sign.cpp raw
1 // Copyright (c) 2009-2010 Satoshi Nakamoto
2 // Copyright (c) 2009-2022 The Limenka developers
3 // Distributed under the MIT software license, see the accompanying
4 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
5
6 #include <script/sign.h>
7
8 #include <consensus/amount.h>
9 #include <consensus/params.h>
10 #include <key.h>
11 #include <policy/policy.h>
12 #include <primitives/transaction.h>
13 #include <script/keyorigin.h>
14 #include <script/miniscript.h>
15 #include <script/script.h>
16 #include <script/signingprovider.h>
17 #include <script/solver.h>
18 #include <uint256.h>
19 #include <util/translation.h>
20 #include <util/vector.h>
21
22 #include <optional>
23
24 typedef std::vector<unsigned char> valtype;
25
26 MutableTransactionSignatureCreator::MutableTransactionSignatureCreator(const CMutableTransaction& tx, unsigned int input_idx, const CAmount& amount, int hash_type)
27 : m_txto{tx}, nIn{input_idx}, nHashType{hash_type}, amount{amount}, checker{&m_txto, nIn, amount, MissingDataBehavior::FAIL},
28 m_txdata(nullptr)
29 {
30 }
31
32 MutableTransactionSignatureCreator::MutableTransactionSignatureCreator(const CMutableTransaction& tx, unsigned int input_idx, const CAmount& amount, const PrecomputedTransactionData* txdata, int hash_type)
33 : m_txto{tx}, nIn{input_idx}, nHashType{hash_type}, amount{amount},
34 checker{txdata ? MutableTransactionSignatureChecker{&m_txto, nIn, amount, *txdata, MissingDataBehavior::FAIL} :
35 MutableTransactionSignatureChecker{&m_txto, nIn, amount, MissingDataBehavior::FAIL}},
36 m_txdata(txdata)
37 { }
38
39 bool MutableTransactionSignatureCreator::CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& address, const CScript& scriptCode, SigVersion sigversion) const
40 {
41 assert(sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0);
42
43 CKey key;
44 if (!provider.GetKey(address, key))
45 return false;
46
47 // Signing with uncompressed keys is disabled in witness scripts
48 if (sigversion == SigVersion::WITNESS_V0 && !key.IsCompressed())
49 return false;
50
51 // Signing without known amount does not work in witness scripts.
52 if (sigversion == SigVersion::WITNESS_V0 && !MoneyRange(amount)) return false;
53
54 // BASE/WITNESS_V0 signatures don't support explicit SIGHASH_DEFAULT, use SIGHASH_ALL instead.
55 const int hashtype = nHashType == SIGHASH_DEFAULT ? SIGHASH_ALL : nHashType;
56
57 uint256 hash = SignatureHash(scriptCode, m_txto, nIn, hashtype, amount, sigversion, m_txdata,
58 nullptr);
59 if (!key.Sign(hash, vchSig))
60 return false;
61 vchSig.push_back((unsigned char)hashtype);
62 return true;
63 }
64
65 bool MutableTransactionSignatureCreator::CreateSchnorrSig(const SigningProvider& provider, std::vector<unsigned char>& sig, const XOnlyPubKey& pubkey, const uint256* leaf_hash, const uint256* merkle_root, SigVersion sigversion) const
66 {
67 assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
68
69 CKey key;
70 if (!provider.GetKeyByXOnly(pubkey, key)) return false;
71
72 // BIP341/BIP342 signing needs lots of precomputed transaction data. While some
73 // (non-SIGHASH_DEFAULT) sighash modes exist that can work with just some subset
74 // of data present, for now, only support signing when everything is provided.
75 if (!m_txdata || !m_txdata->m_bip341_taproot_ready || !m_txdata->m_spent_outputs_ready) return false;
76
77 const int hashtype = nHashType;
78
79 ScriptExecutionData execdata;
80 execdata.m_annex_init = true;
81 execdata.m_annex_present = false; // Only support annex-less signing for now.
82 if (sigversion == SigVersion::TAPSCRIPT) {
83 execdata.m_codeseparator_pos_init = true;
84 execdata.m_codeseparator_pos = 0xFFFFFFFF; // Only support non-OP_CODESEPARATOR BIP342 signing for now.
85 if (!leaf_hash) return false; // BIP342 signing needs leaf hash.
86 execdata.m_tapleaf_hash_init = true;
87 execdata.m_tapleaf_hash = *leaf_hash;
88 }
89 uint256 hash;
90 if (!SignatureHashSchnorr(hash, execdata, m_txto, nIn, hashtype, sigversion, *m_txdata,
91 MissingDataBehavior::FAIL)) return false;
92 sig.resize(64);
93 // Use uint256{} as aux_rnd for now.
94 if (!key.SignSchnorr(hash, sig, merkle_root, {})) return false;
95 if (hashtype) sig.push_back(hashtype);
96 return true;
97 }
98
99 static bool GetCScript(const SigningProvider& provider, const SignatureData& sigdata, const CScriptID& scriptid, CScript& script)
100 {
101 if (provider.GetCScript(scriptid, script)) {
102 return true;
103 }
104 // Look for scripts in SignatureData
105 if (CScriptID(sigdata.redeem_script) == scriptid) {
106 script = sigdata.redeem_script;
107 return true;
108 } else if (CScriptID(sigdata.witness_script) == scriptid) {
109 script = sigdata.witness_script;
110 return true;
111 }
112 return false;
113 }
114
115 static bool GetPubKey(const SigningProvider& provider, const SignatureData& sigdata, const CKeyID& address, CPubKey& pubkey)
116 {
117 // Look for pubkey in all partial sigs
118 const auto it = sigdata.signatures.find(address);
119 if (it != sigdata.signatures.end()) {
120 pubkey = it->second.first;
121 return true;
122 }
123 // Look for pubkey in pubkey lists
124 const auto& pk_it = sigdata.misc_pubkeys.find(address);
125 if (pk_it != sigdata.misc_pubkeys.end()) {
126 pubkey = pk_it->second.first;
127 return true;
128 }
129 const auto& tap_pk_it = sigdata.tap_pubkeys.find(address);
130 if (tap_pk_it != sigdata.tap_pubkeys.end()) {
131 pubkey = tap_pk_it->second.GetEvenCorrespondingCPubKey();
132 return true;
133 }
134 // Query the underlying provider
135 return provider.GetPubKey(address, pubkey);
136 }
137
138 static bool CreateSig(const BaseSignatureCreator& creator, SignatureData& sigdata, const SigningProvider& provider, std::vector<unsigned char>& sig_out, const CPubKey& pubkey, const CScript& scriptcode, SigVersion sigversion)
139 {
140 CKeyID keyid = pubkey.GetID();
141 const auto it = sigdata.signatures.find(keyid);
142 if (it != sigdata.signatures.end()) {
143 sig_out = it->second.second;
144 return true;
145 }
146 KeyOriginInfo info;
147 if (provider.GetKeyOrigin(keyid, info)) {
148 sigdata.misc_pubkeys.emplace(keyid, std::make_pair(pubkey, std::move(info)));
149 }
150 if (creator.CreateSig(provider, sig_out, keyid, scriptcode, sigversion)) {
151 auto i = sigdata.signatures.emplace(keyid, SigPair(pubkey, sig_out));
152 assert(i.second);
153 return true;
154 }
155 // Could not make signature or signature not found, add keyid to missing
156 sigdata.missing_sigs.push_back(keyid);
157 return false;
158 }
159
160 static bool CreateTaprootScriptSig(const BaseSignatureCreator& creator, SignatureData& sigdata, const SigningProvider& provider, std::vector<unsigned char>& sig_out, const XOnlyPubKey& pubkey, const uint256& leaf_hash, SigVersion sigversion)
161 {
162 KeyOriginInfo info;
163 if (provider.GetKeyOriginByXOnly(pubkey, info)) {
164 auto it = sigdata.taproot_misc_pubkeys.find(pubkey);
165 if (it == sigdata.taproot_misc_pubkeys.end()) {
166 sigdata.taproot_misc_pubkeys.emplace(pubkey, std::make_pair(std::set<uint256>({leaf_hash}), info));
167 } else {
168 it->second.first.insert(leaf_hash);
169 }
170 }
171
172 auto lookup_key = std::make_pair(pubkey, leaf_hash);
173 auto it = sigdata.taproot_script_sigs.find(lookup_key);
174 if (it != sigdata.taproot_script_sigs.end()) {
175 sig_out = it->second;
176 return true;
177 }
178 if (creator.CreateSchnorrSig(provider, sig_out, pubkey, &leaf_hash, nullptr, sigversion)) {
179 sigdata.taproot_script_sigs[lookup_key] = sig_out;
180 return true;
181 }
182 return false;
183 }
184
185 template<typename M, typename K, typename V>
186 miniscript::Availability MsLookupHelper(const M& map, const K& key, V& value)
187 {
188 auto it = map.find(key);
189 if (it != map.end()) {
190 value = it->second;
191 return miniscript::Availability::YES;
192 }
193 return miniscript::Availability::NO;
194 }
195
196 /**
197 * Context for solving a Miniscript.
198 * If enough material (access to keys, hash preimages, ..) is given, produces a valid satisfaction.
199 */
200 template<typename Pk>
201 struct Satisfier {
202 using Key = Pk;
203
204 const SigningProvider& m_provider;
205 SignatureData& m_sig_data;
206 const BaseSignatureCreator& m_creator;
207 const CScript& m_witness_script;
208 //! The context of the script we are satisfying (either P2WSH or Tapscript).
209 const miniscript::MiniscriptContext m_script_ctx;
210
211 explicit Satisfier(const SigningProvider& provider LIFETIMEBOUND, SignatureData& sig_data LIFETIMEBOUND,
212 const BaseSignatureCreator& creator LIFETIMEBOUND,
213 const CScript& witscript LIFETIMEBOUND,
214 miniscript::MiniscriptContext script_ctx) : m_provider(provider),
215 m_sig_data(sig_data),
216 m_creator(creator),
217 m_witness_script(witscript),
218 m_script_ctx(script_ctx) {}
219
220 static bool KeyCompare(const Key& a, const Key& b) {
221 return a < b;
222 }
223
224 //! Get a CPubKey from a key hash. Note the key hash may be of an xonly pubkey.
225 template<typename I>
226 std::optional<CPubKey> CPubFromPKHBytes(I first, I last) const {
227 assert(last - first == 20);
228 CPubKey pubkey;
229 CKeyID key_id;
230 std::copy(first, last, key_id.begin());
231 if (GetPubKey(m_provider, m_sig_data, key_id, pubkey)) return pubkey;
232 m_sig_data.missing_pubkeys.push_back(key_id);
233 return {};
234 }
235
236 //! Conversion to raw public key.
237 std::vector<unsigned char> ToPKBytes(const Key& key) const { return {key.begin(), key.end()}; }
238
239 //! Time lock satisfactions.
240 bool CheckAfter(uint32_t value) const { return m_creator.Checker().CheckLockTime(CScriptNum(value)); }
241 bool CheckOlder(uint32_t value) const { return m_creator.Checker().CheckSequence(CScriptNum(value)); }
242
243 //! Hash preimage satisfactions.
244 miniscript::Availability SatSHA256(const std::vector<unsigned char>& hash, std::vector<unsigned char>& preimage) const {
245 return MsLookupHelper(m_sig_data.sha256_preimages, hash, preimage);
246 }
247 miniscript::Availability SatRIPEMD160(const std::vector<unsigned char>& hash, std::vector<unsigned char>& preimage) const {
248 return MsLookupHelper(m_sig_data.ripemd160_preimages, hash, preimage);
249 }
250 miniscript::Availability SatHASH256(const std::vector<unsigned char>& hash, std::vector<unsigned char>& preimage) const {
251 return MsLookupHelper(m_sig_data.hash256_preimages, hash, preimage);
252 }
253 miniscript::Availability SatHASH160(const std::vector<unsigned char>& hash, std::vector<unsigned char>& preimage) const {
254 return MsLookupHelper(m_sig_data.hash160_preimages, hash, preimage);
255 }
256
257 miniscript::MiniscriptContext MsContext() const {
258 return m_script_ctx;
259 }
260 };
261
262 /** Miniscript satisfier specific to P2WSH context. */
263 struct WshSatisfier: Satisfier<CPubKey> {
264 explicit WshSatisfier(const SigningProvider& provider LIFETIMEBOUND, SignatureData& sig_data LIFETIMEBOUND,
265 const BaseSignatureCreator& creator LIFETIMEBOUND, const CScript& witscript LIFETIMEBOUND)
266 : Satisfier(provider, sig_data, creator, witscript, miniscript::MiniscriptContext::P2WSH) {}
267
268 //! Conversion from a raw compressed public key.
269 template <typename I>
270 std::optional<CPubKey> FromPKBytes(I first, I last) const {
271 CPubKey pubkey{first, last};
272 if (pubkey.IsValid()) return pubkey;
273 return {};
274 }
275
276 //! Conversion from a raw compressed public key hash.
277 template<typename I>
278 std::optional<CPubKey> FromPKHBytes(I first, I last) const {
279 return Satisfier::CPubFromPKHBytes(first, last);
280 }
281
282 //! Satisfy an ECDSA signature check.
283 miniscript::Availability Sign(const CPubKey& key, std::vector<unsigned char>& sig) const {
284 if (CreateSig(m_creator, m_sig_data, m_provider, sig, key, m_witness_script, SigVersion::WITNESS_V0)) {
285 return miniscript::Availability::YES;
286 }
287 return miniscript::Availability::NO;
288 }
289 };
290
291 /** Miniscript satisfier specific to Tapscript context. */
292 struct TapSatisfier: Satisfier<XOnlyPubKey> {
293 const uint256& m_leaf_hash;
294
295 explicit TapSatisfier(const SigningProvider& provider LIFETIMEBOUND, SignatureData& sig_data LIFETIMEBOUND,
296 const BaseSignatureCreator& creator LIFETIMEBOUND, const CScript& script LIFETIMEBOUND,
297 const uint256& leaf_hash LIFETIMEBOUND)
298 : Satisfier(provider, sig_data, creator, script, miniscript::MiniscriptContext::TAPSCRIPT),
299 m_leaf_hash(leaf_hash) {}
300
301 //! Conversion from a raw xonly public key.
302 template <typename I>
303 std::optional<XOnlyPubKey> FromPKBytes(I first, I last) const {
304 if (last - first != 32) return {};
305 XOnlyPubKey pubkey;
306 std::copy(first, last, pubkey.begin());
307 return pubkey;
308 }
309
310 //! Conversion from a raw xonly public key hash.
311 template<typename I>
312 std::optional<XOnlyPubKey> FromPKHBytes(I first, I last) const {
313 if (auto pubkey = Satisfier::CPubFromPKHBytes(first, last)) return XOnlyPubKey{*pubkey};
314 return {};
315 }
316
317 //! Satisfy a BIP340 signature check.
318 miniscript::Availability Sign(const XOnlyPubKey& key, std::vector<unsigned char>& sig) const {
319 if (CreateTaprootScriptSig(m_creator, m_sig_data, m_provider, sig, key, m_leaf_hash, SigVersion::TAPSCRIPT)) {
320 return miniscript::Availability::YES;
321 }
322 return miniscript::Availability::NO;
323 }
324 };
325
326 static bool SignTaprootScript(const SigningProvider& provider, const BaseSignatureCreator& creator, SignatureData& sigdata, int leaf_version, Span<const unsigned char> script_bytes, std::vector<valtype>& result)
327 {
328 // Only BIP342 tapscript signing is supported for now.
329 if (leaf_version != TAPROOT_LEAF_TAPSCRIPT) return false;
330
331 uint256 leaf_hash = ComputeTapleafHash(leaf_version, script_bytes);
332 CScript script = CScript(script_bytes.begin(), script_bytes.end());
333
334 TapSatisfier ms_satisfier{provider, sigdata, creator, script, leaf_hash};
335 const auto ms = miniscript::FromScript(script, ms_satisfier);
336 return ms && ms->Satisfy(ms_satisfier, result) == miniscript::Availability::YES;
337 }
338
339 static bool SignTaproot(const SigningProvider& provider, const BaseSignatureCreator& creator, const WitnessV1Taproot& output, SignatureData& sigdata, std::vector<valtype>& result)
340 {
341 TaprootSpendData spenddata;
342 TaprootBuilder builder;
343
344 // Gather information about this output.
345 if (provider.GetTaprootSpendData(output, spenddata)) {
346 sigdata.tr_spenddata.Merge(spenddata);
347 }
348 if (provider.GetTaprootBuilder(output, builder)) {
349 sigdata.tr_builder = builder;
350 }
351
352 // Try key path spending.
353 {
354 KeyOriginInfo info;
355 if (provider.GetKeyOriginByXOnly(sigdata.tr_spenddata.internal_key, info)) {
356 auto it = sigdata.taproot_misc_pubkeys.find(sigdata.tr_spenddata.internal_key);
357 if (it == sigdata.taproot_misc_pubkeys.end()) {
358 sigdata.taproot_misc_pubkeys.emplace(sigdata.tr_spenddata.internal_key, std::make_pair(std::set<uint256>(), info));
359 }
360 }
361
362 std::vector<unsigned char> sig;
363 if (sigdata.taproot_key_path_sig.size() == 0) {
364 if (creator.CreateSchnorrSig(provider, sig, sigdata.tr_spenddata.internal_key, nullptr, &sigdata.tr_spenddata.merkle_root, SigVersion::TAPROOT)) {
365 sigdata.taproot_key_path_sig = sig;
366 }
367 }
368 if (sigdata.taproot_key_path_sig.size() == 0) {
369 if (creator.CreateSchnorrSig(provider, sig, output, nullptr, nullptr, SigVersion::TAPROOT)) {
370 sigdata.taproot_key_path_sig = sig;
371 }
372 }
373 if (sigdata.taproot_key_path_sig.size()) {
374 result = Vector(sigdata.taproot_key_path_sig);
375 return true;
376 }
377 }
378
379 // Try script path spending.
380 std::vector<std::vector<unsigned char>> smallest_result_stack;
381 for (const auto& [key, control_blocks] : sigdata.tr_spenddata.scripts) {
382 const auto& [script, leaf_ver] = key;
383 std::vector<std::vector<unsigned char>> result_stack;
384 if (SignTaprootScript(provider, creator, sigdata, leaf_ver, script, result_stack)) {
385 result_stack.emplace_back(std::begin(script), std::end(script)); // Push the script
386 result_stack.push_back(*control_blocks.begin()); // Push the smallest control block
387 if (smallest_result_stack.size() == 0 ||
388 GetSerializeSize(result_stack) < GetSerializeSize(smallest_result_stack)) {
389 smallest_result_stack = std::move(result_stack);
390 }
391 }
392 }
393 if (smallest_result_stack.size() != 0) {
394 result = std::move(smallest_result_stack);
395 return true;
396 }
397
398 return false;
399 }
400
401 /**
402 * Sign scriptPubKey using signature made with creator.
403 * Signatures are returned in scriptSigRet (or returns false if scriptPubKey can't be signed),
404 * unless whichTypeRet is TxoutType::SCRIPTHASH, in which case scriptSigRet is the redemption script.
405 * Returns false if scriptPubKey could not be completely satisfied.
406 */
407 static bool SignStep(const SigningProvider& provider, const BaseSignatureCreator& creator, const CScript& scriptPubKey,
408 std::vector<valtype>& ret, TxoutType& whichTypeRet, SigVersion sigversion, SignatureData& sigdata)
409 {
410 CScript scriptRet;
411 ret.clear();
412 std::vector<unsigned char> sig;
413
414 std::vector<valtype> vSolutions;
415 whichTypeRet = Solver(scriptPubKey, vSolutions);
416
417 switch (whichTypeRet) {
418 case TxoutType::NONSTANDARD:
419 case TxoutType::NULL_DATA:
420 case TxoutType::WITNESS_UNKNOWN:
421 return false;
422 case TxoutType::PUBKEY:
423 if (!CreateSig(creator, sigdata, provider, sig, CPubKey(vSolutions[0]), scriptPubKey, sigversion)) return false;
424 ret.push_back(std::move(sig));
425 return true;
426 case TxoutType::PUBKEYHASH: {
427 CKeyID keyID = CKeyID(uint160(vSolutions[0]));
428 CPubKey pubkey;
429 if (!GetPubKey(provider, sigdata, keyID, pubkey)) {
430 // Pubkey could not be found, add to missing
431 sigdata.missing_pubkeys.push_back(keyID);
432 return false;
433 }
434 if (!CreateSig(creator, sigdata, provider, sig, pubkey, scriptPubKey, sigversion)) return false;
435 ret.push_back(std::move(sig));
436 ret.push_back(ToByteVector(pubkey));
437 return true;
438 }
439 case TxoutType::SCRIPTHASH: {
440 uint160 h160{vSolutions[0]};
441 if (GetCScript(provider, sigdata, CScriptID{h160}, scriptRet)) {
442 ret.emplace_back(scriptRet.begin(), scriptRet.end());
443 return true;
444 }
445 // Could not find redeemScript, add to missing
446 sigdata.missing_redeem_script = h160;
447 return false;
448 }
449 case TxoutType::MULTISIG: {
450 size_t required = vSolutions.front()[0];
451 ret.emplace_back(); // workaround CHECKMULTISIG bug
452 for (size_t i = 1; i < vSolutions.size() - 1; ++i) {
453 CPubKey pubkey = CPubKey(vSolutions[i]);
454 // We need to always call CreateSig in order to fill sigdata with all
455 // possible signatures that we can create. This will allow further PSBT
456 // processing to work as it needs all possible signature and pubkey pairs
457 if (CreateSig(creator, sigdata, provider, sig, pubkey, scriptPubKey, sigversion)) {
458 if (ret.size() < required + 1) {
459 ret.push_back(std::move(sig));
460 }
461 }
462 }
463 bool ok = ret.size() == required + 1;
464 for (size_t i = 0; i + ret.size() < required + 1; ++i) {
465 ret.emplace_back();
466 }
467 return ok;
468 }
469 case TxoutType::WITNESS_V0_KEYHASH:
470 ret.push_back(vSolutions[0]);
471 return true;
472
473 case TxoutType::WITNESS_V0_SCRIPTHASH:
474 if (GetCScript(provider, sigdata, CScriptID{RIPEMD160(vSolutions[0])}, scriptRet)) {
475 ret.emplace_back(scriptRet.begin(), scriptRet.end());
476 return true;
477 }
478 // Could not find witnessScript, add to missing
479 sigdata.missing_witness_script = uint256(vSolutions[0]);
480 return false;
481
482 case TxoutType::WITNESS_V1_TAPROOT:
483 return SignTaproot(provider, creator, WitnessV1Taproot(XOnlyPubKey{vSolutions[0]}), sigdata, ret);
484
485 case TxoutType::WITNESS_V3_SPKHASH:
486 // P2SPKH: output is a key hash, not directly a pubkey.
487 // SignStep returns the hash value; ProduceSignature resolves the pubkey and signs.
488 ret.push_back(vSolutions[0]);
489 return true;
490
491 case TxoutType::ANCHOR:
492 return true;
493 } // no default case, so the compiler can warn about missing cases
494 assert(false);
495 }
496
497 static CScript PushAll(const std::vector<valtype>& values)
498 {
499 CScript result;
500 for (const valtype& v : values) {
501 if (v.size() == 0) {
502 result << OP_0;
503 } else if (v.size() == 1 && v[0] >= 1 && v[0] <= 16) {
504 result << CScript::EncodeOP_N(v[0]);
505 } else if (v.size() == 1 && v[0] == 0x81) {
506 result << OP_1NEGATE;
507 } else {
508 result << v;
509 }
510 }
511 return result;
512 }
513
514 bool ProduceSignature(const SigningProvider& provider, const BaseSignatureCreator& creator, const CScript& fromPubKey, SignatureData& sigdata)
515 {
516 if (sigdata.complete) return true;
517
518 std::vector<valtype> result;
519 TxoutType whichType;
520 bool solved = SignStep(provider, creator, fromPubKey, result, whichType, SigVersion::BASE, sigdata);
521 bool P2SH = false;
522 CScript subscript;
523
524 if (solved && whichType == TxoutType::SCRIPTHASH)
525 {
526 // Solver returns the subscript that needs to be evaluated;
527 // the final scriptSig is the signatures from that
528 // and then the serialized subscript:
529 subscript = CScript(result[0].begin(), result[0].end());
530 sigdata.redeem_script = subscript;
531 solved = solved && SignStep(provider, creator, subscript, result, whichType, SigVersion::BASE, sigdata) && whichType != TxoutType::SCRIPTHASH;
532 P2SH = true;
533 }
534
535 if (solved && whichType == TxoutType::WITNESS_V0_KEYHASH)
536 {
537 CScript witnessscript;
538 witnessscript << OP_DUP << OP_HASH160 << ToByteVector(result[0]) << OP_EQUALVERIFY << OP_CHECKSIG;
539 TxoutType subType;
540 solved = solved && SignStep(provider, creator, witnessscript, result, subType, SigVersion::WITNESS_V0, sigdata);
541 sigdata.scriptWitness.stack = result;
542 sigdata.witness = true;
543 result.clear();
544 }
545 else if (solved && whichType == TxoutType::WITNESS_V0_SCRIPTHASH)
546 {
547 CScript witnessscript(result[0].begin(), result[0].end());
548 sigdata.witness_script = witnessscript;
549
550 TxoutType subType{TxoutType::NONSTANDARD};
551 solved = solved && SignStep(provider, creator, witnessscript, result, subType, SigVersion::WITNESS_V0, sigdata) && subType != TxoutType::SCRIPTHASH && subType != TxoutType::WITNESS_V0_SCRIPTHASH && subType != TxoutType::WITNESS_V0_KEYHASH;
552
553 // If we couldn't find a solution with the legacy satisfier, try satisfying the script using Miniscript.
554 // Note we need to check if the result stack is empty before, because it might be used even if the Script
555 // isn't fully solved. For instance the CHECKMULTISIG satisfaction in SignStep() pushes partial signatures
556 // and the extractor relies on this behaviour to combine witnesses.
557 if (!solved && result.empty()) {
558 WshSatisfier ms_satisfier{provider, sigdata, creator, witnessscript};
559 const auto ms = miniscript::FromScript(witnessscript, ms_satisfier);
560 solved = ms && ms->Satisfy(ms_satisfier, result) == miniscript::Availability::YES;
561 }
562 result.emplace_back(witnessscript.begin(), witnessscript.end());
563
564 sigdata.scriptWitness.stack = result;
565 sigdata.witness = true;
566 result.clear();
567 } else if (whichType == TxoutType::WITNESS_V1_TAPROOT && !P2SH) {
568 sigdata.witness = true;
569 if (solved) {
570 sigdata.scriptWitness.stack = std::move(result);
571 }
572 result.clear();
573 } else if (solved && whichType == TxoutType::WITNESS_V3_SPKHASH && !P2SH) {
574 uint256 key_hash(result[0]);
575 XOnlyPubKey xpk;
576 if (provider.GetSpkPubKey(key_hash, xpk)) {
577 std::vector<unsigned char> sig;
578 if (creator.CreateSchnorrSig(provider, sig, xpk, nullptr, nullptr, SigVersion::TAPROOT)) {
579 result.clear();
580 result.push_back(std::move(sig));
581 result.push_back(std::vector<unsigned char>(xpk.begin(), xpk.end()));
582 sigdata.scriptWitness.stack = result;
583 sigdata.witness = true;
584 result.clear();
585 } else {
586 solved = false;
587 sigdata.witness = true;
588 }
589 } else {
590 solved = false;
591 sigdata.witness = true;
592 }
593 } else if (solved && whichType == TxoutType::WITNESS_UNKNOWN) {
594 sigdata.witness = true;
595 }
596
597 if (!sigdata.witness) sigdata.scriptWitness.stack.clear();
598 if (P2SH) {
599 result.emplace_back(subscript.begin(), subscript.end());
600 }
601 sigdata.scriptSig = PushAll(result);
602
603 // Test solution.
604 const unsigned int verify_flags = STANDARD_SCRIPT_VERIFY_FLAGS;
605 sigdata.complete = solved && VerifyScript(sigdata.scriptSig, fromPubKey, &sigdata.scriptWitness, verify_flags, creator.Checker());
606 return sigdata.complete;
607 }
608
609 namespace {
610 class SignatureExtractorChecker final : public DeferringSignatureChecker
611 {
612 private:
613 SignatureData& sigdata;
614
615 public:
616 SignatureExtractorChecker(SignatureData& sigdata, BaseSignatureChecker& checker) : DeferringSignatureChecker(checker), sigdata(sigdata) {}
617
618 bool CheckECDSASignature(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override
619 {
620 if (m_checker.CheckECDSASignature(scriptSig, vchPubKey, scriptCode, sigversion)) {
621 CPubKey pubkey(vchPubKey);
622 sigdata.signatures.emplace(pubkey.GetID(), SigPair(pubkey, scriptSig));
623 return true;
624 }
625 return false;
626 }
627 };
628
629 struct Stacks
630 {
631 std::vector<valtype> script;
632 std::vector<valtype> witness;
633
634 Stacks() = delete;
635 Stacks(const Stacks&) = delete;
636 explicit Stacks(const SignatureData& data) : witness(data.scriptWitness.stack) {
637 EvalScript(script, data.scriptSig, SCRIPT_VERIFY_STRICTENC, BaseSignatureChecker(), SigVersion::BASE);
638 }
639 };
640 }
641
642 // Extracts signatures and scripts from incomplete scriptSigs. Please do not extend this, use PSBT instead
643 SignatureData DataFromTransaction(const CMutableTransaction& tx, unsigned int nIn, const CTxOut& txout)
644 {
645 SignatureData data;
646 assert(tx.vin.size() > nIn);
647 data.scriptSig = tx.vin[nIn].scriptSig;
648 data.scriptWitness = tx.vin[nIn].scriptWitness;
649 Stacks stack(data);
650
651 // Get signatures
652 MutableTransactionSignatureChecker tx_checker(&tx, nIn, txout.nValue, MissingDataBehavior::FAIL);
653 SignatureExtractorChecker extractor_checker(data, tx_checker);
654 if (VerifyScript(data.scriptSig, txout.scriptPubKey, &data.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, extractor_checker)) {
655 data.complete = true;
656 return data;
657 }
658
659 // Get scripts
660 std::vector<std::vector<unsigned char>> solutions;
661 TxoutType script_type = Solver(txout.scriptPubKey, solutions);
662 SigVersion sigversion = SigVersion::BASE;
663 CScript next_script = txout.scriptPubKey;
664
665 if (script_type == TxoutType::SCRIPTHASH && !stack.script.empty() && !stack.script.back().empty()) {
666 // Get the redeemScript
667 CScript redeem_script(stack.script.back().begin(), stack.script.back().end());
668 data.redeem_script = redeem_script;
669 next_script = std::move(redeem_script);
670
671 // Get redeemScript type
672 script_type = Solver(next_script, solutions);
673 stack.script.pop_back();
674 }
675 if (script_type == TxoutType::WITNESS_V0_SCRIPTHASH && !stack.witness.empty() && !stack.witness.back().empty()) {
676 // Get the witnessScript
677 CScript witness_script(stack.witness.back().begin(), stack.witness.back().end());
678 data.witness_script = witness_script;
679 next_script = std::move(witness_script);
680
681 // Get witnessScript type
682 script_type = Solver(next_script, solutions);
683 stack.witness.pop_back();
684 stack.script = std::move(stack.witness);
685 stack.witness.clear();
686 sigversion = SigVersion::WITNESS_V0;
687 }
688 if (script_type == TxoutType::MULTISIG && !stack.script.empty()) {
689 // Build a map of pubkey -> signature by matching sigs to pubkeys:
690 assert(solutions.size() > 1);
691 unsigned int num_pubkeys = solutions.size()-2;
692 unsigned int last_success_key = 0;
693 for (const valtype& sig : stack.script) {
694 for (unsigned int i = last_success_key; i < num_pubkeys; ++i) {
695 const valtype& pubkey = solutions[i+1];
696 // We either have a signature for this pubkey, or we have found a signature and it is valid
697 if (data.signatures.count(CPubKey(pubkey).GetID()) || extractor_checker.CheckECDSASignature(sig, pubkey, next_script, sigversion)) {
698 last_success_key = i + 1;
699 break;
700 }
701 }
702 }
703 }
704
705 return data;
706 }
707
708 void UpdateInput(CTxIn& input, const SignatureData& data)
709 {
710 input.scriptSig = data.scriptSig;
711 input.scriptWitness = data.scriptWitness;
712 }
713
714 void SignatureData::MergeSignatureData(SignatureData sigdata)
715 {
716 if (complete) return;
717 if (sigdata.complete) {
718 *this = std::move(sigdata);
719 return;
720 }
721 if (redeem_script.empty() && !sigdata.redeem_script.empty()) {
722 redeem_script = sigdata.redeem_script;
723 }
724 if (witness_script.empty() && !sigdata.witness_script.empty()) {
725 witness_script = sigdata.witness_script;
726 }
727 signatures.insert(std::make_move_iterator(sigdata.signatures.begin()), std::make_move_iterator(sigdata.signatures.end()));
728 }
729
730 namespace {
731 /** Dummy signature checker which accepts all signatures. */
732 class DummySignatureChecker final : public BaseSignatureChecker
733 {
734 public:
735 DummySignatureChecker() = default;
736 bool CheckECDSASignature(const std::vector<unsigned char>& sig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override { return sig.size() != 0; }
737 bool CheckSchnorrSignature(Span<const unsigned char> sig, Span<const unsigned char> pubkey, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror) const override { return sig.size() != 0; }
738 bool CheckLockTime(const CScriptNum& nLockTime) const override { return true; }
739 bool CheckSequence(const CScriptNum& nSequence) const override { return true; }
740 };
741 }
742
743 const BaseSignatureChecker& DUMMY_CHECKER = DummySignatureChecker();
744
745 namespace {
746 class DummySignatureCreator final : public BaseSignatureCreator {
747 private:
748 char m_r_len = 32;
749 char m_s_len = 32;
750 public:
751 DummySignatureCreator(char r_len, char s_len) : m_r_len(r_len), m_s_len(s_len) {}
752 const BaseSignatureChecker& Checker() const override { return DUMMY_CHECKER; }
753 bool CreateSig(const SigningProvider& provider, std::vector<unsigned char>& vchSig, const CKeyID& keyid, const CScript& scriptCode, SigVersion sigversion) const override
754 {
755 // Create a dummy signature that is a valid DER-encoding
756 vchSig.assign(m_r_len + m_s_len + 7, '\000');
757 vchSig[0] = 0x30;
758 vchSig[1] = m_r_len + m_s_len + 4;
759 vchSig[2] = 0x02;
760 vchSig[3] = m_r_len;
761 vchSig[4] = 0x01;
762 vchSig[4 + m_r_len] = 0x02;
763 vchSig[5 + m_r_len] = m_s_len;
764 vchSig[6 + m_r_len] = 0x01;
765 vchSig[6 + m_r_len + m_s_len] = SIGHASH_ALL;
766 return true;
767 }
768 bool CreateSchnorrSig(const SigningProvider& provider, std::vector<unsigned char>& sig, const XOnlyPubKey& pubkey, const uint256* leaf_hash, const uint256* tweak, SigVersion sigversion) const override
769 {
770 sig.assign(64, '\000');
771 return true;
772 }
773 };
774
775 }
776
777 const BaseSignatureCreator& DUMMY_SIGNATURE_CREATOR = DummySignatureCreator(32, 32);
778 const BaseSignatureCreator& DUMMY_MAXIMUM_SIGNATURE_CREATOR = DummySignatureCreator(33, 32);
779
780 bool IsSegWitOutput(const SigningProvider& provider, const CScript& script)
781 {
782 int version;
783 valtype program;
784 if (script.IsWitnessProgram(version, program)) return true;
785 if (script.IsPayToScriptHash()) {
786 std::vector<valtype> solutions;
787 auto whichtype = Solver(script, solutions);
788 if (whichtype == TxoutType::SCRIPTHASH) {
789 auto h160 = uint160(solutions[0]);
790 CScript subscript;
791 if (provider.GetCScript(CScriptID{h160}, subscript)) {
792 if (subscript.IsWitnessProgram(version, program)) return true;
793 }
794 }
795 }
796 return false;
797 }
798
799 bool SignTransaction(CMutableTransaction& mtx, const SigningProvider* keystore, const std::map<COutPoint, Coin>& coins, int nHashType, std::map<int, bilingual_str>& input_errors, std::optional<CAmount>* inputs_amount_sum)
800 {
801 bool fHashSingle = ((nHashType & ~SIGHASH_ANYONECANPAY) == SIGHASH_SINGLE);
802
803 // Use CTransaction for the constant parts of the
804 // transaction to avoid rehashing.
805 const CTransaction txConst(mtx);
806
807 PrecomputedTransactionData txdata;
808 std::vector<CTxOut> spent_outputs;
809 for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
810 CTxIn& txin = mtx.vin[i];
811 auto coin = coins.find(txin.prevout);
812 if (coin == coins.end() || coin->second.IsSpent()) {
813 txdata.Init(txConst, /*spent_outputs=*/{}, /*force=*/true);
814 break;
815 } else {
816 spent_outputs.emplace_back(coin->second.out.nValue, coin->second.out.scriptPubKey);
817 }
818 }
819 if (spent_outputs.size() == mtx.vin.size()) {
820 txdata.Init(txConst, std::move(spent_outputs), true);
821 }
822
823 // Sign what we can:
824 if (inputs_amount_sum) *inputs_amount_sum = 0;
825 for (unsigned int i = 0; i < mtx.vin.size(); ++i) {
826 CTxIn& txin = mtx.vin[i];
827 auto coin = coins.find(txin.prevout);
828 if (coin == coins.end() || coin->second.IsSpent()) {
829 if (inputs_amount_sum) {
830 inputs_amount_sum->reset();
831 inputs_amount_sum = nullptr;
832 }
833 input_errors[i] = _("Input not found or already spent");
834 continue;
835 }
836 const CScript& prevPubKey = coin->second.out.scriptPubKey;
837 const CAmount& amount = coin->second.out.nValue;
838 if (inputs_amount_sum && *inputs_amount_sum) {
839 if (amount > 0) {
840 **inputs_amount_sum += amount;
841 } else {
842 inputs_amount_sum->reset();
843 inputs_amount_sum = nullptr;
844 }
845 }
846
847 SignatureData sigdata = DataFromTransaction(mtx, i, coin->second.out);
848 // Only sign SIGHASH_SINGLE if there's a corresponding output:
849 if (!fHashSingle || (i < mtx.vout.size())) {
850 ProduceSignature(*keystore, MutableTransactionSignatureCreator(mtx, i, amount, &txdata, nHashType), prevPubKey, sigdata);
851 if ((!sigdata.witness) && inputs_amount_sum && *inputs_amount_sum) {
852 inputs_amount_sum->reset();
853 inputs_amount_sum = nullptr;
854 }
855 }
856
857 UpdateInput(txin, sigdata);
858
859 // amount must be specified for valid segwit signature
860 if (amount == MAX_MONEY && !txin.scriptWitness.IsNull()) {
861 input_errors[i] = _("Missing amount");
862 continue;
863 }
864
865 ScriptError serror = SCRIPT_ERR_OK;
866 if (!sigdata.complete && !VerifyScript(txin.scriptSig, prevPubKey, &txin.scriptWitness, STANDARD_SCRIPT_VERIFY_FLAGS, TransactionSignatureChecker(&txConst, i, amount, txdata, MissingDataBehavior::FAIL), &serror)) {
867 if (serror == SCRIPT_ERR_INVALID_STACK_OPERATION) {
868 // Unable to sign input and verification failed (possible attempt to partially sign).
869 input_errors[i] = Untranslated("Unable to sign input, invalid stack size (possibly missing key)");
870 } else if (serror == SCRIPT_ERR_SIG_NULLFAIL) {
871 // Verification failed (possibly due to insufficient signatures).
872 input_errors[i] = Untranslated("CHECK(MULTI)SIG failing with non-zero signature (possibly need more signatures)");
873 } else {
874 input_errors[i] = Untranslated(ScriptErrorString(serror));
875 }
876 } else {
877 // If this input succeeds, make sure there is no error set for it
878 input_errors.erase(i);
879 }
880 }
881 return input_errors.empty();
882 }
883