How Bitcoin checks a spending script

1501    case SigVersion::TAPSCRIPT:
1502        ext_flag = 1;
1503        // key_version must be 0 for now, representing the current version of
1504        // 32-byte public keys in the tapscript signature opcode execution.
1505        // An upgradable public key version (with a size not 32-byte) may
1506        // request a different key_version with a new sigversion.
1507        key_version = 0;
1508        break;
1509    default:
1510        assert(false);
1511    }
1512    assert(in_pos < tx_to.vin.size());
1513    if (!(cache.m_bip341_taproot_ready && cache.m_spent_outputs_ready)) {
1514        return HandleMissingData(mdb);
1515    }
1516
1517    HashWriter ss{HASHER_TAPSIGHASH};
1518
1519    // Epoch
1520    static constexpr uint8_t EPOCH = 0;
1521    ss << EPOCH;
1522
1523    // Hash type
1524    const uint8_t output_type = (hash_type == SIGHASH_DEFAULT) ? SIGHASH_ALL : (hash_type & SIGHASH_OUTPUT_MASK); // Default (no sighash byte) is equivalent to SIGHASH_ALL
1525    const uint8_t input_type = hash_type & SIGHASH_INPUT_MASK;
1526    if (!(hash_type <= 0x03 || (hash_type >= 0x81 && hash_type <= 0x83))) return false;
1527    ss << hash_type;
1528
1529    // Transaction level data
1530    ss << tx_to.version;
1531    ss << tx_to.nLockTime;
1532    if (input_type != SIGHASH_ANYONECANPAY) {
1533        ss << cache.m_prevouts_single_hash;
1534        ss << cache.m_spent_amounts_single_hash;
1535        ss << cache.m_spent_scripts_single_hash;
1536        ss << cache.m_sequences_single_hash;
1537    }
1538    if (output_type == SIGHASH_ALL) {
1539        ss << cache.m_outputs_single_hash;
1540    }
1541
1542    // Data about the input/prevout being spent
1543    assert(execdata.m_annex_init);
1544    const bool have_annex = execdata.m_annex_present;
1545    const uint8_t spend_type = (ext_flag << 1) + (have_annex ? 1 : 0); // The low bit indicates whether an annex is present.
1546    ss << spend_type;
1547    if (input_type == SIGHASH_ANYONECANPAY) {
1548        ss << tx_to.vin[in_pos].prevout;
1549        ss << cache.m_spent_outputs[in_pos];
1550        ss << tx_to.vin[in_pos].nSequence;
1551    } else {
1552        ss << in_pos;
1553    }
1554    if (have_annex) {
1555        ss << execdata.m_annex_hash;
1556    }
1557
1558    // Data about the output (if only one).
1559    if (output_type == SIGHASH_SINGLE) {
1560        if (in_pos >= tx_to.vout.size()) return false;
1561        if (!execdata.m_output_hash) {
1562            HashWriter sha_single_output{};
1563            sha_single_output << tx_to.vout[in_pos];
1564            execdata.m_output_hash = sha_single_output.GetSHA256();
1565        }
1566        ss << execdata.m_output_hash.value();
1567    }
1568
1569    // Additional data for BIP 342 signatures
1570    if (sigversion == SigVersion::TAPSCRIPT) {
1571        assert(execdata.m_tapleaf_hash_init);
1572        ss << execdata.m_tapleaf_hash;
1573        ss << key_version;
1574        assert(execdata.m_codeseparator_pos_init);
1575        ss << execdata.m_codeseparator_pos;
1576    }
1577
1578    hash_out = ss.GetSHA256();
1579    return true;
1580}
1581
1582int SigHashCache::CacheIndex(int32_t hash_type) const noexcept
1583{
1584    // Note that we do not distinguish between BASE and WITNESS_V0 to determine the cache index,
1585    // because no input can simultaneously use both.
1586    return 3 * !!(hash_type & SIGHASH_ANYONECANPAY) +
1587           2 * ((hash_type & 0x1f) == SIGHASH_SINGLE) +
1588           1 * ((hash_type & 0x1f) == SIGHASH_NONE);
1589}
1590
1591bool SigHashCache::Load(int32_t hash_type, const CScript& script_code, HashWriter& writer) const noexcept
1592{
1593    auto& entry = m_cache_entries[CacheIndex(hash_type)];
1594    if (entry.has_value()) {
1595        if (script_code == entry->first) {
1596            writer = HashWriter(entry->second);
1597            return true;
1598        }
1599    }
1600    return false;
1601}
1602
1603void SigHashCache::Store(int32_t hash_type, const CScript& script_code, const HashWriter& writer) noexcept
1604{
1605    auto& entry = m_cache_entries[CacheIndex(hash_type)];
1606    entry.emplace(script_code, writer);
1607}
1608
1609template <class T>
1610uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn, int32_t nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache, SigHashCache* sighash_cache)
1611{
1612    assert(nIn < txTo.vin.size());
1613
1614    if (sigversion != SigVersion::WITNESS_V0) {
1615        // Check for invalid use of SIGHASH_SINGLE
1616        if ((nHashType & 0x1f) == SIGHASH_SINGLE) {
1617            if (nIn >= txTo.vout.size()) {
1618                //  nOut out of range
1619                return uint256::ONE;
1620            }
1621        }
1622    }
1623
1624    HashWriter ss{};
1625
1626    // Try to compute using cached SHA256 midstate.
1627    if (sighash_cache && sighash_cache->Load(nHashType, scriptCode, ss)) {
1628        // Add sighash type and hash.
1629        ss << nHashType;
1630        return ss.GetHash();
1631    }
1632
1633    if (sigversion == SigVersion::WITNESS_V0) {
1634        uint256 hashPrevouts;
1635        uint256 hashSequence;
1636        uint256 hashOutputs;
1637        const bool cacheready = cache && cache->m_bip143_segwit_ready;
1638
1639        if (!(nHashType & SIGHASH_ANYONECANPAY)) {
1640            hashPrevouts = cacheready ? cache->hashPrevouts : SHA256Uint256(GetPrevoutsSHA256(txTo));
1641        }
1642
1643        if (!(nHashType & SIGHASH_ANYONECANPAY) && (nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
1644            hashSequence = cacheready ? cache->hashSequence : SHA256Uint256(GetSequencesSHA256(txTo));
1645        }
1646
1647        if ((nHashType & 0x1f) != SIGHASH_SINGLE && (nHashType & 0x1f) != SIGHASH_NONE) {
1648            hashOutputs = cacheready ? cache->hashOutputs : SHA256Uint256(GetOutputsSHA256(txTo));
1649        } else if ((nHashType & 0x1f) == SIGHASH_SINGLE && nIn < txTo.vout.size()) {
1650            HashWriter inner_ss{};
1651            inner_ss << txTo.vout[nIn];
1652            hashOutputs = inner_ss.GetHash();
1653        }
1654
1655        // Version
1656        ss << txTo.version;
1657        // Input prevouts/nSequence (none/all, depending on flags)
1658        ss << hashPrevouts;
1659        ss << hashSequence;
1660        // The input being signed (replacing the scriptSig with scriptCode + amount)
1661        // The prevout may already be contained in hashPrevout, and the nSequence
1662        // may already be contain in hashSequence.
1663        ss << txTo.vin[nIn].prevout;
1664        ss << scriptCode;
1665        ss << amount;
1666        ss << txTo.vin[nIn].nSequence;
1667        // Outputs (none/one/all, depending on flags)
1668        ss << hashOutputs;
1669        // Locktime
1670        ss << txTo.nLockTime;
1671    } else {
1672        // Wrapper to serialize only the necessary parts of the transaction being signed
1673        CTransactionSignatureSerializer<T> txTmp(txTo, scriptCode, nIn, nHashType);
1674
1675        // Serialize
1676        ss << txTmp;
1677    }
1678
1679    // If a cache object was provided, store the midstate there.
1680    if (sighash_cache != nullptr) {
1681        sighash_cache->Store(nHashType, scriptCode, ss);
1682    }
1683
1684    // Add sighash type and hash.
1685    ss << nHashType;
1686    return ss.GetHash();
1687}
1688
1689template <class T>
1690bool GenericTransactionSignatureChecker<T>::VerifyECDSASignature(const std::vector<unsigned char>& vchSig, const CPubKey& pubkey, const uint256& sighash) const
1691{
1692    return pubkey.Verify(sighash, vchSig);
1693}
1694
1695template <class T>
1696bool GenericTransactionSignatureChecker<T>::VerifySchnorrSignature(std::span<const unsigned char> sig, const XOnlyPubKey& pubkey, const uint256& sighash) const
1697{
1698    return pubkey.VerifySchnorr(sighash, sig);
1699}
1700
1701template <class T>
1702bool GenericTransactionSignatureChecker<T>::CheckECDSASignature(const std::vector<unsigned char>& vchSigIn, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const
1703{
1704    CPubKey pubkey(vchPubKey);
1705    if (!pubkey.IsValid())
1706        return false;
1707
1708    // Hash type is one byte tacked on to the end of the signature
1709    std::vector<unsigned char> vchSig(vchSigIn);
1710    if (vchSig.empty())
1711        return false;
1712    int nHashType = vchSig.back();
1713    vchSig.pop_back();
1714
1715    // Witness sighashes need the amount.
1716    if (sigversion == SigVersion::WITNESS_V0 && amount < 0) return HandleMissingData(m_mdb);
1717
1718    uint256 sighash = SignatureHash(scriptCode, *txTo, nIn, nHashType, amount, sigversion, this->txdata, &m_sighash_cache);
1719
1720    if (!VerifyECDSASignature(vchSig, pubkey, sighash))
1721        return false;
1722
1723    return true;
1724}
1725
1726template <class T>
1727bool GenericTransactionSignatureChecker<T>::CheckSchnorrSignature(std::span<const unsigned char> sig, std::span<const unsigned char> pubkey_in, SigVersion sigversion, ScriptExecutionData& execdata, ScriptError* serror) const
1728{
1729    assert(sigversion == SigVersion::TAPROOT || sigversion == SigVersion::TAPSCRIPT);
1730    // Schnorr signatures have 32-byte public keys. The caller is responsible for enforcing this.
1731    assert(pubkey_in.size() == 32);
1732    // Note that in Tapscript evaluation, empty signatures are treated specially (invalid signature that does not
1733    // abort script execution). This is implemented in EvalChecksigTapscript, which won't invoke
1734    // CheckSchnorrSignature in that case. In other contexts, they are invalid like every other signature with
1735    // size different from 64 or 65.
1736    if (sig.size() != 64 && sig.size() != 65) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_SIZE);
1737
1738    XOnlyPubKey pubkey{pubkey_in};
1739
1740    uint8_t hashtype = SIGHASH_DEFAULT;
1741    if (sig.size() == 65) {
1742        hashtype = SpanPopBack(sig);
1743        if (hashtype == SIGHASH_DEFAULT) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
1744    }
1745    uint256 sighash;
1746    if (!this->txdata) return HandleMissingData(m_mdb);
1747    if (!SignatureHashSchnorr(sighash, execdata, *txTo, nIn, hashtype, sigversion, *this->txdata, m_mdb)) {
1748        return set_error(serror, SCRIPT_ERR_SCHNORR_SIG_HASHTYPE);
1749    }
1750    if (!VerifySchnorrSignature(sig, pubkey, sighash)) return set_error(serror, SCRIPT_ERR_SCHNORR_SIG);