Inside Bitcoin

1001        ("t21", CScript([pubs[1], OP_CHECKSIGVERIFY, OP_1] + [OP_DUP] * 999 + [OP_DROP] * 999)),
1002        # 22) Script that grows the stack to 1001 elements
1003        ("t22", CScript([pubs[1], OP_CHECKSIGVERIFY, OP_1] + [OP_DUP] * 1000 + [OP_DROP] * 1000)),
1004        # 23) Script that expects an input stack of 1000 elements
1005        ("t23", CScript([OP_DROP] * 999 + [pubs[1], OP_CHECKSIG])),
1006        # 24) Script that expects an input stack of 1001 elements
1007        ("t24", CScript([OP_DROP] * 1000 + [pubs[1], OP_CHECKSIG])),
1008        # 25) Script that pushes a MAX_SCRIPT_ELEMENT_SIZE-bytes element
1009        ("t25", CScript([random.randbytes(MAX_SCRIPT_ELEMENT_SIZE), OP_DROP, pubs[1], OP_CHECKSIG])),
1010        # 26) Script that pushes a (MAX_SCRIPT_ELEMENT_SIZE+1)-bytes element
1011        ("t26", CScript([random.randbytes(MAX_SCRIPT_ELEMENT_SIZE+1), OP_DROP, pubs[1], OP_CHECKSIG])),
1012        # 27) CHECKSIGADD that must fail because numeric argument number is >4 bytes
1013        ("t27", CScript([CScriptNum(OVERSIZE_NUMBER), pubs[1], OP_CHECKSIGADD])),
1014        # 28) Pushes random CScriptNum value, checks OP_CHECKSIGADD result
1015        ("t28", CScript([csa_high_val, pubs[1], OP_CHECKSIGADD, csa_high_result, OP_EQUAL])),
1016        # 29) CHECKSIGADD that succeeds with proper sig because numeric argument number is <=4 bytes
1017        ("t29", CScript([CScriptNum(OVERSIZE_NUMBER-1), pubs[1], OP_CHECKSIGADD])),
1018        # 30) Variant of t1 with "normal" 33-byte pubkey
1019        ("t30", CScript([b'\x03' + pubs[1], OP_CHECKSIG])),
1020        # 31) Variant of t2 with "normal" 33-byte pubkey
1021        ("t31", CScript([b'\x02' + pubs[1], OP_CHECKSIGVERIFY, OP_1])),
1022        # 32) Variant of t28 with "normal" 33-byte pubkey
1023        ("t32", CScript([csa_high_val, b'\x03' + pubs[1], OP_CHECKSIGADD, csa_high_result, OP_EQUAL])),
1024        # 33) 999-of-999 multisig
1025        ("t33", CScript(big_scriptops[:1998] + [OP_1])),
1026        # 34) 1000-of-1000 multisig
1027        ("t34", CScript(big_scriptops[:2000] + [OP_1])),
1028        # 35) Variant of t9 that uses a non-minimally encoded input arg
1029        ("t35", CScript([bytes([csa_low_val]), pubs[1], OP_CHECKSIGADD, csa_low_result, OP_EQUAL])),
1030        # 36) Empty script
1031        ("t36", CScript([])),
1032    ]
1033    # Add many dummies to test huge trees
1034    for j in range(100000):
1035        scripts.append((None, CScript([OP_RETURN, random.randrange(100000)])))
1036    random.shuffle(scripts)
1037    tap = taproot_construct(pubs[0], scripts)
1038    common = {
1039        "hashtype": hashtype,
1040        "key": secs[1],
1041        "tap": tap,
1042    }
1043    # Test that MAX_SCRIPT_ELEMENT_SIZE byte stack element inputs are valid, but not one more (and 80 bytes is standard but 81 is not).
1044    add_spender(spenders, "tapscript/inputmaxlimit", leaf="t0", **common, standard=False, inputs=[getter("sign"), random.randbytes(MAX_SCRIPT_ELEMENT_SIZE)], failure={"inputs": [getter("sign"), random.randbytes(MAX_SCRIPT_ELEMENT_SIZE+1)]}, **ERR_PUSH_SIZE)
1045    add_spender(spenders, "tapscript/input80limit", leaf="t0", **common, inputs=[getter("sign"), random.randbytes(80)])
1046    add_spender(spenders, "tapscript/input81limit", leaf="t0", **common, standard=False, inputs=[getter("sign"), random.randbytes(81)])
1047    # Test that OP_CHECKMULTISIG and OP_CHECKMULTISIGVERIFY cause failure, but OP_CHECKSIG and OP_CHECKSIGVERIFY work.
1048    add_spender(spenders, "tapscript/disabled_checkmultisig", leaf="t1", **common, **SINGLE_SIG, failure={"leaf": "t3"}, **ERR_TAPSCRIPT_CHECKMULTISIG)
1049    add_spender(spenders, "tapscript/disabled_checkmultisigverify", leaf="t2", **common, **SINGLE_SIG, failure={"leaf": "t4"}, **ERR_TAPSCRIPT_CHECKMULTISIG)
1050    # Test that OP_IF and OP_NOTIF do not accept non-0x01 as truth value (the MINIMALIF rule is consensus in Tapscript)
1051    add_spender(spenders, "tapscript/minimalif", leaf="t5", **common, inputs=[getter("sign"), b'\x01'], failure={"inputs": [getter("sign"), b'\x02']}, **ERR_TAPSCRIPT_MINIMALIF)
1052    add_spender(spenders, "tapscript/minimalnotif", leaf="t6", **common, inputs=[getter("sign"), b'\x01'], failure={"inputs": [getter("sign"), b'\x03']}, **ERR_TAPSCRIPT_MINIMALIF)
1053    add_spender(spenders, "tapscript/minimalif", leaf="t5", **common, inputs=[getter("sign"), b'\x01'], failure={"inputs": [getter("sign"), b'\x0001']}, **ERR_TAPSCRIPT_MINIMALIF)
1054    add_spender(spenders, "tapscript/minimalnotif", leaf="t6", **common, inputs=[getter("sign"), b'\x01'], failure={"inputs": [getter("sign"), b'\x0100']}, **ERR_TAPSCRIPT_MINIMALIF)
1055    # Test that 1-byte public keys (which are unknown) are acceptable but nonstandard with unrelated signatures, but 0-byte public keys are not valid.
1056    add_spender(spenders, "tapscript/unkpk/checksig", leaf="t16", standard=False, **common, **SINGLE_SIG, failure={"leaf": "t7"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1057    add_spender(spenders, "tapscript/unkpk/checksigadd", leaf="t17", standard=False, **common, **SINGLE_SIG, failure={"leaf": "t10"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1058    add_spender(spenders, "tapscript/unkpk/checksigverify", leaf="t18", standard=False, **common, **SINGLE_SIG, failure={"leaf": "t8"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1059    # Test that 33-byte public keys (which are unknown) are acceptable but nonstandard with valid signatures, but normal pubkeys are not valid in that case.
1060    add_spender(spenders, "tapscript/oldpk/checksig", leaf="t30", standard=False, **common, **SINGLE_SIG, sighash=bitflipper(default_sighash), failure={"leaf": "t1"}, **ERR_SCHNORR_SIG)
1061    add_spender(spenders, "tapscript/oldpk/checksigadd", leaf="t31", standard=False, **common, **SINGLE_SIG, sighash=bitflipper(default_sighash), failure={"leaf": "t2"}, **ERR_SCHNORR_SIG)
1062    add_spender(spenders, "tapscript/oldpk/checksigverify", leaf="t32", standard=False, **common, **SINGLE_SIG, sighash=bitflipper(default_sighash), failure={"leaf": "t28"}, **ERR_SCHNORR_SIG)
1063    # Test that 0-byte public keys are not acceptable.
1064    add_spender(spenders, "tapscript/emptypk/checksig", leaf="t1", **SINGLE_SIG, **common, failure={"leaf": "t7"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1065    add_spender(spenders, "tapscript/emptypk/checksigverify", leaf="t2", **SINGLE_SIG, **common, failure={"leaf": "t8"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1066    add_spender(spenders, "tapscript/emptypk/checksigadd", leaf="t9", **SINGLE_SIG, **common, failure={"leaf": "t10"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1067    add_spender(spenders, "tapscript/emptypk/checksigadd", leaf="t35", standard=False, **SINGLE_SIG, **common, failure={"leaf": "t10"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1068    # Test that OP_CHECKSIGADD results are as expected
1069    add_spender(spenders, "tapscript/checksigaddresults", leaf="t28", **SINGLE_SIG, **common, failure={"leaf": "t27"}, **ERR_SCRIPT_NUM)
1070    add_spender(spenders, "tapscript/checksigaddoversize", leaf="t29", **SINGLE_SIG, **common, failure={"leaf": "t27"}, **ERR_SCRIPT_NUM)
1071    # Test that OP_CHECKSIGADD requires 3 stack elements.
1072    add_spender(spenders, "tapscript/checksigadd3args", leaf="t9", **SINGLE_SIG, **common, failure={"leaf": "t11"}, **ERR_INVALID_STACK_OPERATION)
1073    # Test that empty signatures do not cause script failure in OP_CHECKSIG and OP_CHECKSIGADD (but do fail with empty pubkey, and do fail OP_CHECKSIGVERIFY)
1074    add_spender(spenders, "tapscript/emptysigs/checksig", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t13"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1075    add_spender(spenders, "tapscript/emptysigs/nochecksigverify", leaf="t12", **common, inputs=[b'', getter("sign")], failure={"leaf": "t20"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1076    add_spender(spenders, "tapscript/emptysigs/checksigadd", leaf="t14", **common, inputs=[b'', getter("sign")], failure={"leaf": "t15"}, **ERR_TAPSCRIPT_EMPTY_PUBKEY)
1077    # Test that scripts over 10000 bytes (and over 201 non-push ops) are acceptable.
1078    add_spender(spenders, "tapscript/no10000limit", leaf="t19", **SINGLE_SIG, **common)
1079    # Test that a stack size of 1000 elements is permitted, but 1001 isn't.
1080    add_spender(spenders, "tapscript/1000stack", leaf="t21", **SINGLE_SIG, **common, failure={"leaf": "t22"}, **ERR_STACK_SIZE)
1081    # Test that an input stack size of 1000 elements is permitted, but 1001 isn't.
1082    add_spender(spenders, "tapscript/1000inputs", leaf="t23", **common, inputs=[getter("sign")] + [b'' for _ in range(999)], failure={"leaf": "t24", "inputs": [getter("sign")] + [b'' for _ in range(1000)]}, **ERR_STACK_SIZE)
1083    # Test that pushing a MAX_SCRIPT_ELEMENT_SIZE byte stack element is valid, but one longer is not.
1084    add_spender(spenders, "tapscript/pushmaxlimit", leaf="t25", **common, **SINGLE_SIG, failure={"leaf": "t26"}, **ERR_PUSH_SIZE)
1085    # Test that 999-of-999 multisig works (but 1000-of-1000 triggers stack size limits)
1086    add_spender(spenders, "tapscript/bigmulti", leaf="t33", **common, inputs=big_spend_inputs, num=999, failure={"leaf": "t34", "num": 1000}, **ERR_STACK_SIZE)
1087    # Test that the CLEANSTACK rule is consensus critical in tapscript
1088    add_spender(spenders, "tapscript/cleanstack", leaf="t36", tap=tap, inputs=[b'\x01'], failure={"inputs": [b'\x01', b'\x01']}, **ERR_CLEANSTACK)
1089
1090    # == Test for sigops ratio limit ==
1091
1092    # Given a number n, and a public key pk, functions that produce a (CScript, sigops). Each script takes as
1093    # input a valid signature with the passed pk followed by a dummy push of bytes that are to be dropped, and
1094    # will execute sigops signature checks.
1095    SIGOPS_RATIO_SCRIPTS = [
1096        # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIG.
1097        lambda n, pk: (CScript([OP_DROP, pk] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_CHECKSIG]), n + 1),
1098        # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGVERIFY.
1099        lambda n, pk: (CScript([OP_DROP, pk, OP_0, OP_IF, OP_2DUP, OP_CHECKSIGVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_2, OP_SWAP, OP_CHECKSIGADD, OP_3, OP_EQUAL]), n + 1),
1100        # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIG.
1101        lambda n, pk: (CScript([random.randbytes(220), OP_2DROP, pk, OP_1, OP_NOTIF, OP_2DUP, OP_CHECKSIG, OP_VERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_4, OP_SWAP, OP_CHECKSIGADD, OP_5, OP_EQUAL]), n + 1),
1102        # n OP_CHECKSIGVERIFYs and 1 OP_CHECKSIGADD, but also one unexecuted OP_CHECKSIGADD.
1103        lambda n, pk: (CScript([OP_DROP, pk, OP_1, OP_IF, OP_ELSE, OP_2DUP, OP_6, OP_SWAP, OP_CHECKSIGADD, OP_7, OP_EQUALVERIFY, OP_ENDIF] + [OP_2DUP, OP_CHECKSIGVERIFY] * n + [OP_8, OP_SWAP, OP_CHECKSIGADD, OP_9, OP_EQUAL]), n + 1),
1104        # n+1 OP_CHECKSIGs, but also one OP_CHECKSIG with an empty signature.
1105        lambda n, pk: (CScript([OP_DROP, OP_0, pk, OP_CHECKSIG, OP_NOT, OP_VERIFY, pk] + [OP_2DUP, OP_CHECKSIG, OP_VERIFY] * n + [OP_CHECKSIG]), n + 1),
1106        # n OP_CHECKSIGADDs and 1 OP_CHECKSIG, but also an OP_CHECKSIGADD with an empty signature.
1107        lambda n, pk: (CScript([OP_DROP, OP_0, OP_10, pk, OP_CHECKSIGADD, OP_10, OP_EQUALVERIFY, pk] + [OP_2DUP, OP_16, OP_SWAP, OP_CHECKSIGADD, b'\x11', OP_EQUALVERIFY] * n + [OP_CHECKSIG]), n + 1),
1108    ]
1109    for annex in [None, bytes([ANNEX_TAG]) + random.randbytes(random.randrange(1000))]:
1110        for hashtype in [SIGHASH_DEFAULT, SIGHASH_ALL]:
1111            for pubkey in [pubs[1], random.randbytes(random.choice([x for x in range(2, 81) if x != 32]))]:
1112                for fn_num, fn in enumerate(SIGOPS_RATIO_SCRIPTS):
1113                    merkledepth = random.randrange(129)
1114
1115
1116                    def predict_sigops_ratio(n, dummy_size):
1117                        """Predict whether spending fn(n, pubkey) with dummy_size will pass the ratio test."""
1118                        script, sigops = fn(n, pubkey)
1119                        # Predict the size of the witness for a given choice of n
1120                        stacklen_size = 1
1121                        sig_size = 64 + (hashtype != SIGHASH_DEFAULT)
1122                        siglen_size = 1
1123                        dummylen_size = 1 + 2 * (dummy_size >= 253)
1124                        script_size = len(script)
1125                        scriptlen_size = 1 + 2 * (script_size >= 253)
1126                        control_size = 33 + 32 * merkledepth
1127                        controllen_size = 1 + 2 * (control_size >= 253)
1128                        annex_size = 0 if annex is None else len(annex)
1129                        annexlen_size = 0 if annex is None else 1 + 2 * (annex_size >= 253)
1130                        witsize = stacklen_size + sig_size + siglen_size + dummy_size + dummylen_size + script_size + scriptlen_size + control_size + controllen_size + annex_size + annexlen_size
1131                        # sigops ratio test
1132                        return witsize + 50 >= 50 * sigops
1133                    # Make sure n is high enough that with empty dummy, the script is not valid
1134                    n = 0
1135                    while predict_sigops_ratio(n, 0):
1136                        n += 1
1137                    # But allow picking a bit higher still
1138                    n += random.randrange(5)
1139                    # Now pick dummy size *just* large enough that the overall construction passes
1140                    dummylen = 0
1141                    while not predict_sigops_ratio(n, dummylen):
1142                        dummylen += 1
1143                    scripts = [("s", fn(n, pubkey)[0])]
1144                    for _ in range(merkledepth):
1145                        scripts = [scripts, random.choice(PARTNER_MERKLE_FN)]
1146                    tap = taproot_construct(pubs[0], scripts)
1147                    standard = annex is None and dummylen <= 80 and len(pubkey) == 32
1148                    add_spender(spenders, "tapscript/sigopsratio_%i" % fn_num, tap=tap, leaf="s", annex=annex, hashtype=hashtype, key=secs[1], inputs=[getter("sign"), random.randbytes(dummylen)], standard=standard, failure={"inputs": [getter("sign"), random.randbytes(dummylen - 1)]}, **ERR_TAPSCRIPT_VALIDATION_WEIGHT)
1149
1150    # Future leaf versions
1151    for leafver in range(0, 0x100, 2):
1152        if leafver == LEAF_VERSION_TAPSCRIPT or leafver == ANNEX_TAG:
1153            # Skip the defined LEAF_VERSION_TAPSCRIPT, and the ANNEX_TAG which is not usable as leaf version
1154            continue
1155        scripts = [
1156            ("bare_c0", CScript([OP_NOP])),
1157            ("bare_unkver", CScript([OP_NOP]), leafver),
1158            ("return_c0", CScript([OP_RETURN])),
1159            ("return_unkver", CScript([OP_RETURN]), leafver),
1160            ("undecodable_c0", CScript([OP_PUSHDATA1])),
1161            ("undecodable_unkver", CScript([OP_PUSHDATA1]), leafver),
1162            ("bigpush_c0", CScript([random.randbytes(MAX_SCRIPT_ELEMENT_SIZE+1), OP_DROP])),
1163            ("bigpush_unkver", CScript([random.randbytes(MAX_SCRIPT_ELEMENT_SIZE+1), OP_DROP]), leafver),
1164            ("1001push_c0", CScript([OP_0] * 1001)),
1165            ("1001push_unkver", CScript([OP_0] * 1001), leafver),
1166        ]
1167        random.shuffle(scripts)
1168        tap = taproot_construct(pubs[0], scripts)
1169        add_spender(spenders, "unkver/bare", standard=False, tap=tap, leaf="bare_unkver", failure={"leaf": "bare_c0"}, **ERR_CLEANSTACK)
1170        add_spender(spenders, "unkver/return", standard=False, tap=tap, leaf="return_unkver", failure={"leaf": "return_c0"}, **ERR_OP_RETURN)
1171        add_spender(spenders, "unkver/undecodable", standard=False, tap=tap, leaf="undecodable_unkver", failure={"leaf": "undecodable_c0"}, **ERR_BAD_OPCODE)
1172        add_spender(spenders, "unkver/bigpush", standard=False, tap=tap, leaf="bigpush_unkver", failure={"leaf": "bigpush_c0"}, **ERR_PUSH_SIZE)
1173        add_spender(spenders, "unkver/1001push", standard=False, tap=tap, leaf="1001push_unkver", failure={"leaf": "1001push_c0"}, **ERR_STACK_SIZE)
1174        add_spender(spenders, "unkver/1001inputs", standard=False, tap=tap, leaf="bare_unkver", inputs=[b'']*1001, failure={"leaf": "bare_c0"}, **ERR_STACK_SIZE)
1175
1176    # OP_SUCCESSx tests.
1177    def hashtype(_):
1178        return random.choice(VALID_SIGHASHES_TAPROOT)
1179
1180    for opval in range(76, 0x100):
1181        opcode = CScriptOp(opval)
1182        if not is_op_success(opcode):
1183            continue
1184        scripts = [
1185            ("bare_success", CScript([opcode])),
1186            ("bare_nop", CScript([OP_NOP])),
1187            ("unexecif_success", CScript([OP_0, OP_IF, opcode, OP_ENDIF])),
1188            ("unexecif_nop", CScript([OP_0, OP_IF, OP_NOP, OP_ENDIF])),
1189            ("return_success", CScript([OP_RETURN, opcode])),
1190            ("return_nop", CScript([OP_RETURN, OP_NOP])),
1191            ("undecodable_success", CScript([opcode, OP_PUSHDATA1])),
1192            ("undecodable_nop", CScript([OP_NOP, OP_PUSHDATA1])),
1193            ("undecodable_bypassed_success", CScript([OP_PUSHDATA1, OP_2, opcode])),
1194            ("bigpush_success", CScript([random.randbytes(MAX_SCRIPT_ELEMENT_SIZE+1), OP_DROP, opcode])),
1195            ("bigpush_nop", CScript([random.randbytes(MAX_SCRIPT_ELEMENT_SIZE+1), OP_DROP, OP_NOP])),
1196            ("1001push_success", CScript([OP_0] * 1001 + [opcode])),
1197            ("1001push_nop", CScript([OP_0] * 1001 + [OP_NOP])),
1198        ]
1199        random.shuffle(scripts)
1200        tap = taproot_construct(pubs[0], scripts)
1201        add_spender(spenders, "opsuccess/bare", standard=False, tap=tap, leaf="bare_success", failure={"leaf": "bare_nop"}, **ERR_CLEANSTACK)
1202        add_spender(spenders, "opsuccess/unexecif", standard=False, tap=tap, leaf="unexecif_success", failure={"leaf": "unexecif_nop"}, **ERR_CLEANSTACK)
1203        add_spender(spenders, "opsuccess/return", standard=False, tap=tap, leaf="return_success", failure={"leaf": "return_nop"}, **ERR_OP_RETURN)
1204        add_spender(spenders, "opsuccess/undecodable", standard=False, tap=tap, leaf="undecodable_success", failure={"leaf": "undecodable_nop"}, **ERR_BAD_OPCODE)
1205        add_spender(spenders, "opsuccess/undecodable_bypass", standard=False, tap=tap, leaf="undecodable_success", failure={"leaf": "undecodable_bypassed_success"}, **ERR_BAD_OPCODE)
1206        add_spender(spenders, "opsuccess/bigpush", standard=False, tap=tap, leaf="bigpush_success", failure={"leaf": "bigpush_nop"}, **ERR_PUSH_SIZE)
1207        add_spender(spenders, "opsuccess/1001push", standard=False, tap=tap, leaf="1001push_success", failure={"leaf": "1001push_nop"}, **ERR_STACK_SIZE)
1208        add_spender(spenders, "opsuccess/1001inputs", standard=False, tap=tap, leaf="bare_success", inputs=[b'']*1001, failure={"leaf": "bare_nop"}, **ERR_STACK_SIZE)
1209        add_spender(spenders, "opsuccess/bigstackelem", standard=False, tap=tap, leaf="bare_success", inputs=[random.randbytes(MAX_SCRIPT_ELEMENT_SIZE+1)], failure={"leaf": "bare_nop"}, **ERR_PUSH_SIZE)
1210
1211    # Non-OP_SUCCESSx (verify that those aren't accidentally treated as OP_SUCCESSx)
1212    for opval in range(0, 0x100):
1213        opcode = CScriptOp(opval)
1214        if is_op_success(opcode):
1215            continue
1216        scripts = [
1217            ("normal", CScript([OP_RETURN, opcode] + [OP_NOP] * 75)),
1218            ("op_success", CScript([OP_RETURN, CScriptOp(0x50)]))
1219        ]
1220        tap = taproot_construct(pubs[0], scripts)
1221        add_spender(spenders, "alwaysvalid/notsuccessx", tap=tap, leaf="op_success", inputs=[], standard=False, failure={"leaf": "normal"}) # err_msg differs based on opcode
1222
1223    # == Test case for https://github.com/bitcoin/bitcoin/issues/24765 ==
1224
1225    def zero_fn(h):
1226        return bytes([0] * 32)
1227
1228    tap = taproot_construct(pubs[0], [("leaf", CScript([pubs[1], OP_CHECKSIG, pubs[1], OP_CHECKSIGADD, OP_2, OP_EQUAL])), zero_fn])
1229    add_spender(spenders, "case24765", tap=tap, leaf="leaf", inputs=[getter("sign"), getter("sign")], key=secs[1], no_fail=True)
1230
1231    # == Legacy tests ==
1232
1233    # Also add a few legacy spends into the mix, so that transactions which combine taproot and pre-taproot spends get tested too.
1234    for compressed in [False, True]:
1235        eckey1, pubkey1 = generate_keypair(compressed=compressed)
1236        eckey2, _ = generate_keypair(compressed=compressed)
1237        for p2sh in [False, True]:
1238            for witv0 in [False, True]:
1239                for hashtype in VALID_SIGHASHES_ECDSA + [random.randrange(0x04, 0x80), random.randrange(0x84, 0x100)]:
1240                    standard = (hashtype in VALID_SIGHASHES_ECDSA) and (compressed or not witv0)
1241                    add_spender(spenders, "legacy/pk-wrongkey", hashtype=hashtype, p2sh=p2sh, witv0=witv0, standard=standard, script=key_to_p2pk_script(pubkey1), **SINGLE_SIG, key=eckey1, failure={"key": eckey2}, sigops_weight=4-3*witv0, **ERR_EVAL_FALSE)
1242                    add_spender(spenders, "legacy/pkh-sighashflip", hashtype=hashtype, p2sh=p2sh, witv0=witv0, standard=standard, pkh=pubkey1, key=eckey1, **SIGHASH_BITFLIP, sigops_weight=4-3*witv0, **ERR_EVAL_FALSE)
1243
1244    # Verify that OP_CHECKSIGADD wasn't accidentally added to pre-taproot validation logic.
1245    for p2sh in [False, True]:
1246        for witv0 in [False, True]:
1247            for hashtype in VALID_SIGHASHES_ECDSA + [random.randrange(0x04, 0x80), random.randrange(0x84, 0x100)]:
1248                standard = hashtype in VALID_SIGHASHES_ECDSA and (p2sh or witv0)
1249                add_spender(spenders, "compat/nocsa", hashtype=hashtype, p2sh=p2sh, witv0=witv0, standard=standard, script=CScript([OP_IF, OP_11, pubkey1, OP_CHECKSIGADD, OP_12, OP_EQUAL, OP_ELSE, pubkey1, OP_CHECKSIG, OP_ENDIF]), key=eckey1, sigops_weight=4-3*witv0, inputs=[getter("sign"), b''], failure={"inputs": [getter("sign"), b'\x01']}, **ERR_BAD_OPCODE)
1250