sign.cpp raw
1 // Copyright (c) 2009-2010 Satoshi Nakamoto
2 // Copyright (c) 2009-present The Bitcoin Core developers
3 // Distributed under the MIT software license, see the accompanying
4 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
5
6 #include <script/sign.h>
7
8 #include <addresstype.h>
9 #include <coins.h>
10 #include <consensus/amount.h>
11 #include <hash.h>
12 #include <key.h>
13 #include <musig.h>
14 #include <policy/policy.h>
15 #include <prevector.h>
16 #include <primitives/transaction.h>
17 #include <script/keyorigin.h>
18 #include <script/miniscript.h>
19 #include <script/script.h>
20 #include <script/script_error.h>
21 #include <script/signingprovider.h>
22 #include <script/solver.h>
23 #include <script/verify_flags.h>
24 #include <serialize.h>
25 #include <uint256.h>
26 #include <util/check.h>
27 #include <util/translation.h>
28 #include <util/vector.h>
29
30 #include <algorithm>
31 #include <cstddef>
32 #include <functional>
33 #include <iterator>
34 #include <span>
35 #include <string>
36
37 typedef std::vector<unsigned char> valtype;
38
39 MutableTransactionSignatureCreator::MutableTransactionSignatureCreator(const CMutableTransaction& tx, unsigned int input_idx, const CAmount& amount, const SignOptions& options)
40 : m_txto{tx}, nIn{input_idx}, m_options{options}, amount{amount}, checker{&m_txto, nIn, amount, MissingDataBehavior::FAIL},
41 m_txdata(nullptr)
42 {
43 }
44
45 MutableTransactionSignatureCreator::MutableTransactionSignatureCreator(const CMutableTransaction& tx, unsigned int input_idx, const CAmount& amount, const PrecomputedTransactionData* txdata, const SignOptions& options)
46 : m_txto{tx}, nIn{input_idx}, m_options{options}, amount{amount},
47 checker{txdata ? MutableTransactionSignatureChecker{&m_txto, nIn, amount, *txdata, MissingDataBehavior::FAIL} :
48 MutableTransactionSignatureChecker{&m_txto, nIn, amount, MissingDataBehavior::FAIL}},
49 m_txdata(txdata)
50 {
51 }
52
53 bool MutableTransactionSignatureCreator::CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& address, const CScript& scriptCode, SigVersion sigversion) const
54 {
55 assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0);
56
57 CKey key;
58 if (!provider.GetKey(address, key))
59 return false;
60
61 // Signing with uncompressed keys is disabled in witness scripts
62 if (sigversion == SigVersion::WITNESS_V0 && !key.IsCompressed())
63 return false;
64
65 // Signing without known amount does not work in witness scripts.
66 if (sigversion == SigVersion::WITNESS_V0 && !MoneyRange(amount)) return false;
67
68 // BASE/WITNESS_V0 signatures don't support explicit SIGHASH_DEFAULT, use SIGHASH_ALL instead.
69 const int hashtype = m_options.sighash_type == SIGHASH_DEFAULT ? SIGHASH_ALL : m_options.sighash_type;
70
71 uint256 hash = SignatureHash(scriptCode, m_txto, nIn, hashtype, amount, sigversion, m_txdata);
72 if (!key.Sign(hash, vchSig))
73 return false;
74 vchSig.push_back((unsigned char)hashtype);
75 return true;
76 }
77
78 std::optional<uint256> MutableTransactionSignatureCreator::ComputeSchnorrSignatureHash(const uint256* leaf_hash, SigVersion sigversion) const
79 {
80 assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
81
82 // BIP341/BIP342 signing needs lots of precomputed transaction data. While some
83 // (non-SIGHASH_DEFAULT) sighash modes exist that can work with just some subset
84 // of data present, for now, only support signing when everything is provided.
85 if (!m_txdata || !m_txdata->m_bip341_taproot_ready || !m_txdata->m_spent_outputs_ready) return std::nullopt;
86
87 ScriptExecutionData execdata;
88 execdata.m_annex_init = true;
89 execdata.m_annex_present = false; // Only support annex-less signing for now.
90 if (sigversion == SigVersion::TAPSCRIPT) {
91 execdata.m_codeseparator_pos_init = true;
92 execdata.m_codeseparator_pos = 0xFFFFFFFF; // Only support non-OP_CODESEPARATOR BIP342 signing for now.
93 if (!leaf_hash) return std::nullopt; // BIP342 signing needs leaf hash.
94 execdata.m_tapleaf_hash_init = true;
95 execdata.m_tapleaf_hash = *leaf_hash;
96 }
97 uint256 hash;
98 if (!SignatureHashSchnorr(hash, execdata, m_txto, nIn, m_options.sighash_type, sigversion, *m_txdata, MissingDataBehavior::FAIL)) return std::nullopt;
99 return hash;
100 }
101
102 bool MutableTransactionSignatureCreator::CreateSchnorrSig(const SigningProvider& provider, std::vector<unsigned char>& sig, const XOnlyPubKey& pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion) const
103 {
104 CKey key;
105 if (!provider.GetKeyByXOnly(pubkey, key)) return false;
106
107 std::optional<uint256> hash = ComputeSchnorrSignatureHash(leaf_hash, sigversion);
108 if (!hash.has_value()) return false;
109
110 sig.resize(64);
111 // Use uint256{} as aux_rnd for now.
112 if (!key.SignSchnorr(*hash, sig, merkle_root, {})) return false;
113 if (m_options.sighash_type) sig.push_back(m_options.sighash_type);
114 return true;
115 }
116
117 std::vector<uint8_t> MutableTransactionSignatureCreator::CreateMuSig2Nonce(const SigningProvider& provider, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion, const SignatureData& sigdata) const
118 {
119 assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
120
121 // Retrieve the private key
122 CKey key;
123 if (!provider.GetKey(part_pubkey.GetID(), key)) return {};
124
125 // Retrieve participant pubkeys
126 auto it = sigdata.musig2_pubkeys.find(aggregate_pubkey);
127 if (it == sigdata.musig2_pubkeys.end()) return {};
128 const std::vector<CPubKey>& pubkeys = it->second;
129 if (std::find(pubkeys.begin(), pubkeys.end(), part_pubkey) == pubkeys.end()) return {};
130
131 // Compute sighash
132 std::optional<uint256> sighash = ComputeSchnorrSignatureHash(leaf_hash, sigversion);
133 if (!sighash.has_value()) return {};
134
135 MuSig2SecNonce secnonce;
136 std::vector<uint8_t> out = ::CreateMuSig2Nonce(secnonce, *sighash, key, aggregate_pubkey, pubkeys);
137 if (out.empty()) return {};
138
139 // Store the secnonce in the SigningProvider
140 provider.SetMuSig2SecNonce(MuSig2SessionID(script_pubkey, part_pubkey, *sighash, out), std::move(secnonce));
141
142 return out;
143 }
144
145 bool MutableTransactionSignatureCreator::CreateMuSig2PartialSig(const SigningProvider& provider, uint256& partial_sig, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256* leaf_hash, const std::vector<std::pair<uint256, bool>>& tweaks, SigVersion sigversion, const SignatureData& sigdata) const
146 {
147 assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
148
149 // Retrieve private key
150 CKey key;
151 if (!provider.GetKey(part_pubkey.GetID(), key)) return false;
152
153 // Retrieve participant pubkeys
154 auto it = sigdata.musig2_pubkeys.find(aggregate_pubkey);
155 if (it == sigdata.musig2_pubkeys.end()) return false;
156 const std::vector<CPubKey>& pubkeys = it->second;
157 if (std::find(pubkeys.begin(), pubkeys.end(), part_pubkey) == pubkeys.end()) return {};
158
159 // Retrieve pubnonces
160 auto this_leaf_aggkey = std::make_pair(script_pubkey, leaf_hash ? *leaf_hash : uint256());
161 auto pubnonce_it = sigdata.musig2_pubnonces.find(this_leaf_aggkey);
162 if (pubnonce_it == sigdata.musig2_pubnonces.end()) return false;
163 const std::map<CPubKey, std::vector<uint8_t>>& pubnonces = pubnonce_it->second;
164
165 // Check if enough pubnonces
166 if (pubnonces.size() != pubkeys.size()) return false;
167
168 // Compute sighash
169 std::optional<uint256> sighash = ComputeSchnorrSignatureHash(leaf_hash, sigversion);
170 if (!sighash.has_value()) return false;
171
172 // Retrieve the secnonce
173 auto part_pubnonce_it = pubnonces.find(part_pubkey);
174 if (part_pubnonce_it == pubnonces.end()) return false;
175 uint256 session_id = MuSig2SessionID(script_pubkey, part_pubkey, *sighash, part_pubnonce_it->second);
176 std::optional<std::reference_wrapper<MuSig2SecNonce>> secnonce = provider.GetMuSig2SecNonce(session_id);
177 if (!secnonce || !secnonce->get().IsValid()) return false;
178
179 // Compute the sig
180 std::optional<uint256> sig = ::CreateMuSig2PartialSig(*sighash, key, aggregate_pubkey, pubkeys, pubnonces, *secnonce, tweaks);
181 if (!sig) return false;
182 partial_sig = std::move(*sig);
183
184 // Delete the secnonce now that we're done with it
185 assert(!secnonce->get().IsValid());
186 provider.DeleteMuSig2Session(session_id);
187
188 return true;
189 }
190
191 bool MutableTransactionSignatureCreator::CreateMuSig2AggregateSig(const std::vector<CPubKey>& participants, std::vector<uint8_t>& sig, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const uint256* leaf_hash, const std::vector<std::pair<uint256, bool>>& tweaks, SigVersion sigversion, const SignatureData& sigdata) const
192 {
193 assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
194 if (!participants.size()) return false;
195
196 // Retrieve pubnonces and partial sigs
197 auto this_leaf_aggkey = std::make_pair(script_pubkey, leaf_hash ? *leaf_hash : uint256());
198 auto pubnonce_it = sigdata.musig2_pubnonces.find(this_leaf_aggkey);
199 if (pubnonce_it == sigdata.musig2_pubnonces.end()) return false;
200 const std::map<CPubKey, std::vector<uint8_t>>& pubnonces = pubnonce_it->second;
201 auto partial_sigs_it = sigdata.musig2_partial_sigs.find(this_leaf_aggkey);
202 if (partial_sigs_it == sigdata.musig2_partial_sigs.end()) return false;
203 const std::map<CPubKey, uint256>& partial_sigs = partial_sigs_it->second;
204
205 // Check if enough pubnonces and partial sigs
206 if (pubnonces.size() != participants.size()) return false;
207 if (partial_sigs.size() != participants.size()) return false;
208
209 // Compute sighash
210 std::optional<uint256> sighash = ComputeSchnorrSignatureHash(leaf_hash, sigversion);
211 if (!sighash.has_value()) return false;
212
213 std::optional<std::vector<uint8_t>> res = ::CreateMuSig2AggregateSig(participants, aggregate_pubkey, tweaks, *sighash, pubnonces, partial_sigs);
214 if (!res) return false;
215 sig = res.value();
216 if (m_options.sighash_type) sig.push_back(m_options.sighash_type);
217
218 return true;
219 }
220
221 static bool GetCScript(const SigningProvider& provider, const SignatureData& sigdata, const CScriptID& scriptid, CScript& script)
222 {
223 if (provider.GetCScript(scriptid, script)) {
224 return true;
225 }
226 // Look for scripts in SignatureData
227 if (CScriptID(sigdata.redeem_script) == scriptid) {
228 script = sigdata.redeem_script;
229 return true;
230 } else if (CScriptID(sigdata.witness_script) == scriptid) {
231 script = sigdata.witness_script;
232 return true;
233 }
234 return false;
235 }
236
237 static bool GetPubKey(const SigningProvider& provider, const SignatureData& sigdata, const CKeyID& address, CPubKey& pubkey)
238 {
239 // Look for pubkey in all partial sigs
240 const auto it = sigdata.signatures.find(address);
241 if (it != sigdata.signatures.end()) {
242 pubkey = it->second.first;
243 return true;
244 }
245 // Look for pubkey in pubkey lists
246 const auto& pk_it = sigdata.misc_pubkeys.find(address);
247 if (pk_it != sigdata.misc_pubkeys.end()) {
248 pubkey = pk_it->second.first;
249 return true;
250 }
251 const auto& tap_pk_it = sigdata.tap_pubkeys.find(address);
252 if (tap_pk_it != sigdata.tap_pubkeys.end()) {
253 pubkey = tap_pk_it->second.GetEvenCorrespondingCPubKey();
254 return true;
255 }
256 // Query the underlying provider
257 return provider.GetPubKey(address, pubkey);
258 }
259
260 static bool CreateSig(const BaseSignatureCreator& creator, SignatureData& sigdata, const SigningProvider& provider, std::vector<unsigned char>& sig_out, const CPubKey& pubkey, const CScript& scriptcode, SigVersion sigversion)
261 {
262 CKeyID keyid = pubkey.GetID();
263 const auto it = sigdata.signatures.find(keyid);
264 if (it != sigdata.signatures.end()) {
265 sig_out = it->second.second;
266 return true;
267 }
268 KeyOriginInfo info;
269 if (provider.GetKeyOrigin(keyid, info)) {
270 sigdata.misc_pubkeys.emplace(keyid, std::make_pair(pubkey, std::move(info)));
271 }
272 if (creator.CreateSig(provider, sig_out, keyid, scriptcode, sigversion)) {
273 auto i = sigdata.signatures.emplace(keyid, SigPair(pubkey, sig_out));
274 assert(i.second);
275 return true;
276 }
277 // Could not make signature or signature not found, add keyid to missing
278 sigdata.missing_sigs.push_back(keyid);
279 return false;
280 }
281
282 static bool SignMuSig2(const BaseSignatureCreator& creator, SignatureData& sigdata, const SigningProvider& provider, std::vector<unsigned char>& sig_out, const XOnlyPubKey& script_pubkey, const uint256* merkle_root, const uint256* leaf_hash, SigVersion sigversion)
283 {
284 Assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
285
286 // Lookup derivation paths for the script pubkey
287 KeyOriginInfo agg_info;
288 auto misc_pk_it = sigdata.taproot_misc_pubkeys.find(script_pubkey);
289 if (misc_pk_it != sigdata.taproot_misc_pubkeys.end()) {
290 agg_info = misc_pk_it->second.second;
291 }
292
293 for (const auto& [agg_pub, part_pks] : sigdata.musig2_pubkeys) {
294 if (part_pks.empty()) continue;
295
296 // Fill participant derivation path info
297 for (const auto& part_pk : part_pks) {
298 KeyOriginInfo part_info;
299 if (provider.GetKeyOrigin(part_pk.GetID(), part_info)) {
300 XOnlyPubKey xonly_part(part_pk);
301 auto it = sigdata.taproot_misc_pubkeys.find(xonly_part);
302 if (it == sigdata.taproot_misc_pubkeys.end()) {
303 it = sigdata.taproot_misc_pubkeys.emplace(xonly_part, std::make_pair(std::set<uint256>(), part_info)).first;
304 }
305 if (leaf_hash) it->second.first.insert(*leaf_hash);
306 }
307 }
308
309 // The pubkey in the script may not be the actual aggregate of the participants, but derived from it.
310 // Check the derivation, and compute the BIP 32 derivation tweaks
311 std::vector<std::pair<uint256, bool>> tweaks;
312 CPubKey plain_pub = agg_pub;
313 if (XOnlyPubKey(agg_pub) != script_pubkey) {
314 if (agg_info.path.empty()) continue;
315 // Compute and compare fingerprint
316 CKeyID keyid = agg_pub.GetID();
317 if (!std::equal(agg_info.fingerprint, agg_info.fingerprint + sizeof(agg_info.fingerprint), keyid.data())) {
318 continue;
319 }
320 // Get the BIP32 derivation tweaks
321 CExtPubKey extpub = CreateMuSig2SyntheticXpub(agg_pub);
322 for (const int i : agg_info.path) {
323 auto& [t, xonly] = tweaks.emplace_back();
324 xonly = false;
325 if (!extpub.Derive(extpub, i, &t)) {
326 return false;
327 }
328 }
329 Assert(XOnlyPubKey(extpub.pubkey) == script_pubkey);
330 plain_pub = extpub.pubkey;
331 }
332
333 // Add the merkle root tweak
334 if (sigversion == SigVersion::TAPROOT && merkle_root) {
335 tweaks.emplace_back(script_pubkey.ComputeTapTweakHash(merkle_root->IsNull() ? nullptr : merkle_root), true);
336 std::optional<std::pair<XOnlyPubKey, bool>> tweaked = script_pubkey.CreateTapTweak(merkle_root->IsNull() ? nullptr : merkle_root);
337 if (!Assume(tweaked)) return false;
338 plain_pub = tweaked->first.GetCPubKeys().at(tweaked->second ? 1 : 0);
339 }
340
341 // First try to aggregate
342 if (creator.CreateMuSig2AggregateSig(part_pks, sig_out, agg_pub, plain_pub, leaf_hash, tweaks, sigversion, sigdata)) {
343 if (sigversion == SigVersion::TAPROOT) {
344 sigdata.taproot_key_path_sig = sig_out;
345 } else {
346 auto lookup_key = std::make_pair(script_pubkey, leaf_hash ? *leaf_hash : uint256());
347 sigdata.taproot_script_sigs[lookup_key] = sig_out;
348 }
349 continue;
350 }
351 // Cannot aggregate, try making partial sigs for every participant
352 auto pub_key_leaf_hash = std::make_pair(plain_pub, leaf_hash ? *leaf_hash : uint256());
353 for (const CPubKey& part_pk : part_pks) {
354 uint256 partial_sig;
355 if (creator.CreateMuSig2PartialSig(provider, partial_sig, agg_pub, plain_pub, part_pk, leaf_hash, tweaks, sigversion, sigdata) && Assume(!partial_sig.IsNull())) {
356 sigdata.musig2_partial_sigs[pub_key_leaf_hash].emplace(part_pk, partial_sig);
357 }
358 }
359 // If there are any partial signatures, continue with next aggregate pubkey
360 auto partial_sigs_it = sigdata.musig2_partial_sigs.find(pub_key_leaf_hash);
361 if (partial_sigs_it != sigdata.musig2_partial_sigs.end() && !partial_sigs_it->second.empty()) {
362 continue;
363 }
364 // No partial sigs, try to make pubnonces
365 std::map<CPubKey, std::vector<uint8_t>>& pubnonces = sigdata.musig2_pubnonces[pub_key_leaf_hash];
366 for (const CPubKey& part_pk : part_pks) {
367 if (pubnonces.contains(part_pk)) continue;
368 std::vector<uint8_t> pubnonce = creator.CreateMuSig2Nonce(provider, agg_pub, plain_pub, part_pk, leaf_hash, merkle_root, sigversion, sigdata);
369 if (pubnonce.empty()) continue;
370 pubnonces[part_pk] = std::move(pubnonce);
371 }
372 }
373 return true;
374 }
375
376 static bool CreateTaprootScriptSig(const BaseSignatureCreator& creator, SignatureData& sigdata, const SigningProvider& provider, std::vector<unsigned char>& sig_out, const XOnlyPubKey& pubkey, const uint256& leaf_hash, SigVersion sigversion)
377 {
378 KeyOriginInfo info;
379 if (provider.GetKeyOriginByXOnly(pubkey, info)) {
380 auto it = sigdata.taproot_misc_pubkeys.find(pubkey);
381 if (it == sigdata.taproot_misc_pubkeys.end()) {
382 sigdata.taproot_misc_pubkeys.emplace(pubkey, std::make_pair(std::set<uint256>({leaf_hash}), info));
383 } else {
384 it->second.first.insert(leaf_hash);
385 }
386 }
387
388 auto lookup_key = std::make_pair(pubkey, leaf_hash);
389 auto it = sigdata.taproot_script_sigs.find(lookup_key);
390 if (it != sigdata.taproot_script_sigs.end()) {
391 sig_out = it->second;
392 return true;
393 }
394
395 if (creator.CreateSchnorrSig(provider, sig_out, pubkey, &leaf_hash, nullptr, sigversion)) {
396 sigdata.taproot_script_sigs[lookup_key] = sig_out;
397 } else if (!SignMuSig2(creator, sigdata, provider, sig_out, pubkey, /*merkle_root=*/nullptr, &leaf_hash, sigversion)) {
398 return false;
399 }
400
401 return sigdata.taproot_script_sigs.contains(lookup_key);
402 }
403
404 template<typename M, typename K, typename V>
405 miniscript::Availability MsLookupHelper(const M& map, const K& key, V& value)
406 {
407 auto it = map.find(key);
408 if (it != map.end()) {
409 value = it->second;
410 return miniscript::Availability::YES;
411 }
412 return miniscript::Availability::NO;
413 }
414
415 /**
416 * Context for solving a Miniscript.
417 * If enough material (access to keys, hash preimages, ..) is given, produces a valid satisfaction.
418 */
419 template<typename Pk>
420 struct Satisfier {
421 using Key = Pk;
422
423 const SigningProvider& m_provider;
424 SignatureData& m_sig_data;
425 const BaseSignatureCreator& m_creator;
426 const CScript& m_witness_script;
427 //! The context of the script we are satisfying (either P2WSH or Tapscript).
428 const miniscript::MiniscriptContext m_script_ctx;
429
430 explicit Satisfier(const SigningProvider& provider LIFETIMEBOUND, SignatureData& sig_data LIFETIMEBOUND,
431 const BaseSignatureCreator& creator LIFETIMEBOUND,
432 const CScript& witscript LIFETIMEBOUND,
433 miniscript::MiniscriptContext script_ctx) : m_provider(provider),
434 m_sig_data(sig_data),
435 m_creator(creator),
436 m_witness_script(witscript),
437 m_script_ctx(script_ctx) {}
438
439 static bool KeyCompare(const Key& a, const Key& b) {
440 return a < b;
441 }
442
443 //! Get a CPubKey from a key hash. Note the key hash may be of an xonly pubkey.
444 template<typename I>
445 std::optional<CPubKey> CPubFromPKHBytes(I first, I last) const {
446 assert(last - first == 20);
447 CPubKey pubkey;
448 CKeyID key_id;
449 std::copy(first, last, key_id.begin());
450 if (GetPubKey(m_provider, m_sig_data, key_id, pubkey)) return pubkey;
451 m_sig_data.missing_pubkeys.push_back(key_id);
452 return {};
453 }
454
455 //! Conversion to raw public key.
456 std::vector<unsigned char> ToPKBytes(const Key& key) const { return {key.begin(), key.end()}; }
457
458 //! Time lock satisfactions.
459 bool CheckAfter(uint32_t value) const { return m_creator.Checker().CheckLockTime(CScriptNum(value)); }
460 bool CheckOlder(uint32_t value) const { return m_creator.Checker().CheckSequence(CScriptNum(value)); }
461
462 //! Hash preimage satisfactions.
463 miniscript::Availability SatSHA256(const std::vector<unsigned char>& hash, std::vector<unsigned char>& preimage) const {
464 return MsLookupHelper(m_sig_data.sha256_preimages, hash, preimage);
465 }
466 miniscript::Availability SatRIPEMD160(const std::vector<unsigned char>& hash, std::vector<unsigned char>& preimage) const {
467 return MsLookupHelper(m_sig_data.ripemd160_preimages, hash, preimage);
468 }
469 miniscript::Availability SatHASH256(const std::vector<unsigned char>& hash, std::vector<unsigned char>& preimage) const {
470 return MsLookupHelper(m_sig_data.hash256_preimages, hash, preimage);
471 }
472 miniscript::Availability SatHASH160(const std::vector<unsigned char>& hash, std::vector<unsigned char>& preimage) const {
473 return MsLookupHelper(m_sig_data.hash160_preimages, hash, preimage);
474 }
475
476 miniscript::MiniscriptContext MsContext() const {
477 return m_script_ctx;
478 }
479 };
480
481 /** Miniscript satisfier specific to P2WSH context. */
482 struct WshSatisfier: Satisfier<CPubKey> {
483 explicit WshSatisfier(const SigningProvider& provider LIFETIMEBOUND, SignatureData& sig_data LIFETIMEBOUND,
484 const BaseSignatureCreator& creator LIFETIMEBOUND, const CScript& witscript LIFETIMEBOUND)
485 : Satisfier(provider, sig_data, creator, witscript, miniscript::MiniscriptContext::P2WSH) {}
486
487 //! Conversion from a raw compressed public key.
488 template <typename I>
489 std::optional<CPubKey> FromPKBytes(I first, I last) const {
490 CPubKey pubkey{first, last};
491 if (pubkey.IsValid()) return pubkey;
492 return {};
493 }
494
495 //! Conversion from a raw compressed public key hash.
496 template<typename I>
497 std::optional<CPubKey> FromPKHBytes(I first, I last) const {
498 return Satisfier::CPubFromPKHBytes(first, last);
499 }
500
501 //! Satisfy an ECDSA signature check.
502 miniscript::Availability Sign(const CPubKey& key, std::vector<unsigned char>& sig) const {
503 if (CreateSig(m_creator, m_sig_data, m_provider, sig, key, m_witness_script, SigVersion::WITNESS_V0)) {
504 return miniscript::Availability::YES;
505 }
506 return miniscript::Availability::NO;
507 }
508 };
509
510 /** Miniscript satisfier specific to Tapscript context. */
511 struct TapSatisfier: Satisfier<XOnlyPubKey> {
512 const uint256& m_leaf_hash;
513
514 explicit TapSatisfier(const SigningProvider& provider LIFETIMEBOUND, SignatureData& sig_data LIFETIMEBOUND,
515 const BaseSignatureCreator& creator LIFETIMEBOUND, const CScript& script LIFETIMEBOUND,
516 const uint256& leaf_hash LIFETIMEBOUND)
517 : Satisfier(provider, sig_data, creator, script, miniscript::MiniscriptContext::TAPSCRIPT),
518 m_leaf_hash(leaf_hash) {}
519
520 //! Conversion from a raw xonly public key.
521 template <typename I>
522 std::optional<XOnlyPubKey> FromPKBytes(I first, I last) const {
523 if (last - first != 32) return {};
524 XOnlyPubKey pubkey;
525 std::copy(first, last, pubkey.begin());
526 return pubkey;
527 }
528
529 //! Conversion from a raw xonly public key hash.
530 template<typename I>
531 std::optional<XOnlyPubKey> FromPKHBytes(I first, I last) const {
532 if (auto pubkey = Satisfier::CPubFromPKHBytes(first, last)) return XOnlyPubKey{*pubkey};
533 return {};
534 }
535
536 //! Satisfy a BIP340 signature check.
537 miniscript::Availability Sign(const XOnlyPubKey& key, std::vector<unsigned char>& sig) const {
538 if (CreateTaprootScriptSig(m_creator, m_sig_data, m_provider, sig, key, m_leaf_hash, SigVersion::TAPSCRIPT)) {
539 return miniscript::Availability::YES;
540 }
541 return miniscript::Availability::NO;
542 }
543 };
544
545 static bool SignTaprootScript(const SigningProvider& provider, const BaseSignatureCreator& creator, SignatureData& sigdata, int leaf_version, std::span<const unsigned char> script_bytes, std::vector<valtype>& result)
546 {
547 // Only BIP342 tapscript signing is supported for now.
548 if (leaf_version != TAPROOT_LEAF_TAPSCRIPT) return false;
549
550 uint256 leaf_hash = ComputeTapleafHash(leaf_version, script_bytes);
551 CScript script = CScript(script_bytes.begin(), script_bytes.end());
552
553 TapSatisfier ms_satisfier{provider, sigdata, creator, script, leaf_hash};
554 const auto ms = miniscript::FromScript(script, ms_satisfier);
555 return ms && ms->Satisfy(ms_satisfier, result) == miniscript::Availability::YES;
556 }
557
558 static bool SignTaproot(const SigningProvider& provider, const BaseSignatureCreator& creator, const WitnessV1Taproot& output, SignatureData& sigdata, std::vector<valtype>& result)
559 {
560 TaprootSpendData spenddata;
561 TaprootBuilder builder;
562
563 // Gather information about this output.
564 if (provider.GetTaprootSpendData(output, spenddata)) {
565 sigdata.tr_spenddata.Merge(spenddata);
566 }
567 if (provider.GetTaprootBuilder(output, builder)) {
568 sigdata.tr_builder = builder;
569 }
570 if (auto agg_keys = provider.GetAllMuSig2ParticipantPubkeys(); !agg_keys.empty()) {
571 sigdata.musig2_pubkeys.insert(agg_keys.begin(), agg_keys.end());
572 }
573
574
575 // Try key path spending.
576 {
577 KeyOriginInfo internal_key_info;
578 if (provider.GetKeyOriginByXOnly(sigdata.tr_spenddata.internal_key, internal_key_info)) {
579 auto it = sigdata.taproot_misc_pubkeys.find(sigdata.tr_spenddata.internal_key);
580 if (it == sigdata.taproot_misc_pubkeys.end()) {
581 sigdata.taproot_misc_pubkeys.emplace(sigdata.tr_spenddata.internal_key, std::make_pair(std::set<uint256>(), internal_key_info));
582 }
583 }
584
585 KeyOriginInfo output_key_info;
586 if (provider.GetKeyOriginByXOnly(output, output_key_info)) {
587 auto it = sigdata.taproot_misc_pubkeys.find(output);
588 if (it == sigdata.taproot_misc_pubkeys.end()) {
589 sigdata.taproot_misc_pubkeys.emplace(output, std::make_pair(std::set<uint256>(), output_key_info));
590 }
591 }
592
593 auto make_keypath_sig = [&](const XOnlyPubKey& pk, const uint256* merkle_root) {
594 std::vector<unsigned char> sig;
595 if (creator.CreateSchnorrSig(provider, sig, pk, nullptr, merkle_root, SigVersion::TAPROOT)) {
596 sigdata.taproot_key_path_sig = sig;
597 } else {
598 SignMuSig2(creator, sigdata, provider, sig, pk, merkle_root, /*leaf_hash=*/nullptr, SigVersion::TAPROOT);
599 }
600 };
601
602 // First try signing with internal key
603 if (sigdata.taproot_key_path_sig.size() == 0) {
604 make_keypath_sig(sigdata.tr_spenddata.internal_key, &sigdata.tr_spenddata.merkle_root);
605 }
606 // Try signing with output key if still no signature
607 if (sigdata.taproot_key_path_sig.size() == 0) {
608 make_keypath_sig(output, nullptr);
609 }
610 if (sigdata.taproot_key_path_sig.size()) {
611 result = Vector(sigdata.taproot_key_path_sig);
612 return true;
613 }
614 }
615
616 // Try script path spending.
617 std::vector<std::vector<unsigned char>> smallest_result_stack;
618 for (const auto& [key, control_blocks] : sigdata.tr_spenddata.scripts) {
619 const auto& [script, leaf_ver] = key;
620 std::vector<std::vector<unsigned char>> result_stack;
621 if (SignTaprootScript(provider, creator, sigdata, leaf_ver, script, result_stack)) {
622 result_stack.emplace_back(std::begin(script), std::end(script)); // Push the script
623 result_stack.push_back(*control_blocks.begin()); // Push the smallest control block
624 if (smallest_result_stack.size() == 0 ||
625 GetSerializeSize(result_stack) < GetSerializeSize(smallest_result_stack)) {
626 smallest_result_stack = std::move(result_stack);
627 }
628 }
629 }
630 if (smallest_result_stack.size() != 0) {
631 result = std::move(smallest_result_stack);
632 return true;
633 }
634
635 return false;
636 }
637
638 /**
639 * Sign scriptPubKey using signature made with creator.
640 * Signatures are returned in scriptSigRet (or returns false if scriptPubKey can't be signed),
641 * unless whichTypeRet is TxoutType::SCRIPTHASH, in which case scriptSigRet is the redemption script.
642 * Returns false if scriptPubKey could not be completely satisfied.
643 */
644 static bool SignStep(const SigningProvider& provider, const BaseSignatureCreator& creator, const CScript& scriptPubKey,
645 std::vector<valtype>& ret, TxoutType& whichTypeRet, SigVersion sigversion, SignatureData& sigdata)
646 {
647 CScript scriptRet;
648 ret.clear();
649 std::vector<unsigned char> sig;
650
651 std::vector<valtype> vSolutions;
652 whichTypeRet = Solver(scriptPubKey, vSolutions);
653
654 switch (whichTypeRet) {
655 case TxoutType::NONSTANDARD:
656 case TxoutType::NULL_DATA:
657 case TxoutType::WITNESS_UNKNOWN:
658 return false;
659 case TxoutType::PUBKEY:
660 if (!CreateSig(creator, sigdata, provider, sig, CPubKey(vSolutions[0]), scriptPubKey, sigversion)) return false;
661 ret.push_back(std::move(sig));
662 return true;
663 case TxoutType::PUBKEYHASH: {
664 CKeyID keyID = CKeyID(uint160(vSolutions[0]));
665 CPubKey pubkey;
666 if (!GetPubKey(provider, sigdata, keyID, pubkey)) {
667 // Pubkey could not be found, add to missing
668 sigdata.missing_pubkeys.push_back(keyID);
669 return false;
670 }
671 if (!CreateSig(creator, sigdata, provider, sig, pubkey, scriptPubKey, sigversion)) return false;
672 ret.push_back(std::move(sig));
673 ret.push_back(ToByteVector(pubkey));
674 return true;
675 }
676 case TxoutType::SCRIPTHASH: {
677 uint160 h160{vSolutions[0]};
678 if (GetCScript(provider, sigdata, CScriptID{h160}, scriptRet)) {
679 ret.emplace_back(scriptRet.begin(), scriptRet.end());
680 return true;
681 }
682 // Could not find redeemScript, add to missing
683 sigdata.missing_redeem_script = h160;
684 return false;
685 }
686 case TxoutType::MULTISIG: {
687 size_t required = vSolutions.front()[0];
688 ret.emplace_back(); // workaround CHECKMULTISIG bug
689 for (size_t i = 1; i < vSolutions.size() - 1; ++i) {
690 CPubKey pubkey = CPubKey(vSolutions[i]);
691 // We need to always call CreateSig in order to fill sigdata with all
692 // possible signatures that we can create. This will allow further PSBT
693 // processing to work as it needs all possible signature and pubkey pairs
694 if (CreateSig(creator, sigdata, provider, sig, pubkey, scriptPubKey, sigversion)) {
695 if (ret.size() < required + 1) {
696 ret.push_back(std::move(sig));
697 }
698 }
699 }
700 bool ok = ret.size() == required + 1;
701 for (size_t i = 0; i + ret.size() < required + 1; ++i) {
702 ret.emplace_back();
703 }
704 return ok;
705 }
706 case TxoutType::WITNESS_V0_KEYHASH:
707 ret.push_back(vSolutions[0]);
708 return true;
709
710 case TxoutType::WITNESS_V0_SCRIPTHASH:
711 if (GetCScript(provider, sigdata, CScriptID{RIPEMD160(vSolutions[0])}, scriptRet)) {
712 ret.emplace_back(scriptRet.begin(), scriptRet.end());
713 return true;
714 }
715 // Could not find witnessScript, add to missing
716 sigdata.missing_witness_script = uint256(vSolutions[0]);
717 return false;
718
719 case TxoutType::WITNESS_V1_TAPROOT:
720 return SignTaproot(provider, creator, WitnessV1Taproot(XOnlyPubKey{vSolutions[0]}), sigdata, ret);
721
722 case TxoutType::ANCHOR:
723 return true;
724 } // no default case, so the compiler can warn about missing cases
725 assert(false);
726 }
727
728 static CScript PushAll(const std::vector<valtype>& values)
729 {
730 CScript result;
731 for (const valtype& v : values) {
732 if (v.size() == 0) {
733 result << OP_0;
734 } else if (v.size() == 1 && v[0] >= 1 && v[0] <= 16) {
735 result << CScript::EncodeOP_N(v[0]);
736 } else if (v.size() == 1 && v[0] == 0x81) {
737 result << OP_1NEGATE;
738 } else {
739 result << v;
740 }
741 }
742 return result;
743 }
744
745 bool ProduceSignature(const SigningProvider& provider, const BaseSignatureCreator& creator, const CScript& fromPubKey, SignatureData& sigdata)
746 {
747 if (sigdata.complete) return true;
748
749 std::vector<valtype> result;
750 TxoutType whichType;
751 bool solved = SignStep(provider, creator, fromPubKey, result, whichType, SigVersion::BASE, sigdata);
752 bool P2SH = false;
753 CScript subscript;
754
755 if (solved && whichType == TxoutType::SCRIPTHASH)
756 {
757 // Solver returns the subscript that needs to be evaluated;
758 // the final scriptSig is the signatures from that
759 // and then the serialized subscript:
760 subscript = CScript(result[0].begin(), result[0].end());
761 sigdata.redeem_script = subscript;
762 solved = solved && SignStep(provider, creator, subscript, result, whichType, SigVersion::BASE, sigdata) && whichType != TxoutType::SCRIPTHASH;
763 P2SH = true;
764 }
765
766 if (solved && whichType == TxoutType::WITNESS_V0_KEYHASH)
767 {
768 CScript witnessscript;
769 witnessscript << OP_DUP << OP_HASH160 << ToByteVector(result[0]) << OP_EQUALVERIFY << OP_CHECKSIG;
770 TxoutType subType;
771 solved = solved && SignStep(provider, creator, witnessscript, result, subType, SigVersion::WITNESS_V0, sigdata);
772 sigdata.scriptWitness.stack = result;
773 sigdata.witness = true;
774 result.clear();
775 }
776 else if (solved && whichType == TxoutType::WITNESS_V0_SCRIPTHASH)
777 {
778 CScript witnessscript(result[0].begin(), result[0].end());
779 sigdata.witness_script = witnessscript;
780
781 TxoutType subType{TxoutType::NONSTANDARD};
782 solved = solved && SignStep(provider, creator, witnessscript, result, subType, SigVersion::WITNESS_V0, sigdata) && subType != TxoutType::SCRIPTHASH && subType != TxoutType::WITNESS_V0_SCRIPTHASH && subType != TxoutType::WITNESS_V0_KEYHASH;
783
784 // If we couldn't find a solution with the legacy satisfier, try satisfying the script using Miniscript.
785 // Note we need to check if the result stack is empty before, because it might be used even if the Script
786 // isn't fully solved. For instance the CHECKMULTISIG satisfaction in SignStep() pushes partial signatures
787 // and the extractor relies on this behaviour to combine witnesses.
788 if (!solved && result.empty()) {
789 WshSatisfier ms_satisfier{provider, sigdata, creator, witnessscript};
790 const auto ms = miniscript::FromScript(witnessscript, ms_satisfier);
791 solved = ms && ms->Satisfy(ms_satisfier, result) == miniscript::Availability::YES;
792 }
793 result.emplace_back(witnessscript.begin(), witnessscript.end());
794
795 sigdata.scriptWitness.stack = result;
796 sigdata.witness = true;
797 result.clear();
798 } else if (whichType == TxoutType::WITNESS_V1_TAPROOT && !P2SH) {
799 sigdata.witness = true;
800 if (solved) {
801 sigdata.scriptWitness.stack = std::move(result);
802 }
803 result.clear();
804 } else if (solved && whichType == TxoutType::WITNESS_UNKNOWN) {
805 sigdata.witness = true;
806 }
807
808 if (!sigdata.witness) sigdata.scriptWitness.stack.clear();
809 if (P2SH) {
810 result.emplace_back(subscript.begin(), subscript.end());
811 }
812 sigdata.scriptSig = PushAll(result);
813
814 // Test solution
815 sigdata.complete = solved && VerifyScript(sigdata.scriptSig, fromPubKey, &sigdata.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, creator.Checker());
816 return sigdata.complete;
817 }
818
819 namespace {
820 class SignatureExtractorChecker final : public DeferringSignatureChecker
821 {
822 private:
823 SignatureData& sigdata;
824
825 public:
826 SignatureExtractorChecker(SignatureData& sigdata, BaseSignatureChecker& checker) : DeferringSignatureChecker(checker), sigdata(sigdata) {}
827
828 bool CheckECDSASignature(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override
829 {
830 if (m_checker.CheckECDSASignature(scriptSig, vchPubKey, scriptCode, sigversion)) {
831 CPubKey pubkey(vchPubKey);
832 sigdata.signatures.emplace(pubkey.GetID(), SigPair(pubkey, scriptSig));
833 return true;
834 }
835 return false;
836 }
837 };
838
839 struct Stacks
840 {
841 std::vector<valtype> script;
842 std::vector<valtype> witness;
843
844 Stacks() = delete;
845 Stacks(const Stacks&) = delete;
846 explicit Stacks(const SignatureData& data) : witness(data.scriptWitness.stack) {
847 EvalScript(script, data.scriptSig, SCRIPT_VERIFY_STRICTENC, BaseSignatureChecker(), SigVersion::BASE);
848 }
849 };
850 }
851
852 // Extracts signatures and scripts from incomplete scriptSigs. Please do not extend this, use PSBT instead
853 SignatureData DataFromTransaction(const CMutableTransaction& tx, unsigned int nIn, const CTxOut& txout)
854 {
855 SignatureData data;
856 assert(tx.vin.size() > nIn);
857 data.scriptSig = tx.vin[nIn].scriptSig;
858 data.scriptWitness = tx.vin[nIn].scriptWitness;
859 Stacks stack(data);
860
861 // Get signatures
862 MutableTransactionSignatureChecker tx_checker(&tx, nIn, txout.nValue, MissingDataBehavior::FAIL);
863 SignatureExtractorChecker extractor_checker(data, tx_checker);
864 if (VerifyScript(data.scriptSig, txout.scriptPubKey, &data.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, extractor_checker)) {
865 data.complete = true;
866 return data;
867 }
868
869 // Get scripts
870 std::vector<std::vector<unsigned char>> solutions;
871 TxoutType script_type = Solver(txout.scriptPubKey, solutions);
872 SigVersion sigversion = SigVersion::BASE;
873 CScript next_script = txout.scriptPubKey;
874
875 if (script_type == TxoutType::SCRIPTHASH && !stack.script.empty() && !stack.script.back().empty()) {
876 // Get the redeemScript
877 CScript redeem_script(stack.script.back().begin(), stack.script.back().end());
878 data.redeem_script = redeem_script;
879 next_script = std::move(redeem_script);
880
881 // Get redeemScript type
882 script_type = Solver(next_script, solutions);
883 stack.script.pop_back();
884 }
885 if (script_type == TxoutType::WITNESS_V0_SCRIPTHASH && !stack.witness.empty() && !stack.witness.back().empty()) {
886 // Get the witnessScript
887 CScript witness_script(stack.witness.back().begin(), stack.witness.back().end());
888 data.witness_script = witness_script;
889 next_script = std::move(witness_script);
890
891 // Get witnessScript type
892 script_type = Solver(next_script, solutions);
893 stack.witness.pop_back();
894 stack.script = std::move(stack.witness);
895 stack.witness.clear();
896 sigversion = SigVersion::WITNESS_V0;
897 }
898 if (script_type == TxoutType::MULTISIG && !stack.script.empty()) {
899 // Build a map of pubkey -> signature by matching sigs to pubkeys:
900 assert(solutions.size() > 1);
901 unsigned int num_pubkeys = solutions.size()-2;
902 unsigned int last_success_key = 0;
903 for (const valtype& sig : stack.script) {
904 for (unsigned int i = last_success_key; i < num_pubkeys; ++i) {
905 const valtype& pubkey = solutions[i+1];
906 // We either have a signature for this pubkey, or we have found a signature and it is valid
907 if (data.signatures.contains(CPubKey(pubkey).GetID()) || extractor_checker.CheckECDSASignature(sig, pubkey, next_script, sigversion)) {
908 last_success_key = i + 1;
909 break;
910 }
911 }
912 }
913 }
914
915 return data;
916 }
917
918 void UpdateInput(CTxIn& input, const SignatureData& data)
919 {
920 input.scriptSig = data.scriptSig;
921 input.scriptWitness = data.scriptWitness;
922 }
923
924 void SignatureData::MergeSignatureData(SignatureData sigdata)
925 {
926 if (complete) return;
927 if (sigdata.complete) {
928 *this = std::move(sigdata);
929 return;
930 }
931 if (redeem_script.empty() && !sigdata.redeem_script.empty()) {
932 redeem_script = sigdata.redeem_script;
933 }
934 if (witness_script.empty() && !sigdata.witness_script.empty()) {
935 witness_script = sigdata.witness_script;
936 }
937 signatures.insert(std::make_move_iterator(sigdata.signatures.begin()), std::make_move_iterator(sigdata.signatures.end()));
938 }
939
940 namespace {
941 /** Dummy signature checker which accepts all signatures. */
942 class DummySignatureChecker final : public BaseSignatureChecker
943 {
944 public:
945 DummySignatureChecker() = default;
946 bool CheckECDSASignature(const std::vector<unsigned char>& sig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override { return sig.size() != 0; }
947 bool CheckSchnorrSignature(std::span<const unsigned char> sig, std::span<const unsigned char> pubkey, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror) const override { return sig.size() != 0; }
948 bool CheckLockTime(const CScriptNum& nLockTime) const override { return true; }
949 bool CheckSequence(const CScriptNum& nSequence) const override { return true; }
950 };
951 }
952
953 const BaseSignatureChecker& DUMMY_CHECKER = DummySignatureChecker();
954
955 namespace {
956 class DummySignatureCreator final : public BaseSignatureCreator {
957 private:
958 char m_r_len = 32;
959 char m_s_len = 32;
960 public:
961 DummySignatureCreator(char r_len, char s_len) : m_r_len(r_len), m_s_len(s_len) {}
962 const BaseSignatureChecker& Checker() const override { return DUMMY_CHECKER; }
963 bool CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& keyid, const CScript& scriptCode, SigVersion sigversion) const override
964 {
965 // Create a dummy signature that is a valid DER-encoding
966 vchSig.assign(m_r_len + m_s_len + 7, '\000');
967 vchSig[0] = 0x30;
968 vchSig[1] = m_r_len + m_s_len + 4;
969 vchSig[2] = 0x02;
970 vchSig[3] = m_r_len;
971 vchSig[4] = 0x01;
972 vchSig[4 + m_r_len] = 0x02;
973 vchSig[5 + m_r_len] = m_s_len;
974 vchSig[6 + m_r_len] = 0x01;
975 vchSig[6 + m_r_len + m_s_len] = SIGHASH_ALL;
976 return true;
977 }
978 bool CreateSchnorrSig(const SigningProvider& provider, std::vector<unsigned char>& sig, const XOnlyPubKey& pubkey, const uint256* leaf_hash, const uint256* tweak, SigVersion sigversion) const override
979 {
980 sig.assign(64, '\000');
981 return true;
982 }
983 std::vector<uint8_t> CreateMuSig2Nonce(const SigningProvider& provider, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion, const SignatureData& sigdata) const override
984 {
985 std::vector<uint8_t> out;
986 out.assign(MUSIG2_PUBNONCE_SIZE, '\000');
987 return out;
988 }
989 bool CreateMuSig2PartialSig(const SigningProvider& provider, uint256& partial_sig, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const CPubKey& part_pubkey, const uint256* leaf_hash, const std::vector<std::pair<uint256, bool>>& tweaks, SigVersion sigversion, const SignatureData& sigdata) const override
990 {
991 partial_sig = uint256::ONE;
992 return true;
993 }
994 bool CreateMuSig2AggregateSig(const std::vector<CPubKey>& participants, std::vector<uint8_t>& sig, const CPubKey& aggregate_pubkey, const CPubKey& script_pubkey, const uint256* leaf_hash, const std::vector<std::pair<uint256, bool>>& tweaks, SigVersion sigversion, const SignatureData& sigdata) const override
995 {
996 sig.assign(64, '\000');
997 return true;
998 }
999 };
1000
1001 }
1002
1003 const BaseSignatureCreator& DUMMY_SIGNATURE_CREATOR = DummySignatureCreator(32, 32);
1004 const BaseSignatureCreator& DUMMY_MAXIMUM_SIGNATURE_CREATOR = DummySignatureCreator(33, 32);
1005
1006 bool IsSegWitOutput(const SigningProvider& provider, const CScript& script)
1007 {
1008 int version;
1009 valtype program;
1010 if (script.IsWitnessProgram(version, program)) return true;
1011 if (script.IsPayToScriptHash()) {
1012 std::vector<valtype> solutions;
1013 auto whichtype = Solver(script, solutions);
1014 if (whichtype == TxoutType::SCRIPTHASH) {
1015 auto h160 = uint160(solutions[0]);
1016 CScript subscript;
1017 if (provider.GetCScript(CScriptID{h160}, subscript)) {
1018 if (subscript.IsWitnessProgram(version, program)) return true;
1019 }
1020 }
1021 }
1022 return false;
1023 }
1024
1025 bool SignTransaction(CMutableTransaction& mtx, const SigningProvider* keystore, const std::map<COutPoint, Coin>& coins, const SignOptions& options, std::map<int, bilingual_str>& input_errors)
1026 {
1027 bool fHashSingle = ((options.sighash_type & ~SIGHASH_ANYONECANPAY) == SIGHASH_SINGLE);
1028
1029 // Use CTransaction for the constant parts of the
1030 // transaction to avoid rehashing.
1031 const CTransaction txConst(mtx);
1032
1033 PrecomputedTransactionData txdata;
1034 std::vector<CTxOut> spent_outputs;
1035 for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
1036 CTxIn& txin = mtx.vin[i];
1037 auto coin = coins.find(txin.prevout);
1038 if (coin == coins.end() || coin->second.IsSpent()) {
1039 txdata.Init(txConst, /*spent_outputs=*/{}, /*force=*/true);
1040 break;
1041 } else {
1042 spent_outputs.emplace_back(coin->second.out.nValue, coin->second.out.scriptPubKey);
1043 }
1044 }
1045 if (spent_outputs.size() == mtx.vin.size()) {
1046 txdata.Init(txConst, std::move(spent_outputs), true);
1047 }
1048
1049 // Sign what we can:
1050 for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
1051 CTxIn& txin = mtx.vin[i];
1052 auto coin = coins.find(txin.prevout);
1053 if (coin == coins.end() || coin->second.IsSpent()) {
1054 input_errors[i] = _("Input not found or already spent");
1055 continue;
1056 }
1057 const CScript& prevPubKey = coin->second.out.scriptPubKey;
1058 const CAmount& amount = coin->second.out.nValue;
1059
1060 SignatureData sigdata = DataFromTransaction(mtx, i, coin->second.out);
1061 // Only sign SIGHASH_SINGLE if there's a corresponding output:
1062 if (!fHashSingle || (i < mtx.vout.size())) {
1063 ProduceSignature(*keystore, MutableTransactionSignatureCreator(mtx, i, amount, &txdata, options), prevPubKey, sigdata);
1064 }
1065
1066 UpdateInput(txin, sigdata);
1067
1068 // amount must be specified for valid segwit signature
1069 if (amount == MAX_MONEY && !txin.scriptWitness.IsNull()) {
1070 input_errors[i] = _("Missing amount");
1071 continue;
1072 }
1073
1074 ScriptError serror = SCRIPT_ERR_OK;
1075 if (!sigdata.complete && !VerifyScript(txin.scriptSig, prevPubKey, &txin.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, TransactionSignatureChecker(&txConst, i, amount, txdata, MissingDataBehavior::FAIL), &serror)) {
1076 if (serror == SCRIPT_ERR_INVALID_STACK_OPERATION) {
1077 // Unable to sign input and verification failed (possible attempt to partially sign).
1078 input_errors[i] = Untranslated("Unable to sign input, invalid stack size (possibly missing key)");
1079 } else if (serror == SCRIPT_ERR_SIG_NULLFAIL) {
1080 // Verification failed (possibly due to insufficient signatures).
1081 input_errors[i] = Untranslated("CHECK(MULTI)SIG failing with non-zero signature (possibly need more signatures)");
1082 } else {
1083 input_errors[i] = Untranslated(ScriptErrorString(serror));
1084 }
1085 } else {
1086 // If this input succeeds, make sure there is no error set for it
1087 input_errors.erase(i);
1088 }
1089 }
1090 return input_errors.empty();
1091 }
1092