Bitcoin Core  21.99.0
P2P Digital Currency
interpreter.h
Go to the documentation of this file.
1 // Copyright (c) 2009-2010 Satoshi Nakamoto
2 // Copyright (c) 2009-2020 The Bitcoin Core developers
3 // Distributed under the MIT software license, see the accompanying
4 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
5 
6 #ifndef BITCOIN_SCRIPT_INTERPRETER_H
7 #define BITCOIN_SCRIPT_INTERPRETER_H
8 
9 #include <script/script_error.h>
10 #include <span.h>
11 #include <primitives/transaction.h>
12 
13 #include <vector>
14 #include <stdint.h>
15 
16 class CPubKey;
17 class XOnlyPubKey;
18 class CScript;
19 class CTransaction;
20 class CTxOut;
21 class uint256;
22 
24 enum
25 {
30 
34 };
35 
41 enum
42 {
44 
45  // Evaluate P2SH subscripts (BIP16).
46  SCRIPT_VERIFY_P2SH = (1U << 0),
47 
48  // Passing a non-strict-DER signature or one with undefined hashtype to a checksig operation causes script failure.
49  // Evaluating a pubkey that is not (0x04 + 64 bytes) or (0x02 or 0x03 + 32 bytes) by checksig causes script failure.
50  // (not used or intended as a consensus rule).
52 
53  // Passing a non-strict-DER signature to a checksig operation causes script failure (BIP62 rule 1)
54  SCRIPT_VERIFY_DERSIG = (1U << 2),
55 
56  // Passing a non-strict-DER signature or one with S > order/2 to a checksig operation causes script failure
57  // (BIP62 rule 5).
58  SCRIPT_VERIFY_LOW_S = (1U << 3),
59 
60  // verify dummy stack item consumed by CHECKMULTISIG is of zero-length (BIP62 rule 7).
62 
63  // Using a non-push operator in the scriptSig causes script failure (BIP62 rule 2).
65 
66  // Require minimal encodings for all push operations (OP_0... OP_16, OP_1NEGATE where possible, direct
67  // pushes up to 75 bytes, OP_PUSHDATA up to 255 bytes, OP_PUSHDATA2 for anything larger). Evaluating
68  // any other push causes the script to fail (BIP62 rule 3).
69  // In addition, whenever a stack element is interpreted as a number, it must be of minimal length (BIP62 rule 4).
71 
72  // Discourage use of NOPs reserved for upgrades (NOP1-10)
73  //
74  // Provided so that nodes can avoid accepting or mining transactions
75  // containing executed NOP's whose meaning may change after a soft-fork,
76  // thus rendering the script invalid; with this flag set executing
77  // discouraged NOPs fails the script. This verification flag will never be
78  // a mandatory flag applied to scripts in a block. NOPs that are not
79  // executed, e.g. within an unexecuted IF ENDIF block, are *not* rejected.
80  // NOPs that have associated forks to give them new meaning (CLTV, CSV)
81  // are not subject to this rule.
83 
84  // Require that only a single stack element remains after evaluation. This changes the success criterion from
85  // "At least one stack element must remain, and when interpreted as a boolean, it must be true" to
86  // "Exactly one stack element must remain, and when interpreted as a boolean, it must be true".
87  // (BIP62 rule 6)
88  // Note: CLEANSTACK should never be used without P2SH or WITNESS.
89  // Note: WITNESS_V0 and TAPSCRIPT script execution have behavior similar to CLEANSTACK as part of their
90  // consensus rules. It is automatic there and does not need this flag.
92 
93  // Verify CHECKLOCKTIMEVERIFY
94  //
95  // See BIP65 for details.
97 
98  // support CHECKSEQUENCEVERIFY opcode
99  //
100  // See BIP112 for details
102 
103  // Support segregated witness
104  //
105  SCRIPT_VERIFY_WITNESS = (1U << 11),
106 
107  // Making v1-v16 witness program non-standard
108  //
110 
111  // Segwit script only: Require the argument of OP_IF/NOTIF to be exactly 0x01 or empty vector
112  //
113  // Note: TAPSCRIPT script execution has behavior similar to MINIMALIF as part of its consensus
114  // rules. It is automatic there and does not depend on this flag.
116 
117  // Signature(s) must be empty vector if a CHECK(MULTI)SIG operation failed
118  //
120 
121  // Public keys in segregated witness scripts must be compressed
122  //
124 
125  // Making OP_CODESEPARATOR and FindAndDelete fail any non-segwit scripts
126  //
128 
129  // Taproot/Tapscript validation (BIPs 341 & 342)
130  //
131  SCRIPT_VERIFY_TAPROOT = (1U << 17),
132 
133  // Making unknown Taproot leaf versions non-standard
134  //
136 
137  // Making unknown OP_SUCCESS non-standard
139 
140  // Making unknown public key versions (in BIP 342 scripts) non-standard
142 };
143 
144 bool CheckSignatureEncoding(const std::vector<unsigned char> &vchSig, unsigned int flags, ScriptError* serror);
145 
147 {
148  // BIP341 precomputed data.
149  // These are single-SHA256, see https://github.com/bitcoin/bips/blob/master/bip-0341.mediawiki#cite_note-15.
157 
158  // BIP143 precomputed data (double-SHA256).
161  bool m_bip143_segwit_ready = false;
162 
163  std::vector<CTxOut> m_spent_outputs;
165  bool m_spent_outputs_ready = false;
166 
167  PrecomputedTransactionData() = default;
168 
169  template <class T>
170  void Init(const T& tx, std::vector<CTxOut>&& spent_outputs);
171 
172  template <class T>
173  explicit PrecomputedTransactionData(const T& tx);
174 };
175 
176 enum class SigVersion
177 {
178  BASE = 0,
179  WITNESS_V0 = 1,
180  TAPROOT = 2,
181  TAPSCRIPT = 3,
182 };
183 
185 {
187  bool m_tapleaf_hash_init = false;
190 
192  bool m_codeseparator_pos_init = false;
195 
197  bool m_annex_init = false;
202 
204  bool m_validation_weight_left_init = false;
207 };
208 
210 static constexpr size_t WITNESS_V0_SCRIPTHASH_SIZE = 32;
211 static constexpr size_t WITNESS_V0_KEYHASH_SIZE = 20;
212 static constexpr size_t WITNESS_V1_TAPROOT_SIZE = 32;
213 
214 static constexpr uint8_t TAPROOT_LEAF_MASK = 0xfe;
215 static constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT = 0xc0;
216 static constexpr size_t TAPROOT_CONTROL_BASE_SIZE = 33;
217 static constexpr size_t TAPROOT_CONTROL_NODE_SIZE = 32;
218 static constexpr size_t TAPROOT_CONTROL_MAX_NODE_COUNT = 128;
219 static constexpr size_t TAPROOT_CONTROL_MAX_SIZE = TAPROOT_CONTROL_BASE_SIZE + TAPROOT_CONTROL_NODE_SIZE * TAPROOT_CONTROL_MAX_NODE_COUNT;
220 
221 template <class T>
222 uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache = nullptr);
223 
225 {
226 public:
227  virtual bool CheckECDSASignature(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const
228  {
229  return false;
230  }
231 
232  virtual bool CheckSchnorrSignature(Span<const unsigned char> sig, Span<const unsigned char> pubkey, SigVersion sigversion, const ScriptExecutionData& execdata, ScriptError* serror = nullptr) const
233  {
234  return false;
235  }
236 
237  virtual bool CheckLockTime(const CScriptNum& nLockTime) const
238  {
239  return false;
240  }
241 
242  virtual bool CheckSequence(const CScriptNum& nSequence) const
243  {
244  return false;
245  }
246 
248 };
249 
250 template <class T>
252 {
253 private:
254  const T* txTo;
255  unsigned int nIn;
258 
259 protected:
260  virtual bool VerifyECDSASignature(const std::vector<unsigned char>& vchSig, const CPubKey& vchPubKey, const uint256& sighash) const;
261  virtual bool VerifySchnorrSignature(Span<const unsigned char> sig, const XOnlyPubKey& pubkey, const uint256& sighash) const;
262 
263 public:
264  GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn) : txTo(txToIn), nIn(nInIn), amount(amountIn), txdata(nullptr) {}
265  GenericTransactionSignatureChecker(const T* txToIn, unsigned int nInIn, const CAmount& amountIn, const PrecomputedTransactionData& txdataIn) : txTo(txToIn), nIn(nInIn), amount(amountIn), txdata(&txdataIn) {}
266  bool CheckECDSASignature(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override;
267  bool CheckSchnorrSignature(Span<const unsigned char> sig, Span<const unsigned char> pubkey, SigVersion sigversion, const ScriptExecutionData& execdata, ScriptError* serror = nullptr) const override;
268  bool CheckLockTime(const CScriptNum& nLockTime) const override;
269  bool CheckSequence(const CScriptNum& nSequence) const override;
270 };
271 
274 
275 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* error = nullptr);
276 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* error = nullptr);
277 bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, unsigned int flags, const BaseSignatureChecker& checker, ScriptError* serror = nullptr);
278 
279 size_t CountWitnessSigOps(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, unsigned int flags);
280 
281 int FindAndDelete(CScript& script, const CScript& b);
282 
283 #endif // BITCOIN_SCRIPT_INTERPRETER_H
virtual bool CheckECDSASignature(const std::vector< unsigned char > &scriptSig, const std::vector< unsigned char > &vchPubKey, const CScript &scriptCode, SigVersion sigversion) const
Definition: interpreter.h:227
Witness v0 (P2WPKH and P2WSH); see BIP 141.
virtual bool CheckLockTime(const CScriptNum &nLockTime) const
Definition: interpreter.h:237
virtual ~BaseSignatureChecker()
Definition: interpreter.h:247
Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, key path spending; see BIP 341...
bool VerifyScript(const CScript &scriptSig, const CScript &scriptPubKey, const CScriptWitness *witness, unsigned int flags, const BaseSignatureChecker &checker, ScriptError *serror=nullptr)
enum ScriptError_t ScriptError
static constexpr size_t WITNESS_V1_TAPROOT_SIZE
Definition: interpreter.h:212
GenericTransactionSignatureChecker(const T *txToIn, unsigned int nInIn, const CAmount &amountIn, const PrecomputedTransactionData &txdataIn)
Definition: interpreter.h:265
bool m_annex_present
Whether an annex is present.
Definition: interpreter.h:199
uint256 SignatureHash(const CScript &scriptCode, const T &txTo, unsigned int nIn, int nHashType, const CAmount &amount, SigVersion sigversion, const PrecomputedTransactionData *cache=nullptr)
GenericTransactionSignatureChecker(const T *txToIn, unsigned int nInIn, const CAmount &amountIn)
Definition: interpreter.h:264
int64_t m_validation_weight_left
How much validation weight is left (decremented for every successful non-empty signature check)...
Definition: interpreter.h:206
std::vector< CTxOut > m_spent_outputs
Definition: interpreter.h:163
static constexpr uint8_t TAPROOT_LEAF_TAPSCRIPT
Definition: interpreter.h:215
bool CheckSignatureEncoding(const std::vector< unsigned char > &vchSig, unsigned int flags, ScriptError *serror)
Bare scripts and BIP16 P2SH-wrapped redeemscripts.
Witness v1 with 32-byte program, not BIP16 P2SH-wrapped, script path spending, leaf version 0xc0; see...
static constexpr size_t TAPROOT_CONTROL_BASE_SIZE
Definition: interpreter.h:216
Taproot only; implied when sighash byte is missing, and equivalent to SIGHASH_ALL.
Definition: interpreter.h:31
uint32_t m_codeseparator_pos
Opcode position of the last executed OP_CODESEPARATOR (or 0xFFFFFFFF if none executed).
Definition: interpreter.h:194
static constexpr size_t TAPROOT_CONTROL_NODE_SIZE
Definition: interpreter.h:217
int64_t CAmount
Amount in satoshis (Can be negative)
Definition: amount.h:12
uint256 m_tapleaf_hash
The tapleaf hash.
Definition: interpreter.h:189
const PrecomputedTransactionData * txdata
Definition: interpreter.h:257
static constexpr uint8_t TAPROOT_LEAF_MASK
Definition: interpreter.h:214
An encapsulated public key.
Definition: pubkey.h:31
bool m_bip143_segwit_ready
Whether the 3 fields above are initialized.
Definition: interpreter.h:161
virtual bool CheckSchnorrSignature(Span< const unsigned char > sig, Span< const unsigned char > pubkey, SigVersion sigversion, const ScriptExecutionData &execdata, ScriptError *serror=nullptr) const
Definition: interpreter.h:232
bool EvalScript(std::vector< std::vector< unsigned char > > &stack, const CScript &script, unsigned int flags, const BaseSignatureChecker &checker, SigVersion sigversion, ScriptExecutionData &execdata, ScriptError *error=nullptr)
An output of a transaction.
Definition: transaction.h:128
static constexpr size_t WITNESS_V0_SCRIPTHASH_SIZE
Signature hash sizes.
Definition: interpreter.h:210
bool m_bip341_taproot_ready
Whether the 5 fields above are initialized.
Definition: interpreter.h:156
static constexpr size_t TAPROOT_CONTROL_MAX_SIZE
Definition: interpreter.h:219
int flags
Definition: bitcoin-tx.cpp:512
256-bit opaque blob.
Definition: uint256.h:124
static constexpr size_t TAPROOT_CONTROL_MAX_NODE_COUNT
Definition: interpreter.h:218
size_t CountWitnessSigOps(const CScript &scriptSig, const CScript &scriptPubKey, const CScriptWitness *witness, unsigned int flags)
Serialized script, used inside transaction inputs and outputs.
Definition: script.h:404
static constexpr size_t WITNESS_V0_KEYHASH_SIZE
Definition: interpreter.h:211
bool m_spent_outputs_ready
Whether m_spent_outputs is initialized.
Definition: interpreter.h:165
virtual bool CheckSequence(const CScriptNum &nSequence) const
Definition: interpreter.h:242
int FindAndDelete(CScript &script, const CScript &b)
PrecomputedTransactionData()=default
A Span is an object that can refer to a contiguous sequence of objects.
Definition: span.h:92
The basic transaction that is broadcasted on the network and contained in blocks. ...
Definition: transaction.h:259
void Init(const T &tx, std::vector< CTxOut > &&spent_outputs)
bool error(const char *fmt, const Args &... args)
Definition: system.h:52
uint256 m_annex_hash
Hash of the annex data.
Definition: interpreter.h:201
SigVersion
Definition: interpreter.h:176