Inside Bitcoin

251        std::set<COutPoint> package_outpoints;
252        while (txs.size() < num_txs) {
253            // Create transaction to add to the mempool
254            txs.emplace_back([&] {
255                CMutableTransaction tx_mut;
256                tx_mut.version = CTransaction::CURRENT_VERSION;
257                tx_mut.nLockTime = 0;
258                // Last transaction in a package needs to be a child of parents to get further in validation
259                // so the last transaction to be generated(in a >1 package) must spend all package-made outputs
260                // Note that this test currently only spends package outputs in last transaction.
261                bool last_tx = num_txs > 1 && txs.size() == num_txs - 1;
262                const auto num_in = outpoint_to_rbf ? 2 :
263                    last_tx ? fuzzed_data_provider.ConsumeIntegralInRange<int>(package_outpoints.size()/2 + 1, package_outpoints.size()) :
264                    fuzzed_data_provider.ConsumeIntegralInRange<int>(1, 4);
265                const auto num_out = outpoint_to_rbf ? 1 : fuzzed_data_provider.ConsumeIntegralInRange<int>(1, 4);
266
267                auto& outpoints = last_tx ? package_outpoints : mempool_outpoints;
268
269                Assert((int)outpoints.size() >= num_in && num_in > 0);
270
271                CAmount amount_in{0};
272                for (int i = 0; i < num_in; ++i) {
273                    // Pop random outpoint. We erase them to avoid double-spending
274                    // while in this loop, but later add them back (unless last_tx).
275                    auto pop = outpoints.begin();
276                    std::advance(pop, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, outpoints.size() - 1));
277                    auto outpoint = *pop;
278
279                    if (i == 0 && outpoint_to_rbf) {
280                        outpoint = *outpoint_to_rbf;
281                        outpoints.erase(outpoint);
282                    } else {
283                        outpoints.erase(pop);
284                    }
285                    // no need to update or erase from outpoints_value
286                    amount_in += outpoints_value.at(outpoint);
287
288                    // Create input
289                    CTxIn in;
290                    in.prevout = outpoint;
291                    in.scriptWitness.stack = P2WSH_EMPTY_TRUE_STACK;
292
293                    tx_mut.vin.push_back(in);
294                }
295
296                const auto amount_fee = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, amount_in);
297                const auto amount_out = (amount_in - amount_fee) / num_out;
298                for (int i = 0; i < num_out; ++i) {
299                    tx_mut.vout.emplace_back(amount_out, P2WSH_EMPTY);
300                }
301
302                // Note output amounts can naturally drop to dust on their own.
303                if (!outpoint_to_rbf && fuzzed_data_provider.ConsumeBool()) {
304                    uint32_t dust_index = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, num_out);
305                    tx_mut.vout.insert(tx_mut.vout.begin() + dust_index, CTxOut(0, P2WSH_EMPTY));
306                }
307
308                auto tx = MakeTransactionRef(tx_mut);
309                // Restore previously removed outpoints, except in-package outpoints (to allow RBF)
310                if (!last_tx) {
311                    for (const auto& in : tx->vin) {
312                        Assert(outpoints.insert(in.prevout).second);
313                    }
314                    // Cache the in-package outpoints being made
315                    for (size_t i = 0; i < tx->vout.size(); ++i) {
316                        package_outpoints.emplace(tx->GetHash(), i);
317                    }
318                }
319                // We need newly-created values for the duration of this run
320                for (size_t i = 0; i < tx->vout.size(); ++i) {
321                    outpoints_value[COutPoint(tx->GetHash(), i)] = tx->vout[i].nValue;
322                }
323                return tx;
324            }());
325        }
326
327        if (fuzzed_data_provider.ConsumeBool()) {
328            const auto& txid = fuzzed_data_provider.ConsumeBool() ?
329                                   txs.back()->GetHash() :
330                                   PickValue(fuzzed_data_provider, mempool_outpoints).hash;
331            const auto delta = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-50 * COIN, +50 * COIN);
332            // We only prioritise out of mempool transactions since PrioritiseTransaction doesn't
333            // filter for ephemeral dust
334            if (tx_pool.exists(txid)) {
335                const auto tx_info{tx_pool.info(txid)};
336                if (GetDust(*tx_info.tx, tx_pool.m_opts.dust_relay_feerate).empty()) {
337                    tx_pool.PrioritiseTransaction(txid, delta);
338                }
339            }
340        }
341
342        auto single_submit = txs.size() == 1;
343
344        const auto result_package = WITH_LOCK(::cs_main,
345                                    return ProcessNewPackage(chainstate, tx_pool, txs, /*test_accept=*/single_submit, /*client_maxfeerate=*/{}));
346
347        const auto res = WITH_LOCK(::cs_main, return AcceptToMemoryPool(chainstate, txs.back(), GetTime(),
348                                   /*bypass_limits=*/false, /*test_accept=*/!single_submit));
349
350        if (!single_submit && result_package.m_state.GetResult() != PackageValidationResult::PCKG_POLICY) {
351            // We don't know anything about the validity since transactions were randomly generated, so
352            // just use result_package.m_state here. This makes the expect_valid check meaningless, but
353            // we can still verify that the contents of m_tx_results are consistent with m_state.
354            const bool expect_valid{result_package.m_state.IsValid()};
355            Assert(!CheckPackageMempoolAcceptResult(txs, result_package, expect_valid, &tx_pool));
356        }
357
358        node.validation_signals->SyncWithValidationInterfaceQueue();
359
360        CheckMempoolEphemeralInvariants(tx_pool);
361    }
362
363    node.validation_signals->UnregisterSharedValidationInterface(outpoints_updater);
364
365    WITH_LOCK(::cs_main, tx_pool.check(chainstate.CoinsTip(), chainstate.m_chain.Height() + 1));
366}
367
368
369FUZZ_TARGET(tx_package_eval, .init = initialize_tx_pool)
370{
371    SeedRandomStateForTest(SeedRand::ZEROS);
372    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
373    const auto& node = g_setup->m_node;
374    auto& chainstate{static_cast<DummyChainState&>(node.chainman->ActiveChainstate())};
375
376    MockTime(fuzzed_data_provider, chainstate);
377
378    // All RBF-spendable outpoints outside of the unsubmitted package
379    std::set<COutPoint> mempool_outpoints;
380    std::unordered_map<COutPoint, CAmount, SaltedOutpointHasher> outpoints_value;
381    for (const auto& outpoint : g_outpoints_coinbase_init_mature) {
382        Assert(mempool_outpoints.insert(outpoint).second);
383        outpoints_value[outpoint] = 50 * COIN;
384    }
385
386    auto outpoints_updater = std::make_shared<OutpointsUpdater>(mempool_outpoints);
387    node.validation_signals->RegisterSharedValidationInterface(outpoints_updater);
388
389    auto tx_pool_{MakeMempool(fuzzed_data_provider, node)};
390    MockedTxPool& tx_pool = *static_cast<MockedTxPool*>(tx_pool_.get());
391
392    chainstate.SetMempool(&tx_pool);
393
394    LIMITED_WHILE (fuzzed_data_provider.remaining_bytes() > 0, 300) {
395        Assert(!mempool_outpoints.empty());
396
397        std::vector<CTransactionRef> txs;
398
399        // Make packages of 1-to-26 transactions
400        const auto num_txs = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 26);
401        std::set<COutPoint> package_outpoints;
402        while (txs.size() < num_txs) {
403            // Create transaction to add to the mempool
404            txs.emplace_back([&] {
405                CMutableTransaction tx_mut;
406                tx_mut.version = fuzzed_data_provider.ConsumeBool() ? TRUC_VERSION : CTransaction::CURRENT_VERSION;
407                tx_mut.nLockTime = fuzzed_data_provider.ConsumeBool() ? 0 : fuzzed_data_provider.ConsumeIntegral<uint32_t>();
408                // Last transaction in a package needs to be a child of parents to get further in validation
409                // so the last transaction to be generated(in a >1 package) must spend all package-made outputs
410                // Note that this test currently only spends package outputs in last transaction.
411                bool last_tx = num_txs > 1 && txs.size() == num_txs - 1;
412                const auto num_in = last_tx ? package_outpoints.size()  : fuzzed_data_provider.ConsumeIntegralInRange<int>(1, mempool_outpoints.size());
413                auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<int>(1, mempool_outpoints.size() * 2);
414
415                auto& outpoints = last_tx ? package_outpoints : mempool_outpoints;
416
417                Assert(!outpoints.empty());
418
419                CAmount amount_in{0};
420                for (size_t i = 0; i < num_in; ++i) {
421                    // Pop random outpoint. We erase them to avoid double-spending
422                    // while in this loop, but later add them back (unless last_tx).
423                    auto pop = outpoints.begin();
424                    std::advance(pop, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, outpoints.size() - 1));
425                    const auto outpoint = *pop;
426                    outpoints.erase(pop);
427                    // no need to update or erase from outpoints_value
428                    amount_in += outpoints_value.at(outpoint);
429
430                    // Create input
431                    const auto sequence = ConsumeSequence(fuzzed_data_provider);
432                    const auto script_sig = CScript{};
433                    const auto script_wit_stack = fuzzed_data_provider.ConsumeBool() ? P2WSH_EMPTY_TRUE_STACK : P2WSH_EMPTY_TWO_STACK;
434
435                    CTxIn in;
436                    in.prevout = outpoint;
437                    in.nSequence = sequence;
438                    in.scriptSig = script_sig;
439                    in.scriptWitness.stack = script_wit_stack;
440
441                    tx_mut.vin.push_back(in);
442                }
443
444                // Duplicate an input
445                bool dup_input = fuzzed_data_provider.ConsumeBool();
446                if (dup_input) {
447                    tx_mut.vin.push_back(tx_mut.vin.back());
448                }
449
450                // Refer to a non-existent input
451                if (fuzzed_data_provider.ConsumeBool()) {
452                    tx_mut.vin.emplace_back();
453                }
454
455                // Make a p2pk output to make sigops adjusted vsize to violate TRUC rules, potentially, which is never spent
456                if (last_tx && amount_in > 1000 && fuzzed_data_provider.ConsumeBool()) {
457                    tx_mut.vout.emplace_back(1000, CScript() << std::vector<unsigned char>(33, 0x02) << OP_CHECKSIG);
458                    // Don't add any other outputs.
459                    num_out = 1;
460                    amount_in -= 1000;
461                }
462
463                const auto amount_fee = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, amount_in);
464                const auto amount_out = (amount_in - amount_fee) / num_out;
465                for (int i = 0; i < num_out; ++i) {
466                    tx_mut.vout.emplace_back(amount_out, P2WSH_EMPTY);
467                }
468                auto tx = MakeTransactionRef(tx_mut);
469                // Restore previously removed outpoints, except in-package outpoints
470                if (!last_tx) {
471                    for (const auto& in : tx->vin) {
472                        // It's a fake input, or a new input, or a duplicate
473                        Assert(in == CTxIn() || outpoints.insert(in.prevout).second || dup_input);
474                    }
475                    // Cache the in-package outpoints being made
476                    for (size_t i = 0; i < tx->vout.size(); ++i) {
477                        package_outpoints.emplace(tx->GetHash(), i);
478                    }
479                }
480                // We need newly-created values for the duration of this run
481                for (size_t i = 0; i < tx->vout.size(); ++i) {
482                    outpoints_value[COutPoint(tx->GetHash(), i)] = tx->vout[i].nValue;
483                }
484                return tx;
485            }());
486        }
487
488        if (fuzzed_data_provider.ConsumeBool()) {
489            MockTime(fuzzed_data_provider, chainstate);
490        }
491        if (fuzzed_data_provider.ConsumeBool()) {
492            tx_pool.RollingFeeUpdate();
493        }
494        if (fuzzed_data_provider.ConsumeBool()) {
495            const auto& txid = fuzzed_data_provider.ConsumeBool() ?
496                                   txs.back()->GetHash() :
497                                   PickValue(fuzzed_data_provider, mempool_outpoints).hash;
498            const auto delta = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-50 * COIN, +50 * COIN);
499            tx_pool.PrioritiseTransaction(txid, delta);
500        }