fix: properly detect testnet keys in wildcard descriptors

- Add detection for testnet extended key prefixes (tpub, tprv, upub, uprv, vpub, vprv)
- Set ok_for_mainnet=false for descriptors using testnet keys
- Log at info level whether descriptor uses mainnet or testnet keys
- Add tests for testnet key detection and ok_for_mainnet validation

Author: average-gary

stratum-apps/src/config_helpers/coinbase_output/mod.rs

@@ -6,9 +6,25 @@ use miniscript::{
     descriptor::DescriptorPublicKey,
     DefiniteDescriptorKey, Descriptor,
 };
+use tracing::info;
 
 pub use errors::Error;
 
+/// Testnet extended key prefixes (BIP32/BIP49/BIP84).
+/// These indicate the key is for testnet/regtest, not mainnet.
+const TESTNET_KEY_PREFIXES: &[&str] = &[
+    "tpub", "tprv", // BIP32 testnet
+    "upub", "uprv", // BIP49 testnet (P2WPKH-P2SH)
+    "vpub", "vprv", // BIP84 testnet (P2WPKH native)
+];
+
+/// Returns true if the descriptor string contains any testnet extended key prefixes.
+fn descriptor_uses_testnet_keys(descriptor: &str) -> bool {
+    TESTNET_KEY_PREFIXES
+        .iter()
+        .any(|prefix| descriptor.contains(prefix))
+}
+
 /// Coinbase output transaction.
 ///
 /// Typically used for parsing coinbase outputs defined in SRI role configuration files.
@@ -52,9 +68,23 @@ impl CoinbaseRewardScript {
                     .at_derivation_index(0)
                     .map_err(|e| Error::Miniscript(miniscript::Error::Unexpected(e.to_string())))?;
 
+                // Detect if this is a testnet key based on the key prefix
+                let uses_testnet_keys = descriptor_uses_testnet_keys(s);
+                let ok_for_mainnet = !uses_testnet_keys;
+
+                if uses_testnet_keys {
+                    info!(
+                        "Coinbase descriptor uses testnet keys (tpub/upub/vpub) - not valid for mainnet"
+                    );
+                } else {
+                    info!(
+                        "Coinbase descriptor uses mainnet keys (xpub/ypub/zpub) - valid for mainnet"
+                    );
+                }
+
                 return Ok(Self {
                     script_pubkey: definite.script_pubkey(),
-                    ok_for_mainnet: true,
+                    ok_for_mainnet,
                     wildcard_descriptor_str: Some(s.to_string()),
                 });
             }
@@ -482,7 +512,38 @@ mod tests {
         ).unwrap();
 
         assert!(desc.has_wildcard());
-        // Mainnet xpubs are allowed
+        // Mainnet xpubs are valid for mainnet
         assert!(desc.ok_for_mainnet());
     }
+
+    #[test]
+    fn test_testnet_tpub_wildcard_not_ok_for_mainnet() {
+        // Testnet tpub with wildcard - should NOT be ok for mainnet
+        let desc = CoinbaseRewardScript::from_descriptor(
+            "wpkh(tpubD6NzVbkrYhZ4XgiXtGrdW5XDAPFCL9h7we1vwNCpn8tGbBcgfVYjXyhWo4E1xkh56hjod1RhGjxbaTLV3X4FyWuejifB9jusQ46QzG87VKp/0/*)"
+        ).unwrap();
+
+        assert!(desc.has_wildcard());
+        // Testnet tpubs are NOT valid for mainnet
+        assert!(!desc.ok_for_mainnet());
+    }
+
+    #[test]
+    fn test_testnet_key_detection() {
+        // Test the testnet key detection helper
+        assert!(super::descriptor_uses_testnet_keys("wpkh(tpub.../0/*)"));
+        assert!(super::descriptor_uses_testnet_keys("wpkh(tprv.../0/*)"));
+        assert!(super::descriptor_uses_testnet_keys("wpkh(upub.../0/*)"));
+        assert!(super::descriptor_uses_testnet_keys("wpkh(uprv.../0/*)"));
+        assert!(super::descriptor_uses_testnet_keys("wpkh(vpub.../0/*)"));
+        assert!(super::descriptor_uses_testnet_keys("wpkh(vprv.../0/*)"));
+
+        // Mainnet keys should return false
+        assert!(!super::descriptor_uses_testnet_keys("wpkh(xpub.../0/*)"));
+        assert!(!super::descriptor_uses_testnet_keys("wpkh(xprv.../0/*)"));
+        assert!(!super::descriptor_uses_testnet_keys("wpkh(ypub.../0/*)"));
+        assert!(!super::descriptor_uses_testnet_keys("wpkh(yprv.../0/*)"));
+        assert!(!super::descriptor_uses_testnet_keys("wpkh(zpub.../0/*)"));
+        assert!(!super::descriptor_uses_testnet_keys("wpkh(zprv.../0/*)"));
+    }
 }