psbt.h raw
1 // Copyright (c) 2009-present The Bitcoin Core developers
2 // Distributed under the MIT software license, see the accompanying
3 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5 #ifndef BITCOIN_PSBT_H
6 #define BITCOIN_PSBT_H
7
8 #include <common/types.h>
9 #include <musig.h>
10 #include <node/transaction.h>
11 #include <policy/feerate.h>
12 #include <primitives/transaction.h>
13 #include <pubkey.h>
14 #include <script/keyorigin.h>
15 #include <script/sign.h>
16 #include <script/signingprovider.h>
17 #include <span.h>
18 #include <streams.h>
19 #include <uint256.h>
20 #include <util/result.h>
21
22 #include <optional>
23 #include <bitset>
24
25 namespace node {
26 enum class TransactionError;
27 } // namespace node
28
29 using common::PSBTError;
30
31 // Magic bytes
32 static constexpr uint8_t PSBT_MAGIC_BYTES[5] = {'p', 's', 'b', 't', 0xff};
33
34 // Global types
35 static constexpr uint8_t PSBT_GLOBAL_UNSIGNED_TX = 0x00;
36 static constexpr uint8_t PSBT_GLOBAL_XPUB = 0x01;
37 static constexpr uint8_t PSBT_GLOBAL_TX_VERSION = 0x02;
38 static constexpr uint8_t PSBT_GLOBAL_FALLBACK_LOCKTIME = 0x03;
39 static constexpr uint8_t PSBT_GLOBAL_INPUT_COUNT = 0x04;
40 static constexpr uint8_t PSBT_GLOBAL_OUTPUT_COUNT = 0x05;
41 static constexpr uint8_t PSBT_GLOBAL_TX_MODIFIABLE = 0x06;
42 static constexpr uint8_t PSBT_GLOBAL_VERSION = 0xFB;
43 static constexpr uint8_t PSBT_GLOBAL_PROPRIETARY = 0xFC;
44
45 // Input types
46 static constexpr uint8_t PSBT_IN_NON_WITNESS_UTXO = 0x00;
47 static constexpr uint8_t PSBT_IN_WITNESS_UTXO = 0x01;
48 static constexpr uint8_t PSBT_IN_PARTIAL_SIG = 0x02;
49 static constexpr uint8_t PSBT_IN_SIGHASH = 0x03;
50 static constexpr uint8_t PSBT_IN_REDEEMSCRIPT = 0x04;
51 static constexpr uint8_t PSBT_IN_WITNESSSCRIPT = 0x05;
52 static constexpr uint8_t PSBT_IN_BIP32_DERIVATION = 0x06;
53 static constexpr uint8_t PSBT_IN_SCRIPTSIG = 0x07;
54 static constexpr uint8_t PSBT_IN_SCRIPTWITNESS = 0x08;
55 static constexpr uint8_t PSBT_IN_RIPEMD160 = 0x0A;
56 static constexpr uint8_t PSBT_IN_SHA256 = 0x0B;
57 static constexpr uint8_t PSBT_IN_HASH160 = 0x0C;
58 static constexpr uint8_t PSBT_IN_HASH256 = 0x0D;
59 static constexpr uint8_t PSBT_IN_PREVIOUS_TXID = 0x0e;
60 static constexpr uint8_t PSBT_IN_OUTPUT_INDEX = 0x0f;
61 static constexpr uint8_t PSBT_IN_SEQUENCE = 0x10;
62 static constexpr uint8_t PSBT_IN_REQUIRED_TIME_LOCKTIME = 0x11;
63 static constexpr uint8_t PSBT_IN_REQUIRED_HEIGHT_LOCKTIME = 0x12;
64 static constexpr uint8_t PSBT_IN_TAP_KEY_SIG = 0x13;
65 static constexpr uint8_t PSBT_IN_TAP_SCRIPT_SIG = 0x14;
66 static constexpr uint8_t PSBT_IN_TAP_LEAF_SCRIPT = 0x15;
67 static constexpr uint8_t PSBT_IN_TAP_BIP32_DERIVATION = 0x16;
68 static constexpr uint8_t PSBT_IN_TAP_INTERNAL_KEY = 0x17;
69 static constexpr uint8_t PSBT_IN_TAP_MERKLE_ROOT = 0x18;
70 static constexpr uint8_t PSBT_IN_MUSIG2_PARTICIPANT_PUBKEYS = 0x1a;
71 static constexpr uint8_t PSBT_IN_MUSIG2_PUB_NONCE = 0x1b;
72 static constexpr uint8_t PSBT_IN_MUSIG2_PARTIAL_SIG = 0x1c;
73 static constexpr uint8_t PSBT_IN_PROPRIETARY = 0xFC;
74
75 // Output types
76 static constexpr uint8_t PSBT_OUT_REDEEMSCRIPT = 0x00;
77 static constexpr uint8_t PSBT_OUT_WITNESSSCRIPT = 0x01;
78 static constexpr uint8_t PSBT_OUT_BIP32_DERIVATION = 0x02;
79 static constexpr uint8_t PSBT_OUT_AMOUNT = 0x03;
80 static constexpr uint8_t PSBT_OUT_SCRIPT = 0x04;
81 static constexpr uint8_t PSBT_OUT_TAP_INTERNAL_KEY = 0x05;
82 static constexpr uint8_t PSBT_OUT_TAP_TREE = 0x06;
83 static constexpr uint8_t PSBT_OUT_TAP_BIP32_DERIVATION = 0x07;
84 static constexpr uint8_t PSBT_OUT_MUSIG2_PARTICIPANT_PUBKEYS = 0x08;
85 static constexpr uint8_t PSBT_OUT_PROPRIETARY = 0xFC;
86
87 // The separator is 0x00. Reading this in means that the unserializer can interpret it
88 // as a 0 length key which indicates that this is the separator. The separator has no value.
89 static constexpr uint8_t PSBT_SEPARATOR = 0x00;
90
91 // BIP 174 does not specify a maximum file size, but we set a limit anyway
92 // to prevent reading a stream indefinitely and running out of memory.
93 const std::streamsize MAX_FILE_SIZE_PSBT = 100000000; // 100 MB
94
95 // PSBT version number
96 static constexpr uint32_t PSBT_HIGHEST_VERSION = 2;
97
98 /** A structure for PSBT proprietary types */
99 struct PSBTProprietary
100 {
101 uint64_t subtype;
102 std::vector<unsigned char> identifier;
103 std::vector<unsigned char> key;
104 std::vector<unsigned char> value;
105
106 bool operator<(const PSBTProprietary &b) const {
107 return key < b.key;
108 }
109 bool operator==(const PSBTProprietary &b) const {
110 return key == b.key;
111 }
112 };
113
114 // Takes a stream and multiple arguments and serializes them as if first serialized into a vector and then into the stream
115 // The resulting output into the stream has the total serialized length of all of the objects followed by all objects concatenated with each other.
116 template<typename Stream, typename... X>
117 void SerializeToVector(Stream& s, const X&... args)
118 {
119 SizeComputer sizecomp;
120 SerializeMany(sizecomp, args...);
121 WriteCompactSize(s, sizecomp.size());
122 SerializeMany(s, args...);
123 }
124
125 // Takes a stream and multiple arguments and unserializes them first as a vector then each object individually in the order provided in the arguments
126 template<typename Stream, typename... X>
127 void UnserializeFromVector(Stream& s, X&&... args)
128 {
129 size_t expected_size = ReadCompactSize(s);
130 size_t remaining_before = s.size();
131 UnserializeMany(s, args...);
132 size_t remaining_after = s.size();
133 if (remaining_after + expected_size != remaining_before) {
134 throw std::ios_base::failure("Size of value was not the stated size");
135 }
136 }
137
138 // Deserialize bytes of given length from the stream as a KeyOriginInfo
139 template<typename Stream>
140 KeyOriginInfo DeserializeKeyOrigin(Stream& s, uint64_t length)
141 {
142 // Read in key path
143 if (length % 4 || length == 0) {
144 throw std::ios_base::failure("Invalid length for HD key path");
145 }
146
147 KeyOriginInfo hd_keypath;
148 s >> hd_keypath.fingerprint;
149 for (unsigned int i = 4; i < length; i += sizeof(uint32_t)) {
150 uint32_t index;
151 s >> index;
152 hd_keypath.path.push_back(index);
153 }
154 return hd_keypath;
155 }
156
157 // Deserialize a length prefixed KeyOriginInfo from a stream
158 template<typename Stream>
159 void DeserializeHDKeypath(Stream& s, KeyOriginInfo& hd_keypath)
160 {
161 hd_keypath = DeserializeKeyOrigin(s, ReadCompactSize(s));
162 }
163
164 // Deserialize HD keypaths into a map
165 template<typename Stream>
166 void DeserializeHDKeypaths(Stream& s, const std::vector<unsigned char>& key, std::map<CPubKey, KeyOriginInfo>& hd_keypaths)
167 {
168 // Make sure that the key is the size of pubkey + 1
169 if (key.size() != CPubKey::SIZE + 1 && key.size() != CPubKey::COMPRESSED_SIZE + 1) {
170 throw std::ios_base::failure("Size of key was not the expected size for the type BIP32 keypath");
171 }
172 // Read in the pubkey from key
173 CPubKey pubkey(key.begin() + 1, key.end());
174 if (!pubkey.IsFullyValid()) {
175 throw std::ios_base::failure("Invalid pubkey");
176 }
177
178 KeyOriginInfo keypath;
179 DeserializeHDKeypath(s, keypath);
180
181 // Add to map
182 hd_keypaths.emplace(pubkey, std::move(keypath));
183 }
184
185 // Serialize a KeyOriginInfo to a stream
186 template<typename Stream>
187 void SerializeKeyOrigin(Stream& s, KeyOriginInfo hd_keypath)
188 {
189 s << hd_keypath.fingerprint;
190 for (const auto& path : hd_keypath.path) {
191 s << path;
192 }
193 }
194
195 // Serialize a length prefixed KeyOriginInfo to a stream
196 template<typename Stream>
197 void SerializeHDKeypath(Stream& s, KeyOriginInfo hd_keypath)
198 {
199 WriteCompactSize(s, (hd_keypath.path.size() + 1) * sizeof(uint32_t));
200 SerializeKeyOrigin(s, hd_keypath);
201 }
202
203 // Serialize HD keypaths to a stream from a map
204 template<typename Stream>
205 void SerializeHDKeypaths(Stream& s, const std::map<CPubKey, KeyOriginInfo>& hd_keypaths, CompactSizeWriter type)
206 {
207 for (const auto& keypath_pair : hd_keypaths) {
208 if (!keypath_pair.first.IsValid()) {
209 throw std::ios_base::failure("Invalid CPubKey being serialized");
210 }
211 SerializeToVector(s, type, std::span{keypath_pair.first});
212 SerializeHDKeypath(s, keypath_pair.second);
213 }
214 }
215
216 // Deserialize a PSBT_{IN/OUT}_MUSIG2_PARTICIPANT_PUBKEYS field
217 template<typename Stream>
218 void DeserializeMuSig2ParticipantPubkeys(Stream& s, SpanReader& skey, std::map<CPubKey, std::vector<CPubKey>>& out, std::string context)
219 {
220 std::array<unsigned char, CPubKey::COMPRESSED_SIZE> agg_pubkey_bytes;
221 skey >> std::as_writable_bytes(std::span{agg_pubkey_bytes});
222 CPubKey agg_pubkey(agg_pubkey_bytes);
223 if (!agg_pubkey.IsFullyValid()) {
224 throw std::ios_base::failure(context + " musig2 aggregate pubkey is invalid");
225 }
226
227 std::vector<CPubKey> participants;
228 std::vector<unsigned char> val;
229 s >> val;
230 SpanReader s_val{val};
231 while (s_val.size() >= CPubKey::COMPRESSED_SIZE) {
232 std::array<unsigned char, CPubKey::COMPRESSED_SIZE> part_pubkey_bytes;
233 s_val >> std::as_writable_bytes(std::span{part_pubkey_bytes});
234 CPubKey participant(part_pubkey_bytes);
235 if (!participant.IsFullyValid()) {
236 throw std::ios_base::failure(context + " musig2 participant pubkey is invalid");
237 }
238 participants.push_back(participant);
239 }
240 if (!s_val.empty()) {
241 throw std::ios_base::failure(context + " musig2 participants pubkeys value size is not a multiple of 33");
242 }
243
244 out.emplace(agg_pubkey, participants);
245 }
246
247 // Deserialize the MuSig2 participant identifiers from PSBT_MUSIG2_{PUBNONCE/PARTIAL_SIG} fields
248 // Both fields contain the same data after the type byte - aggregate pubkey | participant pubkey | leaf script hash
249 template<typename Stream>
250 void DeserializeMuSig2ParticipantDataIdentifier(Stream& skey, CPubKey& agg_pub, CPubKey& part_pub, uint256& leaf_hash)
251 {
252 leaf_hash.SetNull();
253
254 std::array<unsigned char, CPubKey::COMPRESSED_SIZE> part_pubkey_bytes;
255 std::array<unsigned char, CPubKey::COMPRESSED_SIZE> agg_pubkey_bytes;
256
257 skey >> std::as_writable_bytes(std::span{part_pubkey_bytes}) >> std::as_writable_bytes(std::span{agg_pubkey_bytes});
258 agg_pub.Set(agg_pubkey_bytes.begin(), agg_pubkey_bytes.end());
259 if (!agg_pub.IsFullyValid()) {
260 throw std::ios_base::failure("musig2 aggregate pubkey is invalid");
261 }
262
263 part_pub.Set(part_pubkey_bytes.begin(), part_pubkey_bytes.end());
264 if (!part_pub.IsFullyValid()) {
265 throw std::ios_base::failure("musig2 participant pubkey is invalid");
266 }
267
268 if (!skey.empty()) {
269 skey >> leaf_hash;
270 }
271 }
272
273 static inline void ExpectedKeySize(const std::string& key_name, const std::vector<unsigned char>& key, uint64_t expected_size) {
274 if (key.size() != expected_size) {
275 throw std::ios_base::failure(tfm::format("Size of key was not %d for the type %s", expected_size, key_name));
276 }
277 }
278
279 /** A structure for PSBTs which contain per-input information */
280 class PSBTInput
281 {
282 private:
283 uint32_t m_psbt_version;
284
285 public:
286 CTransactionRef non_witness_utxo;
287 CTxOut witness_utxo;
288 CScript redeem_script;
289 CScript witness_script;
290 CScript final_script_sig;
291 CScriptWitness final_script_witness;
292 std::map<CPubKey, KeyOriginInfo> hd_keypaths;
293 std::map<CKeyID, SigPair> partial_sigs;
294 std::map<uint160, std::vector<unsigned char>> ripemd160_preimages;
295 std::map<uint256, std::vector<unsigned char>> sha256_preimages;
296 std::map<uint160, std::vector<unsigned char>> hash160_preimages;
297 std::map<uint256, std::vector<unsigned char>> hash256_preimages;
298
299 Txid prev_txid;
300 uint32_t prev_out;
301 std::optional<uint32_t> sequence;
302 std::optional<uint32_t> time_locktime;
303 std::optional<uint32_t> height_locktime;
304
305 // Taproot fields
306 std::vector<unsigned char> m_tap_key_sig;
307 std::map<std::pair<XOnlyPubKey, uint256>, std::vector<unsigned char>> m_tap_script_sigs;
308 std::map<std::pair<std::vector<unsigned char>, int>, std::set<std::vector<unsigned char>, ShortestVectorFirstComparator>> m_tap_scripts;
309 std::map<XOnlyPubKey, std::pair<std::set<uint256>, KeyOriginInfo>> m_tap_bip32_paths;
310 XOnlyPubKey m_tap_internal_key;
311 uint256 m_tap_merkle_root;
312
313 // MuSig2 fields
314 std::map<CPubKey, std::vector<CPubKey>> m_musig2_participants;
315 // Key is the aggregate pubkey and the script leaf hash, value is a map of participant pubkey to pubnonce
316 std::map<std::pair<CPubKey, uint256>, std::map<CPubKey, std::vector<uint8_t>>> m_musig2_pubnonces;
317 // Key is the aggregate pubkey and the script leaf hash, value is a map of participant pubkey to partial_sig
318 std::map<std::pair<CPubKey, uint256>, std::map<CPubKey, uint256>> m_musig2_partial_sigs;
319
320 std::map<std::vector<unsigned char>, std::vector<unsigned char>> unknown;
321 std::set<PSBTProprietary> m_proprietary;
322 std::optional<int> sighash_type;
323
324 bool IsNull() const;
325 void FillSignatureData(SignatureData& sigdata) const;
326 void FromSignatureData(const SignatureData& sigdata);
327 [[nodiscard]] bool Merge(const PSBTInput& input);
328 uint32_t GetVersion() const { return m_psbt_version; }
329 COutPoint GetOutPoint() const;
330 /**
331 * Retrieves the UTXO for this input
332 *
333 * @param[out] utxo The UTXO of this input
334 * @return Whether the UTXO could be retrieved
335 */
336 bool GetUTXO(CTxOut& utxo) const;
337 bool HasSignatures() const;
338
339 explicit PSBTInput(uint32_t psbt_version, const Txid& prev_txid, uint32_t prev_out, std::optional<uint32_t> sequence = std::nullopt)
340 : m_psbt_version(psbt_version),
341 prev_txid(prev_txid),
342 prev_out(prev_out),
343 sequence(sequence)
344 {
345 assert(m_psbt_version == 0 || m_psbt_version == 2);
346 }
347
348 // Construct a PSBTInput when the previous txid and output index are expected to be serialized
349 template <typename Stream>
350 explicit PSBTInput(deserialize_type, Stream& s, uint32_t psbt_version)
351 : m_psbt_version(psbt_version)
352 {
353 assert(m_psbt_version == 2);
354 Unserialize(s);
355 }
356
357 bool operator==(const PSBTInput&) const = default;
358
359 template <typename Stream>
360 inline void Serialize(Stream& s) const {
361 // Write the utxo
362 if (non_witness_utxo) {
363 SerializeToVector(s, CompactSizeWriter(PSBT_IN_NON_WITNESS_UTXO));
364 SerializeToVector(s, TX_NO_WITNESS(non_witness_utxo));
365 }
366 if (!witness_utxo.IsNull()) {
367 SerializeToVector(s, CompactSizeWriter(PSBT_IN_WITNESS_UTXO));
368 SerializeToVector(s, witness_utxo);
369 }
370
371 if (final_script_sig.empty() && final_script_witness.IsNull()) {
372 // Write any partial signatures
373 for (const auto& sig_pair : partial_sigs) {
374 SerializeToVector(s, CompactSizeWriter(PSBT_IN_PARTIAL_SIG), std::span{sig_pair.second.first});
375 s << sig_pair.second.second;
376 }
377
378 // Write the sighash type
379 if (sighash_type != std::nullopt) {
380 SerializeToVector(s, CompactSizeWriter(PSBT_IN_SIGHASH));
381 SerializeToVector(s, *sighash_type);
382 }
383
384 // Write the redeem script
385 if (!redeem_script.empty()) {
386 SerializeToVector(s, CompactSizeWriter(PSBT_IN_REDEEMSCRIPT));
387 s << redeem_script;
388 }
389
390 // Write the witness script
391 if (!witness_script.empty()) {
392 SerializeToVector(s, CompactSizeWriter(PSBT_IN_WITNESSSCRIPT));
393 s << witness_script;
394 }
395
396 // Write any hd keypaths
397 SerializeHDKeypaths(s, hd_keypaths, CompactSizeWriter(PSBT_IN_BIP32_DERIVATION));
398
399 // Write any ripemd160 preimage
400 for (const auto& [hash, preimage] : ripemd160_preimages) {
401 SerializeToVector(s, CompactSizeWriter(PSBT_IN_RIPEMD160), std::span{hash});
402 s << preimage;
403 }
404
405 // Write any sha256 preimage
406 for (const auto& [hash, preimage] : sha256_preimages) {
407 SerializeToVector(s, CompactSizeWriter(PSBT_IN_SHA256), std::span{hash});
408 s << preimage;
409 }
410
411 // Write any hash160 preimage
412 for (const auto& [hash, preimage] : hash160_preimages) {
413 SerializeToVector(s, CompactSizeWriter(PSBT_IN_HASH160), std::span{hash});
414 s << preimage;
415 }
416
417 // Write any hash256 preimage
418 for (const auto& [hash, preimage] : hash256_preimages) {
419 SerializeToVector(s, CompactSizeWriter(PSBT_IN_HASH256), std::span{hash});
420 s << preimage;
421 }
422
423 // Write taproot key sig
424 if (!m_tap_key_sig.empty()) {
425 SerializeToVector(s, PSBT_IN_TAP_KEY_SIG);
426 s << m_tap_key_sig;
427 }
428
429 // Write taproot script sigs
430 for (const auto& [pubkey_leaf, sig] : m_tap_script_sigs) {
431 const auto& [xonly, leaf_hash] = pubkey_leaf;
432 SerializeToVector(s, PSBT_IN_TAP_SCRIPT_SIG, xonly, leaf_hash);
433 s << sig;
434 }
435
436 // Write taproot leaf scripts
437 for (const auto& [leaf, control_blocks] : m_tap_scripts) {
438 const auto& [script, leaf_ver] = leaf;
439 for (const auto& control_block : control_blocks) {
440 SerializeToVector(s, PSBT_IN_TAP_LEAF_SCRIPT, std::span{control_block});
441 std::vector<unsigned char> value_v(script.begin(), script.end());
442 value_v.push_back((uint8_t)leaf_ver);
443 s << value_v;
444 }
445 }
446
447 // Write taproot bip32 keypaths
448 for (const auto& [xonly, leaf_origin] : m_tap_bip32_paths) {
449 const auto& [leaf_hashes, origin] = leaf_origin;
450 SerializeToVector(s, PSBT_IN_TAP_BIP32_DERIVATION, xonly);
451 std::vector<unsigned char> value;
452 VectorWriter s_value{value, 0};
453 s_value << leaf_hashes;
454 SerializeKeyOrigin(s_value, origin);
455 s << value;
456 }
457
458 // Write taproot internal key
459 if (!m_tap_internal_key.IsNull()) {
460 SerializeToVector(s, PSBT_IN_TAP_INTERNAL_KEY);
461 s << ToByteVector(m_tap_internal_key);
462 }
463
464 // Write taproot merkle root
465 if (!m_tap_merkle_root.IsNull()) {
466 SerializeToVector(s, PSBT_IN_TAP_MERKLE_ROOT);
467 SerializeToVector(s, m_tap_merkle_root);
468 }
469
470 // Write MuSig2 Participants
471 for (const auto& [agg_pubkey, part_pubs] : m_musig2_participants) {
472 SerializeToVector(s, CompactSizeWriter(PSBT_IN_MUSIG2_PARTICIPANT_PUBKEYS), std::span{agg_pubkey});
473 std::vector<unsigned char> value;
474 VectorWriter s_value{value, 0};
475 for (auto& pk : part_pubs) {
476 s_value << std::span{pk};
477 }
478 s << value;
479 }
480
481 // Write MuSig2 pubnonces
482 for (const auto& [agg_pubkey_leaf_hash, pubnonces] : m_musig2_pubnonces) {
483 const auto& [agg_pubkey, leaf_hash] = agg_pubkey_leaf_hash;
484 for (const auto& [part_pubkey, pubnonce] : pubnonces) {
485 if (leaf_hash.IsNull()) {
486 SerializeToVector(s, CompactSizeWriter(PSBT_IN_MUSIG2_PUB_NONCE), std::span{part_pubkey}, std::span{agg_pubkey});
487 } else {
488 SerializeToVector(s, CompactSizeWriter(PSBT_IN_MUSIG2_PUB_NONCE), std::span{part_pubkey}, std::span{agg_pubkey}, leaf_hash);
489 }
490 s << pubnonce;
491 }
492 }
493
494 // Write MuSig2 partial signatures
495 for (const auto& [agg_pubkey_leaf_hash, psigs] : m_musig2_partial_sigs) {
496 const auto& [agg_pubkey, leaf_hash] = agg_pubkey_leaf_hash;
497 for (const auto& [pubkey, psig] : psigs) {
498 if (leaf_hash.IsNull()) {
499 SerializeToVector(s, CompactSizeWriter(PSBT_IN_MUSIG2_PARTIAL_SIG), std::span{pubkey}, std::span{agg_pubkey});
500 } else {
501 SerializeToVector(s, CompactSizeWriter(PSBT_IN_MUSIG2_PARTIAL_SIG), std::span{pubkey}, std::span{agg_pubkey}, leaf_hash);
502 }
503 SerializeToVector(s, psig);
504 }
505 }
506 }
507
508 // Write script sig
509 if (!final_script_sig.empty()) {
510 SerializeToVector(s, CompactSizeWriter(PSBT_IN_SCRIPTSIG));
511 s << final_script_sig;
512 }
513 // write script witness
514 if (!final_script_witness.IsNull()) {
515 SerializeToVector(s, CompactSizeWriter(PSBT_IN_SCRIPTWITNESS));
516 SerializeToVector(s, final_script_witness.stack);
517 }
518
519 // Write PSBTv2 fields
520 if (m_psbt_version >= 2) {
521 // Write prev txid, vout, sequence, and lock times
522 SerializeToVector(s, CompactSizeWriter(PSBT_IN_PREVIOUS_TXID));
523 SerializeToVector(s, prev_txid);
524
525 SerializeToVector(s, CompactSizeWriter(PSBT_IN_OUTPUT_INDEX));
526 SerializeToVector(s, prev_out);
527
528 if (sequence != std::nullopt) {
529 SerializeToVector(s, CompactSizeWriter(PSBT_IN_SEQUENCE));
530 SerializeToVector(s, *sequence);
531 }
532 if (time_locktime != std::nullopt) {
533 SerializeToVector(s, CompactSizeWriter(PSBT_IN_REQUIRED_TIME_LOCKTIME));
534 SerializeToVector(s, *time_locktime);
535 }
536 if (height_locktime != std::nullopt) {
537 SerializeToVector(s, CompactSizeWriter(PSBT_IN_REQUIRED_HEIGHT_LOCKTIME));
538 SerializeToVector(s, *height_locktime);
539 }
540 }
541
542 // Write proprietary things
543 for (const auto& entry : m_proprietary) {
544 s << entry.key;
545 s << entry.value;
546 }
547
548 // Write unknown things
549 for (auto& entry : unknown) {
550 s << entry.first;
551 s << entry.second;
552 }
553
554 s << PSBT_SEPARATOR;
555 }
556
557
558 template <typename Stream>
559 inline void Unserialize(Stream& s) {
560 // Used for duplicate key detection
561 std::set<std::vector<unsigned char>> key_lookup;
562 // Cache whether PSBTv2 required fields were seen
563 bool found_prev_txid = false;
564 bool found_prev_out = false;
565
566 // Read loop
567 bool found_sep = false;
568 while(!s.empty()) {
569 // Read the key of format "<keylen><keytype><keydata>" after which
570 // "key" will contain "<keytype><keydata>"
571 std::vector<unsigned char> key;
572 s >> key;
573
574 // the key is empty if that was actually a separator byte
575 // This is a special case for key lengths 0 as those are not allowed (except for separator)
576 if (key.empty()) {
577 found_sep = true;
578 break;
579 }
580
581 // Duplicate keys are not permitted
582 if (!key_lookup.emplace(key).second) {
583 throw std::ios_base::failure(tfm::format("Duplicate Key, input key \"%s\" already provided", HexStr(key)));
584 }
585
586 // "skey" is used so that "key" is unchanged after reading keytype below
587 SpanReader skey{key};
588 // keytype is of the format compact size uint at the beginning of "key"
589 uint64_t type = ReadCompactSize(skey);
590
591 // Do stuff based on keytype "type", i.e., key checks, reading values of the
592 // format "<valuelen><valuedata>" from the stream "s", and value checks
593 switch(type) {
594 case PSBT_IN_NON_WITNESS_UTXO:
595 {
596 ExpectedKeySize("Input Non-witness UTXO", key, 1);
597 // Set the stream to unserialize with witness since this is always a valid network transaction
598 UnserializeFromVector(s, TX_WITH_WITNESS(non_witness_utxo));
599 break;
600 }
601 case PSBT_IN_WITNESS_UTXO:
602 ExpectedKeySize("Input Witness UTXO", key, 1);
603 UnserializeFromVector(s, witness_utxo);
604 break;
605 case PSBT_IN_PARTIAL_SIG:
606 {
607 // Make sure that the key is the size of pubkey + 1
608 if (key.size() != CPubKey::SIZE + 1 && key.size() != CPubKey::COMPRESSED_SIZE + 1) {
609 throw std::ios_base::failure("Size of key was not the expected size for the type partial signature pubkey");
610 }
611 // Read in the pubkey from key
612 CPubKey pubkey(key.begin() + 1, key.end());
613 if (!pubkey.IsFullyValid()) {
614 throw std::ios_base::failure("Invalid pubkey");
615 }
616
617 // Read in the signature from value
618 std::vector<unsigned char> sig;
619 s >> sig;
620
621 // Check that the signature is validly encoded
622 if (sig.empty() || !CheckSignatureEncoding(sig, SCRIPT_VERIFY_DERSIG | SCRIPT_VERIFY_STRICTENC, nullptr)) {
623 throw std::ios_base::failure("Signature is not a valid encoding");
624 }
625
626 // Add to list
627 partial_sigs.emplace(pubkey.GetID(), SigPair(pubkey, std::move(sig)));
628 break;
629 }
630 case PSBT_IN_SIGHASH:
631 ExpectedKeySize("Input Sighash Type", key, 1);
632 int sighash;
633 UnserializeFromVector(s, sighash);
634 sighash_type = sighash;
635 break;
636 case PSBT_IN_REDEEMSCRIPT:
637 {
638 ExpectedKeySize("Input redeemScript", key, 1);
639 s >> redeem_script;
640 break;
641 }
642 case PSBT_IN_WITNESSSCRIPT:
643 {
644 ExpectedKeySize("Input witnessScript", key, 1);
645 s >> witness_script;
646 break;
647 }
648 case PSBT_IN_BIP32_DERIVATION:
649 {
650 DeserializeHDKeypaths(s, key, hd_keypaths);
651 break;
652 }
653 case PSBT_IN_SCRIPTSIG:
654 {
655 ExpectedKeySize("Input Final scriptSig", key, 1);
656 s >> final_script_sig;
657 break;
658 }
659 case PSBT_IN_SCRIPTWITNESS:
660 {
661 ExpectedKeySize("Input Final scriptWitness", key, 1);
662 UnserializeFromVector(s, final_script_witness.stack);
663 break;
664 }
665 case PSBT_IN_RIPEMD160:
666 {
667 ExpectedKeySize("Input RIPEMD160 Preimage", key, CRIPEMD160::OUTPUT_SIZE + 1);
668 // Read in the hash from key
669 std::vector<unsigned char> hash_vec(key.begin() + 1, key.end());
670 uint160 hash(hash_vec);
671
672 // Read in the preimage from value
673 std::vector<unsigned char> preimage;
674 s >> preimage;
675
676 // Add to preimages list
677 ripemd160_preimages.emplace(hash, std::move(preimage));
678 break;
679 }
680 case PSBT_IN_SHA256:
681 {
682 ExpectedKeySize("Input SHA256 Preimage", key, CSHA256::OUTPUT_SIZE + 1);
683 // Read in the hash from key
684 std::vector<unsigned char> hash_vec(key.begin() + 1, key.end());
685 uint256 hash(hash_vec);
686
687 // Read in the preimage from value
688 std::vector<unsigned char> preimage;
689 s >> preimage;
690
691 // Add to preimages list
692 sha256_preimages.emplace(hash, std::move(preimage));
693 break;
694 }
695 case PSBT_IN_HASH160:
696 {
697 ExpectedKeySize("Input Hash160 Preimage", key, CHash160::OUTPUT_SIZE + 1);
698 // Read in the hash from key
699 std::vector<unsigned char> hash_vec(key.begin() + 1, key.end());
700 uint160 hash(hash_vec);
701
702 // Read in the preimage from value
703 std::vector<unsigned char> preimage;
704 s >> preimage;
705
706 // Add to preimages list
707 hash160_preimages.emplace(hash, std::move(preimage));
708 break;
709 }
710 case PSBT_IN_HASH256:
711 {
712 ExpectedKeySize("Input Hash256 Preimage", key, CHash256::OUTPUT_SIZE + 1);
713 // Read in the hash from key
714 std::vector<unsigned char> hash_vec(key.begin() + 1, key.end());
715 uint256 hash(hash_vec);
716
717 // Read in the preimage from value
718 std::vector<unsigned char> preimage;
719 s >> preimage;
720
721 // Add to preimages list
722 hash256_preimages.emplace(hash, std::move(preimage));
723 break;
724 }
725 case PSBT_IN_PREVIOUS_TXID:
726 {
727 ExpectedKeySize("Input Previous TXID", key, 1);
728 if (m_psbt_version < 2) {
729 throw std::ios_base::failure("Previous txid is not allowed in PSBTv0");
730 }
731 UnserializeFromVector(s, prev_txid);
732 found_prev_txid = true;
733 break;
734 }
735 case PSBT_IN_OUTPUT_INDEX:
736 {
737 ExpectedKeySize("Input Previous Output's Index", key, 1);
738 if (m_psbt_version < 2) {
739 throw std::ios_base::failure("Previous output's index is not allowed in PSBTv0");
740 }
741 UnserializeFromVector(s, prev_out);
742 found_prev_out = true;
743 break;
744 }
745 case PSBT_IN_SEQUENCE:
746 {
747 ExpectedKeySize("Input Sequence", key, 1);
748 if (m_psbt_version < 2) {
749 throw std::ios_base::failure("Sequence is not allowed in PSBTv0");
750 }
751 sequence.emplace();
752 UnserializeFromVector(s, *sequence);
753 break;
754 }
755 case PSBT_IN_REQUIRED_TIME_LOCKTIME:
756 {
757 ExpectedKeySize("Input Required Time Based Locktime", key, 1);
758 if (m_psbt_version < 2) {
759 throw std::ios_base::failure("Required time based locktime is not allowed in PSBTv0");
760 }
761 time_locktime.emplace();
762 UnserializeFromVector(s, *time_locktime);
763 if (*time_locktime < LOCKTIME_THRESHOLD) {
764 throw std::ios_base::failure("Required time based locktime is invalid (less than 500000000)");
765 }
766 break;
767 }
768 case PSBT_IN_REQUIRED_HEIGHT_LOCKTIME:
769 {
770 ExpectedKeySize("Input Required Height Based Locktime", key, 1);
771 if (m_psbt_version < 2) {
772 throw std::ios_base::failure("Required height based locktime is not allowed in PSBTv0");
773 }
774 height_locktime.emplace();
775 UnserializeFromVector(s, *height_locktime);
776 if (*height_locktime >= LOCKTIME_THRESHOLD) {
777 throw std::ios_base::failure("Required height based locktime is invalid (greater than or equal to 500000000)");
778 } else if (*height_locktime == 0) {
779 throw std::ios_base::failure("Required height based locktime is invalid (0)");
780 }
781 break;
782 }
783 case PSBT_IN_TAP_KEY_SIG:
784 {
785 ExpectedKeySize("Input Taproot Key Path Signature", key, 1);
786 s >> m_tap_key_sig;
787 if (m_tap_key_sig.size() < 64) {
788 throw std::ios_base::failure("Input Taproot key path signature is shorter than 64 bytes");
789 } else if (m_tap_key_sig.size() > 65) {
790 throw std::ios_base::failure("Input Taproot key path signature is longer than 65 bytes");
791 }
792 break;
793 }
794 case PSBT_IN_TAP_SCRIPT_SIG:
795 {
796 ExpectedKeySize("Input Taproot Script Path Signature", key, 65);
797 SpanReader s_key{std::span{key}.subspan(1)};
798 XOnlyPubKey xonly;
799 uint256 hash;
800 s_key >> xonly;
801 s_key >> hash;
802 std::vector<unsigned char> sig;
803 s >> sig;
804 if (sig.size() < 64) {
805 throw std::ios_base::failure("Input Taproot script path signature is shorter than 64 bytes");
806 } else if (sig.size() > 65) {
807 throw std::ios_base::failure("Input Taproot script path signature is longer than 65 bytes");
808 }
809 m_tap_script_sigs.emplace(std::make_pair(xonly, hash), sig);
810 break;
811 }
812 case PSBT_IN_TAP_LEAF_SCRIPT:
813 {
814 if (key.size() < 34) {
815 throw std::ios_base::failure("Input Taproot leaf script key is not at least 34 bytes");
816 } else if ((key.size() - 2) % 32 != 0) {
817 throw std::ios_base::failure("Input Taproot leaf script key's control block size is not valid");
818 }
819 std::vector<unsigned char> script_v;
820 s >> script_v;
821 if (script_v.empty()) {
822 throw std::ios_base::failure("Input Taproot leaf script must be at least 1 byte");
823 }
824 uint8_t leaf_ver = script_v.back();
825 script_v.pop_back();
826 const auto leaf_script = std::make_pair(script_v, (int)leaf_ver);
827 m_tap_scripts[leaf_script].insert(std::vector<unsigned char>(key.begin() + 1, key.end()));
828 break;
829 }
830 case PSBT_IN_TAP_BIP32_DERIVATION:
831 {
832 ExpectedKeySize("Input Taproot BIP32 Keypath", key, 33);
833 SpanReader s_key{std::span{key}.subspan(1)};
834 XOnlyPubKey xonly;
835 s_key >> xonly;
836 std::set<uint256> leaf_hashes;
837 uint64_t value_len = ReadCompactSize(s);
838 size_t before_hashes = s.size();
839 s >> leaf_hashes;
840 size_t after_hashes = s.size();
841 size_t hashes_len = before_hashes - after_hashes;
842 if (hashes_len > value_len) {
843 throw std::ios_base::failure("Input Taproot BIP32 keypath has an invalid length");
844 }
845 size_t origin_len = value_len - hashes_len;
846 m_tap_bip32_paths.emplace(xonly, std::make_pair(leaf_hashes, DeserializeKeyOrigin(s, origin_len)));
847 break;
848 }
849 case PSBT_IN_TAP_INTERNAL_KEY:
850 {
851 ExpectedKeySize("Input Taproot Internal Key", key, 1);
852 UnserializeFromVector(s, m_tap_internal_key);
853 break;
854 }
855 case PSBT_IN_TAP_MERKLE_ROOT:
856 {
857 ExpectedKeySize("Input Taproot Merkle Root", key, 1);
858 UnserializeFromVector(s, m_tap_merkle_root);
859 break;
860 }
861 case PSBT_IN_MUSIG2_PARTICIPANT_PUBKEYS:
862 {
863 ExpectedKeySize("Input MuSig2 Participants Pubkeys", key, CPubKey::COMPRESSED_SIZE + 1);
864 DeserializeMuSig2ParticipantPubkeys(s, skey, m_musig2_participants, std::string{"Input"});
865 break;
866 }
867 case PSBT_IN_MUSIG2_PUB_NONCE:
868 {
869 if (key.size() != 2 * CPubKey::COMPRESSED_SIZE + 1 && key.size() != 2 * CPubKey::COMPRESSED_SIZE + CSHA256::OUTPUT_SIZE + 1) {
870 throw std::ios_base::failure("Input musig2 pubnonce key is not expected size of 67 or 99 bytes");
871 }
872 CPubKey agg_pub, part_pub;
873 uint256 leaf_hash;
874 DeserializeMuSig2ParticipantDataIdentifier(skey, agg_pub, part_pub, leaf_hash);
875
876 std::vector<uint8_t> pubnonce;
877 s >> pubnonce;
878 if (pubnonce.size() != MUSIG2_PUBNONCE_SIZE) {
879 throw std::ios_base::failure("Input musig2 pubnonce value is not 66 bytes");
880 }
881
882 m_musig2_pubnonces[std::make_pair(agg_pub, leaf_hash)].emplace(part_pub, pubnonce);
883 break;
884 }
885 case PSBT_IN_MUSIG2_PARTIAL_SIG:
886 {
887 if (key.size() != 2 * CPubKey::COMPRESSED_SIZE + 1 && key.size() != 2 * CPubKey::COMPRESSED_SIZE + CSHA256::OUTPUT_SIZE + 1) {
888 throw std::ios_base::failure("Input musig2 partial sig key is not expected size of 67 or 99 bytes");
889 }
890 CPubKey agg_pub, part_pub;
891 uint256 leaf_hash;
892 DeserializeMuSig2ParticipantDataIdentifier(skey, agg_pub, part_pub, leaf_hash);
893
894 uint256 partial_sig;
895 UnserializeFromVector(s, partial_sig);
896
897 m_musig2_partial_sigs[std::make_pair(agg_pub, leaf_hash)].emplace(part_pub, partial_sig);
898 break;
899 }
900 case PSBT_IN_PROPRIETARY:
901 {
902 PSBTProprietary this_prop;
903 skey >> this_prop.identifier;
904 this_prop.subtype = ReadCompactSize(skey);
905 this_prop.key = key;
906
907 s >> this_prop.value;
908 m_proprietary.insert(this_prop);
909 break;
910 }
911 // Unknown stuff
912 default:
913 // Read in the value
914 std::vector<unsigned char> val_bytes;
915 s >> val_bytes;
916 unknown.emplace(std::move(key), std::move(val_bytes));
917 break;
918 }
919 }
920
921 if (!found_sep) {
922 throw std::ios_base::failure("Separator is missing at the end of an input map");
923 }
924
925 // Make sure required PSBTv2 fields are present
926 if (m_psbt_version >= 2) {
927 if (!found_prev_txid) {
928 throw std::ios_base::failure("Previous TXID is required in PSBTv2");
929 }
930 if (!found_prev_out) {
931 throw std::ios_base::failure("Previous output's index is required in PSBTv2");
932 }
933 }
934 }
935 };
936
937 /** A structure for PSBTs which contains per output information */
938 class PSBTOutput
939 {
940 private:
941 uint32_t m_psbt_version;
942
943 public:
944 CScript redeem_script;
945 CScript witness_script;
946 std::map<CPubKey, KeyOriginInfo> hd_keypaths;
947
948 XOnlyPubKey m_tap_internal_key;
949 std::vector<std::tuple<uint8_t, uint8_t, std::vector<unsigned char>>> m_tap_tree;
950 std::map<XOnlyPubKey, std::pair<std::set<uint256>, KeyOriginInfo>> m_tap_bip32_paths;
951 std::map<CPubKey, std::vector<CPubKey>> m_musig2_participants;
952
953 std::map<std::vector<unsigned char>, std::vector<unsigned char>> unknown;
954 std::set<PSBTProprietary> m_proprietary;
955
956 CAmount amount;
957 CScript script;
958
959 bool IsNull() const;
960 void FillSignatureData(SignatureData& sigdata) const;
961 void FromSignatureData(const SignatureData& sigdata);
962 [[nodiscard]] bool Merge(const PSBTOutput& output);
963 uint32_t GetVersion() const { return m_psbt_version; }
964
965 explicit PSBTOutput(uint32_t psbt_version, CAmount amount, const CScript& script)
966 : m_psbt_version(psbt_version),
967 amount(amount),
968 script(script)
969 {
970 assert(m_psbt_version == 0 || m_psbt_version == 2);
971 }
972
973 // Construct a PSBTOutput when the amount and script are expected to be serialized
974 template <typename Stream>
975 explicit PSBTOutput(deserialize_type, Stream& s, uint32_t psbt_version)
976 : m_psbt_version(psbt_version)
977 {
978 assert(m_psbt_version == 2);
979 Unserialize(s);
980 }
981
982 bool operator==(const PSBTOutput&) const = default;
983
984 template <typename Stream>
985 inline void Serialize(Stream& s) const {
986 // Write the redeem script
987 if (!redeem_script.empty()) {
988 SerializeToVector(s, CompactSizeWriter(PSBT_OUT_REDEEMSCRIPT));
989 s << redeem_script;
990 }
991
992 // Write the witness script
993 if (!witness_script.empty()) {
994 SerializeToVector(s, CompactSizeWriter(PSBT_OUT_WITNESSSCRIPT));
995 s << witness_script;
996 }
997
998 // Write any hd keypaths
999 SerializeHDKeypaths(s, hd_keypaths, CompactSizeWriter(PSBT_OUT_BIP32_DERIVATION));
1000
1001 if (m_psbt_version >= 2) {
1002 // Write amount and spk
1003 SerializeToVector(s, CompactSizeWriter(PSBT_OUT_AMOUNT));
1004 SerializeToVector(s, amount);
1005
1006 SerializeToVector(s, CompactSizeWriter(PSBT_OUT_SCRIPT));
1007 s << script;
1008 }
1009
1010 // Write proprietary things
1011 for (const auto& entry : m_proprietary) {
1012 s << entry.key;
1013 s << entry.value;
1014 }
1015
1016 // Write taproot internal key
1017 if (!m_tap_internal_key.IsNull()) {
1018 SerializeToVector(s, PSBT_OUT_TAP_INTERNAL_KEY);
1019 s << ToByteVector(m_tap_internal_key);
1020 }
1021
1022 // Write taproot tree
1023 if (!m_tap_tree.empty()) {
1024 SerializeToVector(s, PSBT_OUT_TAP_TREE);
1025 std::vector<unsigned char> value;
1026 VectorWriter s_value{value, 0};
1027 for (const auto& [depth, leaf_ver, script] : m_tap_tree) {
1028 s_value << depth;
1029 s_value << leaf_ver;
1030 s_value << script;
1031 }
1032 s << value;
1033 }
1034
1035 // Write taproot bip32 keypaths
1036 for (const auto& [xonly, leaf] : m_tap_bip32_paths) {
1037 const auto& [leaf_hashes, origin] = leaf;
1038 SerializeToVector(s, PSBT_OUT_TAP_BIP32_DERIVATION, xonly);
1039 std::vector<unsigned char> value;
1040 VectorWriter s_value{value, 0};
1041 s_value << leaf_hashes;
1042 SerializeKeyOrigin(s_value, origin);
1043 s << value;
1044 }
1045
1046 // Write MuSig2 Participants
1047 for (const auto& [agg_pubkey, part_pubs] : m_musig2_participants) {
1048 SerializeToVector(s, CompactSizeWriter(PSBT_OUT_MUSIG2_PARTICIPANT_PUBKEYS), std::span{agg_pubkey});
1049 std::vector<unsigned char> value;
1050 VectorWriter s_value{value, 0};
1051 for (auto& pk : part_pubs) {
1052 s_value << std::span{pk};
1053 }
1054 s << value;
1055 }
1056
1057 // Write unknown things
1058 for (auto& entry : unknown) {
1059 s << entry.first;
1060 s << entry.second;
1061 }
1062
1063 s << PSBT_SEPARATOR;
1064 }
1065
1066
1067 template <typename Stream>
1068 inline void Unserialize(Stream& s) {
1069 // Used for duplicate key detection
1070 std::set<std::vector<unsigned char>> key_lookup;
1071 // Cache whether PSBTv2 required fields are found
1072 bool found_amount = false;
1073 bool found_script = false;
1074
1075 // Read loop
1076 bool found_sep = false;
1077 while(!s.empty()) {
1078 // Read the key of format "<keylen><keytype><keydata>" after which
1079 // "key" will contain "<keytype><keydata>"
1080 std::vector<unsigned char> key;
1081 s >> key;
1082
1083 // the key is empty if that was actually a separator byte
1084 // This is a special case for key lengths 0 as those are not allowed (except for separator)
1085 if (key.empty()) {
1086 found_sep = true;
1087 break;
1088 }
1089
1090 // Duplicate keys are not permitted
1091 if (!key_lookup.emplace(key).second) {
1092 throw std::ios_base::failure(tfm::format("Duplicate Key, output key \"%s\" already provided", HexStr(key)));
1093 }
1094
1095 // "skey" is used so that "key" is unchanged after reading keytype below
1096 SpanReader skey{key};
1097 // keytype is of the format compact size uint at the beginning of "key"
1098 uint64_t type = ReadCompactSize(skey);
1099
1100 // Do stuff based on keytype "type", i.e., key checks, reading values of the
1101 // format "<valuelen><valuedata>" from the stream "s", and value checks
1102 switch(type) {
1103 case PSBT_OUT_REDEEMSCRIPT:
1104 {
1105 ExpectedKeySize("Output redeemScript", key, 1);
1106 s >> redeem_script;
1107 break;
1108 }
1109 case PSBT_OUT_WITNESSSCRIPT:
1110 {
1111 ExpectedKeySize("Output witnessScript", key, 1);
1112 s >> witness_script;
1113 break;
1114 }
1115 case PSBT_OUT_BIP32_DERIVATION:
1116 {
1117 DeserializeHDKeypaths(s, key, hd_keypaths);
1118 break;
1119 }
1120 case PSBT_OUT_AMOUNT:
1121 {
1122 ExpectedKeySize("Output Amount", key, 1);
1123 if (m_psbt_version < 2) {
1124 throw std::ios_base::failure("Output amount is not allowed in PSBTv0");
1125 }
1126 UnserializeFromVector(s, amount);
1127 found_amount = true;
1128 break;
1129 }
1130 case PSBT_OUT_SCRIPT:
1131 {
1132 ExpectedKeySize("Output Script", key, 1);
1133 if (m_psbt_version < 2) {
1134 throw std::ios_base::failure("Output script is not allowed in PSBTv0");
1135 }
1136 s >> script;
1137 found_script = true;
1138 break;
1139 }
1140 case PSBT_OUT_TAP_INTERNAL_KEY:
1141 {
1142 ExpectedKeySize("Output Taproot Internal Key", key, 1);
1143 UnserializeFromVector(s, m_tap_internal_key);
1144 break;
1145 }
1146 case PSBT_OUT_TAP_TREE:
1147 {
1148 ExpectedKeySize("Output Taproot Tree Key", key, 1);
1149 std::vector<unsigned char> tree_v;
1150 s >> tree_v;
1151 SpanReader s_tree{tree_v};
1152 if (s_tree.empty()) {
1153 throw std::ios_base::failure("Output Taproot tree must not be empty");
1154 }
1155 TaprootBuilder builder;
1156 while (!s_tree.empty()) {
1157 uint8_t depth;
1158 uint8_t leaf_ver;
1159 std::vector<unsigned char> script;
1160 s_tree >> depth;
1161 s_tree >> leaf_ver;
1162 s_tree >> script;
1163 if (depth > TAPROOT_CONTROL_MAX_NODE_COUNT) {
1164 throw std::ios_base::failure("Output Taproot tree has as leaf greater than Taproot maximum depth");
1165 }
1166 if ((leaf_ver & ~TAPROOT_LEAF_MASK) != 0) {
1167 throw std::ios_base::failure("Output Taproot tree has a leaf with an invalid leaf version");
1168 }
1169 m_tap_tree.emplace_back(depth, leaf_ver, script);
1170 builder.Add((int)depth, script, (int)leaf_ver, /*track=*/true);
1171 }
1172 if (!builder.IsComplete()) {
1173 throw std::ios_base::failure("Output Taproot tree is malformed");
1174 }
1175 break;
1176 }
1177 case PSBT_OUT_TAP_BIP32_DERIVATION:
1178 {
1179 ExpectedKeySize("Output Taproot BIP32 Keypath", key, 33);
1180 XOnlyPubKey xonly(uint256(std::span<uint8_t>(key).last(32)));
1181 std::set<uint256> leaf_hashes;
1182 uint64_t value_len = ReadCompactSize(s);
1183 size_t before_hashes = s.size();
1184 s >> leaf_hashes;
1185 size_t after_hashes = s.size();
1186 size_t hashes_len = before_hashes - after_hashes;
1187 if (hashes_len > value_len) {
1188 throw std::ios_base::failure("Output Taproot BIP32 keypath has an invalid length");
1189 }
1190 size_t origin_len = value_len - hashes_len;
1191 m_tap_bip32_paths.emplace(xonly, std::make_pair(leaf_hashes, DeserializeKeyOrigin(s, origin_len)));
1192 break;
1193 }
1194 case PSBT_OUT_MUSIG2_PARTICIPANT_PUBKEYS:
1195 {
1196 ExpectedKeySize("Output MuSig2 Participants Pubkeys", key, CPubKey::COMPRESSED_SIZE + 1);
1197 DeserializeMuSig2ParticipantPubkeys(s, skey, m_musig2_participants, std::string{"Output"});
1198 break;
1199 }
1200 case PSBT_OUT_PROPRIETARY:
1201 {
1202 PSBTProprietary this_prop;
1203 skey >> this_prop.identifier;
1204 this_prop.subtype = ReadCompactSize(skey);
1205 this_prop.key = key;
1206
1207 s >> this_prop.value;
1208 m_proprietary.insert(this_prop);
1209 break;
1210 }
1211 // Unknown stuff
1212 default: {
1213 // Read in the value
1214 std::vector<unsigned char> val_bytes;
1215 s >> val_bytes;
1216 unknown.emplace(std::move(key), std::move(val_bytes));
1217 break;
1218 }
1219 }
1220 }
1221
1222 if (!found_sep) {
1223 throw std::ios_base::failure("Separator is missing at the end of an output map");
1224 }
1225
1226 // Make sure required PSBTv2 fields are present
1227 if (m_psbt_version >= 2) {
1228 if (!found_amount) {
1229 throw std::ios_base::failure("Output amount is required in PSBTv2");
1230 }
1231 if (!found_script) {
1232 throw std::ios_base::failure("Output script is required in PSBTv2");
1233 }
1234 }
1235 }
1236 };
1237
1238 /** A version of CTransaction with the PSBT format*/
1239 class PartiallySignedTransaction
1240 {
1241 private:
1242 std::optional<uint32_t> m_version;
1243
1244 public:
1245 // We use a vector of CExtPubKey in the event that there happens to be the same KeyOriginInfos for different CExtPubKeys
1246 // Note that this map swaps the key and values from the serialization
1247 std::map<KeyOriginInfo, std::set<CExtPubKey>> m_xpubs;
1248 std::optional<std::bitset<8>> m_tx_modifiable;
1249 std::vector<PSBTInput> inputs;
1250 std::vector<PSBTOutput> outputs;
1251 std::map<std::vector<unsigned char>, std::vector<unsigned char>> unknown;
1252 std::set<PSBTProprietary> m_proprietary;
1253
1254 uint32_t tx_version;
1255 std::optional<uint32_t> fallback_locktime;
1256
1257 bool IsNull() const;
1258 uint32_t GetVersion() const;
1259
1260 /** Merge psbt into this. The two psbts must have the same underlying CTransaction (i.e. the
1261 * same actual Bitcoin transaction.) Returns true if the merge succeeded, false otherwise. */
1262 [[nodiscard]] bool Merge(const PartiallySignedTransaction& psbt);
1263 bool AddInput(const PSBTInput& psbtin);
1264 bool AddOutput(const PSBTOutput& psbtout);
1265 std::optional<uint32_t> ComputeTimeLock() const;
1266 std::optional<CMutableTransaction> GetUnsignedTx() const;
1267 std::optional<Txid> GetUniqueID() const;
1268 explicit PartiallySignedTransaction(const CMutableTransaction& tx, uint32_t version = 2);
1269
1270 template <typename Stream>
1271 inline void Serialize(Stream& s) const {
1272
1273 // magic bytes
1274 s << PSBT_MAGIC_BYTES;
1275
1276 if (GetVersion() < 2) {
1277 // unsigned tx flag
1278 SerializeToVector(s, CompactSizeWriter(PSBT_GLOBAL_UNSIGNED_TX));
1279
1280 // Write serialized tx to a stream
1281 SerializeToVector(s, TX_NO_WITNESS(*GetUnsignedTx()));
1282 }
1283
1284 // Write xpubs
1285 for (const auto& xpub_pair : m_xpubs) {
1286 for (const auto& xpub : xpub_pair.second) {
1287 unsigned char ser_xpub[BIP32_EXTKEY_WITH_VERSION_SIZE];
1288 xpub.EncodeWithVersion(ser_xpub);
1289 // Note that the serialization swaps the key and value
1290 // The xpub is the key (for uniqueness) while the path is the value
1291 SerializeToVector(s, PSBT_GLOBAL_XPUB, ser_xpub);
1292 SerializeHDKeypath(s, xpub_pair.first);
1293 }
1294 }
1295
1296 if (GetVersion() >= 2) {
1297 // Write PSBTv2 tx version, locktime, counts, etc.
1298 SerializeToVector(s, CompactSizeWriter(PSBT_GLOBAL_TX_VERSION));
1299 SerializeToVector(s, tx_version);
1300 if (fallback_locktime != std::nullopt) {
1301 SerializeToVector(s, CompactSizeWriter(PSBT_GLOBAL_FALLBACK_LOCKTIME));
1302 SerializeToVector(s, *fallback_locktime);
1303 }
1304
1305 SerializeToVector(s, CompactSizeWriter(PSBT_GLOBAL_INPUT_COUNT));
1306 SerializeToVector(s, CompactSizeWriter(inputs.size()));
1307 SerializeToVector(s, CompactSizeWriter(PSBT_GLOBAL_OUTPUT_COUNT));
1308 SerializeToVector(s, CompactSizeWriter(outputs.size()));
1309
1310 if (m_tx_modifiable != std::nullopt) {
1311 SerializeToVector(s, CompactSizeWriter(PSBT_GLOBAL_TX_MODIFIABLE));
1312 SerializeToVector(s, static_cast<uint8_t>(m_tx_modifiable->to_ulong()));
1313 }
1314 }
1315
1316 // PSBT version
1317 if (GetVersion() > 0) {
1318 SerializeToVector(s, CompactSizeWriter(PSBT_GLOBAL_VERSION));
1319 SerializeToVector(s, *m_version);
1320 }
1321
1322 // Write proprietary things
1323 for (const auto& entry : m_proprietary) {
1324 s << entry.key;
1325 s << entry.value;
1326 }
1327
1328 // Write the unknown things
1329 for (auto& entry : unknown) {
1330 s << entry.first;
1331 s << entry.second;
1332 }
1333
1334 // Separator
1335 s << PSBT_SEPARATOR;
1336
1337 // Write inputs
1338 for (const PSBTInput& input : inputs) {
1339 s << input;
1340 }
1341 // Write outputs
1342 for (const PSBTOutput& output : outputs) {
1343 s << output;
1344 }
1345 }
1346
1347
1348 template <typename Stream>
1349 inline void Unserialize(Stream& s) {
1350 // Read the magic bytes
1351 uint8_t magic[5];
1352 s >> magic;
1353 if (!std::equal(magic, magic + 5, PSBT_MAGIC_BYTES)) {
1354 throw std::ios_base::failure("Invalid PSBT magic bytes");
1355 }
1356
1357 // Used for duplicate key detection
1358 std::set<std::vector<unsigned char>> key_lookup;
1359
1360 // Track the global xpubs we have already seen. Just for sanity checking
1361 std::set<CExtPubKey> global_xpubs;
1362
1363 // Read global data
1364 bool found_sep = false;
1365 std::optional<CMutableTransaction> tx;
1366 uint64_t input_count = 0;
1367 uint64_t output_count = 0;
1368 bool found_input_count = false;
1369 bool found_output_count = false;
1370 bool found_tx_version = false;
1371 bool found_fallback_locktime = false;
1372 while(!s.empty()) {
1373 // Read the key of format "<keylen><keytype><keydata>" after which
1374 // "key" will contain "<keytype><keydata>"
1375 std::vector<unsigned char> key;
1376 s >> key;
1377
1378 // the key is empty if that was actually a separator byte
1379 // This is a special case for key lengths 0 as those are not allowed (except for separator)
1380 if (key.empty()) {
1381 found_sep = true;
1382 break;
1383 }
1384
1385 // Duplicate keys are not permitted
1386 if (!key_lookup.emplace(key).second) {
1387 throw std::ios_base::failure(tfm::format("Duplicate Key, global key \"%s\" already provided", HexStr(key)));
1388 }
1389
1390 // "skey" is used so that "key" is unchanged after reading keytype below
1391 SpanReader skey{key};
1392 // keytype is of the format compact size uint at the beginning of "key"
1393 uint64_t type = ReadCompactSize(skey);
1394
1395 // Do stuff based on keytype "type", i.e., key checks, reading values of the
1396 // format "<valuelen><valuedata>" from the stream "s", and value checks
1397 switch(type) {
1398 case PSBT_GLOBAL_UNSIGNED_TX:
1399 {
1400 ExpectedKeySize("Global Unsigned TX", key, 1);
1401 // Set the stream to serialize with non-witness since this should always be non-witness
1402 tx.emplace();
1403 UnserializeFromVector(s, TX_NO_WITNESS(*tx));
1404 // Make sure that all scriptSigs and scriptWitnesses are empty
1405 for (const CTxIn& txin : tx->vin) {
1406 if (!txin.scriptSig.empty() || !txin.scriptWitness.IsNull()) {
1407 throw std::ios_base::failure("Unsigned tx does not have empty scriptSigs and scriptWitnesses.");
1408 }
1409 }
1410 tx_version = tx->version;
1411 fallback_locktime = tx->nLockTime;
1412 // Set the input and output counts
1413 input_count = tx->vin.size();
1414 output_count = tx->vout.size();
1415 break;
1416 }
1417 case PSBT_GLOBAL_TX_VERSION:
1418 {
1419 ExpectedKeySize("Global Transaction Version", key, 1);
1420 UnserializeFromVector(s, tx_version);
1421 found_tx_version = true;
1422 break;
1423 }
1424 case PSBT_GLOBAL_FALLBACK_LOCKTIME:
1425 {
1426 ExpectedKeySize("Global Fallback Locktime", key, 1);
1427 fallback_locktime.emplace();
1428 UnserializeFromVector(s, *fallback_locktime);
1429 found_fallback_locktime = true;
1430 break;
1431 }
1432 case PSBT_GLOBAL_INPUT_COUNT:
1433 {
1434 ExpectedKeySize("Global Input Count", key, 1);
1435 CompactSizeReader reader(input_count);
1436 UnserializeFromVector(s, reader);
1437 found_input_count = true;
1438 break;
1439 }
1440 case PSBT_GLOBAL_OUTPUT_COUNT:
1441 {
1442 ExpectedKeySize("Global Output Count", key, 1);
1443 CompactSizeReader reader(output_count);
1444 UnserializeFromVector(s, reader);
1445 found_output_count = true;
1446 break;
1447 }
1448 case PSBT_GLOBAL_TX_MODIFIABLE:
1449 {
1450 ExpectedKeySize("Global TX Modifiable Flags", key, 1);
1451 uint8_t tx_mod;
1452 UnserializeFromVector(s, tx_mod);
1453 m_tx_modifiable.emplace(tx_mod);
1454 break;
1455 }
1456 case PSBT_GLOBAL_XPUB:
1457 {
1458 ExpectedKeySize("Global XPUB", key, BIP32_EXTKEY_WITH_VERSION_SIZE + 1);
1459 // Read in the xpub from key
1460 CExtPubKey xpub;
1461 xpub.DecodeWithVersion(&key.data()[1]);
1462 if (!xpub.pubkey.IsFullyValid()) {
1463 throw std::ios_base::failure("Invalid pubkey");
1464 }
1465 global_xpubs.insert(xpub);
1466 // Read in the keypath from stream
1467 KeyOriginInfo keypath;
1468 DeserializeHDKeypath(s, keypath);
1469
1470 // Note that we store these swapped to make searches faster.
1471 // Serialization uses xpub -> keypath to enqure key uniqueness
1472 if (!m_xpubs.contains(keypath)) {
1473 // Make a new set to put the xpub in
1474 m_xpubs[keypath] = {xpub};
1475 } else {
1476 // Insert xpub into existing set
1477 m_xpubs[keypath].insert(xpub);
1478 }
1479 break;
1480 }
1481 case PSBT_GLOBAL_VERSION:
1482 {
1483 ExpectedKeySize("Global PSBT Version", key, 1);
1484 uint32_t v;
1485 UnserializeFromVector(s, v);
1486 m_version = v;
1487 if (*m_version > PSBT_HIGHEST_VERSION) {
1488 throw std::ios_base::failure("Unsupported version number");
1489 }
1490 break;
1491 }
1492 case PSBT_GLOBAL_PROPRIETARY:
1493 {
1494 PSBTProprietary this_prop;
1495 skey >> this_prop.identifier;
1496 this_prop.subtype = ReadCompactSize(skey);
1497 this_prop.key = key;
1498
1499 s >> this_prop.value;
1500 m_proprietary.insert(this_prop);
1501 break;
1502 }
1503 // Unknown stuff
1504 default: {
1505 // Read in the value
1506 std::vector<unsigned char> val_bytes;
1507 s >> val_bytes;
1508 unknown.emplace(std::move(key), std::move(val_bytes));
1509 }
1510 }
1511 }
1512
1513 if (!found_sep) {
1514 throw std::ios_base::failure("Separator is missing at the end of the global map");
1515 }
1516
1517 const uint32_t psbt_ver = GetVersion();
1518
1519 // Check PSBT version constraints
1520 if (psbt_ver == 0) {
1521 // Make sure that we got an unsigned tx for PSBTv0
1522 if (!tx) {
1523 throw std::ios_base::failure("No unsigned transaction was provided");
1524 }
1525 // Make sure no PSBTv2 fields are present
1526 if (found_tx_version) {
1527 throw std::ios_base::failure("PSBT_GLOBAL_TX_VERSION is not allowed in PSBTv0");
1528 }
1529 if (found_fallback_locktime) {
1530 throw std::ios_base::failure("PSBT_GLOBAL_FALLBACK_LOCKTIME is not allowed in PSBTv0");
1531 }
1532 if (found_input_count) {
1533 throw std::ios_base::failure("PSBT_GLOBAL_INPUT_COUNT is not allowed in PSBTv0");
1534 }
1535 if (found_output_count) {
1536 throw std::ios_base::failure("PSBT_GLOBAL_OUTPUT_COUNT is not allowed in PSBTv0");
1537 }
1538 if (m_tx_modifiable != std::nullopt) {
1539 throw std::ios_base::failure("PSBT_GLOBAL_TX_MODIFIABLE is not allowed in PSBTv0");
1540 }
1541 }
1542 // Disallow v1
1543 if (psbt_ver == 1) {
1544 throw std::ios_base::failure("There is no PSBT version 1");
1545 }
1546 if (psbt_ver == 2) {
1547 // Tx version, input, and output counts are required
1548 if (!found_tx_version) {
1549 throw std::ios_base::failure("PSBT_GLOBAL_TX_VERSION is required in PSBTv2");
1550 }
1551 if (!found_input_count) {
1552 throw std::ios_base::failure("PSBT_GLOBAL_INPUT_COUNT is required in PSBTv2");
1553 }
1554 if (!found_output_count) {
1555 throw std::ios_base::failure("PSBT_GLOBAL_OUTPUT_COUNT is required in PSBTv2");
1556 }
1557 // Unsigned tx is disallowed
1558 if (tx) {
1559 throw std::ios_base::failure("PSBT_GLOBAL_UNSIGNED_TX is not allowed in PSBTv2");
1560 }
1561 }
1562 if (psbt_ver > 2) {
1563 throw std::ios_base::failure("Unknown PSBT version");
1564 }
1565
1566 // Read input data
1567 unsigned int i = 0;
1568 while (!s.empty() && i < input_count) {
1569 if (psbt_ver < 2) {
1570 inputs.emplace_back(psbt_ver, tx->vin[i].prevout.hash, tx->vin[i].prevout.n, tx->vin[i].nSequence);
1571 s >> inputs.back();
1572 } else {
1573 inputs.emplace_back(deserialize, s, psbt_ver);
1574 }
1575
1576 // Make sure the non-witness utxo matches the outpoint
1577 const PSBTInput& input = inputs.back();
1578 if (input.non_witness_utxo) {
1579 if (psbt_ver < 2) {
1580 if (input.non_witness_utxo->GetHash() != tx->vin[i].prevout.hash) {
1581 throw std::ios_base::failure("Non-witness UTXO does not match outpoint hash");
1582 }
1583 if (tx->vin[i].prevout.n >= input.non_witness_utxo->vout.size()) {
1584 throw std::ios_base::failure("Input specifies output index that does not exist");
1585 }
1586 } else {
1587 if (input.non_witness_utxo->GetHash() != input.prev_txid) {
1588 throw std::ios_base::failure("Non-witness UTXO does not match outpoint hash");
1589 }
1590 if (input.prev_out >= input.non_witness_utxo->vout.size()) {
1591 throw std::ios_base::failure("Input specifies output index that does not exist");
1592 }
1593 }
1594 }
1595 ++i;
1596 }
1597 // Make sure that the number of inputs matches the number of inputs in the transaction
1598 if (inputs.size() != input_count) {
1599 throw std::ios_base::failure("Inputs provided does not match the number of inputs in transaction.");
1600 }
1601
1602 // Read output data
1603 i = 0;
1604 while (!s.empty() && i < output_count) {
1605 if (psbt_ver < 2) {
1606 outputs.emplace_back(psbt_ver, tx->vout[i].nValue, tx->vout[i].scriptPubKey);
1607 s >> outputs.back();
1608 } else {
1609 outputs.emplace_back(deserialize, s, psbt_ver);
1610 }
1611 ++i;
1612 }
1613 // Make sure that the number of outputs matches the number of outputs in the transaction
1614 if (outputs.size() != output_count) {
1615 throw std::ios_base::failure("Outputs provided does not match the number of outputs in transaction.");
1616 }
1617 }
1618
1619 template <typename Stream>
1620 PartiallySignedTransaction(deserialize_type, Stream& s) {
1621 Unserialize(s);
1622 }
1623 };
1624
1625 enum class PSBTRole {
1626 CREATOR,
1627 UPDATER,
1628 SIGNER,
1629 FINALIZER,
1630 EXTRACTOR
1631 };
1632
1633 std::string PSBTRoleName(PSBTRole role);
1634
1635 /** Compute a PrecomputedTransactionData object from a psbt. */
1636 std::optional<PrecomputedTransactionData> PrecomputePSBTData(const PartiallySignedTransaction& psbt);
1637
1638 /** Checks whether a PSBTInput is already signed by checking for non-null finalized fields. */
1639 bool PSBTInputSigned(const PSBTInput& input);
1640
1641 /** Checks whether a PSBTInput is already signed by doing script verification using final fields. */
1642 bool PSBTInputSignedAndVerified(const PartiallySignedTransaction& psbt, unsigned int input_index, const PrecomputedTransactionData* txdata);
1643
1644 /** Signs a PSBTInput, verifying that all provided data matches what is being signed.
1645 *
1646 * txdata should be the output of PrecomputePSBTData (which can be shared across
1647 * multiple SignPSBTInput calls). If it is nullptr, a dummy signature will be created.
1648 **/
1649 [[nodiscard]] PSBTError SignPSBTInput(const SigningProvider& provider, PartiallySignedTransaction& psbt, int index, const PrecomputedTransactionData* txdata, const common::PSBTFillOptions& options, SignatureData* out_sigdata = nullptr);
1650
1651 /** Reduces the size of the PSBT by dropping unnecessary `non_witness_utxos` (i.e. complete previous transactions) from a psbt when all inputs are segwit v1. */
1652 void RemoveUnnecessaryTransactions(PartiallySignedTransaction& psbtx);
1653
1654 /** Counts the unsigned inputs of a PSBT. */
1655 size_t CountPSBTUnsignedInputs(const PartiallySignedTransaction& psbt);
1656
1657 /** Updates a PSBTOutput with information from provider.
1658 *
1659 * This fills in the redeem_script, witness_script, and hd_keypaths where possible.
1660 */
1661 void UpdatePSBTOutput(const SigningProvider& provider, PartiallySignedTransaction& psbt, int index);
1662
1663 /**
1664 * Finalizes a PSBT if possible, combining partial signatures.
1665 *
1666 * @param[in,out] psbtx PartiallySignedTransaction to finalize
1667 * return True if the PSBT is now complete, false otherwise
1668 */
1669 bool FinalizePSBT(PartiallySignedTransaction& psbtx);
1670
1671 /**
1672 * Finalizes a PSBT if possible, and extracts it to a CMutableTransaction if it could be finalized.
1673 *
1674 * @param[in] psbtx PartiallySignedTransaction
1675 * @param[out] result CMutableTransaction representing the complete transaction, if successful
1676 * @return True if we successfully extracted the transaction, false otherwise
1677 */
1678 bool FinalizeAndExtractPSBT(PartiallySignedTransaction& psbtx, CMutableTransaction& result);
1679
1680 /**
1681 * Combines PSBTs with the same underlying transaction, resulting in a single PSBT with all partial signatures from each input.
1682 *
1683 * @param[in] psbtxs the PSBTs to combine
1684 * @return The combined PSBT or std::nullopt if the PSBTs cannot be combined
1685 */
1686 [[nodiscard]] std::optional<PartiallySignedTransaction> CombinePSBTs(const std::vector<PartiallySignedTransaction>& psbtxs);
1687
1688 //! Decode a base64ed PSBT into a PartiallySignedTransaction
1689 [[nodiscard]] util::Result<PartiallySignedTransaction> DecodeBase64PSBT(const std::string& base64_tx);
1690 //! Decode a raw (binary blob) PSBT into a PartiallySignedTransaction
1691 [[nodiscard]] util::Result<PartiallySignedTransaction> DecodeRawPSBT(std::span<const std::byte> tx_data);
1692
1693 #endif // BITCOIN_PSBT_H
1694