Inside Bitcoin

501
502                elif opcode == OP_PUSHDATA1:
503                    pushdata_type = 'PUSHDATA1'
504                    if i >= len(self):
505                        raise CScriptInvalidError('PUSHDATA1: missing data length')
506                    datasize = self[i]
507                    i += 1
508
509                elif opcode == OP_PUSHDATA2:
510                    pushdata_type = 'PUSHDATA2'
511                    if i + 1 >= len(self):
512                        raise CScriptInvalidError('PUSHDATA2: missing data length')
513                    datasize = self[i] + (self[i + 1] << 8)
514                    i += 2
515
516                elif opcode == OP_PUSHDATA4:
517                    pushdata_type = 'PUSHDATA4'
518                    if i + 3 >= len(self):
519                        raise CScriptInvalidError('PUSHDATA4: missing data length')
520                    datasize = self[i] + (self[i + 1] << 8) + (self[i + 2] << 16) + (self[i + 3] << 24)
521                    i += 4
522
523                else:
524                    assert False  # shouldn't happen
525
526                data = bytes(self[i:i + datasize])
527
528                # Check for truncation
529                if len(data) < datasize:
530                    raise CScriptTruncatedPushDataError('%s: truncated data' % pushdata_type, data)
531
532                i += datasize
533
534                yield (opcode, data, sop_idx)
535
536    def __iter__(self):
537        """'Cooked' iteration
538
539        Returns either a CScriptOP instance, an integer, or bytes, as
540        appropriate.
541
542        See raw_iter() if you need to distinguish the different possible
543        PUSHDATA encodings.
544        """
545        for (opcode, data, sop_idx) in self.raw_iter():
546            if data is not None:
547                yield data
548            else:
549                opcode = CScriptOp(opcode)
550
551                if opcode.is_small_int():
552                    yield opcode.decode_op_n()
553                else:
554                    yield CScriptOp(opcode)
555
556    def __repr__(self):
557        def _repr(o):
558            if isinstance(o, bytes):
559                return "x('%s')" % o.hex()
560            else:
561                return repr(o)
562
563        ops = []
564        i = iter(self)
565        while True:
566            op = None
567            try:
568                op = _repr(next(i))
569            except CScriptTruncatedPushDataError as err:
570                op = '%s...<ERROR: %s>' % (_repr(err.data), err)
571                break
572            except CScriptInvalidError as err:
573                op = '<ERROR: %s>' % err
574                break
575            except StopIteration:
576                break
577            finally:
578                if op is not None:
579                    ops.append(op)
580
581        return "CScript([%s])" % ', '.join(ops)
582
583    def GetSigOpCount(self, fAccurate):
584        """Get the SigOp count.
585
586        fAccurate - Accurately count CHECKMULTISIG, see BIP16 for details.
587
588        Note that this is consensus-critical.
589        """
590        n = 0
591        lastOpcode = OP_INVALIDOPCODE
592        for (opcode, data, sop_idx) in self.raw_iter():
593            if opcode in (OP_CHECKSIG, OP_CHECKSIGVERIFY):
594                n += 1
595            elif opcode in (OP_CHECKMULTISIG, OP_CHECKMULTISIGVERIFY):
596                if fAccurate and (OP_1 <= lastOpcode <= OP_16):
597                    n += lastOpcode.decode_op_n()
598                else:
599                    n += 20
600            lastOpcode = opcode
601        return n
602
603    def IsWitnessProgram(self):
604        """A witness program is any valid CScript that consists of a 1-byte
605           push opcode followed by a data push between 2 and 40 bytes."""
606        return ((4 <= len(self) <= 42) and
607                (self[0] == OP_0 or (OP_1 <= self[0] <= OP_16)) and
608                (self[1] + 2 == len(self)))
609
610
611SIGHASH_DEFAULT = 0 # Taproot-only default, semantics same as SIGHASH_ALL
612SIGHASH_ALL = 1
613SIGHASH_NONE = 2
614SIGHASH_SINGLE = 3
615SIGHASH_ANYONECANPAY = 0x80
616
617def FindAndDelete(script, sig):
618    """Consensus critical, see FindAndDelete() in Satoshi codebase"""
619    r = b''
620    last_sop_idx = sop_idx = 0
621    skip = True
622    for (opcode, data, sop_idx) in script.raw_iter():
623        if not skip:
624            r += script[last_sop_idx:sop_idx]
625        last_sop_idx = sop_idx
626        if script[sop_idx:sop_idx + len(sig)] == sig:
627            skip = True
628        else:
629            skip = False
630    if not skip:
631        r += script[last_sop_idx:]
632    return CScript(r)
633
634def LegacySignatureMsg(script, txTo, inIdx, hashtype):
635    """Preimage of the signature hash, if it exists.
636
637    Returns either (None, err) to indicate error (which translates to sighash 1),
638    or (msg, None).
639    """
640
641    if inIdx >= len(txTo.vin):
642        return (None, "inIdx %d out of range (%d)" % (inIdx, len(txTo.vin)))
643    txtmp = CTransaction(txTo)
644
645    for txin in txtmp.vin:
646        txin.scriptSig = b''
647    txtmp.vin[inIdx].scriptSig = FindAndDelete(script, CScript([OP_CODESEPARATOR]))
648
649    if (hashtype & 0x1f) == SIGHASH_NONE:
650        txtmp.vout = []
651
652        for i in range(len(txtmp.vin)):
653            if i != inIdx:
654                txtmp.vin[i].nSequence = 0
655
656    elif (hashtype & 0x1f) == SIGHASH_SINGLE:
657        outIdx = inIdx
658        if outIdx >= len(txtmp.vout):
659            return (None, "outIdx %d out of range (%d)" % (outIdx, len(txtmp.vout)))
660
661        tmp = txtmp.vout[outIdx]
662        txtmp.vout = []
663        for _ in range(outIdx):
664            txtmp.vout.append(CTxOut(-1))
665        txtmp.vout.append(tmp)
666
667        for i in range(len(txtmp.vin)):
668            if i != inIdx:
669                txtmp.vin[i].nSequence = 0
670
671    if hashtype & SIGHASH_ANYONECANPAY:
672        tmp = txtmp.vin[inIdx]
673        txtmp.vin = []
674        txtmp.vin.append(tmp)
675
676    s = txtmp.serialize_without_witness()
677    s += hashtype.to_bytes(4, "little")
678
679    return (s, None)
680
681def LegacySignatureHash(*args, **kwargs):
682    """Consensus-correct SignatureHash
683
684    Returns (hash, err) to precisely match the consensus-critical behavior of
685    the SIGHASH_SINGLE bug. (inIdx is *not* checked for validity)
686    """
687
688    HASH_ONE = b'\x01\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00\x00'
689    msg, err = LegacySignatureMsg(*args, **kwargs)
690    if msg is None:
691        return (HASH_ONE, err)
692    else:
693        return (hash256(msg), err)
694
695def sign_input_legacy(tx, input_index, input_scriptpubkey, privkey, sighash_type=SIGHASH_ALL):
696    """Add legacy ECDSA signature for a given transaction input. Note that the signature
697       is prepended to the scriptSig field, i.e. additional data pushes necessary for more
698       complex spends than P2PK (e.g. pubkey for P2PKH) can be already set before."""
699    (sighash, err) = LegacySignatureHash(input_scriptpubkey, tx, input_index, sighash_type)
700    assert err is None
701    der_sig = privkey.sign_ecdsa(sighash)
702    tx.vin[input_index].scriptSig = bytes(CScript([der_sig + bytes([sighash_type])])) + tx.vin[input_index].scriptSig
703
704def sign_input_segwitv0(tx, input_index, input_scriptpubkey, input_amount, privkey, sighash_type=SIGHASH_ALL):
705    """Add segwitv0 ECDSA signature for a given transaction input. Note that the signature
706       is inserted at the bottom of the witness stack, i.e. additional witness data
707       needed (e.g. pubkey for P2WPKH) can already be set before."""
708    sighash = SegwitV0SignatureHash(input_scriptpubkey, tx, input_index, sighash_type, input_amount)
709    der_sig = privkey.sign_ecdsa(sighash)
710    tx.wit.vtxinwit[input_index].scriptWitness.stack.insert(0, der_sig + bytes([sighash_type]))
711
712# TODO: Allow cached hashPrevouts/hashSequence/hashOutputs to be provided.
713# Performance optimization probably not necessary for python tests, however.
714# Note that this corresponds to sigversion == 1 in EvalScript, which is used
715# for version 0 witnesses.
716def SegwitV0SignatureMsg(script, txTo, inIdx, hashtype, amount):
717    ZERO_HASH = bytes([0]*32)
718
719    hashPrevouts = ZERO_HASH
720    hashSequence = ZERO_HASH
721    hashOutputs = ZERO_HASH
722
723    if not (hashtype & SIGHASH_ANYONECANPAY):
724        serialize_prevouts = bytes()
725        for i in txTo.vin:
726            serialize_prevouts += i.prevout.serialize()
727        hashPrevouts = hash256(serialize_prevouts)
728
729    if (not (hashtype & SIGHASH_ANYONECANPAY) and (hashtype & 0x1f) != SIGHASH_SINGLE and (hashtype & 0x1f) != SIGHASH_NONE):
730        serialize_sequence = bytes()
731        for i in txTo.vin:
732            serialize_sequence += i.nSequence.to_bytes(4, "little")
733        hashSequence = hash256(serialize_sequence)
734
735    if ((hashtype & 0x1f) != SIGHASH_SINGLE and (hashtype & 0x1f) != SIGHASH_NONE):
736        serialize_outputs = bytes()
737        for o in txTo.vout:
738            serialize_outputs += o.serialize()
739        hashOutputs = hash256(serialize_outputs)
740    elif ((hashtype & 0x1f) == SIGHASH_SINGLE and inIdx < len(txTo.vout)):
741        serialize_outputs = txTo.vout[inIdx].serialize()
742        hashOutputs = hash256(serialize_outputs)
743
744    ss = bytes()
745    ss += txTo.version.to_bytes(4, "little")
746    ss += hashPrevouts
747    ss += hashSequence
748    ss += txTo.vin[inIdx].prevout.serialize()
749    ss += ser_string(script)
750    ss += amount.to_bytes(8, "little", signed=True)