Vulnerability: bitcoin-spv - SPV proofs do not support transactions with larger numbers of inputs and outputs  Pending
Severity: high

Description:
There is no explicit restriction on the number of inputs and outputs a Bitcoin transaction can have - as long as the transaction fits into a block. The number of inputs and outputs in a transaction is denoted by a leading “varint” - a variable length integer. In `BTCUtils.validateVin` and `BTCUtils.validateVout`, the value of this varint is restricted to under `0xFD`, or 253:\\n```\\n/// @notice Checks that the vin passed up is properly formatted\\n/// @dev Consider a vin with a valid vout in its scriptsig\\n/// @param \\_vin Raw bytes length-prefixed input vector\\n/// @return True if it represents a validly formatted vin\\nfunction validateVin(bytes memory \\_vin) internal pure returns (bool) {\\n    uint256 \\_offset = 1;\\n    uint8 \\_nIns = uint8(\\_vin.slice(0, 1)[0]);\\n\\n    // Not valid if it says there are too many or no inputs\\n    if (\\_nIns >= 0xfd || \\_nIns == 0) {\\n        return false;\\n    }\\n```\\n\\nTransactions that include more than 252 inputs or outputs will not pass this validation, leading to some legitimate deposits being rejected by the tBTC system.\\nThe 252-item limit exists in a few forms throughout the system, outside of the aforementioned `BTCUtils.validateVin` and BTCUtils.validateVout:\\nBTCUtils.determineOutputLength:\\n```\\n/// @notice Determines the length of an output\\n/// @dev 5 types: WPKH, WSH, PKH, SH, and OP\\_RETURN\\n/// @param \\_output The output\\n/// @return The length indicated by the prefix, error if invalid length\\nfunction determineOutputLength(bytes memory \\_output) internal pure returns (uint256) {\\n    uint8 \\_len = uint8(\\_output.slice(8, 1)[0]);\\n    require(\\_len < 0xfd, "Multi-byte VarInts not supported");\\n\\n    return \\_len + 8 + 1; // 8 byte value, 1 byte for \\_len itself\\n}\\n```\\n\\nDepositUtils.findAndParseFundingOutput:\\n```\\nfunction findAndParseFundingOutput(\\n    DepositUtils.Deposit storage \\_d,\\n    bytes memory \\_txOutputVector,\\n    uint8 \\_fundingOutputIndex\\n) public view returns (bytes8) {\\n```\\n\\nDepositUtils.validateAndParseFundingSPVProof:\\n```\\nfunction validateAndParseFundingSPVProof(\\n    DepositUtils.Deposit storage \\_d,\\n    bytes4 \\_txVersion,\\n    bytes memory \\_txInputVector,\\n    bytes memory \\_txOutputVector,\\n    bytes4 \\_txLocktime,\\n    uint8 \\_fundingOutputIndex,\\n    bytes memory \\_merkleProof,\\n    uint256 \\_txIndexInBlock,\\n    bytes memory \\_bitcoinHeaders\\n) public view returns (bytes8 \\_valueBytes, bytes memory \\_utxoOutpoint){\\n```\\n\\nDepositFunding.provideFraudBTCFundingProof:\\n```\\nfunction provideFraudBTCFundingProof(\\n    DepositUtils.Deposit storage \\_d,\\n    bytes4 \\_txVersion,\\n    bytes memory \\_txInputVector,\\n    bytes memory \\_txOutputVector,\\n    bytes4 \\_txLocktime,\\n    uint8 \\_fundingOutputIndex,\\n    bytes memory \\_merkleProof,\\n    uint256 \\_txIndexInBlock,\\n    bytes memory \\_bitcoinHeaders\\n) public returns (bool) {\\n```\\n\\nDepositFunding.provideBTCFundingProof:\\n```\\nfunction provideBTCFundingProof(\\n    DepositUtils.Deposit storage \\_d,\\n    bytes4 \\_txVersion,\\n    bytes memory \\_txInputVector,\\n    bytes memory \\_txOutputVector,\\n    bytes4 \\_txLocktime,\\n    uint8 \\_fundingOutputIndex,\\n    bytes memory \\_merkleProof,\\n    uint256 \\_txIndexInBlock,\\n    bytes memory \\_bitcoinHeaders\\n) public returns (bool) {\\n```\\n\\nDepositLiquidation.provideSPVFraudProof:\\n```\\nfunction provideSPVFraudProof(\\n    DepositUtils.Deposit storage \\_d,\\n    bytes4 \\_txVersion,\\n    bytes memory \\_txInputVector,\\n    bytes memory \\_txOutputVector,\\n    bytes4 \\_txLocktime,\\n    bytes memory \\_merkleProof,\\n    uint256 \\_txIndexInBlock,\\n    uint8 \\_targetInputIndex,\\n    bytes memory \\_bitcoinHeaders\\n) public {\\n```\\n

Impact:

Recommended mitigation:
Resolution\\nThe client provided the following statement:\\nBenchmarks and takeaways are being tracked in issue https://github.com/keep-network/tbtc/issues/556.\\nIncorporate varint parsing in `BTCUtils.validateVin` and `BTCUtils.validateVout`. Ensure that other components of the system reflect the removal of the 252-item limit.