Inside Bitcoin

751        #
752        # Merkle tree malleability (CVE-2012-2459): repeating sequences of transactions in a block without
753        #                           affecting the merkle root of a block, while still invalidating it.
754        #                           See:  src/consensus/merkle.h
755        #
756        #  b57 has three txns:  coinbase, tx, tx1.  The merkle root computation will duplicate tx.
757        #  Result:  OK
758        #
759        #  b56 copies b57 but duplicates tx1 and does not recalculate the block hash.  So it has a valid merkle
760        #  root but duplicate transactions.
761        #  Result:  Fails
762        #
763        #  b57p2 has six transactions in its merkle tree:
764        #       - coinbase, tx, tx1, tx2, tx3, tx4
765        #  Merkle root calculation will duplicate as necessary.
766        #  Result:  OK.
767        #
768        #  b56p2 copies b57p2 but adds both tx3 and tx4.  The purpose of the test is to make sure the code catches
769        #  duplicate txns that are not next to one another with the "bad-txns-duplicate" error (which indicates
770        #  that the error was caught early, avoiding a DOS vulnerability.)
771
772        # b57 - a good block with 2 txs, don't submit until end
773        self.move_tip(55)
774        self.next_block(57)
775        tx = self.create_and_sign_transaction(out[16], 1)
776        tx1 = self.create_tx(tx, 0, 1)
777        b57 = self.update_block(57, [tx, tx1])
778
779        # b56 - copy b57, add a duplicate tx
780        self.log.info("Reject a block with a duplicate transaction in the Merkle Tree (but with a valid Merkle Root)")
781        self.move_tip(55)
782        b56 = copy.deepcopy(b57)
783        self.blocks[56] = b56
784        assert_equal(len(b56.vtx), 3)
785        b56 = self.update_block(56, [tx1])
786        assert_equal(b56.hash_hex, b57.hash_hex)
787        self.send_blocks([b56], success=False, reject_reason='bad-txns-duplicate', reconnect=True)
788
789        # b57p2 - a good block with 6 tx'es, don't submit until end
790        self.move_tip(55)
791        self.next_block("57p2")
792        tx = self.create_and_sign_transaction(out[16], 1)
793        tx1 = self.create_tx(tx, 0, 1)
794        tx2 = self.create_tx(tx1, 0, 1)
795        tx3 = self.create_tx(tx2, 0, 1)
796        tx4 = self.create_tx(tx3, 0, 1)
797        b57p2 = self.update_block("57p2", [tx, tx1, tx2, tx3, tx4])
798
799        # b56p2 - copy b57p2, duplicate two non-consecutive tx's
800        self.log.info("Reject a block with two duplicate transactions in the Merkle Tree (but with a valid Merkle Root)")
801        self.move_tip(55)
802        b56p2 = copy.deepcopy(b57p2)
803        self.blocks["b56p2"] = b56p2
804        assert_equal(b56p2.hash_hex, b57p2.hash_hex)
805        assert_equal(len(b56p2.vtx), 6)
806        b56p2 = self.update_block("b56p2", [tx3, tx4])
807        self.send_blocks([b56p2], success=False, reject_reason='bad-txns-duplicate', reconnect=True)
808
809        self.move_tip("57p2")
810        self.send_blocks([b57p2], True)
811
812        self.move_tip(57)
813        self.send_blocks([b57], False)  # The tip is not updated because 57p2 seen first
814        self.save_spendable_output()
815
816        # Test a few invalid tx types
817        #
818        # -> b35 (10) -> b39 (11) -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 ()
819        #                                                                                    \-> ??? (17)
820        #
821
822        # tx with prevout.n out of range
823        self.log.info("Reject a block with a transaction with prevout.n out of range")
824        self.move_tip(57)
825        self.next_block(58, spend=out[17])
826        tx = CTransaction()
827        assert len(out[17].vout) < 42
828        tx.vin.append(CTxIn(COutPoint(out[17].txid_int, 42), CScript([OP_TRUE]), SEQUENCE_FINAL))
829        tx.vout.append(CTxOut(0, b""))
830        b58 = self.update_block(58, [tx])
831        self.send_blocks([b58], success=False, reject_reason='bad-txns-inputs-missingorspent', reconnect=True)
832
833        # tx with output value > input value
834        self.log.info("Reject a block with a transaction with outputs > inputs")
835        self.move_tip(57)
836        self.next_block(59)
837        tx = self.create_and_sign_transaction(out[17], 51 * COIN)
838        b59 = self.update_block(59, [tx])
839        self.send_blocks([b59], success=False, reject_reason='bad-txns-in-belowout', reconnect=True)
840
841        # reset to good chain
842        self.move_tip(57)
843        b60 = self.next_block(60)
844        self.send_blocks([b60], True)
845        self.save_spendable_output()
846
847        # Test BIP30 (reject duplicate)
848        #
849        # -> b39 (11) -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 ()
850        #                                                                                  \-> b61 ()
851        #
852        # Blocks are not allowed to contain a transaction whose id matches that of an earlier,
853        # not-fully-spent transaction in the same chain. To test, make identical coinbases;
854        # the second one should be rejected. See also CVE-2012-1909.
855        #
856        self.log.info("Reject a block with a transaction with a duplicate hash of a previous transaction (BIP30)")
857        self.move_tip(60)
858        b61 = self.next_block(61)
859        b61.vtx[0].nLockTime = 0
860        b61.vtx[0].vin[0].scriptSig = DUPLICATE_COINBASE_SCRIPT_SIG
861        b61 = self.update_block(61, [])
862        assert_equal(duplicate_tx.serialize(), b61.vtx[0].serialize())
863        # BIP30 is always checked on regtest, regardless of the BIP34 activation height
864        self.send_blocks([b61], success=False, reject_reason='bad-txns-BIP30', reconnect=True)
865
866        # Test BIP30 (allow duplicate if spent)
867        #
868        # -> b57 (16) -> b60 ()
869        #            \-> b_spend_dup_cb (b_dup_cb) -> b_dup_2 ()
870        #
871        self.move_tip(57)
872        self.next_block('spend_dup_cb')
873        tx = CTransaction()
874        tx.vin.append(CTxIn(COutPoint(duplicate_tx.txid_int, 0)))
875        tx.vout.append(CTxOut(0, CScript([OP_TRUE])))
876        self.sign_tx(tx, duplicate_tx)
877        b_spend_dup_cb = self.update_block('spend_dup_cb', [tx])
878
879        b_dup_2 = self.next_block('dup_2')
880        b_dup_2.vtx[0].nLockTime = 0
881        b_dup_2.vtx[0].vin[0].scriptSig = DUPLICATE_COINBASE_SCRIPT_SIG
882        b_dup_2 = self.update_block('dup_2', [])
883        assert_equal(duplicate_tx.serialize(), b_dup_2.vtx[0].serialize())
884        assert_equal(self.nodes[0].gettxout(txid=duplicate_tx.txid_hex, n=0)['confirmations'], 119)
885        self.send_blocks([b_spend_dup_cb, b_dup_2], success=True)
886        # The duplicate has less confirmations
887        assert_equal(self.nodes[0].gettxout(txid=duplicate_tx.txid_hex, n=0)['confirmations'], 1)
888
889        # Test tx.isFinal is properly rejected (not an exhaustive tx.isFinal test, that should be in data-driven transaction tests)
890        #
891        # -> b_spend_dup_cb (b_dup_cb) -> b_dup_2 ()
892        #                                           \-> b62 (18)
893        #
894        self.log.info("Reject a block with a transaction with a nonfinal locktime")
895        self.move_tip('dup_2')
896        self.next_block(62)
897        tx = CTransaction()
898        tx.nLockTime = 0xffffffff  # this locktime is non-final
899        tx.vin.append(CTxIn(COutPoint(out[18].txid_int, 0)))  # don't set nSequence
900        tx.vout.append(CTxOut(0, CScript([OP_TRUE])))
901        assert_greater_than(SEQUENCE_FINAL, tx.vin[0].nSequence)
902        b62 = self.update_block(62, [tx])
903        self.send_blocks([b62], success=False, reject_reason='bad-txns-nonfinal', reconnect=True)
904
905        # Test a non-final coinbase is also rejected
906        #
907        # -> b_spend_dup_cb (b_dup_cb) -> b_dup_2 ()
908        #                                           \-> b63 (-)
909        #
910        self.log.info("Reject a block with a coinbase transaction with a nonfinal locktime")
911        self.move_tip('dup_2')
912        b63 = self.next_block(63)
913        b63.vtx[0].nLockTime = 0xffffffff
914        b63.vtx[0].vin[0].nSequence = 0xDEADBEEF
915        b63 = self.update_block(63, [])
916        self.send_blocks([b63], success=False, reject_reason='bad-txns-nonfinal', reconnect=True)
917
918        #  This checks that a block with a bloated VARINT between the block_header and the array of tx such that
919        #  the block is > MAX_BLOCK_WEIGHT with the bloated varint, but <= MAX_BLOCK_WEIGHT without the bloated varint,
920        #  does not cause a subsequent, identical block with canonical encoding to be rejected.  The test does not
921        #  care whether the bloated block is accepted or rejected; it only cares that the second block is accepted.
922        #
923        #  What matters is that the receiving node should not reject the bloated block, and then reject the canonical
924        #  block on the basis that it's the same as an already-rejected block (which would be a consensus failure.)
925        #
926        #  -> b_spend_dup_cb (b_dup_cb) -> b_dup_2 () -> b64 (18)
927        #                                              \
928        #                                               b64a (18)
929        #  b64a is a bloated block (non-canonical varint)
930        #  b64 is a good block (same as b64 but w/ canonical varint)
931        #
932        self.log.info("Accept a valid block even if a bloated version of the block has previously been sent")
933        self.move_tip('dup_2')
934        regular_block = self.next_block("64a", spend=out[18])
935
936        # make it a "broken_block," with non-canonical serialization
937        b64a = CBrokenBlock(regular_block)
938        b64a.initialize(regular_block)
939        self.blocks["64a"] = b64a
940        self.tip = b64a
941        tx = CTransaction()
942
943        # use canonical serialization to calculate size
944        script_length = (MAX_BLOCK_WEIGHT - 4 * len(b64a.normal_serialize()) - 276) // 4
945        script_output = CScript([b'\x00' * script_length])
946        tx.vout.append(CTxOut(0, script_output))
947        tx.vin.append(CTxIn(COutPoint(b64a.vtx[1].txid_int, 0)))
948        b64a = self.update_block("64a", [tx])
949        assert_equal(b64a.get_weight(), MAX_BLOCK_WEIGHT + 8 * 4)
950        self.send_blocks([b64a], success=False, reject_reason='non-canonical ReadCompactSize()')
951
952        # bitcoind doesn't disconnect us for sending a bloated block, but if we subsequently
953        # resend the header message, it won't send us the getdata message again. Just
954        # disconnect and reconnect and then call sync_blocks.
955        # TODO: improve this test to be less dependent on P2P DOS behaviour.
956        node.disconnect_p2ps()
957        self.reconnect_p2p()
958
959        self.move_tip('dup_2')
960        b64 = CBlock(b64a)
961        b64.vtx = copy.deepcopy(b64a.vtx)
962        assert_equal(b64.hash_hex, b64a.hash_hex)
963        assert_equal(b64.get_weight(), MAX_BLOCK_WEIGHT)
964        self.blocks[64] = b64
965        b64 = self.update_block(64, [])
966        self.send_blocks([b64], True)
967        self.save_spendable_output()
968
969        # Spend an output created in the block itself
970        #
971        # -> b_dup_2 () -> b64 (18) -> b65 (19)
972        #
973        self.log.info("Accept a block with a transaction spending an output created in the same block")
974        self.move_tip(64)
975        self.next_block(65)
976        tx1 = self.create_and_sign_transaction(out[19], out[19].vout[0].nValue)
977        tx2 = self.create_and_sign_transaction(tx1, 0)
978        b65 = self.update_block(65, [tx1, tx2])
979        self.send_blocks([b65], True)
980        self.save_spendable_output()
981
982        # Attempt to spend an output created later in the same block
983        #
984        # -> b64 (18) -> b65 (19)
985        #                        \-> b66 (20)
986        self.log.info("Reject a block with a transaction spending an output created later in the same block")
987        self.move_tip(65)
988        self.next_block(66)
989        tx1 = self.create_and_sign_transaction(out[20], out[20].vout[0].nValue)
990        tx2 = self.create_and_sign_transaction(tx1, 1)
991        b66 = self.update_block(66, [tx2, tx1])
992        self.send_blocks([b66], success=False, reject_reason='bad-txns-inputs-missingorspent', reconnect=True)
993
994        # Attempt to double-spend a transaction created in a block
995        #
996        # -> b64 (18) -> b65 (19)
997        #                        \-> b67 (20)
998        #
999        #
1000        self.log.info("Reject a block with a transaction double spending a transaction created in the same block")