aboutsummaryrefslogtreecommitdiff
path: root/src/script
AgeCommit message (Collapse)Author
2022-04-25Precomputed hashes are note #16 in BIP341Gregory Sanders
2022-04-18miniscript: the 'd:' wrapper must not be 'u'Antoine Poinsot
The value it leaves on the stack depends on the last element on the stack. However, we can't make sure this element is OP_1 (which would give us the 'u' property) without the MINIMALIF rule. MINIMALIF is only policy for P2WSH, therefore giving 'd:' the 'u' property breaks consensus soundness: it makes it possible (by consensus but not policy) for instance to satisfy a thresh() without satisfying at least k of its subs. This bug was found and reported by Andrew Poelstra.
2022-04-06doc: Convert remaining comments to clang-tidy formatMarcoFalke
2022-04-05Merge bitcoin/bitcoin#24147: Miniscript integrationlaanwj
2da94a4c6f55f7a3621f4a6f70902c52f735c868 fuzz: add a fuzz target for Miniscript decoding from Script (Antoine Poinsot) f8369996e76dbc41a12f7b7eea14a7e7990a81c1 Miniscript: ops limit and stack size computation (Pieter Wuille) 2e55e88f86d0dd49b35d04af3f57e863498aabae Miniscript: conversion from script (Pieter Wuille) 1ddaa66eae67b102f5e37d212d366a5dcad4aa26 Miniscript: type system, script creation, text notation, tests (Pieter Wuille) 4fe29368c0ded0e62f437cab3a7c904f7fd3ad67 script: expose getter for CScriptNum, add a BuildScript helper (Antoine Poinsot) f4e289f384efdda6c3f56e1e1c30820a91ac2612 script: move CheckMinimalPush from interpreter to script.h (Antoine Poinsot) 31ec6ae92a5d9910a26d90a6ff20bab27dee5826 script: make IsPushdataOp non-static (Antoine Poinsot) Pull request description: Miniscript is a language for writing (a subset of) Bitcoin Scripts in a structured way. Miniscript permits: - To safely extend the Output Descriptor language to many more scripting features thanks to the typing system (composition). - Statical analysis of spending conditions, maximum spending cost of each branch, security properties, third-party malleability. - General satisfaction of any correctly typed ("valid" [0]) Miniscript. The satisfaction itself is also analyzable. - To extend the possibilities of external signers, because of all of the above and since it carries enough metadata. Miniscript guarantees: - That for any statically-analyzed as "safe" [0] Script, a witness can be constructed in the bounds of the consensus and standardness rules (standardness complete). - That unless the conditions of the Miniscript are met, no witness can be created for the Script (consensus sound). - Third-party malleability protection for the satisfaction of a sane Miniscript, which is too complex to summarize here. For more details around Miniscript (including the specifications), please refer to the [website](https://bitcoin.sipa.be/miniscript/). Miniscript was designed by Pieter Wuille, Andrew Poelstra and Sanket Kanjalkar. This PR is an updated and rebased version of #16800. See [the commit history of the Miniscript repository](https://github.com/sipa/miniscript/commits/master) for details about the changes made since September 2019 (TL;DR: bugfixes, introduction of timelock conflicts in the type system, `pk()` and `pkh()` aliases, `thresh_m` renamed to `multi`, all recursive algorithms were made non-recursive). This PR is also the first in a series of 3: - The first one (here) integrates the backbone of Miniscript. - The second one (#24148) introduces support for Miniscript in Output Descriptors, allowing for watch-only support of Miniscript Descriptors in the wallet. - The third one (#24149) implements signing for these Miniscript Descriptors, using Miniscript's satisfaction algorithm. Note to reviewers: - Miniscript is currently defined only for P2WSH. No Taproot yet. - Miniscript is different from the policy language (a high-level logical representation of a spending policy). A policy->Miniscript compiler is not included here. - The fuzz target included here is more interestingly extended in the 3rd PR to check a script's satisfaction against `VerifyScript`. I think it could be further improved by having custom mutators as we now have for multisig (see https://github.com/bitcoin/bitcoin/issues/23105). A minified corpus of Miniscript Scripts is available at https://github.com/bitcoin-core/qa-assets/pull/85. [0] We call "valid" any correctly-typed Miniscript. And "safe" any sane Miniscript, ie one whose satisfaction isn't malleable, which requires a key for any spending path, etc.. ACKs for top commit: jb55: ACK 2da94a4c6f55f7a3621f4a6f70902c52f735c868 laanwj: Light code review ACK 2da94a4c6f55f7a3621f4a6f70902c52f735c868 (mostly reviewed the changes to the existing code and build system) Tree-SHA512: d3ef558436cfcc699a50ad13caf1e776f7d0addddb433ee28ef38f66ea5c3e581382d8c748ccac9b51768e4b95712ed7a6112b0e3281a6551e0f325331de9167
2022-04-04refactor: fix clang-tidy named args usagefanquake
2022-03-23Merge bitcoin/bitcoin#24462: For descriptor pubkey parse errors, include ↵MarcoFalke
context information 9b526727000509dc6ef90f2ce6a9049edebf959c For descriptor pubkey parse errors, include context information (Ben Woosley) Pull request description: This adds readily-available context information to the error string, for further disambiguation. This is a revival of #16123 which was largely addressed in #16542. Note 'Multi:' is used rather than 'multi():' as it also encompasses 'sortedmulti():' ACKs for top commit: achow101: ACK 9b526727000509dc6ef90f2ce6a9049edebf959c theStack: ACK 9b526727000509dc6ef90f2ce6a9049edebf959c Tree-SHA512: 96533ea8c3ac7010f9b62e75b4bd20b65aff843030eb91c7a88312975acecaaf17909b7d1841f45edc86dbf7fa402d208adb85f0673bd79b857dbebacb8c9395
2022-03-17Miniscript: ops limit and stack size computationPieter Wuille
Co-Authored-By: Antoine Poinsot <darosior@protonmail.com>
2022-03-17Miniscript: conversion from scriptPieter Wuille
Co-Authored-By: Antoine Poinsot <darosior@protonmail.com> Co-Authored-By: Samuel Dobson <dobsonsa68@gmail.com>
2022-03-17Miniscript: type system, script creation, text notation, testsPieter Wuille
More information about Miniscript can be found at https://bitcoin.sipa.be/miniscript/ (the website source is hosted at https://github.com/sipa/miniscript/). This commit defines all fragments, their composition, parsing from string representation and conversion to Script. Co-Authored-By: Antoine Poinsot <darosior@protonmail.com> Co-Authored-By: Sanket Kanjalkar <sanket1729@gmail.com> Co-Authored-By: Samuel Dobson <dobsonsa68@gmail.com>
2022-03-17script: expose getter for CScriptNum, add a BuildScript helperAntoine Poinsot
Some prep work for Miniscript. BuildScript is an efficient way to build Scripts in a generic manner (by concatenating OPs, data, and other Scripts). Co-Authored-By: Pieter Wuille <pieter@wuille.net>
2022-03-17script: move CheckMinimalPush from interpreter to script.hAntoine Poinsot
It is used by Miniscript.
2022-03-17script: make IsPushdataOp non-staticAntoine Poinsot
We'll need it for Miniscript
2022-03-12Merge bitcoin/bitcoin#24164: build: Bump minimum required clang/libc++ to 8.0MarcoFalke
fae20e6b50306f91c74037e915aa0ab75a0a6b3b Revert "Avoid the use of P0083R3 std::set::merge" (MarcoFalke) fab53b5fd45cf55a1d4d313e46ffce7396c9590e ci/doc: Set minimum required clang/libc++ version to 8.0 (MarcoFalke) Pull request description: This is not for 23.0, but for 24.0. It comes with the following benefits: * Can use C++17 P0083R3 std::set::merge from libc++ 8.0 * No longer need to provide support for clang-7, which already fails to compile on some architectures (https://github.com/bitcoin/bitcoin/issues/21294#issuecomment-998098483) This should be fine, given that all supported operating systems ship with at least clang-10: * CentOS 8: clang-12 * Stretch: https://packages.debian.org/stretch/clang-11 * Buster: https://packages.debian.org/buster-backports/clang-11 * Bionic: https://packages.ubuntu.com/bionic-updates/clang-10 * Focal: https://packages.ubuntu.com/focal/clang-10 ACKs for top commit: fanquake: ACK fae20e6b50306f91c74037e915aa0ab75a0a6b3b - I think this is fine to do. I would be surprised if in another 6 months time someone was stuck on a system we supported, needing to compile Core, and only had access to Clang 7 or older. As mentioned in the PR description, all systems we currently support, already support multiple newer versions of Clang. hebasto: ACK fae20e6b50306f91c74037e915aa0ab75a0a6b3b, I have reviewed the code and it looks OK, I agree it can be merged. Tree-SHA512: 3b4c6c130ff40dd7e84934af076863415e5dd661d823c72e3e3832566c65be6e877a7ef9164bbcf394bcea4b897fc29a48db0f231c22ace0e2c9b5638659a628
2022-03-04Revert "Avoid the use of P0083R3 std::set::merge"MarcoFalke
This reverts commit 6cf4ea71878c0a83f2e49831e4dfa119c53761b7.
2022-03-04Merge bitcoin/bitcoin#24043: Add (sorted)multi_a descriptor for k-of-n ↵Andrew Chow
multisig inside tr 4828d53eccd52a67631c64cef0ba7df90dff138d Add (sorted)multi_a descriptors to doc/descriptors.md (Pieter Wuille) b5f33ac1f82aea290b4653af36ac2ad1bf1cce7b Simplify wallet_taproot.py functional test (Pieter Wuille) eb0667ea96d52db9135514a5e95ab943f6abd8a6 Add tests for (sorted)multi_a derivation/signing (Pieter Wuille) c17c6aa08df81aa0086d80b50187c8cd60ecc222 Add signing support for (sorted)multi_a scripts (Pieter Wuille) 3eed6fca57d1fa7544f372e6e7de0a9ae1b5715a Add multi_a descriptor inference (Pieter Wuille) 79728c4a3d8a74f276daf1e72abbdecdab85a5d8 Add (sorted)multi_a descriptor and script derivation (Pieter Wuille) 25e95f9ff89a97b87ce218f28274c3c821b2d54d Merge/generalize IsValidMultisigKeyCount/GetMultisigKeyCount (Pieter Wuille) Pull request description: This adds a new `multi_a(k,key_1,key_2,...,key_n)` (and corresponding `sortedmulti_a`) descriptor for k-of-n policies inside `tr()`. Semantically it is very similar to the existing `multi()` descriptor, but with the following changes: * The corresponding script is `<key1> OP_CHECKSIG <key2> OP_CHECKSIGADD <key3> OP_CHECKSIGADD ... <key_n> OP_CHECKSIGADD <k> OP_NUMEQUAL`, rather than the traditional `OP_CHECKMULTISIG`-based script, making it usable inside the `tr()` descriptor. * The keys can optionally be specified in x-only notation. * Both the number of keys and the threshold can be as high as 999; this is the limit due to the consensus stacksize=1000 limit I expect that this functionality will later be replaced with a miniscript-based implementation, but I don't think it's necessary to wait for that. Limitations: * The wallet code will for not estimate witness size incorrectly for script path spends, which may result in a (dramatic) fee underpayment with large multi_a scripts. * The multi_a script construction is (slightly) suboptimal for n-of-n (where a `<key1> OP_CHECKSIGVERIFY ... <key_n-1> OP_CHECKSIGVERIFY <key_n> OP_CHECKSIG` would be better). Such a construction is not included here. ACKs for top commit: achow101: ACK 4828d53eccd52a67631c64cef0ba7df90dff138d gruve-p: ACK https://github.com/bitcoin/bitcoin/pull/24043/commits/4828d53eccd52a67631c64cef0ba7df90dff138d sanket1729: code review ACK 4828d53eccd52a67631c64cef0ba7df90dff138d darosior: Code review ACK 4828d53eccd52a67631c64cef0ba7df90dff138d Tree-SHA512: 5dcd434b79585f0ff830f7d501d27df5e346f5749f47a3109ec309ebf2cbbad0e1da541eec654026d911ab67fd7cf7793fab0f765628d68d81b96ef2a4d234ce
2022-03-03For descriptor pubkey parse errors, include context informationBen Woosley
Note 'Multi:' is used rather than 'multi():' as it also encompasses 'sortedmulti():'
2022-02-15Bugfix: make ToPrivateString work with x-only keysPieter Wuille
2022-02-14Bugfix: set x-only flag when inferring pk() inside tr()Pieter Wuille
2022-01-31Fix unsigned integer overflow in tapscript validation weight calculationMarcoFalke
2022-01-27Merge bitcoin/bitcoin#23438: refactor: Use spans of std::byte in serializelaanwj
fa5d2e678c809c26bd40d7e7c171529d3ffb5903 Remove unused char serialize (MarcoFalke) fa24493d6394b3a477535f480664c9596f18e3c5 Use spans of std::byte in serialize (MarcoFalke) fa65bbf217b725ada35107b4ad646d250228355c span: Add BytePtr helper (MarcoFalke) Pull request description: This changes the serialize code (`.read()` and `.write()` functions) to take a `Span` instead of a pointer and size. This is a breaking change for the serialize interface, so at no additional cost we can also switch to `std::byte` (instead of using `char`). The benefits of using `Span`: * Less verbose and less fragile code when passing an already existing `Span`(-like) object to or from serialization The benefits of using `std::byte`: * `std::byte` can't accidentally be mistaken for an integer The goal here is to only change serialize to use spans of `std::byte`. If needed, `AsBytes`, `MakeUCharSpan`, ... can be used (temporarily) to pass spans of the right type. Other changes that are included here: * [#22167](https://github.com/bitcoin/bitcoin/pull/22167) (refactor: Remove char serialize by MarcoFalke) * [#21906](https://github.com/bitcoin/bitcoin/pull/21906) (Preserve const in cast on CTransactionSignatureSerializer by promag) ACKs for top commit: laanwj: Concept and code review ACK fa5d2e678c809c26bd40d7e7c171529d3ffb5903 sipa: re-utACK fa5d2e678c809c26bd40d7e7c171529d3ffb5903 Tree-SHA512: 08ee9eced5fb777cedae593b11e33660bed9a3e1711a7451a87b835089a96c99ce0632918bb4666a4e859c4d020f88fb50f2dd734216b0c3d1a9a704967ece6f
2022-01-19Optimize CHECKSIGADD Script ValidationJeremy Rubin
2022-01-12Add signing support for (sorted)multi_a scriptsPieter Wuille
2022-01-12Add multi_a descriptor inferencePieter Wuille
2022-01-12Add (sorted)multi_a descriptor and script derivationPieter Wuille
2022-01-12Merge/generalize IsValidMultisigKeyCount/GetMultisigKeyCountPieter Wuille
2022-01-02Use spans of std::byte in serializeMarcoFalke
This switches .read() and .write() to take spans of bytes.
2022-01-01rpc: Quote user supplied descriptor in error msgMarcoFalke
2021-12-30scripted-diff: Bump copyright headersHennadii Stepanov
-BEGIN VERIFY SCRIPT- ./contrib/devtools/copyright_header.py update ./ -END VERIFY SCRIPT- Commits of previous years: * 2020: fa0074e2d82928016a43ca408717154a1c70a4db * 2019: aaaaad6ac95b402fe18d019d67897ced6b316ee0
2021-12-10Implement operator< for KeyOriginInfo and CExtPubKeyAndrew Chow
2021-12-10moveonly: Move (Un)Serialize(To/From)Vector, (De)SerializeHDKeypaths to psbt ↵Andrew Chow
module SerializeToVector, UnserializeFromVector, DeserializeHDKeypaths, and SerializeHDKeypaths were in sign.h where PSBT was originally implemented. Since all of the PSBT serialization has moved to its own file, these functions should follow.
2021-12-10Types are compact size uintsAndrew Chow
2021-11-29More Span simplificationsPieter Wuille
Based on suggestions by MarcoFalke <falke.marco@gmail.com>
2021-11-29Replace MakeSpan helper with Span deduction guidePieter Wuille
2021-11-22Merge bitcoin/bitcoin#22364: wallet: Make a tr() descriptor by defaultMarcoFalke
4868c9f1b39f03adee0009cd41d96598b43e8b78 Extract Taproot internal keyid with GetKeyFromDestination (Andrew Chow) d8abbe119c71f917e0fd2e80536c1e5d979b4dc6 Mention bech32m in -addresstype and -changetype help (Andrew Chow) 8fb57845ee3844c9ba854471065109d2e409300f Create a tr() descriptor bech32m DescriptorScriptPubKeyMan by default (Andrew Chow) 54b3699862de687f782c7c52500d6a2372478355 Store pubkeys in TRDescriptor::MakeScripts (Andrew Chow) Pull request description: Make a `tr()` descriptor by default in descriptor wallets so that users will be able to make and use segwit v1 bech32m addresses. ACKs for top commit: MarcoFalke: Concept ACK 4868c9f1b39f03adee0009cd41d96598b43e8b78 Sjors: re-utACK 4868c9f1b39f03adee0009cd41d96598b43e8b78 gruve-p: ACK https://github.com/bitcoin/bitcoin/pull/22364/commits/4868c9f1b39f03adee0009cd41d96598b43e8b78 meshcollider: Concept + code review ACK 4868c9f1b39f03adee0009cd41d96598b43e8b78 Tree-SHA512: e5896e665b8d559f1d759b6582d1bb24f70d4698a57307684339d9fdcdac28ae9bc17bc946a7efec9cb35c130a95ffc36e3961a335124ec4535d77b8d00e9631
2021-11-16Extract Taproot internal keyid with GetKeyFromDestinationAndrew Chow
2021-11-16doc: Pick better named args for MutableTransactionSignatureCreatorMarcoFalke
Argument names of "nInIn" are not helpful.
2021-11-15Store pubkeys in TRDescriptor::MakeScriptsAndrew Chow
When expanding the scripts for a TRDescriptor, also store the pubkeys in the FlatSigningProvider.
2021-11-12tests: implement BIP341 test vectorsPieter Wuille
2021-11-12Make signing follow BIP340 exactly w.r.t. aux randomnessPieter Wuille
libsecp256k1's secp256k1_schnorrsig_sign only follows BIP340 exactly if an aux_rand32 argument is passed. When no randomness is used (as is the case in the current codebase here), there is no impact on security between not providing aux_rand32 at all, or providing an empty one. Yet, for repeatability/testability it is simpler to always use an all-zero one.
2021-09-30[MOVEONLY] consensus: move amount.h into consensusfanquake
Move amount.h to consensus/amount.h. Renames, adds missing and removes uneeded includes.
2021-09-29Merge bitcoin/bitcoin#22650: Remove -deprecatedrpc=addresses flag and ↵Samuel Dobson
corresponding code/logic 43cd6b8af9d613ca033800c5cd8524c3f77e13ec doc: add release notes for removal of the -deprecatedrpc=addresses flag (Michael Dietz) 2b1fdc2c6ce1d0b0e51a3f107e23443c142d57af refactor: minor styling, prefer snake case and same line if (Michael Dietz) d64deac7b823a0eba97ab3a3686054eefe330d3c refactor: share logic between ScriptPubKeyToUniv and ScriptToUniv (Michael Dietz) 8721638daa8502c7f8de5ae24a9393d7290a2ce5 rpc: remove deprecated addresses and reqSigs from rpc outputs (Michael Dietz) Pull request description: Resolves #21797 now that we've branched-off to v23 ("addresses" and "reqSigs" deprecated) "ExtractDestinations" should be removed. `-deprecatedrpc=addresses` was initially added in this PR #20286 (which resolved the original issue #20102). Some chunks of code and logic are no longer used/necessary with the removal of this, and therefore some minor refactoring is done in this PR as well (separated commits) ACKs for top commit: MarcoFalke: re-ACK 43cd6b8af9d613ca033800c5cd8524c3f77e13ec 🐉 meshcollider: Code review ACK 43cd6b8af9d613ca033800c5cd8524c3f77e13ec jonatack: ACK 43cd6b8af9d613ca033800c5cd8524c3f77e13ec per `git range-diff a9d0cec 92dc5e9 43cd6b8`, also rebased to latest master, debug built + quick re-review of each commit to bring back context, and ran tests locally at the final commit Tree-SHA512: fba83495e396d3c06f0dcf49292f14f4aa6b68fa758f0503941fade1a6e7271cda8378e2734af1faea550d1b43c85a36c52ebcc9dec0732936f9233b4b97901c
2021-09-24rpc: remove deprecated addresses and reqSigs from rpc outputsMichael Dietz
2021-09-03Add LIFETIMEBOUND to CScript where neededMarcoFalke
2021-09-27scripted-diff: Rename overloaded int GetArg to GetIntArgRussell Yanofsky
Improve readability of code, simplify future scripted diff cleanup PRs, and be more consistent with naming for GetBoolArg. This will also be useful for replacing runtime settings type checking with compile time checking. -BEGIN VERIFY SCRIPT- git grep -l GetArg | xargs sed -i 's/GetArg(\([^)]*\( [0-9]\+\|-1\|port\|BaseParams().RPCPort()\|Params().GetDefaultPort()\|_TIMEOUT\|Height\|_WORKQUEUE\|_THREADS\|_CONNECTIONS\|LIMIT\|SigOp\|Bytes\|_VERSION\|_AGE\|_CHECKS\|Checks() ? 1 : 0\|_BANTIME\|Cache\|BLOCKS\|LEVEL\|Weight\|Version\|BUFFER\|TARGET\|WEIGHT\|TXN\|TRANSACTIONS\|ADJUSTMENT\|i64\|Size\|nDefault\|_EXPIRY\|HEIGHT\|SIZE\|SNDHWM\|_TIME_MS\)\))/GetIntArg(\1)/g' -END VERIFY SCRIPT- Co-authored-by: Hennadii Stepanov <32963518+hebasto@users.noreply.github.com>
2021-08-23Consolidate XOnlyPubKey lookup hackAndrew Chow
The places where we need to lookup information for a XOnlyPubKey currently implement a hack which makes both serializations of the full pubkey in order to try the CKeyIDs for the lookup functions. Instead of duplicating this everywhere it is needed, we can consolidate the CKeyID generation into a function, and then have wrappers around GetPubKey, GetKey, and GetKeyOrigin which takes the XOnlyPubKey, retrieves all of the CKeyIDs (using the new GetKeyIDs() function in XOnlyPubKey), and tries their respective underlying lookup function.
2021-08-23Merge bitcoin/bitcoin#22275: A few follow-ups for taproot signingfanquake
08f57a0057c58f19cd8ae3de89548d014980478a Assert that IsComplete() in GetSpendData() (Pieter Wuille) d8f4b976d5ae9e6eee741dfdda53b8bc8573221b Remove default nHashTypeIn arguments to MutableTransactionSignatureCreator (Pieter Wuille) c7048aae9545afd8d522e200ecadcf69f22399a0 Simplify SignTransaction precomputation loop (Pieter Wuille) addb9b5a71ff96bdb1a4c15bc9345de0d7f2c98c Improve comments in taproot signing logic (Pieter Wuille) Pull request description: This addresses a few review comments from #21365 that were left at the time of merge (as well as some from #22166 applying to the commit it shared with #21365). I do not think any are blockers for a 22.0 release. ACKs for top commit: theStack: re-ACK 08f57a0057c58f19cd8ae3de89548d014980478a 🌴 Zero-1729: crACK 08f57a0 jonatack: Code review ACK 08f57a0057c58f19cd8ae3de89548d014980478a per `git range-diff e9d6eb1 9336670 08f57a0` followed by re-code review per commit to swap context back into memory and debug build/run unit tests + feature_taproot.py as a sanity check Tree-SHA512: 968750109ba8d6faf3016035a38f81c6aefb724c632a3cab0bbf43cf31b9d187b6b0fddd8772768f57338df11eb07ab9c4c6dacdf3cf35b71f29699c67a301ea
2021-08-20Avoid temporary vectors/uint256s in VerifyTaprootCommitmentPieter Wuille
As XOnlyPubKey has a Span-based constructor, that can be used directly without needing to first convert the byte sequence into a vector, only to convert that to a uint256, which only then can then be passed as a span to the constructor.
2021-08-20Assert that IsComplete() in GetSpendData()Pieter Wuille
2021-08-20Remove default nHashTypeIn arguments to MutableTransactionSignatureCreatorPieter Wuille
These were unused except in tests, and were also overlooked when changing SIGHASH_ALL -> SIGHASH_DEFAULT.
2021-08-20Simplify SignTransaction precomputation loopPieter Wuille
generated by cgit v1.2.3 (git 2.26.2) at 2025-02-25 02:48:58 +0000