1001        m_subpackage.m_conflicting_fees += it->GetModifiedFee();
1002        m_subpackage.m_conflicting_size += it->GetTxSize();
1003    }
1004
1005    if (const auto err_string{PaysForRBF(m_subpackage.m_conflicting_fees, ws.m_modified_fees, ws.m_vsize,
1006                                         m_pool.m_opts.incremental_relay_feerate, hash)}) {
1007        // Result may change in a package context
1008        return state.Invalid(TxValidationResult::TX_RECONSIDERABLE,
1009                             strprintf("insufficient fee%s", ws.m_sibling_eviction ? " (including sibling eviction)" : ""), *err_string);
1010    }
1011
1012    // Add all the to-be-removed transactions to the changeset.
1013    for (auto it : all_conflicts) {
1014        m_subpackage.m_changeset->StageRemoval(it);
1015    }
1016
1017    // Run cluster size limit checks and fail if we exceed them.
1018    if (!m_subpackage.m_changeset->CheckMemPoolPolicyLimits()) {
1019        return state.Invalid(TxValidationResult::TX_MEMPOOL_POLICY, "too-large-cluster", "");
1020    }
1021
1022    if (const auto err_string{ImprovesFeerateDiagram(*m_subpackage.m_changeset)}) {
1023        // We checked above for the cluster size limits being respected, so a
1024        // failure here can only be due to an insufficient fee.
1025        Assume(err_string->first == DiagramCheckError::FAILURE);
1026        return state.Invalid(TxValidationResult::TX_RECONSIDERABLE, "replacement-failed", err_string->second);
1027    }
1028
1029    return true;
1030}
1031
1032bool MemPoolAccept::PackageRBFChecks(const std::vector<CTransactionRef>& txns,
1033                                     std::vector<Workspace>& workspaces,
1034                                     PackageValidationState& package_state)
1035{
1036    AssertLockHeld(cs_main);
1037    AssertLockHeld(m_pool.cs);
1038
1039    assert(std::all_of(txns.cbegin(), txns.cend(), [this](const auto& tx)
1040                       { return !m_pool.exists(tx->GetHash());}));
1041
1042    assert(txns.size() == workspaces.size());
1043
1044    // We're in package RBF context; replacement proposal must be size 2
1045    if (workspaces.size() != 2 || !Assume(IsChildWithParents(txns))) {
1046        return package_state.Invalid(PackageValidationResult::PCKG_POLICY, "package RBF failed: package must be 1-parent-1-child");
1047    }
1048
1049    // If the package has in-mempool parents, we won't consider a package RBF
1050    // since it would result in a cluster larger than 2.
1051    // N.B. To relax this constraint we will need to revisit how CCoinsViewMemPool::PackageAddTransaction
1052    // is being used inside AcceptMultipleTransactions to track available inputs while processing a package.
1053    // Specifically we would need to check that the ancestors of the new
1054    // transactions don't intersect with the set of transactions to be removed
1055    // due to RBF, which is not checked at all in the package acceptance
1056    // context.
1057    for (const auto& ws : workspaces) {
1058        if (!ws.m_parents.empty()) {
1059            return package_state.Invalid(PackageValidationResult::PCKG_POLICY, "package RBF failed: new transaction cannot have mempool ancestors");
1060        }
1061    }
1062
1063    // Aggregate all conflicts into one set.
1064    CTxMemPool::setEntries direct_conflict_iters;
1065    for (Workspace& ws : workspaces) {
1066        // Aggregate all conflicts into one set.
1067        direct_conflict_iters.merge(ws.m_iters_conflicting);
1068    }
1069
1070    const auto& parent_ws = workspaces[0];
1071    const auto& child_ws = workspaces[1];
1072
1073    // Don't consider replacements that would cause us to remove a large number of mempool entries.
1074    // This limit is not increased in a package RBF. Use the aggregate number of transactions.
1075    CTxMemPool::setEntries all_conflicts;
1076    if (const auto err_string{GetEntriesForConflicts(*child_ws.m_ptx, m_pool, direct_conflict_iters,
1077                                                     all_conflicts)}) {
1078        return package_state.Invalid(PackageValidationResult::PCKG_POLICY,
1079                                     "package RBF failed: too many potential replacements", *err_string);
1080    }
1081
1082    for (CTxMemPool::txiter it : all_conflicts) {
1083        m_subpackage.m_changeset->StageRemoval(it);
1084        m_subpackage.m_conflicting_fees += it->GetModifiedFee();
1085        m_subpackage.m_conflicting_size += it->GetTxSize();
1086    }
1087
1088    // Use the child as the transaction for attributing errors to.
1089    const Txid& child_hash = child_ws.m_ptx->GetHash();
1090    if (const auto err_string{PaysForRBF(/*original_fees=*/m_subpackage.m_conflicting_fees,
1091                                         /*replacement_fees=*/m_subpackage.m_total_modified_fees,
1092                                         /*replacement_vsize=*/m_subpackage.m_total_vsize,
1093                                         m_pool.m_opts.incremental_relay_feerate, child_hash)}) {
1094        return package_state.Invalid(PackageValidationResult::PCKG_POLICY,
1095                                     "package RBF failed: insufficient anti-DoS fees", *err_string);
1096    }
1097
1098    // Ensure this two transaction package is a "chunk" on its own; we don't want the child
1099    // to be only paying anti-DoS fees
1100    const CFeeRate parent_feerate(parent_ws.m_modified_fees, parent_ws.m_vsize);
1101    const CFeeRate package_feerate(m_subpackage.m_total_modified_fees, m_subpackage.m_total_vsize);
1102    if (package_feerate <= parent_feerate) {
1103        return package_state.Invalid(PackageValidationResult::PCKG_POLICY,
1104                                     "package RBF failed: package feerate is less than or equal to parent feerate",
1105                                     strprintf("package feerate %s <= parent feerate is %s", package_feerate.ToString(), parent_feerate.ToString()));
1106    }
1107
1108    // Run cluster size limit checks and fail if we exceed them.
1109    if (!m_subpackage.m_changeset->CheckMemPoolPolicyLimits()) {
1110        return package_state.Invalid(PackageValidationResult::PCKG_POLICY, "too-large-cluster", "");
1111    }
1112
1113    // Check if it's economically rational to mine this package rather than the ones it replaces.
1114    if (const auto err_tup{ImprovesFeerateDiagram(*m_subpackage.m_changeset)}) {
1115        Assume(err_tup->first == DiagramCheckError::FAILURE);
1116        return package_state.Invalid(PackageValidationResult::PCKG_POLICY,
1117                                     "package RBF failed: " + err_tup.value().second, "");
1118    }
1119
1120    LogDebug(BCLog::TXPACKAGES, "package RBF checks passed: parent %s (wtxid=%s), child %s (wtxid=%s), package hash (%s)\n",
1121        txns.front()->GetHash().ToString(), txns.front()->GetWitnessHash().ToString(),
1122        txns.back()->GetHash().ToString(), txns.back()->GetWitnessHash().ToString(),
1123        GetPackageHash(txns).ToString());
1124
1125
1126    return true;
1127}
1128
1129bool MemPoolAccept::PolicyScriptChecks(Workspace& ws)
1130{
1131    AssertLockHeld(cs_main);
1132    AssertLockHeld(m_pool.cs);
1133    const CTransaction& tx = *ws.m_ptx;
1134    TxValidationState& state = ws.m_state;
1135
1136    constexpr script_verify_flags scriptVerifyFlags = STANDARD_SCRIPT_VERIFY_FLAGS;
1137
1138    // Check input scripts and signatures.
1139    // This is done last to help prevent CPU exhaustion denial-of-service attacks.
1140    if (!CheckInputScripts(tx, state, m_view, scriptVerifyFlags, true, false, ws.m_precomputed_txdata, GetValidationCache())) {
1141        // Detect a failure due to a missing witness so that p2p code can handle rejection caching appropriately.
1142        if (!tx.HasWitness() && SpendsNonAnchorWitnessProg(tx, m_view)) {
1143            state.Invalid(TxValidationResult::TX_WITNESS_STRIPPED,
1144                    state.GetRejectReason(), state.GetDebugMessage());
1145        }
1146        return false; // state filled in by CheckInputScripts
1147    }
1148
1149    return true;
1150}
1151
1152bool MemPoolAccept::ConsensusScriptChecks(Workspace& ws)
1153{
1154    AssertLockHeld(cs_main);
1155    AssertLockHeld(m_pool.cs);
1156    const CTransaction& tx = *ws.m_ptx;
1157    const Txid& hash = ws.m_hash;
1158    TxValidationState& state = ws.m_state;
1159
1160    // Check again against the current block tip's script verification
1161    // flags to cache our script execution flags. This is, of course,
1162    // useless if the next block has different script flags from the
1163    // previous one, but because the cache tracks script flags for us it
1164    // will auto-invalidate and we'll just have a few blocks of extra
1165    // misses on soft-fork activation.
1166    //
1167    // This is also useful in case of bugs in the standard flags that cause
1168    // transactions to pass as valid when they're actually invalid. For
1169    // instance the STRICTENC flag was incorrectly allowing certain
1170    // CHECKSIG NOT scripts to pass, even though they were invalid.
1171    //
1172    // There is a similar check in CreateNewBlock() to prevent creating
1173    // invalid blocks (using TestBlockValidity), however allowing such
1174    // transactions into the mempool can be exploited as a DoS attack.
1175    script_verify_flags currentBlockScriptVerifyFlags{GetBlockScriptFlags(*m_active_chainstate.m_chain.Tip(), m_active_chainstate.m_chainman)};
1176    if (!CheckInputsFromMempoolAndCache(tx, state, m_view, m_pool, currentBlockScriptVerifyFlags,
1177                                        ws.m_precomputed_txdata, m_active_chainstate.CoinsTip(), GetValidationCache())) {
1178        LogError("BUG! PLEASE REPORT THIS! CheckInputScripts failed against latest-block but not STANDARD flags %s, %s", hash.ToString(), state.ToString());
1179        return Assume(false);
1180    }
1181
1182    return true;
1183}
1184
1185void MemPoolAccept::FinalizeSubpackage(const ATMPArgs& args)
1186{
1187    AssertLockHeld(cs_main);
1188    AssertLockHeld(m_pool.cs);
1189
1190    if (!m_subpackage.m_changeset->GetRemovals().empty()) Assume(args.m_allow_replacement);
1191    // Remove conflicting transactions from the mempool
1192    for (CTxMemPool::txiter it : m_subpackage.m_changeset->GetRemovals())
1193    {
1194        std::string log_string = strprintf("replacing mempool tx %s (wtxid=%s, fees=%s, vsize=%s). ",
1195                                      it->GetTx().GetHash().ToString(),
1196                                      it->GetTx().GetWitnessHash().ToString(),
1197                                      it->GetFee(),
1198                                      it->GetTxSize());
1199        FeeFrac feerate{m_subpackage.m_total_modified_fees, int32_t(m_subpackage.m_total_vsize)};
1200        uint256 tx_or_package_hash{};
1201        const bool replaced_with_tx{m_subpackage.m_changeset->GetTxCount() == 1};
1202        if (replaced_with_tx) {
1203            const CTransaction& tx = m_subpackage.m_changeset->GetAddedTxn(0);
1204            tx_or_package_hash = tx.GetHash().ToUint256();
1205            log_string += strprintf("New tx %s (wtxid=%s, fees=%s, vsize=%s)",
1206                                    tx.GetHash().ToString(),
1207                                    tx.GetWitnessHash().ToString(),
1208                                    feerate.fee,
1209                                    feerate.size);
1210        } else {
1211            tx_or_package_hash = GetPackageHash(m_subpackage.m_changeset->GetAddedTxns());
1212            log_string += strprintf("New package %s with %lu txs, fees=%s, vsize=%s",
1213                                    tx_or_package_hash.ToString(),
1214                                    m_subpackage.m_changeset->GetTxCount(),
1215                                    feerate.fee,
1216                                    feerate.size);
1217
1218        }
1219        LogDebug(BCLog::MEMPOOL, "%s\n", log_string);
1220        TRACEPOINT(mempool, replaced,
1221                it->GetTx().GetHash().data(),
1222                it->GetTxSize(),
1223                it->GetFee(),
1224                std::chrono::duration_cast<std::chrono::duration<std::uint64_t>>(it->GetTime()).count(),
1225                tx_or_package_hash.data(),
1226                feerate.size,
1227                feerate.fee,
1228                replaced_with_tx
1229        );
1230        m_subpackage.m_replaced_transactions.push_back(it->GetSharedTx());
1231    }
1232    m_subpackage.m_changeset->Apply();
1233    m_subpackage.m_changeset.reset();
1234}
1235
1236bool MemPoolAccept::SubmitPackage(const ATMPArgs& args, std::vector<Workspace>& workspaces,
1237                                  PackageValidationState& package_state,
1238                                  std::map<Wtxid, MempoolAcceptResult>& results)
1239{
1240    AssertLockHeld(cs_main);
1241    AssertLockHeld(m_pool.cs);
1242    // Sanity check: none of the transactions should be in the mempool, and none of the transactions
1243    // should have a same-txid-different-witness equivalent in the mempool.
1244    assert(std::all_of(workspaces.cbegin(), workspaces.cend(), [this](const auto& ws) { return !m_pool.exists(ws.m_ptx->GetHash()); }));
1245
1246    bool all_submitted = true;
1247    FinalizeSubpackage(args);
1248    // ConsensusScriptChecks adds to the script cache and is therefore consensus-critical;
1249    // CheckInputsFromMempoolAndCache asserts that transactions only spend coins available from the
1250    // mempool or UTXO set. Submit each transaction to the mempool immediately after calling