Bitcoin Core  26.99.0
P2P Digital Currency
package_eval.cpp
Go to the documentation of this file.
1 // Copyright (c) 2023 The Bitcoin Core developers
2 // Distributed under the MIT software license, see the accompanying
3 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
4 
5 #include <consensus/validation.h>
6 #include <node/context.h>
7 #include <node/mempool_args.h>
8 #include <node/miner.h>
10 #include <test/fuzz/fuzz.h>
11 #include <test/fuzz/util.h>
12 #include <test/fuzz/util/mempool.h>
13 #include <test/util/mining.h>
14 #include <test/util/script.h>
15 #include <test/util/setup_common.h>
16 #include <test/util/txmempool.h>
17 #include <util/rbf.h>
18 #include <validation.h>
19 #include <validationinterface.h>
20 
21 using node::NodeContext;
22 
23 namespace {
24 
25 const TestingSetup* g_setup;
26 std::vector<COutPoint> g_outpoints_coinbase_init_mature;
27 
28 struct MockedTxPool : public CTxMemPool {
29  void RollingFeeUpdate() EXCLUSIVE_LOCKS_REQUIRED(!cs)
30  {
31  LOCK(cs);
32  lastRollingFeeUpdate = GetTime();
33  blockSinceLastRollingFeeBump = true;
34  }
35 };
36 
37 void initialize_tx_pool()
38 {
39  static const auto testing_setup = MakeNoLogFileContext<const TestingSetup>();
40  g_setup = testing_setup.get();
41 
42  for (int i = 0; i < 2 * COINBASE_MATURITY; ++i) {
43  COutPoint prevout{MineBlock(g_setup->m_node, P2WSH_EMPTY)};
44  if (i < COINBASE_MATURITY) {
45  // Remember the txids to avoid expensive disk access later on
46  g_outpoints_coinbase_init_mature.push_back(prevout);
47  }
48  }
50 }
51 
52 struct OutpointsUpdater final : public CValidationInterface {
53  std::set<COutPoint>& m_mempool_outpoints;
54 
55  explicit OutpointsUpdater(std::set<COutPoint>& r)
56  : m_mempool_outpoints{r} {}
57 
58  void TransactionAddedToMempool(const NewMempoolTransactionInfo& tx, uint64_t /* mempool_sequence */) override
59  {
60  // for coins spent we always want to be able to rbf so they're not removed
61 
62  // outputs from this tx can now be spent
63  for (uint32_t index{0}; index < tx.info.m_tx->vout.size(); ++index) {
64  m_mempool_outpoints.insert(COutPoint{tx.info.m_tx->GetHash(), index});
65  }
66  }
67 
68  void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override
69  {
70  // outpoints spent by this tx are now available
71  for (const auto& input : tx->vin) {
72  // Could already exist if this was a replacement
73  m_mempool_outpoints.insert(input.prevout);
74  }
75  // outpoints created by this tx no longer exist
76  for (uint32_t index{0}; index < tx->vout.size(); ++index) {
77  m_mempool_outpoints.erase(COutPoint{tx->GetHash(), index});
78  }
79  }
80 };
81 
82 struct TransactionsDelta final : public CValidationInterface {
83  std::set<CTransactionRef>& m_added;
84 
85  explicit TransactionsDelta(std::set<CTransactionRef>& a)
86  : m_added{a} {}
87 
88  void TransactionAddedToMempool(const NewMempoolTransactionInfo& tx, uint64_t /* mempool_sequence */) override
89  {
90  // Transactions may be entered and booted any number of times
91  m_added.insert(tx.info.m_tx);
92  }
93 
94  void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override
95  {
96  // Transactions may be entered and booted any number of times
97  m_added.erase(tx);
98  }
99 };
100 
101 void MockTime(FuzzedDataProvider& fuzzed_data_provider, const Chainstate& chainstate)
102 {
103  const auto time = ConsumeTime(fuzzed_data_provider,
104  chainstate.m_chain.Tip()->GetMedianTimePast() + 1,
105  std::numeric_limits<decltype(chainstate.m_chain.Tip()->nTime)>::max());
106  SetMockTime(time);
107 }
108 
109 CTxMemPool MakeMempool(FuzzedDataProvider& fuzzed_data_provider, const NodeContext& node)
110 {
111  // Take the default options for tests...
113 
114 
115  // ...override specific options for this specific fuzz suite
116  mempool_opts.limits.ancestor_count = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 50);
117  mempool_opts.limits.ancestor_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 202) * 1'000;
118  mempool_opts.limits.descendant_count = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 50);
119  mempool_opts.limits.descendant_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 202) * 1'000;
120  mempool_opts.max_size_bytes = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 200) * 1'000'000;
121  mempool_opts.expiry = std::chrono::hours{fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 999)};
122  nBytesPerSigOp = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(1, 999);
123 
124  mempool_opts.check_ratio = 1;
125  mempool_opts.require_standard = fuzzed_data_provider.ConsumeBool();
126 
127  // ...and construct a CTxMemPool from it
128  return CTxMemPool{mempool_opts};
129 }
130 
131 FUZZ_TARGET(tx_package_eval, .init = initialize_tx_pool)
132 {
133  FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
134  const auto& node = g_setup->m_node;
135  auto& chainstate{static_cast<DummyChainState&>(node.chainman->ActiveChainstate())};
136 
137  MockTime(fuzzed_data_provider, chainstate);
138 
139  // All RBF-spendable outpoints outside of the unsubmitted package
140  std::set<COutPoint> mempool_outpoints;
141  std::map<COutPoint, CAmount> outpoints_value;
142  for (const auto& outpoint : g_outpoints_coinbase_init_mature) {
143  Assert(mempool_outpoints.insert(outpoint).second);
144  outpoints_value[outpoint] = 50 * COIN;
145  }
146 
147  auto outpoints_updater = std::make_shared<OutpointsUpdater>(mempool_outpoints);
148  RegisterSharedValidationInterface(outpoints_updater);
149 
150  CTxMemPool tx_pool_{MakeMempool(fuzzed_data_provider, node)};
151  MockedTxPool& tx_pool = *static_cast<MockedTxPool*>(&tx_pool_);
152 
153  chainstate.SetMempool(&tx_pool);
154 
155  LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 300)
156  {
157  Assert(!mempool_outpoints.empty());
158 
159  std::vector<CTransactionRef> txs;
160 
161  // Make packages of 1-to-26 transactions
162  const auto num_txs = (size_t) fuzzed_data_provider.ConsumeIntegralInRange<int>(1, 26);
163  std::set<COutPoint> package_outpoints;
164  while (txs.size() < num_txs) {
165 
166  // Last transaction in a package needs to be a child of parents to get further in validation
167  // so the last transaction to be generated(in a >1 package) must spend all package-made outputs
168  // Note that this test currently only spends package outputs in last transaction.
169  bool last_tx = num_txs > 1 && txs.size() == num_txs - 1;
170 
171  // Create transaction to add to the mempool
172  const CTransactionRef tx = [&] {
173  CMutableTransaction tx_mut;
175  tx_mut.nLockTime = fuzzed_data_provider.ConsumeBool() ? 0 : fuzzed_data_provider.ConsumeIntegral<uint32_t>();
176  // Last tx will sweep all outpoints in package
177  const auto num_in = last_tx ? package_outpoints.size() : fuzzed_data_provider.ConsumeIntegralInRange<int>(1, mempool_outpoints.size());
178  const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<int>(1, mempool_outpoints.size() * 2);
179 
180  auto& outpoints = last_tx ? package_outpoints : mempool_outpoints;
181 
182  Assert(!outpoints.empty());
183 
184  CAmount amount_in{0};
185  for (size_t i = 0; i < num_in; ++i) {
186  // Pop random outpoint
187  auto pop = outpoints.begin();
188  std::advance(pop, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, outpoints.size() - 1));
189  const auto outpoint = *pop;
190  outpoints.erase(pop);
191  // no need to update or erase from outpoints_value
192  amount_in += outpoints_value.at(outpoint);
193 
194  // Create input
195  const auto sequence = ConsumeSequence(fuzzed_data_provider);
196  const auto script_sig = CScript{};
197  const auto script_wit_stack = fuzzed_data_provider.ConsumeBool() ? P2WSH_EMPTY_TRUE_STACK : P2WSH_EMPTY_TWO_STACK;
198 
199  CTxIn in;
200  in.prevout = outpoint;
201  in.nSequence = sequence;
202  in.scriptSig = script_sig;
203  in.scriptWitness.stack = script_wit_stack;
204 
205  tx_mut.vin.push_back(in);
206  }
207 
208  // Duplicate an input
209  bool dup_input = fuzzed_data_provider.ConsumeBool();
210  if (dup_input) {
211  tx_mut.vin.push_back(tx_mut.vin.back());
212  }
213 
214  // Refer to a non-existant input
215  if (fuzzed_data_provider.ConsumeBool()) {
216  tx_mut.vin.emplace_back();
217  }
218 
219  const auto amount_fee = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, amount_in);
220  const auto amount_out = (amount_in - amount_fee) / num_out;
221  for (int i = 0; i < num_out; ++i) {
222  tx_mut.vout.emplace_back(amount_out, P2WSH_EMPTY);
223  }
224  // TODO vary transaction sizes to catch size-related issues
225  auto tx = MakeTransactionRef(tx_mut);
226  // Restore previously removed outpoints, except in-package outpoints
227  if (!last_tx) {
228  for (const auto& in : tx->vin) {
229  // It's a fake input, or a new input, or a duplicate
230  Assert(in == CTxIn() || outpoints.insert(in.prevout).second || dup_input);
231  }
232  // Cache the in-package outpoints being made
233  for (size_t i = 0; i < tx->vout.size(); ++i) {
234  package_outpoints.emplace(tx->GetHash(), i);
235  }
236  }
237  // We need newly-created values for the duration of this run
238  for (size_t i = 0; i < tx->vout.size(); ++i) {
239  outpoints_value[COutPoint(tx->GetHash(), i)] = tx->vout[i].nValue;
240  }
241  return tx;
242  }();
243  txs.push_back(tx);
244  }
245 
246  if (fuzzed_data_provider.ConsumeBool()) {
247  MockTime(fuzzed_data_provider, chainstate);
248  }
249  if (fuzzed_data_provider.ConsumeBool()) {
250  tx_pool.RollingFeeUpdate();
251  }
252  if (fuzzed_data_provider.ConsumeBool()) {
253  const auto& txid = fuzzed_data_provider.ConsumeBool() ?
254  txs.back()->GetHash() :
255  PickValue(fuzzed_data_provider, mempool_outpoints).hash;
256  const auto delta = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-50 * COIN, +50 * COIN);
257  tx_pool.PrioritiseTransaction(txid.ToUint256(), delta);
258  }
259 
260  // Remember all added transactions
261  std::set<CTransactionRef> added;
262  auto txr = std::make_shared<TransactionsDelta>(added);
264  const bool bypass_limits = fuzzed_data_provider.ConsumeBool();
265 
266  // When there are multiple transactions in the package, we call ProcessNewPackage(txs, test_accept=false)
267  // and AcceptToMemoryPool(txs.back(), test_accept=true). When there is only 1 transaction, we might flip it
268  // (the package is a test accept and ATMP is a submission).
269  auto single_submit = txs.size() == 1 && fuzzed_data_provider.ConsumeBool();
270 
271  const auto result_package = WITH_LOCK(::cs_main,
272  return ProcessNewPackage(chainstate, tx_pool, txs, /*test_accept=*/single_submit));
273 
274  const auto res = WITH_LOCK(::cs_main, return AcceptToMemoryPool(chainstate, txs.back(), GetTime(), bypass_limits, /*test_accept=*/!single_submit));
275  const bool accepted = res.m_result_type == MempoolAcceptResult::ResultType::VALID;
276 
279 
280  // There is only 1 transaction in the package. We did a test-package-accept and a ATMP
281  if (single_submit) {
282  Assert(accepted != added.empty());
283  Assert(accepted == res.m_state.IsValid());
284  if (accepted) {
285  Assert(added.size() == 1);
286  Assert(txs.back() == *added.begin());
287  }
288  } else if (result_package.m_state.GetResult() != PackageValidationResult::PCKG_POLICY) {
289  // We don't know anything about the validity since transactions were randomly generated, so
290  // just use result_package.m_state here. This makes the expect_valid check meaningless, but
291  // we can still verify that the contents of m_tx_results are consistent with m_state.
292  const bool expect_valid{result_package.m_state.IsValid()};
293  Assert(!CheckPackageMempoolAcceptResult(txs, result_package, expect_valid, nullptr));
294  } else {
295  // This is empty if it fails early checks, or "full" if transactions are looked at deeper
296  Assert(result_package.m_tx_results.size() == txs.size() || result_package.m_tx_results.empty());
297  }
298  }
299 
300  UnregisterSharedValidationInterface(outpoints_updater);
301 
302  WITH_LOCK(::cs_main, tx_pool.check(chainstate.CoinsTip(), chainstate.m_chain.Height() + 1));
303 }
304 } // namespace
int64_t CAmount
Amount in satoshis (Can be negative)
Definition: amount.h:12
static constexpr CAmount COIN
The amount of satoshis in one BTC.
Definition: amount.h:15
#define Assert(val)
Identity function.
Definition: check.h:77
uint32_t nTime
Definition: chain.h:199
int64_t GetMedianTimePast() const
Definition: chain.h:289
CBlockIndex * Tip() const
Returns the index entry for the tip of this chain, or nullptr if none.
Definition: chain.h:458
int Height() const
Return the maximal height in the chain.
Definition: chain.h:487
An outpoint - a combination of a transaction hash and an index n into its vout.
Definition: transaction.h:29
Serialized script, used inside transaction inputs and outputs.
Definition: script.h:414
static const int32_t CURRENT_VERSION
Definition: transaction.h:299
An input of a transaction.
Definition: transaction.h:67
uint32_t nSequence
Definition: transaction.h:71
CScript scriptSig
Definition: transaction.h:70
CScriptWitness scriptWitness
Only serialized through CTransaction.
Definition: transaction.h:72
COutPoint prevout
Definition: transaction.h:69
CTxMemPool stores valid-according-to-the-current-best-chain transactions that may be included in the ...
Definition: txmempool.h:300
Implement this to subscribe to events generated in validation and mempool.
virtual void TransactionRemovedFromMempool(const CTransactionRef &tx, MemPoolRemovalReason reason, uint64_t mempool_sequence)
Notifies listeners of a transaction leaving mempool.
virtual void TransactionAddedToMempool(const NewMempoolTransactionInfo &tx, uint64_t mempool_sequence)
Notifies listeners of a transaction having been added to mempool.
Chainstate stores and provides an API to update our local knowledge of the current best chain.
Definition: validation.h:491
CChain m_chain
The current chain of blockheaders we consult and build on.
Definition: validation.h:571
CCoinsViewCache & CoinsTip() EXCLUSIVE_LOCKS_REQUIRED(
Definition: validation.h:596
T ConsumeIntegralInRange(T min, T max)
static const int COINBASE_MATURITY
Coinbase transaction outputs can only be spent after this number of new blocks (network rule)
Definition: consensus.h:19
RecursiveMutex cs_main
Mutex to guard access to validation specific variables, such as reading or changing the chainstate.
Definition: cs_main.cpp:8
#define FUZZ_TARGET(...)
Definition: fuzz.h:39
#define LIMITED_WHILE(condition, limit)
Can be used to limit a theoretically unbounded loop.
Definition: fuzz.h:23
uint64_t sequence
static void pool cs
MemPoolRemovalReason
Reason why a transaction was removed from the mempool, this is passed to the notification signal.
Definition: init.h:25
@ PCKG_POLICY
The package itself is invalid (e.g. too many transactions).
unsigned int nBytesPerSigOp
Definition: settings.cpp:10
static CTransactionRef MakeTransactionRef(Tx &&txIn)
Definition: transaction.h:424
std::shared_ptr< const CTransaction > CTransactionRef
Definition: transaction.h:423
node::NodeContext m_node
Definition: setup_common.h:50
A mutable version of CTransaction.
Definition: transaction.h:378
std::vector< CTxOut > vout
Definition: transaction.h:380
std::vector< CTxIn > vin
Definition: transaction.h:379
std::vector< std::vector< unsigned char > > stack
Definition: script.h:569
Testing setup that configures a complete environment.
Definition: setup_common.h:77
const CTransactionRef m_tx
int64_t ancestor_count
The maximum allowed number of transactions in a package including the entry and its ancestors.
Options struct containing options for constructing a CTxMemPool.
NodeContext struct containing references to chain state and connection state.
Definition: context.h:48
#define LOCK(cs)
Definition: sync.h:257
#define WITH_LOCK(cs, code)
Run code while locking a mutex.
Definition: sync.h:301
uint32_t ConsumeSequence(FuzzedDataProvider &fuzzed_data_provider) noexcept
Definition: util.cpp:155
int64_t ConsumeTime(FuzzedDataProvider &fuzzed_data_provider, const std::optional< int64_t > &min, const std::optional< int64_t > &max) noexcept
Definition: util.cpp:34
auto & PickValue(FuzzedDataProvider &fuzzed_data_provider, Collection &col)
Definition: util.h:47
COutPoint MineBlock(const NodeContext &node, const CScript &coinbase_scriptPubKey)
Returns the generated coin.
Definition: mining.cpp:63
static const std::vector< std::vector< uint8_t > > P2WSH_EMPTY_TRUE_STACK
Definition: script.h:30
static const std::vector< std::vector< uint8_t > > P2WSH_EMPTY_TWO_STACK
Definition: script.h:31
static const CScript P2WSH_EMPTY
Definition: script.h:22
CTxMemPool::Options MemPoolOptionsForTest(const NodeContext &node)
Definition: txmempool.cpp:18
std::optional< std::string > CheckPackageMempoolAcceptResult(const Package &txns, const PackageMempoolAcceptResult &result, bool expect_valid, const CTxMemPool *mempool)
Check expected properties for every PackageMempoolAcceptResult, regardless of value.
Definition: txmempool.cpp:40
#define EXCLUSIVE_LOCKS_REQUIRED(...)
Definition: threadsafety.h:49
int64_t GetTime()
Definition: time.cpp:97
void SetMockTime(int64_t nMockTimeIn)
DEPRECATED Use SetMockTime with chrono type.
Definition: time.cpp:81
MempoolAcceptResult AcceptToMemoryPool(Chainstate &active_chainstate, const CTransactionRef &tx, int64_t accept_time, bool bypass_limits, bool test_accept) EXCLUSIVE_LOCKS_REQUIRED(
Try to add a transaction to the mempool.
PackageMempoolAcceptResult ProcessNewPackage(Chainstate &active_chainstate, CTxMemPool &pool, const Package &package, bool test_accept)
Validate (and maybe submit) a package to the mempool.
void UnregisterSharedValidationInterface(std::shared_ptr< CValidationInterface > callbacks)
Unregister subscriber.
void SyncWithValidationInterfaceQueue()
This is a synonym for the following, which asserts certain locks are not held: std::promise<void> pro...
void RegisterSharedValidationInterface(std::shared_ptr< CValidationInterface > callbacks)
Register subscriber.