Inside Bitcoin

251        Assert(!res.m_state.IsInvalid());
252        Assert(res.m_vsize);
253        Assert(res.m_base_fees);
254        Assert(res.m_effective_feerate);
255        Assert(res.m_wtxids_fee_calculations);
256        Assert(!res.m_other_wtxid);
257        break;
258    }
259    case MempoolAcceptResult::ResultType::INVALID:
260    {
261        // It may be already in the mempool since in ATMP cases we don't set MEMPOOL_ENTRY or DIFFERENT_WITNESS
262        Assert(!res.m_state.IsValid());
263        Assert(res.m_state.IsInvalid());
264
265        const bool is_reconsiderable{res.m_state.GetResult() == TxValidationResult::TX_RECONSIDERABLE};
266        Assert(!res.m_vsize);
267        Assert(!res.m_base_fees);
268        // Fee information is provided if the failure is TX_RECONSIDERABLE.
269        // In other cases, validation may be unable or unwilling to calculate the fees.
270        Assert(res.m_effective_feerate.has_value() == is_reconsiderable);
271        Assert(res.m_wtxids_fee_calculations.has_value() == is_reconsiderable);
272        Assert(!res.m_other_wtxid);
273        break;
274    }
275    case MempoolAcceptResult::ResultType::MEMPOOL_ENTRY:
276    {
277        // ATMP never sets this; only set in package settings
278        Assert(false);
279        break;
280    }
281    case MempoolAcceptResult::ResultType::DIFFERENT_WITNESS:
282    {
283        // ATMP never sets this; only set in package settings
284        Assert(false);
285        break;
286    }
287    }
288}
289
290FUZZ_TARGET(tx_pool_standard, .init = initialize_tx_pool)
291{
292    SeedRandomStateForTest(SeedRand::ZEROS);
293    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
294    const auto& node = g_setup->m_node;
295    auto& chainstate{static_cast<DummyChainState&>(node.chainman->ActiveChainstate())};
296
297    MockTime(fuzzed_data_provider, chainstate);
298
299    // All RBF-spendable outpoints
300    std::set<COutPoint> outpoints_rbf;
301    // All outpoints counting toward the total supply (subset of outpoints_rbf)
302    std::set<COutPoint> outpoints_supply;
303    for (const auto& outpoint : g_outpoints_coinbase_init_mature) {
304        Assert(outpoints_supply.insert(outpoint).second);
305    }
306    outpoints_rbf = outpoints_supply;
307
308    // The sum of the values of all spendable outpoints
309    constexpr CAmount SUPPLY_TOTAL{COINBASE_MATURITY * 50 * COIN};
310
311    SetMempoolConstraints(*node.args, fuzzed_data_provider);
312    auto tx_pool_{MakeMempool(fuzzed_data_provider, node)};
313    MockedTxPool& tx_pool = *static_cast<MockedTxPool*>(tx_pool_.get());
314
315    chainstate.SetMempool(&tx_pool);
316
317    // Helper to query an amount
318    const CCoinsViewMemPool amount_view{WITH_LOCK(::cs_main, return &chainstate.CoinsTip()), tx_pool};
319    const auto GetAmount = [&](const COutPoint& outpoint) {
320        auto coin{amount_view.GetCoin(outpoint).value()};
321        return coin.out.nValue;
322    };
323
324    LIMITED_WHILE (fuzzed_data_provider.ConsumeBool(), 100) {
325        {
326            // Total supply is the mempool fee + all outpoints
327            CAmount supply_now{WITH_LOCK(tx_pool.cs, return tx_pool.GetTotalFee())};
328            for (const auto& op : outpoints_supply) {
329                supply_now += GetAmount(op);
330            }
331            Assert(supply_now == SUPPLY_TOTAL);
332        }
333        Assert(!outpoints_supply.empty());
334
335        // Create transaction to add to the mempool
336        const CTransactionRef tx = [&] {
337            CMutableTransaction tx_mut;
338            tx_mut.version = fuzzed_data_provider.ConsumeBool() ? TRUC_VERSION : CTransaction::CURRENT_VERSION;
339            tx_mut.nLockTime = fuzzed_data_provider.ConsumeBool() ? 0 : fuzzed_data_provider.ConsumeIntegral<uint32_t>();
340            const auto num_in = fuzzed_data_provider.ConsumeIntegralInRange<int>(1, outpoints_rbf.size());
341            const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<int>(1, outpoints_rbf.size() * 2);
342
343            CAmount amount_in{0};
344            for (int i = 0; i < num_in; ++i) {
345                // Pop random outpoint
346                auto pop = outpoints_rbf.begin();
347                std::advance(pop, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, outpoints_rbf.size() - 1));
348                const auto outpoint = *pop;
349                outpoints_rbf.erase(pop);
350                amount_in += GetAmount(outpoint);
351
352                // Create input
353                const auto sequence = ConsumeSequence(fuzzed_data_provider);
354                const auto script_sig = CScript{};
355                const auto script_wit_stack = std::vector<std::vector<uint8_t>>{WITNESS_STACK_ELEM_OP_TRUE};
356                CTxIn in;
357                in.prevout = outpoint;
358                in.nSequence = sequence;
359                in.scriptSig = script_sig;
360                in.scriptWitness.stack = script_wit_stack;
361
362                tx_mut.vin.push_back(in);
363            }
364
365            // Check sigops in mempool + block template creation
366            bool add_sigops{fuzzed_data_provider.ConsumeBool()};
367
368            const auto amount_fee = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-1000, amount_in);
369            const auto amount_out = (amount_in - amount_fee) / num_out;
370            for (int i = 0; i < num_out; ++i) {
371                if (i == 0 && add_sigops) {
372                    tx_mut.vout.emplace_back(amount_out, CScript() << std::vector<unsigned char>(33, 0x02) << OP_CHECKSIG);
373                } else {
374                    tx_mut.vout.emplace_back(amount_out, P2WSH_OP_TRUE);
375                }
376            }
377
378            auto tx = MakeTransactionRef(tx_mut);
379            // Restore previously removed outpoints
380            for (const auto& in : tx->vin) {
381                Assert(outpoints_rbf.insert(in.prevout).second);
382            }
383            return tx;
384        }();
385
386        if (fuzzed_data_provider.ConsumeBool()) {
387            MockTime(fuzzed_data_provider, chainstate);
388        }
389        if (fuzzed_data_provider.ConsumeBool()) {
390            tx_pool.RollingFeeUpdate();
391        }
392        if (fuzzed_data_provider.ConsumeBool()) {
393            const auto& txid = fuzzed_data_provider.ConsumeBool() ?
394                                   tx->GetHash() :
395                                   PickValue(fuzzed_data_provider, outpoints_rbf).hash;
396            const auto delta = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-50 * COIN, +50 * COIN);
397            tx_pool.PrioritiseTransaction(txid, delta);
398        }
399
400        // Remember all removed and added transactions
401        std::set<CTransactionRef> removed;
402        std::set<CTransactionRef> added;
403        auto txr = std::make_shared<TransactionsDelta>(removed, added);
404        node.validation_signals->RegisterSharedValidationInterface(txr);
405
406        // Make sure ProcessNewPackage on one transaction works.
407        // The result is not guaranteed to be the same as what is returned by ATMP.
408        const auto result_package = WITH_LOCK(::cs_main,
409                                    return ProcessNewPackage(chainstate, tx_pool, {tx}, true, /*client_maxfeerate=*/{}));
410        // If something went wrong due to a package-specific policy, it might not return a
411        // validation result for the transaction.
412        if (result_package.m_state.GetResult() != PackageValidationResult::PCKG_POLICY) {
413            auto it = result_package.m_tx_results.find(tx->GetWitnessHash());
414            Assert(it != result_package.m_tx_results.end());
415            Assert(it->second.m_result_type == MempoolAcceptResult::ResultType::VALID ||
416                   it->second.m_result_type == MempoolAcceptResult::ResultType::INVALID);
417        }
418
419        const auto res = WITH_LOCK(::cs_main, return AcceptToMemoryPool(chainstate, tx, GetTime(), /*bypass_limits=*/false, /*test_accept=*/false));
420        const bool accepted = res.m_result_type == MempoolAcceptResult::ResultType::VALID;
421        node.validation_signals->SyncWithValidationInterfaceQueue();
422        node.validation_signals->UnregisterSharedValidationInterface(txr);
423
424        bool txid_in_mempool = tx_pool.exists(tx->GetHash());
425        bool wtxid_in_mempool = tx_pool.exists(tx->GetWitnessHash());
426        CheckATMPInvariants(res, txid_in_mempool, wtxid_in_mempool);
427
428        Assert(accepted != added.empty());
429        if (accepted) {
430            Assert(added.size() == 1); // For now, no package acceptance
431            Assert(tx == *added.begin());
432            CheckMempoolTRUCInvariants(tx_pool);
433        } else {
434            // Do not consider rejected transaction removed
435            removed.erase(tx);
436        }
437
438        // Helper to insert spent and created outpoints of a tx into collections
439        using Sets = std::vector<std::reference_wrapper<std::set<COutPoint>>>;
440        const auto insert_tx = [](Sets created_by_tx, Sets consumed_by_tx, const auto& tx) {
441            for (size_t i{0}; i < tx.vout.size(); ++i) {
442                for (auto& set : created_by_tx) {
443                    Assert(set.get().emplace(tx.GetHash(), i).second);
444                }
445            }
446            for (const auto& in : tx.vin) {
447                for (auto& set : consumed_by_tx) {
448                    Assert(set.get().insert(in.prevout).second);
449                }
450            }
451        };
452        // Add created outpoints, remove spent outpoints
453        {
454            // Outpoints that no longer exist at all
455            std::set<COutPoint> consumed_erased;
456            // Outpoints that no longer count toward the total supply
457            std::set<COutPoint> consumed_supply;
458            for (const auto& removed_tx : removed) {
459                insert_tx(/*created_by_tx=*/{consumed_erased}, /*consumed_by_tx=*/{outpoints_supply}, /*tx=*/*removed_tx);
460            }
461            for (const auto& added_tx : added) {
462                insert_tx(/*created_by_tx=*/{outpoints_supply, outpoints_rbf}, /*consumed_by_tx=*/{consumed_supply}, /*tx=*/*added_tx);
463            }
464            for (const auto& p : consumed_erased) {
465                Assert(outpoints_supply.erase(p) == 1);
466                Assert(outpoints_rbf.erase(p) == 1);
467            }
468            for (const auto& p : consumed_supply) {
469                Assert(outpoints_supply.erase(p) == 1);
470            }
471        }
472    }
473    Finish(fuzzed_data_provider, tx_pool, chainstate);
474}
475
476FUZZ_TARGET(tx_pool, .init = initialize_tx_pool)
477{
478    SeedRandomStateForTest(SeedRand::ZEROS);
479    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
480    const auto& node = g_setup->m_node;
481    auto& chainstate{static_cast<DummyChainState&>(node.chainman->ActiveChainstate())};
482
483    MockTime(fuzzed_data_provider, chainstate);
484
485    std::vector<Txid> txids;
486    txids.reserve(g_outpoints_coinbase_init_mature.size());
487    for (const auto& outpoint : g_outpoints_coinbase_init_mature) {
488        txids.push_back(outpoint.hash);
489    }
490    for (int i{0}; i <= 3; ++i) {
491        // Add some immature and non-existent outpoints
492        txids.push_back(g_outpoints_coinbase_init_immature.at(i).hash);
493        txids.push_back(Txid::FromUint256(ConsumeUInt256(fuzzed_data_provider)));
494    }
495
496    SetMempoolConstraints(*node.args, fuzzed_data_provider);
497    auto tx_pool_{MakeMempool(fuzzed_data_provider, node)};
498    MockedTxPool& tx_pool = *static_cast<MockedTxPool*>(tx_pool_.get());
499
500    chainstate.SetMempool(&tx_pool);