1251bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, script_verify_flags flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* serror)
1252{
1253    ScriptExecutionData execdata;
1254    return EvalScript(stack, script, flags, checker, sigversion, execdata, serror);
1255}
1256
1257namespace {
1258
1259/**
1260 * Wrapper that serializes like CTransaction, but with the modifications
1261 *  required for the signature hash done in-place
1262 */
1263template <class T>
1264class CTransactionSignatureSerializer
1265{
1266private:
1267    const T& txTo;             //!< reference to the spending transaction (the one being serialized)
1268    const CScript& scriptCode; //!< output script being consumed
1269    const unsigned int nIn;    //!< input index of txTo being signed
1270    const bool fAnyoneCanPay;  //!< whether the hashtype has the SIGHASH_ANYONECANPAY flag set
1271    const bool fHashSingle;    //!< whether the hashtype is SIGHASH_SINGLE
1272    const bool fHashNone;      //!< whether the hashtype is SIGHASH_NONE
1273
1274public:
1275    CTransactionSignatureSerializer(const T& txToIn, const CScript& scriptCodeIn, unsigned int nInIn, int nHashTypeIn) :
1276        txTo(txToIn), scriptCode(scriptCodeIn), nIn(nInIn),
1277        fAnyoneCanPay(!!(nHashTypeIn & SIGHASH_ANYONECANPAY)),
1278        fHashSingle((nHashTypeIn & 0x1f) == SIGHASH_SINGLE),
1279        fHashNone((nHashTypeIn & 0x1f) == SIGHASH_NONE) {}
1280
1281    /** Serialize the passed scriptCode, skipping OP_CODESEPARATORs */
1282    template<typename S>
1283    void SerializeScriptCode(S &s) const {
1284        CScript::const_iterator it = scriptCode.begin();
1285        CScript::const_iterator itBegin = it;
1286        opcodetype opcode;
1287        unsigned int nCodeSeparators = 0;
1288        while (scriptCode.GetOp(it, opcode)) {
1289            if (opcode == OP_CODESEPARATOR)
1290                nCodeSeparators++;
1291        }
1292        ::WriteCompactSize(s, scriptCode.size() - nCodeSeparators);
1293        it = itBegin;
1294        while (scriptCode.GetOp(it, opcode)) {
1295            if (opcode == OP_CODESEPARATOR) {
1296                s.write(std::as_bytes(std::span{&itBegin[0], size_t(it - itBegin - 1)}));
1297                itBegin = it;
1298            }
1299        }
1300        if (itBegin != scriptCode.end())
1301            s.write(std::as_bytes(std::span{&itBegin[0], size_t(it - itBegin)}));
1302    }
1303
1304    /** Serialize an input of txTo */
1305    template<typename S>
1306    void SerializeInput(S &s, unsigned int nInput) const {
1307        // In case of SIGHASH_ANYONECANPAY, only the input being signed is serialized
1308        if (fAnyoneCanPay)
1309            nInput = nIn;
1310        // Serialize the prevout
1311        ::Serialize(s, txTo.vin[nInput].prevout);
1312        // Serialize the script
1313        if (nInput != nIn)
1314            // Blank out other inputs' signatures
1315            ::Serialize(s, CScript());
1316        else
1317            SerializeScriptCode(s);
1318        // Serialize the nSequence
1319        if (nInput != nIn && (fHashSingle || fHashNone))
1320            // let the others update at will
1321            ::Serialize(s, int32_t{0});
1322        else
1323            ::Serialize(s, txTo.vin[nInput].nSequence);
1324    }
1325
1326    /** Serialize an output of txTo */
1327    template<typename S>
1328    void SerializeOutput(S &s, unsigned int nOutput) const {
1329        if (fHashSingle && nOutput != nIn)
1330            // Do not lock-in the txout payee at other indices as txin
1331            ::Serialize(s, CTxOut());
1332        else
1333            ::Serialize(s, txTo.vout[nOutput]);
1334    }
1335
1336    /** Serialize txTo */
1337    template<typename S>
1338    void Serialize(S &s) const {
1339        // Serialize version
1340        ::Serialize(s, txTo.version);
1341        // Serialize vin
1342        unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
1343        ::WriteCompactSize(s, nInputs);
1344        for (unsigned int nInput = 0; nInput < nInputs; nInput++)
1345             SerializeInput(s, nInput);
1346        // Serialize vout
1347        unsigned int nOutputs = fHashNone ? 0 : (fHashSingle ? nIn+1 : txTo.vout.size());
1348        ::WriteCompactSize(s, nOutputs);
1349        for (unsigned int nOutput = 0; nOutput < nOutputs; nOutput++)
1350             SerializeOutput(s, nOutput);
1351        // Serialize nLockTime
1352        ::Serialize(s, txTo.nLockTime);
1353    }
1354};
1355
1356/** Compute the (single) SHA256 of the concatenation of all prevouts of a tx. */
1357template <class T>
1358uint256 GetPrevoutsSHA256(const T& txTo)
1359{
1360    HashWriter ss{};
1361    for (const auto& txin : txTo.vin) {
1362        ss << txin.prevout;
1363    }
1364    return ss.GetSHA256();
1365}
1366
1367/** Compute the (single) SHA256 of the concatenation of all nSequences of a tx. */
1368template <class T>
1369uint256 GetSequencesSHA256(const T& txTo)
1370{
1371    HashWriter ss{};
1372    for (const auto& txin : txTo.vin) {
1373        ss << txin.nSequence;
1374    }
1375    return ss.GetSHA256();
1376}
1377
1378/** Compute the (single) SHA256 of the concatenation of all txouts of a tx. */
1379template <class T>
1380uint256 GetOutputsSHA256(const T& txTo)
1381{
1382    HashWriter ss{};
1383    for (const auto& txout : txTo.vout) {
1384        ss << txout;
1385    }
1386    return ss.GetSHA256();
1387}
1388
1389/** Compute the (single) SHA256 of the concatenation of all amounts spent by a tx. */
1390uint256 GetSpentAmountsSHA256(const std::vector<CTxOut>& outputs_spent)
1391{
1392    HashWriter ss{};
1393    for (const auto& txout : outputs_spent) {
1394        ss << txout.nValue;
1395    }
1396    return ss.GetSHA256();
1397}
1398
1399/** Compute the (single) SHA256 of the concatenation of all scriptPubKeys spent by a tx. */
1400uint256 GetSpentScriptsSHA256(const std::vector<CTxOut>& outputs_spent)
1401{
1402    HashWriter ss{};
1403    for (const auto& txout : outputs_spent) {
1404        ss << txout.scriptPubKey;
1405    }
1406    return ss.GetSHA256();
1407}
1408
1409
1410} // namespace
1411
1412template <class T>
1413void PrecomputedTransactionData::Init(const T& txTo, std::vector<CTxOut>&& spent_outputs, bool force)
1414{
1415    assert(!m_spent_outputs_ready);
1416
1417    m_spent_outputs = std::move(spent_outputs);
1418    if (!m_spent_outputs.empty()) {
1419        assert(m_spent_outputs.size() == txTo.vin.size());
1420        m_spent_outputs_ready = true;
1421    }
1422
1423    // Determine which precomputation-impacting features this transaction uses.
1424    bool uses_bip143_segwit = force;
1425    bool uses_bip341_taproot = force;
1426    for (size_t inpos = 0; inpos < txTo.vin.size() && !(uses_bip143_segwit && uses_bip341_taproot); ++inpos) {
1427        if (!txTo.vin[inpos].scriptWitness.IsNull()) {
1428            if (m_spent_outputs_ready && m_spent_outputs[inpos].scriptPubKey.size() == 2 + WITNESS_V1_TAPROOT_SIZE &&
1429                m_spent_outputs[inpos].scriptPubKey[0] == OP_1) {
1430                // Treat every witness-bearing spend with 34-byte scriptPubKey that starts with OP_1 as a Taproot
1431                // spend. This only works if spent_outputs was provided as well, but if it wasn't, actual validation
1432                // will fail anyway. Note that this branch may trigger for scriptPubKeys that aren't actually segwit
1433                // but in that case validation will fail as SCRIPT_ERR_WITNESS_UNEXPECTED anyway.
1434                uses_bip341_taproot = true;
1435            } else {
1436                // Treat every spend that's not known to native witness v1 as a Witness v0 spend. This branch may
1437                // also be taken for unknown witness versions, but it is harmless, and being precise would require
1438                // P2SH evaluation to find the redeemScript.
1439                uses_bip143_segwit = true;
1440            }
1441        }
1442        if (uses_bip341_taproot && uses_bip143_segwit) break; // No need to scan further if we already need all.
1443    }
1444
1445    if (uses_bip143_segwit || uses_bip341_taproot) {
1446        // Computations shared between both sighash schemes.
1447        m_prevouts_single_hash = GetPrevoutsSHA256(txTo);
1448        m_sequences_single_hash = GetSequencesSHA256(txTo);
1449        m_outputs_single_hash = GetOutputsSHA256(txTo);
1450    }
1451    if (uses_bip143_segwit) {
1452        hashPrevouts = SHA256Uint256(m_prevouts_single_hash);
1453        hashSequence = SHA256Uint256(m_sequences_single_hash);
1454        hashOutputs = SHA256Uint256(m_outputs_single_hash);
1455        m_bip143_segwit_ready = true;
1456    }
1457    if (uses_bip341_taproot && m_spent_outputs_ready) {
1458        m_spent_amounts_single_hash = GetSpentAmountsSHA256(m_spent_outputs);
1459        m_spent_scripts_single_hash = GetSpentScriptsSHA256(m_spent_outputs);
1460        m_bip341_taproot_ready = true;
1461    }
1462}
1463
1464template <class T>
1465PrecomputedTransactionData::PrecomputedTransactionData(const T& txTo)
1466{
1467    Init(txTo, {});
1468}
1469
1470// explicit instantiation
1471template void PrecomputedTransactionData::Init(const CTransaction& txTo, std::vector<CTxOut>&& spent_outputs, bool force);
1472template void PrecomputedTransactionData::Init(const CMutableTransaction& txTo, std::vector<CTxOut>&& spent_outputs, bool force);
1473template PrecomputedTransactionData::PrecomputedTransactionData(const CTransaction& txTo);
1474template PrecomputedTransactionData::PrecomputedTransactionData(const CMutableTransaction& txTo);
1475
1476const HashWriter HASHER_TAPSIGHASH{TaggedHash("TapSighash")};
1477const HashWriter HASHER_TAPLEAF{TaggedHash("TapLeaf")};
1478const HashWriter HASHER_TAPBRANCH{TaggedHash("TapBranch")};
1479
1480static bool HandleMissingData(MissingDataBehavior mdb)
1481{
1482    switch (mdb) {
1483    case MissingDataBehavior::ASSERT_FAIL:
1484        assert(!"Missing data");
1485        break;
1486    case MissingDataBehavior::FAIL:
1487        return false;
1488    }
1489    assert(!"Unknown MissingDataBehavior value");
1490}
1491
1492template<typename T>
1493bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, const T& tx_to, uint32_t in_pos, uint8_t hash_type, SigVersion sigversion, const PrecomputedTransactionData& cache, MissingDataBehavior mdb)
1494{
1495    uint8_t ext_flag, key_version;
1496    switch (sigversion) {
1497    case SigVersion::TAPROOT:
1498        ext_flag = 0;
1499        // key_version is not used and left uninitialized.
1500        break;