain::Notificati
     OutputType TransactionChangeType(const std::optional<OutputType>& change_type, const std::vector<CRecipient>& vecSend) const;
 
     /** Fetch the inputs and sign with SIGHASH_ALL. */
+    // ELEMENTS: sign with SIGHASH_ALL_WITH_RANGEPROOF for DynaFed chains
     bool SignTransaction(CMutableTransaction& tx) const EXCLUSIVE_LOCKS_REQUIRED(cs_wallet);
     /** Sign the tx given the input coins and sighash. */
     bool SignTransaction(CMutableTransaction& tx, const std::map<COutPoint, Coin>& coins, int sighash, std::map<int, bilingual_str>& input_errors) const;

From fbd9fb14511a1bfae27c626f05d6052492f4a1a4 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 18 Aug 2026 15:33:18 +0200
Subject: [PATCH 6/9] rpc: default raw signing to rangeproof-committing sighash
 when dynafed active

Default the raw signing RPCs to commit to output rangeproofs when dynafed
is active at the current tip. The SignTransaction util gains a
sighash_rangeproof_active parameter and, when no sighash is supplied,
resolves the default via DefaultSighashType. Wire this through
signrawtransactionwithkey and descriptorprocesspsbt using
DeploymentActiveAfter(DEPLOYMENT_DYNA_FED) for tip activation. Explicit
user-supplied sighash types are left untouched.
---
 src/rpc/rawtransaction.cpp      | 18 +++++++++++++++---
 src/rpc/rawtransaction_util.cpp |  6 ++++--
 src/rpc/rawtransaction_util.h   |  2 +-
 3 files changed, 20 insertions(+), 6 deletions(-)

diff --git a/src/rpc/rawtransaction.cpp b/src/rpc/rawtransaction.cpp
index 1877d08777..8e4f887107 100644
--- a/src/rpc/rawtransaction.cpp
+++ b/src/rpc/rawtransaction.cpp
@@ -11,6 +11,7 @@
 #include <consensus/amount.h>
 #include <consensus/validation.h>
 #include <core_io.h>
+#include <deploymentstatus.h>
 #include <index/txindex.h>
 #include <key_io.h>
 #include <logging.h>
@@ -891,8 +892,10 @@ static RPCHelpMan signrawtransactionwithkey()
     ParsePrevouts(request.params[2], &keystore, coins);
 
     UniValue result(UniValue::VOBJ);
-    auto tip = WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip());
-    SignTransaction(mtx, &keystore, coins, request.params[3], result, tip);
+    const auto [tip, sighash_rangeproof_active] = WITH_LOCK(::cs_main, return std::make_pair(
+        chainman.ActiveChain().Tip(),
+        DeploymentActiveAfter(chainman.ActiveChain().Tip(), chainman, Consensus::DEPLOYMENT_DYNA_FED)));
+    SignTransaction(mtx, &keystore, coins, request.params[3], result, tip, sighash_rangeproof_active);
     return result;
 },
     };
@@ -3300,7 +3303,16 @@ RPCHelpMan descriptorprocesspsbt()
         EvalDescriptorStringOrObject(descs[i], provider, /*expand_priv=*/true);
     }
 
-    int sighash_type = ParseSighashString(request.params[2]);
+    // ELEMENTS: when no sighash is specified, default to committing to
+    // rangeproofs if SIGHASH_RANGEPROOF is active at the current tip.
+    int sighash_type;
+    if (request.params[2].isNull()) {
+        ChainstateManager& chainman = EnsureAnyChainman(request.context);
+        const bool sighash_rangeproof_active = WITH_LOCK(::cs_main, return DeploymentActiveAfter(chainman.ActiveChain().Tip(), chainman, Consensus::DEPLOYMENT_DYNA_FED));
+        sighash_type = DefaultSighashType(sighash_rangeproof_active);
+    } else {
+        sighash_type = ParseSighashString(request.params[2]);
+    }
     bool bip32derivs = request.params[3].isNull() ? true : request.params[3].get_bool();
     bool finalize = request.params[4].isNull() ? true : request.params[4].get_bool();
 
diff --git a/src/rpc/rawtransaction_util.cpp b/src/rpc/rawtransaction_util.cpp
index 54419134d7..0c30f61d54 100644
--- a/src/rpc/rawtransaction_util.cpp
+++ b/src/rpc/rawtransaction_util.cpp
@@ -608,9 +608,11 @@ bool ValidateTransactionPeginInputs(const CMutableTransaction& mtx, const CBlock
     return immature_pegin;
 }
 
-void SignTransaction(CMutableTransaction& mtx, const SigningProvider* keystore, const std::map<COutPoint, Coin>& coins, const UniValue& hashType, UniValue& result, const CBlockIndex* active_chain_tip)
+void SignTransaction(CMutableTransaction& mtx, const SigningProvider* keystore, const std::map<COutPoint, Coin>& coins, const UniValue& hashType, UniValue& result, const CBlockIndex* active_chain_tip, bool sighash_rangeproof_active)
 {
-    int nHashType = ParseSighashString(hashType);
+    // ELEMENTS: when no sighash is specified, default to committing to
+    // rangeproofs if SIGHASH_RANGEPROOF is active at the current tip.
+    int nHashType = hashType.isNull() ? DefaultSighashType(sighash_rangeproof_active) : ParseSighashString(hashType);
 
     // Script verification errors
     std::map<int, bilingual_str> input_errors;
diff --git a/src/rpc/rawtransaction_util.h b/src/rpc/rawtransaction_util.h
index 7f8226c56f..4ff1b18993 100644
--- a/src/rpc/rawtransaction_util.h
+++ b/src/rpc/rawtransaction_util.h
@@ -37,7 +37,7 @@ class SigningProvider;
  * @param  hashType      The signature hash type
  * @param result         JSON object where signed transaction results accumulate
  */
-void SignTransaction(CMutableTransaction& mtx, const SigningProvider* keystore, const std::map<COutPoint, Coin>& coins, const UniValue& hashType, UniValue& result, const CBlockIndex* active_chain_tip);
+void SignTransaction(CMutableTransaction& mtx, const SigningProvider* keystore, const std::map<COutPoint, Coin>& coins, const UniValue& hashType, UniValue& result, const CBlockIndex* active_chain_tip, bool sighash_rangeproof_active);
 void SignTransactionResultToJSON(CMutableTransaction& mtx, bool complete, const std::map<COutPoint, Coin>& coins, const std::map<int, bilingual_str>& input_errors, bool immature_pegin, UniValue& result);
 
 /**

From eedea3c0a617cf5f6c6a072855e41d71c48dc2d2 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 18 Aug 2026 15:33:23 +0200
Subject: [PATCH 7/9] bitcoin-tx: default to rangeproof-committing sighash via
 chain params

elements-tx has no chainstate, so gate the default sighash on chain
parameters via CChainParams::SighashRangeproofActiveByParams(): commit to
rangeproofs by default on chains where dynafed is known active (including
liquidv1), otherwise use the historical SIGHASH_ALL default so
offline-built txs stay standard and valid. Normalize SIGHASH_DEFAULT to
SIGHASH_ALL for the legacy tool path; explicit sighash=... still
overrides.
---
 src/bitcoin-tx.cpp | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)

diff --git a/src/bitcoin-tx.cpp b/src/bitcoin-tx.cpp
index 83e6435fc4..2ac0fb357e 100644
--- a/src/bitcoin-tx.cpp
+++ b/src/bitcoin-tx.cpp
@@ -5,6 +5,7 @@
 #include <bitcoin-build-config.h> // IWYU pragma: keep
 
 #include <asset.h>
+#include <chainparams.h>
 #include <chainparamsbase.h>
 #include <clientversion.h>
 #include <coins.h>
@@ -21,6 +22,7 @@
 #include <script/sign.h>
 #include <script/signingprovider.h>
 #include <univalue.h>
+#include <util/chaintype.h>
 #include <util/exception.h>
 #include <util/fs.h>
 #include <util/moneystr.h>
@@ -615,7 +617,16 @@ static std::vector<unsigned char> ParseHexUV(const UniValue& v, const std::strin
 
 static void MutateTxSign(CMutableTransaction& tx, const std::string& flagStr)
 {
-    int nHashType = SIGHASH_ALL;
+    // ELEMENTS: bitcoin-tx has no chainstate, so we cannot check live dynafed
+    // activation. Gate the default on chain parameters instead: commit to
+    // rangeproofs by default on chains where dynafed (which enables
+    // SCRIPT_SIGHASH_RANGEPROOF) is known to be active. Otherwise use the
+    // historical SIGHASH_ALL default so offline-built txs stay standard and valid.
+    // See CChainParams::SighashRangeproofActiveByParams() for the liquidv1 nuance.
+    int nHashType = DefaultSighashType(Params().SighashRangeproofActiveByParams());
+    // DefaultSighashType may return SIGHASH_DEFAULT (0); for the legacy tool path
+    // treat that as SIGHASH_ALL.
+    if (nHashType == SIGHASH_DEFAULT) nHashType = SIGHASH_ALL;
 
     if (flagStr.size() > 0)
         if (!findSighashFlags(nHashType, flagStr))

From 897fdc8dc4cbb34ae1b9645afac62d574c2eaf2f Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 18 Aug 2026 15:33:30 +0200
Subject: [PATCH 8/9] test: assert wallet default commits rangeproofs
 post-dynafed

Extend feature_sighash_rangeproof.py with a case asserting that the
wallet's default sign path (no explicit sighash arg) produces signatures
that commit to output rangeproofs once dynafed is active.
---
 test/functional/feature_sighash_rangeproof.py | 45 +++++++++++++++++++
 1 file changed, 45 insertions(+)

diff --git a/test/functional/feature_sighash_rangeproof.py b/test/functional/feature_sighash_rangeproof.py
index a2f20824f5..aec2a4f602 100755
--- a/test/functional/feature_sighash_rangeproof.py
+++ b/test/functional/feature_sighash_rangeproof.py
@@ -178,6 +178,46 @@ def prepare_tx_signed_with_sighash(self, address_type, sighash_rangeproof_aware,
 
         return signed_tx
 
+    def assert_default_sign_commits_rangeproof(self, address_type, expect_rangeproof):
+        # Sign a blinded tx using the wallet default sighash (no explicit sighash
+        # argument) and assert whether the resulting pre-Taproot signatures
+        # commit to the SIGHASH_RANGEPROOF (0x40) bit.
+        addr = self.nodes[1].getnewaddress("", address_type)
+        assert len(self.nodes[1].getaddressinfo(addr)["confidential_key"]) > 0
+        self.nodes[0].sendtoaddress(addr, 1.0)
+        self.generate(self.nodes[0], 1)
+        self.sync_all()
+        utxo = self.nodes[1].listunspent(1, 1, [addr])[0]
+
+        sink_addr = self.nodes[2].getnewaddress()
+        unsigned_hex = self.nodes[1].createrawtransaction(
+            [{"txid": utxo["txid"], "vout": utxo["vout"]}],
+            [{sink_addr: 0.9}, {"fee": 0.1}]
+        )
+        blinded_hex = self.nodes[1].blindrawtransaction(unsigned_hex)
+        # Deliberately omit the sighash argument to exercise the wallet default.
+        signed = self.nodes[1].signrawtransactionwithwallet(blinded_hex)
+        assert signed["complete"], f"default-signed tx incomplete: {signed}"
+        signed_tx = tx_from_hex(signed["hex"])
+
+        # The tx must be accepted (standard + valid) with the default sighash.
+        test_accept = self.nodes[0].testmempoolaccept([signed["hex"]])[0]
+        assert test_accept["allowed"], "default-signed tx not accepted: {}".format(test_accept["reject-reason"])
+
+        # Extract the sighash byte from the signature and check the 0x40 bit.
+        if address_type == "legacy":
+            # scriptSig: <sig> <pubkey>; the signature is the first push.
+            script_sig = signed_tx.vin[0].scriptSig
+            # The first byte is the push length of the signature.
+            sig_len = script_sig[0]
+            sig = script_sig[1:1 + sig_len]
+        else:
+            # segwit v0 (native or p2sh-wrapped): signature is first witness item.
+            sig = signed_tx.wit.vtxinwit[0].scriptWitness.stack[0]
+        sighash_byte = sig[-1]
+        has_rangeproof = bool(sighash_byte & SIGHASH_RANGEPROOF)
+        assert_equal(has_rangeproof, expect_rangeproof)
+
     def assert_tx_standard(self, tx, assert_standard=True):
         # Test the standardness of the tx by submitting it to the mempool.
 
@@ -244,6 +284,11 @@ def run_test(self):
             self.assert_tx_standard(tx, False)
             self.assert_tx_valid(tx, True)
 
+            # Pre-activation, the wallet default must NOT set SIGHASH_RANGEPROOF,
+            # otherwise it would produce non-standard/invalid signatures.
+            self.log.info(f"Pre-activation default sighash for {address_type} address")
+            self.assert_default_sign_commits_rangeproof(address_type, expect_rangeproof=False)
+
         # Activate dynafed (nb of blocks taken from dynafed activation test)
         # Generate across several calls to `generatetoaddress` to ensure no individual call times out
         self.generate(self.nodes[0], 503)

From bbb1f5a540cf8480d36af2a7d27030d35d4ca526 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Tue, 18 Aug 2026 15:33:34 +0200
Subject: [PATCH 9/9] doc: release note for default rangeproof-committing
 sighash

Document the new default pre-Taproot sighash (SIGHASH_ALL |
SIGHASH_RANGEPROOF), its scope (wallet + raw RPC + bitcoin-tx), and the
activation/chain-params gating.
---
 doc/release-notes-20861.md | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/doc/release-notes-20861.md b/doc/release-notes-20861.md
index 5c68e4ab0c..2a7902e119 100644
--- a/doc/release-notes-20861.md
+++ b/doc/release-notes-20861.md
@@ -1,3 +1,25 @@
+Wallet and signing
+------------------
+
+- ELEMENTS: The default sighash used when signing pre-Taproot (legacy and
+  segwit v0) inputs now commits to the output rangeproofs on chains where
+  `SIGHASH_RANGEPROOF` is active (i.e. dynafed is active). Concretely, when no
+  sighash type is specified, the wallet, the `signrawtransactionwithkey` /
+  `signrawtransactionwithwallet` / `walletprocesspsbt` / `descriptorprocesspsbt`
+  RPCs, and `elements-tx` now default to `SIGHASH_ALL|RANGEPROOF` instead of
+  `SIGHASH_ALL`. This removes the previous default's third-party rangeproof
+  (witness) malleability and matches the rangeproof coverage that Taproot inputs
+  already have.
+
+  The new default is gated on activation: node-backed signing checks live
+  dynafed activation at the current tip, while the offline `elements-tx` tool
+  gates on the selected chain's parameters (only chains where dynafed is always
+  active). On chains where `SIGHASH_RANGEPROOF` is not active, the historical
+  `SIGHASH_ALL` default is used so that signatures remain standard and valid.
+  Taproot signing is unaffected: the `SIGHASH_RANGEPROOF` bit is ignored for
+  Taproot (which always commits to rangeproofs). Users can still request any
+  specific sighash type explicitly to override the default.
+
 Updated RPCs
 ------------