Inside Bitcoin

751    ss += txTo.vin[inIdx].nSequence.to_bytes(4, "little")
752    ss += hashOutputs
753    ss += txTo.nLockTime.to_bytes(4, "little")
754    ss += hashtype.to_bytes(4, "little")
755    return ss
756
757def SegwitV0SignatureHash(*args, **kwargs):
758    return hash256(SegwitV0SignatureMsg(*args, **kwargs))
759
760class TestFrameworkScript(unittest.TestCase):
761    def test_bn2vch(self):
762        self.assertEqual(bn2vch(0), bytes([]))
763        self.assertEqual(bn2vch(1), bytes([0x01]))
764        self.assertEqual(bn2vch(-1), bytes([0x81]))
765        self.assertEqual(bn2vch(0x7F), bytes([0x7F]))
766        self.assertEqual(bn2vch(-0x7F), bytes([0xFF]))
767        self.assertEqual(bn2vch(0x80), bytes([0x80, 0x00]))
768        self.assertEqual(bn2vch(-0x80), bytes([0x80, 0x80]))
769        self.assertEqual(bn2vch(0xFF), bytes([0xFF, 0x00]))
770        self.assertEqual(bn2vch(-0xFF), bytes([0xFF, 0x80]))
771        self.assertEqual(bn2vch(0x100), bytes([0x00, 0x01]))
772        self.assertEqual(bn2vch(-0x100), bytes([0x00, 0x81]))
773        self.assertEqual(bn2vch(0x7FFF), bytes([0xFF, 0x7F]))
774        self.assertEqual(bn2vch(-0x8000), bytes([0x00, 0x80, 0x80]))
775        self.assertEqual(bn2vch(-0x7FFFFF), bytes([0xFF, 0xFF, 0xFF]))
776        self.assertEqual(bn2vch(0x80000000), bytes([0x00, 0x00, 0x00, 0x80, 0x00]))
777        self.assertEqual(bn2vch(-0x80000000), bytes([0x00, 0x00, 0x00, 0x80, 0x80]))
778        self.assertEqual(bn2vch(0xFFFFFFFF), bytes([0xFF, 0xFF, 0xFF, 0xFF, 0x00]))
779        self.assertEqual(bn2vch(123456789), bytes([0x15, 0xCD, 0x5B, 0x07]))
780        self.assertEqual(bn2vch(-54321), bytes([0x31, 0xD4, 0x80]))
781
782    def test_cscriptnum_encoding(self):
783        # round-trip negative and multi-byte CScriptNums
784        values = [0, 1, -1, -2, 127, 128, -255, 256, (1 << 15) - 1, -(1 << 16), (1 << 24) - 1, (1 << 31), 1 - (1 << 32), 1 << 40, 1500, -1500]
785        for value in values:
786            self.assertEqual(CScriptNum.decode(CScriptNum.encode(CScriptNum(value))), value)
787
788    def test_legacy_sigopcount(self):
789        # test repeated single sig ops
790        for n_ops in range(1, 100, 10):
791            for singlesig_op in (OP_CHECKSIG, OP_CHECKSIGVERIFY):
792                singlesigs_script = CScript([singlesig_op]*n_ops)
793                self.assertEqual(singlesigs_script.GetSigOpCount(fAccurate=False), n_ops)
794                self.assertEqual(singlesigs_script.GetSigOpCount(fAccurate=True), n_ops)
795        # test multisig op (including accurate counting, i.e. BIP16)
796        for n in range(1, 16+1):
797            for multisig_op in (OP_CHECKMULTISIG, OP_CHECKMULTISIGVERIFY):
798                multisig_script = CScript([CScriptOp.encode_op_n(n), multisig_op])
799                self.assertEqual(multisig_script.GetSigOpCount(fAccurate=False), 20)
800                self.assertEqual(multisig_script.GetSigOpCount(fAccurate=True), n)
801
802def BIP341_sha_prevouts(txTo):
803    return sha256(b"".join(i.prevout.serialize() for i in txTo.vin))
804
805def BIP341_sha_amounts(spent_utxos):
806    return sha256(b"".join(u.nValue.to_bytes(8, "little", signed=True) for u in spent_utxos))
807
808def BIP341_sha_scriptpubkeys(spent_utxos):
809    return sha256(b"".join(ser_string(u.scriptPubKey) for u in spent_utxos))
810
811def BIP341_sha_sequences(txTo):
812    return sha256(b"".join(i.nSequence.to_bytes(4, "little") for i in txTo.vin))
813
814def BIP341_sha_outputs(txTo):
815    return sha256(b"".join(o.serialize() for o in txTo.vout))
816
817def TaprootSignatureMsg(txTo, spent_utxos, hash_type, input_index=0, *, scriptpath=False, leaf_script=None, codeseparator_pos=-1, annex=None, leaf_ver=LEAF_VERSION_TAPSCRIPT):
818    assert_equal(len(txTo.vin), len(spent_utxos))
819    assert input_index < len(txTo.vin)
820    out_type = SIGHASH_ALL if hash_type == 0 else hash_type & 3
821    in_type = hash_type & SIGHASH_ANYONECANPAY
822    spk = spent_utxos[input_index].scriptPubKey
823    ss = bytes([0, hash_type]) # epoch, hash_type
824    ss += txTo.version.to_bytes(4, "little")
825    ss += txTo.nLockTime.to_bytes(4, "little")
826    if in_type != SIGHASH_ANYONECANPAY:
827        ss += BIP341_sha_prevouts(txTo)
828        ss += BIP341_sha_amounts(spent_utxos)
829        ss += BIP341_sha_scriptpubkeys(spent_utxos)
830        ss += BIP341_sha_sequences(txTo)
831    if out_type == SIGHASH_ALL:
832        ss += BIP341_sha_outputs(txTo)
833    spend_type = 0
834    if annex is not None:
835        spend_type |= 1
836    if scriptpath:
837        spend_type |= 2
838    ss += bytes([spend_type])
839    if in_type == SIGHASH_ANYONECANPAY:
840        ss += txTo.vin[input_index].prevout.serialize()
841        ss += spent_utxos[input_index].nValue.to_bytes(8, "little", signed=True)
842        ss += ser_string(spk)
843        ss += txTo.vin[input_index].nSequence.to_bytes(4, "little")
844    else:
845        ss += input_index.to_bytes(4, "little")
846    if (spend_type & 1):
847        ss += sha256(ser_string(annex))
848    if out_type == SIGHASH_SINGLE:
849        if input_index < len(txTo.vout):
850            ss += sha256(txTo.vout[input_index].serialize())
851        else:
852            ss += bytes(0 for _ in range(32))
853    if scriptpath:
854        ss += TaggedHash("TapLeaf", bytes([leaf_ver]) + ser_string(leaf_script))
855        ss += bytes([0])
856        ss += codeseparator_pos.to_bytes(4, "little", signed=False)
857    assert_equal(len(ss), 175 - (in_type == SIGHASH_ANYONECANPAY) * 49 - (out_type != SIGHASH_ALL and out_type != SIGHASH_SINGLE) * 32 + (annex is not None) * 32 + scriptpath * 37)
858    return ss
859
860def TaprootSignatureHash(*args, **kwargs):
861    return TaggedHash("TapSighash", TaprootSignatureMsg(*args, **kwargs))
862
863def taproot_tree_helper(scripts):
864    if len(scripts) == 0:
865        return ([], bytes())
866    if len(scripts) == 1:
867        # One entry: treat as a leaf
868        script = scripts[0]
869        assert not callable(script)
870        if isinstance(script, list):
871            return taproot_tree_helper(script)
872        assert isinstance(script, tuple)
873        version = LEAF_VERSION_TAPSCRIPT
874        name = script[0]
875        code = script[1]
876        if len(script) == 3:
877            version = script[2]
878        assert_equal(version & 1, 0)
879        assert isinstance(code, bytes)
880        h = TaggedHash("TapLeaf", bytes([version]) + ser_string(code))
881        if name is None:
882            return ([], h)
883        return ([(name, version, code, bytes(), h)], h)
884    elif len(scripts) == 2 and callable(scripts[1]):
885        # Two entries, and the right one is a function
886        left, left_h = taproot_tree_helper(scripts[0:1])
887        right_h = scripts[1](left_h)
888        left = [(name, version, script, control + right_h, leaf) for name, version, script, control, leaf in left]
889        right = []
890    else:
891        # Two or more entries: descend into each side
892        split_pos = len(scripts) // 2
893        left, left_h = taproot_tree_helper(scripts[0:split_pos])
894        right, right_h = taproot_tree_helper(scripts[split_pos:])
895        left = [(name, version, script, control + right_h, leaf) for name, version, script, control, leaf in left]
896        right = [(name, version, script, control + left_h, leaf) for name, version, script, control, leaf in right]
897    if right_h < left_h:
898        right_h, left_h = left_h, right_h
899    h = TaggedHash("TapBranch", left_h + right_h)
900    return (left + right, h)
901
902# A TaprootInfo object has the following fields:
903# - scriptPubKey: the scriptPubKey (witness v1 CScript)
904# - internal_pubkey: the internal pubkey (32 bytes)
905# - negflag: whether the pubkey in the scriptPubKey was negated from internal_pubkey+tweak*G (bool).
906# - tweak: the tweak (32 bytes)
907# - leaves: a dict of name -> TaprootLeafInfo objects for all known leaves
908# - merkle_root: the script tree's Merkle root, or bytes() if no leaves are present
909TaprootInfo = namedtuple("TaprootInfo", "scriptPubKey,internal_pubkey,negflag,tweak,leaves,merkle_root,output_pubkey")
910
911# A TaprootLeafInfo object has the following fields:
912# - script: the leaf script (CScript or bytes)
913# - version: the leaf version (0xc0 for BIP342 tapscript)
914# - merklebranch: the merkle branch to use for this leaf (32*N bytes)
915TaprootLeafInfo = namedtuple("TaprootLeafInfo", "script,version,merklebranch,leaf_hash")
916
917def taproot_construct(pubkey, scripts=None, treat_internal_as_infinity=False):
918    """Construct a tree of Taproot spending conditions
919
920    pubkey: a 32-byte xonly pubkey for the internal pubkey (bytes)
921    scripts: a list of items; each item is either:
922             - a (name, CScript or bytes, leaf version) tuple
923             - a (name, CScript or bytes) tuple (defaulting to leaf version 0xc0)
924             - another list of items (with the same structure)
925             - a list of two items; the first of which is an item itself, and the
926               second is a function. The function takes as input the Merkle root of the
927               first item, and produces a (fictitious) partner to hash with.
928
929    Returns: a TaprootInfo object
930    """
931    if scripts is None:
932        scripts = []
933
934    ret, h = taproot_tree_helper(scripts)
935    tweak = TaggedHash("TapTweak", pubkey + h)
936    if treat_internal_as_infinity:
937        tweaked, negated = compute_xonly_pubkey(tweak)
938    else:
939        tweaked, negated = tweak_add_pubkey(pubkey, tweak)
940    leaves = dict((name, TaprootLeafInfo(script, version, merklebranch, leaf)) for name, version, script, merklebranch, leaf in ret)
941    return TaprootInfo(CScript([OP_1, tweaked]), pubkey, negated + 0, tweak, leaves, h, tweaked)
942
943def is_op_success(o):
944    return o == 0x50 or o == 0x62 or o == 0x89 or o == 0x8a or o == 0x8d or o == 0x8e or (o >= 0x7e and o <= 0x81) or (o >= 0x83 and o <= 0x86) or (o >= 0x95 and o <= 0x99) or (o >= 0xbb and o <= 0xfe)
945