Inside Bitcoin

501        sigdata.tr_builder = builder;
502    }
503    for (const auto& [pubkey, leaf_origin] : m_tap_bip32_paths) {
504        sigdata.taproot_misc_pubkeys.emplace(pubkey, leaf_origin);
505        sigdata.tap_pubkeys.emplace(Hash160(pubkey), pubkey);
506    }
507    sigdata.musig2_pubkeys.insert(m_musig2_participants.begin(), m_musig2_participants.end());
508}
509
510void PSBTOutput::FromSignatureData(const SignatureData& sigdata)
511{
512    if (redeem_script.empty() && !sigdata.redeem_script.empty()) {
513        redeem_script = sigdata.redeem_script;
514    }
515    if (witness_script.empty() && !sigdata.witness_script.empty()) {
516        witness_script = sigdata.witness_script;
517    }
518    for (const auto& entry : sigdata.misc_pubkeys) {
519        hd_keypaths.emplace(entry.second);
520    }
521    if (!sigdata.tr_spenddata.internal_key.IsNull()) {
522        m_tap_internal_key = sigdata.tr_spenddata.internal_key;
523    }
524    if (sigdata.tr_builder.has_value() && sigdata.tr_builder->HasScripts()) {
525        m_tap_tree = sigdata.tr_builder->GetTreeTuples();
526    }
527    for (const auto& [pubkey, leaf_origin] : sigdata.taproot_misc_pubkeys) {
528        m_tap_bip32_paths.emplace(pubkey, leaf_origin);
529    }
530    m_musig2_participants.insert(sigdata.musig2_pubkeys.begin(), sigdata.musig2_pubkeys.end());
531}
532
533void PSBTOutput::Merge(const PSBTOutput& output)
534{
535    hd_keypaths.insert(output.hd_keypaths.begin(), output.hd_keypaths.end());
536    m_proprietary.insert(output.m_proprietary.begin(), output.m_proprietary.end());
537    unknown.insert(output.unknown.begin(), output.unknown.end());
538    m_tap_bip32_paths.insert(output.m_tap_bip32_paths.begin(), output.m_tap_bip32_paths.end());
539
540    if (redeem_script.empty() && !output.redeem_script.empty()) redeem_script = output.redeem_script;
541    if (witness_script.empty() && !output.witness_script.empty()) witness_script = output.witness_script;
542    if (m_tap_internal_key.IsNull() && !output.m_tap_internal_key.IsNull()) m_tap_internal_key = output.m_tap_internal_key;
543    if (m_tap_tree.empty() && !output.m_tap_tree.empty()) m_tap_tree = output.m_tap_tree;
544    m_musig2_participants.insert(output.m_musig2_participants.begin(), output.m_musig2_participants.end());
545}
546
547bool PSBTInputSigned(const PSBTInput& input)
548{
549    return !input.final_script_sig.empty() || !input.final_script_witness.IsNull();
550}
551
552bool PSBTInputSignedAndVerified(const PartiallySignedTransaction& psbt, unsigned int input_index, const PrecomputedTransactionData* txdata)
553{
554    CTxOut utxo;
555    assert(input_index < psbt.inputs.size());
556    const PSBTInput& input = psbt.inputs[input_index];
557
558    if (input.non_witness_utxo) {
559        // If we're taking our information from a non-witness UTXO, verify that it matches the prevout.
560        COutPoint prevout = input.GetOutPoint();
561        if (prevout.n >= input.non_witness_utxo->vout.size()) {
562            return false;
563        }
564        if (input.non_witness_utxo->GetHash() != prevout.hash) {
565            return false;
566        }
567        utxo = input.non_witness_utxo->vout[prevout.n];
568    } else if (!input.witness_utxo.IsNull()) {
569        utxo = input.witness_utxo;
570    } else {
571        return false;
572    }
573
574    std::optional<CMutableTransaction> unsigned_tx = psbt.GetUnsignedTx();
575    if (!unsigned_tx) {
576        return false;
577    }
578    const CMutableTransaction& tx = *unsigned_tx;
579    if (txdata) {
580        return VerifyScript(input.final_script_sig, utxo.scriptPubKey, &input.final_script_witness, STANDARD_SCRIPT_VERIFY_FLAGS, MutableTransactionSignatureChecker{&tx, input_index, utxo.nValue, *txdata, MissingDataBehavior::FAIL});
581    } else {
582        return VerifyScript(input.final_script_sig, utxo.scriptPubKey, &input.final_script_witness, STANDARD_SCRIPT_VERIFY_FLAGS, MutableTransactionSignatureChecker{&tx, input_index, utxo.nValue, MissingDataBehavior::FAIL});
583    }
584}
585
586size_t CountPSBTUnsignedInputs(const PartiallySignedTransaction& psbt) {
587    size_t count = 0;
588    for (const auto& input : psbt.inputs) {
589        if (!PSBTInputSigned(input)) {
590            count++;
591        }
592    }
593
594    return count;
595}
596
597void UpdatePSBTOutput(const SigningProvider& provider, PartiallySignedTransaction& psbt, int index)
598{
599    std::optional<CMutableTransaction> unsigned_tx = psbt.GetUnsignedTx();
600    if (!unsigned_tx) {
601        return;
602    }
603    const CTxOut& out = unsigned_tx->vout.at(index);
604    PSBTOutput& psbt_out = psbt.outputs.at(index);
605
606    // Fill a SignatureData with output info
607    SignatureData sigdata;
608    psbt_out.FillSignatureData(sigdata);
609
610    // Construct a would-be spend of this output, to update sigdata with.
611    // Note that ProduceSignature is used to fill in metadata (not actual signatures),
612    // so provider does not need to provide any private keys (it can be a HidingSigningProvider).
613    CMutableTransaction tx{};
614    tx.vin.emplace_back();
615    MutableTransactionSignatureCreator creator(tx, /*input_idx=*/0, out.nValue, {.sighash_type = SIGHASH_ALL});
616    ProduceSignature(provider, creator, out.scriptPubKey, sigdata);
617
618    // Put redeem_script, witness_script, key paths, into PSBTOutput.
619    psbt_out.FromSignatureData(sigdata);
620}
621
622std::optional<PrecomputedTransactionData> PrecomputePSBTData(const PartiallySignedTransaction& psbt)
623{
624    std::optional<CMutableTransaction> unsigned_tx = psbt.GetUnsignedTx();
625    if (!unsigned_tx) {
626        return std::nullopt;
627    }
628    const CMutableTransaction& tx = *unsigned_tx;
629    bool have_all_spent_outputs = true;
630    std::vector<CTxOut> utxos;
631    for (const PSBTInput& input : psbt.inputs) {
632        if (!input.GetUTXO(utxos.emplace_back())) have_all_spent_outputs = false;
633    }
634    PrecomputedTransactionData txdata;
635    if (have_all_spent_outputs) {
636        txdata.Init(tx, std::move(utxos), true);
637    } else {
638        txdata.Init(tx, {}, true);
639    }
640    return txdata;
641}
642
643util::Expected<void, PSBTError> SignPSBTInput(const SigningProvider& provider, PartiallySignedTransaction& psbt, int index, const PrecomputedTransactionData* txdata, const common::PSBTFillOptions& options,  SignatureData* out_sigdata)
644{
645    PSBTInput& input = psbt.inputs.at(index);
646    std::optional<CMutableTransaction> unsigned_tx = psbt.GetUnsignedTx();
647    if (!unsigned_tx) {
648        return util::Unexpected{PSBTError::INVALID_TX};
649    }
650    const CMutableTransaction& tx = *unsigned_tx;
651
652    if (PSBTInputSignedAndVerified(psbt, index, txdata)) {
653        return {};
654    }
655
656    // Fill SignatureData with input info
657    SignatureData sigdata;
658    input.FillSignatureData(sigdata);
659
660    // Get UTXO
661    bool require_witness_sig = false;
662    CTxOut utxo;
663
664    if (input.non_witness_utxo) {
665        // If we're taking our information from a non-witness UTXO, verify that it matches the prevout.
666        COutPoint prevout = input.GetOutPoint();
667        if (prevout.n >= input.non_witness_utxo->vout.size()) {
668            return util::Unexpected{PSBTError::MISSING_INPUTS};
669        }
670        if (input.non_witness_utxo->GetHash() != prevout.hash) {
671            return util::Unexpected{PSBTError::MISSING_INPUTS};
672        }
673        utxo = input.non_witness_utxo->vout[prevout.n];
674    } else if (!input.witness_utxo.IsNull()) {
675        utxo = input.witness_utxo;
676        // When we're taking our information from a witness UTXO, we can't verify it is actually data from
677        // the output being spent. This is safe in case a witness signature is produced (which includes this
678        // information directly in the hash), but not for non-witness signatures. Remember that we require
679        // a witness signature in this situation.
680        require_witness_sig = true;
681    } else {
682        return util::Unexpected{PSBTError::MISSING_INPUTS};
683    }
684
685    // Get the sighash type
686    // If both the field and the parameter are provided, they must match
687    // If only the parameter is provided, use it and add it to the PSBT if it is other than SIGHASH_DEFAULT
688    // for all input types, and not SIGHASH_ALL for non-taproot input types.
689    // If neither are provided, use SIGHASH_DEFAULT if it is taproot, and SIGHASH_ALL for everything else.
690    int sighash{options.sighash_type.value_or(utxo.scriptPubKey.IsPayToTaproot() ? SIGHASH_DEFAULT : SIGHASH_ALL)};
691
692    // For user safety, the desired sighash must be provided if the PSBT wants something other than the default set in the previous line.
693    if (input.sighash_type && input.sighash_type != sighash) {
694        return util::Unexpected{PSBTError::SIGHASH_MISMATCH};
695    }
696    // Set the PSBT sighash field when sighash is not DEFAULT or ALL
697    // DEFAULT is allowed for non-taproot inputs since DEFAULT may be passed for them (e.g. the psbt being signed also has taproot inputs)
698    // Note that signing already aliases DEFAULT to ALL for non-taproot inputs.
699    if (utxo.scriptPubKey.IsPayToTaproot() ? sighash != SIGHASH_DEFAULT :
700                                            (sighash != SIGHASH_DEFAULT && sighash != SIGHASH_ALL)) {
701        input.sighash_type = sighash;
702    }
703
704    // Check all existing signatures use the sighash type
705    if (sighash == SIGHASH_DEFAULT) {
706        if (!input.m_tap_key_sig.empty() && input.m_tap_key_sig.size() != 64) {
707            return util::Unexpected{PSBTError::SIGHASH_MISMATCH};
708        }
709        for (const auto& [_, sig] : input.m_tap_script_sigs) {
710            if (sig.size() != 64) return util::Unexpected{PSBTError::SIGHASH_MISMATCH};
711        }
712    } else {
713        if (!input.m_tap_key_sig.empty() && (input.m_tap_key_sig.size() != 65 || input.m_tap_key_sig.back() != sighash)) {
714            return util::Unexpected{PSBTError::SIGHASH_MISMATCH};
715        }
716        for (const auto& [_, sig] : input.m_tap_script_sigs) {
717            if (sig.size() != 65 || sig.back() != sighash) return util::Unexpected{PSBTError::SIGHASH_MISMATCH};
718        }
719        for (const auto& [_, sig] : input.partial_sigs) {
720            if (sig.second.back() != sighash) return util::Unexpected{PSBTError::SIGHASH_MISMATCH};
721        }
722    }
723
724    sigdata.witness = false;
725    bool sig_complete;
726    if (txdata == nullptr) {
727        sig_complete = ProduceSignature(provider, DUMMY_SIGNATURE_CREATOR, utxo.scriptPubKey, sigdata);
728    } else {
729        MutableTransactionSignatureCreator creator(tx, index, utxo.nValue, txdata, {.sighash_type = sighash});
730        sig_complete = ProduceSignature(provider, creator, utxo.scriptPubKey, sigdata);
731    }
732    // Verify that a witness signature was produced in case one was required.
733    if (require_witness_sig && !sigdata.witness) return util::Unexpected{PSBTError::INCOMPLETE};
734
735    // If we are not finalizing, set sigdata.complete to false to not set the scriptWitness
736    if (!options.finalize && sigdata.complete) sigdata.complete = false;
737
738    input.FromSignatureData(sigdata);
739
740    // If we have a witness signature, put a witness UTXO.
741    if (sigdata.witness) {
742        input.witness_utxo = utxo;
743        // We can remove the non_witness_utxo if and only if there are no non-segwit or segwit v0
744        // inputs in this transaction. Since this requires inspecting the entire transaction, this
745        // is something for the caller to deal with (i.e. FillPSBT).
746    }
747
748    // Fill in the missing info
749    if (out_sigdata) {
750        out_sigdata->missing_pubkeys = sigdata.missing_pubkeys;