How Bitcoin checks a spending script

1001
1002                    if (opcode == OP_NUMEQUALVERIFY)
1003                    {
1004                        if (CastToBool(stacktop(-1)))
1005                            popstack(stack);
1006                        else
1007                            return set_error(serror, SCRIPT_ERR_NUMEQUALVERIFY);
1008                    }
1009                }
1010                break;
1011
1012                case OP_WITHIN:
1013                {
1014                    // (x min max -- out)
1015                    if (stack.size() < 3)
1016                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
1017                    CScriptNum bn1(stacktop(-3), fRequireMinimal);
1018                    CScriptNum bn2(stacktop(-2), fRequireMinimal);
1019                    CScriptNum bn3(stacktop(-1), fRequireMinimal);
1020                    bool fValue = (bn2 <= bn1 && bn1 < bn3);
1021                    popstack(stack);
1022                    popstack(stack);
1023                    popstack(stack);
1024                    stack.push_back(fValue ? vchTrue : vchFalse);
1025                }
1026                break;
1027
1028
1029                //
1030                // Crypto
1031                //
1032                case OP_RIPEMD160:
1033                case OP_SHA1:
1034                case OP_SHA256:
1035                case OP_HASH160:
1036                case OP_HASH256:
1037                {
1038                    // (in -- hash)
1039                    if (stack.size() < 1)
1040                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
1041                    valtype& vch = stacktop(-1);
1042                    valtype vchHash((opcode == OP_RIPEMD160 || opcode == OP_SHA1 || opcode == OP_HASH160) ? 20 : 32);
1043                    if (opcode == OP_RIPEMD160)
1044                        CRIPEMD160().Write(vch.data(), vch.size()).Finalize(vchHash.data());
1045                    else if (opcode == OP_SHA1)
1046                        CSHA1().Write(vch.data(), vch.size()).Finalize(vchHash.data());
1047                    else if (opcode == OP_SHA256)
1048                        CSHA256().Write(vch.data(), vch.size()).Finalize(vchHash.data());
1049                    else if (opcode == OP_HASH160)
1050                        CHash160().Write(vch).Finalize(vchHash);
1051                    else if (opcode == OP_HASH256)
1052                        CHash256().Write(vch).Finalize(vchHash);
1053                    popstack(stack);
1054                    stack.push_back(vchHash);
1055                }
1056                break;
1057
1058                case OP_CODESEPARATOR:
1059                {
1060                    // If SCRIPT_VERIFY_CONST_SCRIPTCODE flag is set, use of OP_CODESEPARATOR is rejected in pre-segwit
1061                    // script, even in an unexecuted branch (this is checked above the opcode case statement).
1062
1063                    // Hash starts after the code separator
1064                    pbegincodehash = pc;
1065                    execdata.m_codeseparator_pos = opcode_pos;
1066                }
1067                break;
1068
1069                case OP_CHECKSIG:
1070                case OP_CHECKSIGVERIFY:
1071                {
1072                    // (sig pubkey -- bool)
1073                    if (stack.size() < 2)
1074                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
1075
1076                    valtype& vchSig    = stacktop(-2);
1077                    valtype& vchPubKey = stacktop(-1);
1078
1079                    bool fSuccess = true;
1080                    if (!EvalChecksig(vchSig, vchPubKey, pbegincodehash, pend, execdata, flags, checker, sigversion, serror, fSuccess)) return false;
1081                    popstack(stack);
1082                    popstack(stack);
1083                    stack.push_back(fSuccess ? vchTrue : vchFalse);
1084                    if (opcode == OP_CHECKSIGVERIFY)
1085                    {
1086                        if (fSuccess)
1087                            popstack(stack);
1088                        else
1089                            return set_error(serror, SCRIPT_ERR_CHECKSIGVERIFY);
1090                    }
1091                }
1092                break;
1093
1094                case OP_CHECKSIGADD:
1095                {
1096                    // OP_CHECKSIGADD is only available in Tapscript
1097                    if (sigversion == SigVersion::BASE || sigversion == SigVersion::WITNESS_V0) return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
1098
1099                    // (sig num pubkey -- num)
1100                    if (stack.size() < 3) return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
1101
1102                    const valtype& sig = stacktop(-3);
1103                    const CScriptNum num(stacktop(-2), fRequireMinimal);
1104                    const valtype& pubkey = stacktop(-1);
1105
1106                    bool success = true;
1107                    if (!EvalChecksig(sig, pubkey, pbegincodehash, pend, execdata, flags, checker, sigversion, serror, success)) return false;
1108                    popstack(stack);
1109                    popstack(stack);
1110                    popstack(stack);
1111                    stack.push_back((num + (success ? 1 : 0)).getvch());
1112                }
1113                break;
1114
1115                case OP_CHECKMULTISIG:
1116                case OP_CHECKMULTISIGVERIFY:
1117                {
1118                    if (sigversion == SigVersion::TAPSCRIPT) return set_error(serror, SCRIPT_ERR_TAPSCRIPT_CHECKMULTISIG);
1119
1120                    // ([sig ...] num_of_signatures [pubkey ...] num_of_pubkeys -- bool)
1121
1122                    int i = 1;
1123                    if ((int)stack.size() < i)
1124                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
1125
1126                    int nKeysCount = CScriptNum(stacktop(-i), fRequireMinimal).getint();
1127                    if (nKeysCount < 0 || nKeysCount > MAX_PUBKEYS_PER_MULTISIG)
1128                        return set_error(serror, SCRIPT_ERR_PUBKEY_COUNT);
1129                    nOpCount += nKeysCount;
1130                    if (nOpCount > MAX_OPS_PER_SCRIPT)
1131                        return set_error(serror, SCRIPT_ERR_OP_COUNT);
1132                    int ikey = ++i;
1133                    // ikey2 is the position of last non-signature item in the stack. Top stack item = 1.
1134                    // With SCRIPT_VERIFY_NULLFAIL, this is used for cleanup if operation fails.
1135                    int ikey2 = nKeysCount + 2;
1136                    i += nKeysCount;
1137                    if ((int)stack.size() < i)
1138                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
1139
1140                    int nSigsCount = CScriptNum(stacktop(-i), fRequireMinimal).getint();
1141                    if (nSigsCount < 0 || nSigsCount > nKeysCount)
1142                        return set_error(serror, SCRIPT_ERR_SIG_COUNT);
1143                    int isig = ++i;
1144                    i += nSigsCount;
1145                    if ((int)stack.size() < i)
1146                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
1147
1148                    // Subset of script starting at the most recent codeseparator
1149                    CScript scriptCode(pbegincodehash, pend);
1150
1151                    // Drop the signature in pre-segwit scripts but not segwit scripts
1152                    for (int k = 0; k < nSigsCount; k++)
1153                    {
1154                        valtype& vchSig = stacktop(-isig-k);
1155                        if (sigversion == SigVersion::BASE) {
1156                            int found = FindAndDelete(scriptCode, CScript() << vchSig);
1157                            if (found > 0 && (flags & SCRIPT_VERIFY_CONST_SCRIPTCODE))
1158                                return set_error(serror, SCRIPT_ERR_SIG_FINDANDDELETE);
1159                        }
1160                    }
1161
1162                    bool fSuccess = true;
1163                    while (fSuccess && nSigsCount > 0)
1164                    {
1165                        valtype& vchSig    = stacktop(-isig);
1166                        valtype& vchPubKey = stacktop(-ikey);
1167
1168                        // Note how this makes the exact order of pubkey/signature evaluation
1169                        // distinguishable by CHECKMULTISIG NOT if the STRICTENC flag is set.
1170                        // See the script_(in)valid tests for details.
1171                        if (!CheckSignatureEncoding(vchSig, flags, serror) || !CheckPubKeyEncoding(vchPubKey, flags, sigversion, serror)) {
1172                            // serror is set
1173                            return false;
1174                        }
1175
1176                        // Check signature
1177                        bool fOk = checker.CheckECDSASignature(vchSig, vchPubKey, scriptCode, sigversion);
1178
1179                        if (fOk) {
1180                            isig++;
1181                            nSigsCount--;
1182                        }
1183                        ikey++;
1184                        nKeysCount--;
1185
1186                        // If there are more signatures left than keys left,
1187                        // then too many signatures have failed. Exit early,
1188                        // without checking any further signatures.
1189                        if (nSigsCount > nKeysCount)
1190                            fSuccess = false;
1191                    }
1192
1193                    // Clean up stack of actual arguments
1194                    while (i-- > 1) {
1195                        // If the operation failed, we require that all signatures must be empty vector
1196                        if (!fSuccess && (flags & SCRIPT_VERIFY_NULLFAIL) && !ikey2 && stacktop(-1).size())
1197                            return set_error(serror, SCRIPT_ERR_SIG_NULLFAIL);
1198                        if (ikey2 > 0)
1199                            ikey2--;
1200                        popstack(stack);
1201                    }
1202
1203                    // A bug causes CHECKMULTISIG to consume one extra argument
1204                    // whose contents were not checked in any way.
1205                    //
1206                    // Unfortunately this is a potential source of mutability,
1207                    // so optionally verify it is exactly equal to zero prior
1208                    // to removing it from the stack.
1209                    if (stack.size() < 1)
1210                        return set_error(serror, SCRIPT_ERR_INVALID_STACK_OPERATION);
1211                    if ((flags & SCRIPT_VERIFY_NULLDUMMY) && stacktop(-1).size())
1212                        return set_error(serror, SCRIPT_ERR_SIG_NULLDUMMY);
1213                    popstack(stack);
1214
1215                    stack.push_back(fSuccess ? vchTrue : vchFalse);
1216
1217                    if (opcode == OP_CHECKMULTISIGVERIFY)
1218                    {
1219                        if (fSuccess)
1220                            popstack(stack);
1221                        else
1222                            return set_error(serror, SCRIPT_ERR_CHECKMULTISIGVERIFY);
1223                    }
1224                }
1225                break;
1226
1227                default:
1228                    return set_error(serror, SCRIPT_ERR_BAD_OPCODE);
1229            }
1230
1231            // Size limits
1232            if (stack.size() + altstack.size() > MAX_STACK_SIZE)
1233                return set_error(serror, SCRIPT_ERR_STACK_SIZE);
1234        }
1235    }
1236    catch (const scriptnum_error&)
1237    {
1238        return set_error(serror, SCRIPT_ERR_SCRIPTNUM);
1239    }
1240    catch (...)
1241    {
1242        return set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
1243    }
1244
1245    if (!vfExec.empty())
1246        return set_error(serror, SCRIPT_ERR_UNBALANCED_CONDITIONAL);
1247
1248    return set_success(serror);
1249}
1250