2001        return true;
2002    } else {
2003        if (flags & SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM) {
2004            return set_error(serror, SCRIPT_ERR_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM);
2005        }
2006        // Other version/size/p2sh combinations return true for future softfork compatibility
2007        return true;
2008    }
2009    // There is intentionally no return statement here, to be able to use "control reaches end of non-void function" warnings to detect gaps in the logic above.
2010}
2011
2012bool VerifyScript(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness* witness, script_verify_flags flags, const BaseSignatureChecker& checker, ScriptError* serror)
2013{
2014    static const CScriptWitness emptyWitness;
2015    if (witness == nullptr) {
2016        witness = &emptyWitness;
2017    }
2018    bool hadWitness = false;
2019
2020    set_error(serror, SCRIPT_ERR_UNKNOWN_ERROR);
2021
2022    if ((flags & SCRIPT_VERIFY_SIGPUSHONLY) != 0 && !scriptSig.IsPushOnly()) {
2023        return set_error(serror, SCRIPT_ERR_SIG_PUSHONLY);
2024    }
2025
2026    // scriptSig and scriptPubKey must be evaluated sequentially on the same stack
2027    // rather than being simply concatenated (see CVE-2010-5141)
2028    std::vector<std::vector<unsigned char> > stack, stackCopy;
2029    if (!EvalScript(stack, scriptSig, flags, checker, SigVersion::BASE, serror))
2030        // serror is set
2031        return false;
2032    if (flags & SCRIPT_VERIFY_P2SH)
2033        stackCopy = stack;
2034    if (!EvalScript(stack, scriptPubKey, flags, checker, SigVersion::BASE, serror))
2035        // serror is set
2036        return false;
2037    if (stack.empty())
2038        return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
2039    if (CastToBool(stack.back()) == false)
2040        return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
2041
2042    // Bare witness programs
2043    int witnessversion;
2044    std::vector<unsigned char> witnessprogram;
2045    if (flags & SCRIPT_VERIFY_WITNESS) {
2046        if (scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram)) {
2047            hadWitness = true;
2048            if (scriptSig.size() != 0) {
2049                // The scriptSig must be _exactly_ CScript(), otherwise we reintroduce malleability.
2050                return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED);
2051            }
2052            if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/false)) {
2053                return false;
2054            }
2055            // Bypass the cleanstack check at the end. The actual stack is obviously not clean
2056            // for witness programs.
2057            stack.resize(1);
2058        }
2059    }
2060
2061    // Additional validation for spend-to-script-hash transactions:
2062    if ((flags & SCRIPT_VERIFY_P2SH) && scriptPubKey.IsPayToScriptHash())
2063    {
2064        // scriptSig must be literals-only or validation fails
2065        if (!scriptSig.IsPushOnly())
2066            return set_error(serror, SCRIPT_ERR_SIG_PUSHONLY);
2067
2068        // Restore stack.
2069        swap(stack, stackCopy);
2070
2071        // stack cannot be empty here, because if it was the
2072        // P2SH  HASH <> EQUAL  scriptPubKey would be evaluated with
2073        // an empty stack and the EvalScript above would return false.
2074        assert(!stack.empty());
2075
2076        const valtype& pubKeySerialized = stack.back();
2077        CScript pubKey2(pubKeySerialized.begin(), pubKeySerialized.end());
2078        popstack(stack);
2079
2080        if (!EvalScript(stack, pubKey2, flags, checker, SigVersion::BASE, serror))
2081            // serror is set
2082            return false;
2083        if (stack.empty())
2084            return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
2085        if (!CastToBool(stack.back()))
2086            return set_error(serror, SCRIPT_ERR_EVAL_FALSE);
2087
2088        // P2SH witness program
2089        if (flags & SCRIPT_VERIFY_WITNESS) {
2090            if (pubKey2.IsWitnessProgram(witnessversion, witnessprogram)) {
2091                hadWitness = true;
2092                if (scriptSig != CScript() << std::vector<unsigned char>(pubKey2.begin(), pubKey2.end())) {
2093                    // The scriptSig must be _exactly_ a single push of the redeemScript. Otherwise we
2094                    // reintroduce malleability.
2095                    return set_error(serror, SCRIPT_ERR_WITNESS_MALLEATED_P2SH);
2096                }
2097                if (!VerifyWitnessProgram(*witness, witnessversion, witnessprogram, flags, checker, serror, /*is_p2sh=*/true)) {
2098                    return false;
2099                }
2100                // Bypass the cleanstack check at the end. The actual stack is obviously not clean
2101                // for witness programs.
2102                stack.resize(1);
2103            }
2104        }
2105    }
2106
2107    // The CLEANSTACK check is only performed after potential P2SH evaluation,
2108    // as the non-P2SH evaluation of a P2SH script will obviously not result in
2109    // a clean stack (the P2SH inputs remain). The same holds for witness evaluation.
2110    if ((flags & SCRIPT_VERIFY_CLEANSTACK) != 0) {
2111        // Disallow CLEANSTACK without P2SH, as otherwise a switch CLEANSTACK->P2SH+CLEANSTACK
2112        // would be possible, which is not a softfork (and P2SH should be one).
2113        assert((flags & SCRIPT_VERIFY_P2SH) != 0);
2114        assert((flags & SCRIPT_VERIFY_WITNESS) != 0);
2115        if (stack.size() != 1) {
2116            return set_error(serror, SCRIPT_ERR_CLEANSTACK);
2117        }
2118    }
2119
2120    if (flags & SCRIPT_VERIFY_WITNESS) {
2121        // We can't check for correct unexpected witness data if P2SH was off, so require
2122        // that WITNESS implies P2SH. Otherwise, going from WITNESS->P2SH+WITNESS would be
2123        // possible, which is not a softfork.
2124        assert((flags & SCRIPT_VERIFY_P2SH) != 0);
2125        if (!hadWitness && !witness->IsNull()) {
2126            return set_error(serror, SCRIPT_ERR_WITNESS_UNEXPECTED);
2127        }
2128    }
2129
2130    return set_success(serror);
2131}
2132
2133size_t static WitnessSigOps(int witversion, const std::vector<unsigned char>& witprogram, const CScriptWitness& witness)
2134{
2135    if (witversion == 0) {
2136        if (witprogram.size() == WITNESS_V0_KEYHASH_SIZE)
2137            return 1;
2138
2139        if (witprogram.size() == WITNESS_V0_SCRIPTHASH_SIZE && witness.stack.size() > 0) {
2140            CScript subscript(witness.stack.back().begin(), witness.stack.back().end());
2141            return subscript.GetSigOpCount(true);
2142        }
2143    }
2144
2145    // Future flags may be implemented here.
2146    return 0;
2147}
2148
2149size_t CountWitnessSigOps(const CScript& scriptSig, const CScript& scriptPubKey, const CScriptWitness& witness, script_verify_flags flags)
2150{
2151    if ((flags & SCRIPT_VERIFY_WITNESS) == 0) {
2152        return 0;
2153    }
2154    assert((flags & SCRIPT_VERIFY_P2SH) != 0);
2155
2156    int witnessversion;
2157    std::vector<unsigned char> witnessprogram;
2158    if (scriptPubKey.IsWitnessProgram(witnessversion, witnessprogram)) {
2159        return WitnessSigOps(witnessversion, witnessprogram, witness);
2160    }
2161
2162    if (scriptPubKey.IsPayToScriptHash() && scriptSig.IsPushOnly()) {
2163        CScript::const_iterator pc = scriptSig.begin();
2164        std::vector<unsigned char> data;
2165        while (pc < scriptSig.end()) {
2166            opcodetype opcode;
2167            scriptSig.GetOp(pc, opcode, data);
2168        }
2169        CScript subscript(data.begin(), data.end());
2170        if (subscript.IsWitnessProgram(witnessversion, witnessprogram)) {
2171            return WitnessSigOps(witnessversion, witnessprogram, witness);
2172        }
2173    }
2174
2175    return 0;
2176}
2177
2178const std::map<std::string, script_verify_flag_name>& ScriptFlagNamesToEnum()
2179{
2180#define FLAG_NAME(flag) {std::string(#flag), SCRIPT_VERIFY_##flag}
2181    static const std::map<std::string, script_verify_flag_name> g_names_to_enum{
2182        FLAG_NAME(P2SH),
2183        FLAG_NAME(STRICTENC),
2184        FLAG_NAME(DERSIG),
2185        FLAG_NAME(LOW_S),
2186        FLAG_NAME(SIGPUSHONLY),
2187        FLAG_NAME(MINIMALDATA),
2188        FLAG_NAME(NULLDUMMY),
2189        FLAG_NAME(DISCOURAGE_UPGRADABLE_NOPS),
2190        FLAG_NAME(CLEANSTACK),
2191        FLAG_NAME(MINIMALIF),
2192        FLAG_NAME(NULLFAIL),
2193        FLAG_NAME(CHECKLOCKTIMEVERIFY),
2194        FLAG_NAME(CHECKSEQUENCEVERIFY),
2195        FLAG_NAME(WITNESS),
2196        FLAG_NAME(DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM),
2197        FLAG_NAME(WITNESS_PUBKEYTYPE),
2198        FLAG_NAME(CONST_SCRIPTCODE),
2199        FLAG_NAME(TAPROOT),
2200        FLAG_NAME(DISCOURAGE_UPGRADABLE_PUBKEYTYPE),
2201        FLAG_NAME(DISCOURAGE_OP_SUCCESS),
2202        FLAG_NAME(DISCOURAGE_UPGRADABLE_TAPROOT_VERSION),
2203    };
2204#undef FLAG_NAME
2205    return g_names_to_enum;
2206}
2207
2208std::vector<std::string> GetScriptFlagNames(script_verify_flags flags)
2209{
2210    std::vector<std::string> res;
2211    if (flags == SCRIPT_VERIFY_NONE) {
2212        return res;
2213    }
2214    script_verify_flags leftover = flags;
2215    for (const auto& [name, flag] : ScriptFlagNamesToEnum()) {
2216        if ((flags & flag) != 0) {
2217            res.push_back(name);
2218            leftover &= ~flag;
2219        }
2220    }
2221    if (leftover != 0) {
2222        res.push_back(strprintf("0x%08x", leftover.as_int()));
2223    }
2224    return res;
2225}
2226