bitcoinrb 1.12.0 → 1.13.0

data/lib/bitcoin/message/ping.rb

@@ -14,15 +14,17 @@ module Bitcoin
       end
 
       def self.parse_from_payload(payload)
-        new(payload.unpack1('Q'))
+        new(payload.unpack1('Q<'))
       end
 
       def to_payload
-        [nonce].pack('Q')
+        nonce ? [nonce].pack('Q<') : ''
       end
 
+      # Generate pong message as a response. Return nil if the ping has no nonce
+      # (sent by a node before BIP-31), since such a ping does not expect a pong.
       def to_response
-        Pong.new(nonce)
+        Pong.new(nonce) if nonce
       end
 
     end

data/lib/bitcoin/message/pong.rb

@@ -14,11 +14,11 @@ module Bitcoin
       end
 
       def self.parse_from_payload(payload)
-        new(payload.unpack1('Q'))
+        new(payload.unpack1('Q<'))
       end
 
       def to_payload
-        [nonce].pack('Q')
+        [nonce].pack('Q<')
       end
     end
 

data/lib/bitcoin/message/send_cmpct.rb

@@ -22,12 +22,12 @@ module Bitcoin
       def self.parse_from_payload(payload)
         buf = StringIO.new(payload)
         mode = buf.read(1).unpack1('c')
-        version = buf.read(8).unpack1('Q')
+        version = buf.read(8).unpack1('Q<')
         new(mode, version)
       end
 
       def to_payload
-        [mode, version].pack('cQ')
+        [mode, version].pack('cQ<')
       end
 
       def high?

data/lib/bitcoin/message/version.rb

@@ -32,7 +32,7 @@ module Bitcoin
       end
 
       def self.parse_from_payload(payload)
-        version, services, timestamp, local_addr, remote_addr, nonce, rest = payload.unpack('VQQa26a26Qa*')
+        version, services, timestamp, local_addr, remote_addr, nonce, rest = payload.unpack('VQ<Q<a26a26Q<a*')
         v = new
         v.version = version
         v.services = services
@@ -50,10 +50,10 @@ module Bitcoin
 
       def to_payload
         [
-          [version, services, timestamp].pack('VQQ'),
+          [version, services, timestamp].pack('VQ<Q<'),
           local_addr.to_payload(true),
           remote_addr.to_payload(true),
-          [nonce].pack('Q'),
+          [nonce].pack('Q<'),
           pack_var_string(user_agent),
           [start_height].pack('V'),
           pack_boolean(relay)
@@ -61,7 +61,7 @@ module Bitcoin
       end
 
       def unpack_relay_field(payload)
-        ( version >= 70001 && payload ) ? unpack_boolean(payload) : [ true, nil ]
+        ( version >= 70001 && payload && !payload.empty? ) ? unpack_boolean(payload) : [ true, nil ]
       end
 
       # Check whether +service_flag+ support this version.

data/lib/bitcoin/message.rb

@@ -1,8 +1,6 @@
 module Bitcoin
   module Message
 
-    class Error < StandardError; end
-
     autoload :Base, 'bitcoin/message/base'
     autoload :Inventory, 'bitcoin/message/inventory'
     autoload :InventoriesParser, 'bitcoin/message/inventories_parser'
@@ -107,6 +105,8 @@ module Bitcoin
         Pong.parse_from_payload(payload)
       when GetHeaders::COMMAND
         GetHeaders.parse_from_payload(payload)
+      when GetBlocks::COMMAND
+        GetBlocks.parse_from_payload(payload)
       when Headers::COMMAND
         Headers.parse_from_payload(payload)
       when Block::COMMAND
@@ -125,8 +125,18 @@ module Bitcoin
         Inv.parse_from_payload(payload)
       when MerkleBlock::COMMAND
         MerkleBlock.parse_from_payload(payload)
+      when FilterLoad::COMMAND
+        FilterLoad.parse_from_payload(payload)
+      when FilterAdd::COMMAND
+        FilterAdd.parse_from_payload(payload)
+      when FilterClear::COMMAND
+        FilterClear.new
       when CmpctBlock::COMMAND
         CmpctBlock.parse_from_payload(payload)
+      when GetBlockTxn::COMMAND
+        GetBlockTxn.parse_from_payload(payload)
+      when BlockTxn::COMMAND
+        BlockTxn.parse_from_payload(payload)
       when GetData::COMMAND
         GetData.parse_from_payload(payload)
       when GetCFHeaders::COMMAND

data/lib/bitcoin/message_sign.rb

@@ -10,6 +10,22 @@ module Bitcoin
     FORMAT_SIMPLE = :simple
     FORMAT_FULL = :full
 
+    # Prefix
+    SIGNATURE_PREFIX_SIMPLE = 'smp'
+    SIGNATURE_PREFIX_FULL = 'ful'
+    SIGNATURE_PREFIX_POF = 'pof'
+
+    # BIP-322 Required rules
+    BIP322_VERIFY_FLAGS = [
+      SCRIPT_VERIFY_P2SH, SCRIPT_VERIFY_DERSIG, SCRIPT_VERIFY_STRICTENC,
+      SCRIPT_VERIFY_LOW_S, SCRIPT_VERIFY_NULLFAIL, SCRIPT_VERIFY_MINIMALDATA,
+      SCRIPT_VERIFY_CLEANSTACK, SCRIPT_VERIFY_MINIMALIF,
+      SCRIPT_VERIFY_CONST_SCRIPTCODE,
+      SCRIPT_VERIFY_WITNESS, SCRIPT_VERIFY_TAPROOT,
+      SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS,
+      SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM
+    ].inject(:|)
+
     # Sign a message.
     # @param [Bitcoin::Key] key Private key to sign.
     # @param [String] message The message to be signed.
@@ -20,28 +36,38 @@ module Bitcoin
     def sign_message(key, message, prefix: Bitcoin.chain_params.message_magic, format: FORMAT_LEGACY, address: nil)
       validate_format!(format)
       digest = message_hash(message, prefix: prefix, legacy: format == FORMAT_LEGACY)
+      prefix_marker = ''
       sig = case format
             when FORMAT_LEGACY
               key.sign_compact(digest)
             else
               validate_address!(address)
               addr = Bitcoin::Script.parse_from_addr(address)
-              sig_ver, algo = if addr.p2wpkh?
+              sig_ver, algo = if addr.p2wpkh? || addr.p2wsh?
                                 [:witness_v0, :ecdsa]
                               elsif addr.p2tr?
                                 [:taproot, :schnorr]
                               else
-                                raise ArgumentError "#{address} dose not supported."
+
                               end
               tx = to_sign_tx(digest, address)
-              prev_out = Bitcoin::TxOut.new(script_pubkey: addr)
-              sighash = tx.sighash_for_input(0, addr, sig_version: sig_ver, amount: 0, prevouts: [prev_out])
-              sig = key.sign(sighash, algo: algo) + [Bitcoin::SIGHASH_TYPE[:all]].pack('C')
-              tx.in[0].script_witness.stack << sig
-              tx.in[0].script_witness.stack << key.pubkey.htb
+              prev_out = Bitcoin::TxOut.new(script_pubkey: addr, value: 0)
+              if addr.p2tr?
+                sighash = tx.sighash_for_input(0, addr, sig_version: :taproot, prevouts: [prev_out], hash_type: Bitcoin::SIGHASH_TYPE[:default])
+                tweaked = Bitcoin::Taproot.tweak_private_key(key, '')
+                tx.in[0].script_witness.stack << tweaked.sign(sighash, algo: :schnorr)
+              elsif addr.p2wpkh? || addr.p2wsh?
+                sighash = tx.sighash_for_input(0, addr, sig_version: :witness_v0, amount: 0, prevouts: [prev_out])
+                ecdsa  = key.sign(sighash, algo: :ecdsa) + [Bitcoin::SIGHASH_TYPE[:all]].pack('C')
+                tx.in[0].script_witness.stack << ecdsa
+                tx.in[0].script_witness.stack << key.pubkey.htb
+              else
+                raise ArgumentError, "#{address} dose not supported."
+              end
+              prefix_marker = format == FORMAT_SIMPLE ? SIGNATURE_PREFIX_SIMPLE : SIGNATURE_PREFIX_FULL
               format == FORMAT_SIMPLE ? tx.in[0].script_witness.to_payload : tx.to_payload
             end
-      Base64.strict_encode64(sig)
+      prefix_marker + Base64.strict_encode64(sig)
     end
 
     # Verify a signed message.
@@ -51,41 +77,41 @@ module Bitcoin
     # @return [Boolean] Verification result.
     def verify_message(address, signature, message, prefix: Bitcoin.chain_params.message_magic)
       addr_script = Bitcoin::Script.parse_from_addr(address)
+      variant, body = case signature
+                      when ''
+                        raise ArgumentError, 'signature too short'
+                      when /\A#{SIGNATURE_PREFIX_SIMPLE}/
+                        [:simple, signature[3..]]
+                      when /\A#{SIGNATURE_PREFIX_FULL}/
+                        [:full, signature[3..]]
+                      when /\A#{SIGNATURE_PREFIX_POF}/
+                        [:pof, signature[3..]]
+                      else
+                        [:fallback, signature]
+                      end
       begin
-        sig = Base64.strict_decode64(signature)
+        payload = Base64.strict_decode64(body)
       rescue ArgumentError
         raise ArgumentError, 'Invalid signature'
       end
-      if addr_script.p2pkh?
-        begin
-          # Legacy verification
-          pubkey = Bitcoin::Key.recover_compact(message_hash(message, prefix: prefix, legacy: true), sig)
-          return false unless pubkey
-          pubkey.to_p2pkh == address
-        rescue Exception
-          false
-        end
-      elsif addr_script.witness_program?
-        # BIP322 verification
-        digest = message_hash(message, prefix: prefix, legacy: false)
+
+      case variant
+      when :simple, :fallback
+        return verify_legacy(address, payload, message, prefix: prefix) if addr_script.p2pkh?
+        raise ArgumentError, 'simple format not supported for this address' unless
+          addr_script.p2wpkh? || addr_script.p2wsh? || addr_script.p2tr?
+        verify_simple(addr_script, payload, message, prefix: prefix)
+      when :full
         begin
-          # Full
-          tx = Bitcoin::Tx.parse_from_payload(sig)
-          validate_to_sign_tx!(tx)
-          to_spend = to_spend_tx(digest, address)
-          return false unless tx.in[0].out_point.tx_hash == to_spend.tx_hash
-        rescue Exception
-          # Simple
-          tx = to_sign_tx(digest, address)
-          tx.in[0].script_witness = Bitcoin::ScriptWitness.parse_from_payload(sig)
+          tx = Bitcoin::Tx.parse_from_payload(payload)
+        rescue StandardError
+          raise ArgumentError, 'error parsing signature as full variant'
         end
-        script_pubkey = Bitcoin::Script.parse_from_addr(address)
-        tx_out = Bitcoin::TxOut.new(script_pubkey: script_pubkey)
-        flags = Bitcoin::STANDARD_SCRIPT_VERIFY_FLAGS
-        interpreter = Bitcoin::ScriptInterpreter.new(flags: flags, checker: Bitcoin::TxChecker.new(tx: tx, input_index: 0, prevouts: [tx_out]))
-        interpreter.verify_script(Bitcoin::Script.new, script_pubkey, tx.in[0].script_witness)
+        verify_full(addr_script, tx, message, prefix: prefix)
+      when :pof
+        raise NotImplementedError, 'proof of funds variant is not supported'
       else
-        raise ArgumentError, "This address unsupported."
+        raise ArgumentError, "unknown signature variant: #{variant.inspect}"
       end
     end
 
@@ -99,8 +125,7 @@ module Bitcoin
     end
 
     def validate_address!(address)
-      script = Bitcoin::Script.parse_from_addr(address)
-      raise ArgumentError, 'This address unsupported' if script.p2sh? || script.p2wsh?
+      Bitcoin::Script.parse_from_addr(address)
     end
 
     def validate_format!(format)
@@ -110,6 +135,7 @@ module Bitcoin
     end
 
     def validate_to_sign_tx!(tx)
+      raise ArgumentError, "Invalid version." unless [0, 2].include?(tx.version)
       raise ArgumentError, "Multiple inputs (proof of funds) are not supported." unless tx.in.length == 1
       raise ArgumentError, "vin[0].prevout.n must be 0." unless tx.in[0].out_point.index == 0
       raise ArgumentError, "Multiple outputs are not supported." unless tx.out.length == 1
@@ -140,8 +166,42 @@ module Bitcoin
       tx
     end
 
+    def verify_simple(addr_script, witness_payload, message, prefix:)
+      digest = message_hash(message, prefix: prefix, legacy: false)
+      tx = to_sign_tx(digest, addr_script.to_addr)
+      tx.in[0].script_witness = Bitcoin::ScriptWitness.parse_from_payload(witness_payload)
+      run_interpreter(tx, addr_script)
+    end
+
+    def verify_full(addr_script, tx, message, prefix:)
+      digest = message_hash(message, prefix: prefix, legacy: false)
+      to_spend = to_spend_tx(digest, addr_script.to_addr)
+      validate_to_sign_tx!(tx)
+      return false unless tx.in[0].out_point.tx_hash == to_spend.tx_hash
+      run_interpreter(tx, addr_script)
+    end
+
+    def run_interpreter(tx, script_pubkey)
+      tx_out = Bitcoin::TxOut.new(script_pubkey: script_pubkey)
+      checker = Bitcoin::TxChecker.new(tx: tx, input_index: 0, prevouts: [tx_out])
+      interpreter = Bitcoin::ScriptInterpreter.new(flags: BIP322_VERIFY_FLAGS, checker: checker)
+      interpreter.verify_script(tx.in[0].script_sig, script_pubkey, tx.in[0].script_witness)
+    end
+
+    def verify_legacy(address, sig_bytes, message, prefix:)
+      pubkey = Bitcoin::Key.recover_compact(message_hash(message, prefix: prefix, legacy: true), sig_bytes)
+      return false unless pubkey
+      pubkey.to_p2pkh == address
+    rescue StandardError
+      false
+    end
+
     private_class_method :validate_address!
     private_class_method :validate_format!
     private_class_method :validate_to_sign_tx!
+    private_class_method :run_interpreter
+    private_class_method :verify_simple
+    private_class_method :verify_full
+    private_class_method :verify_legacy
   end
 end

data/lib/bitcoin/mnemonic.rb

@@ -24,7 +24,7 @@ module Bitcoin
     def to_entropy(words)
       word_master = load_words
       mnemonic = words.map do |w|
-        index = word_master.index(w.downcase)
+        index = word_master.index(normalize(w).downcase)
         raise IndexError, 'word not found in words list.' unless index
         index.to_s(2).rjust(11, '0')
       end.join
@@ -53,8 +53,8 @@ module Bitcoin
     # @return [String] seed
     def to_seed(mnemonic, passphrase: '')
       to_entropy(mnemonic)
-      OpenSSL::PKCS5.pbkdf2_hmac(mnemonic.join(' ').downcase,
-                                 'mnemonic' + passphrase, 2048, 64, OpenSSL::Digest::SHA512.new).bth
+      OpenSSL::PKCS5.pbkdf2_hmac(normalize(mnemonic.join(' ')).downcase,
+                                 'mnemonic' + normalize(passphrase), 2048, 64, OpenSSL::Digest::SHA512.new).bth
     end
 
     # calculate entropy checksum
@@ -69,7 +69,12 @@ module Bitcoin
 
     # load word list contents
     def load_words
-      File.readlines("#{WORD_DIR}/#{language}.txt").map(&:strip)
+      File.readlines("#{WORD_DIR}/#{language}.txt", encoding: Encoding::UTF_8).map{|w| normalize(w.strip)}
+    end
+
+    # BIP-39 requires that mnemonic sentences and passphrases are normalized using NFKD.
+    def normalize(str)
+      str.unicode_normalize(:nfkd)
     end
 
   end

data/lib/bitcoin/psbt/input.rb

@@ -55,8 +55,9 @@ module Bitcoin
             found_sep = true
             break
           end
-          key_type = buf.read(1).unpack1('C')
-          key = buf.read(key_len - 1)
+          key_start = buf.pos
+          key_type = Bitcoin.unpack_var_int_from_io(buf)
+          key = buf.read(key_len - (buf.pos - key_start))
           value = buf.read(Bitcoin.unpack_var_int_from_io(buf))
 
           case key_type
@@ -79,7 +80,8 @@ module Bitcoin
           when PSBT_IN_TYPES[:sighash]
             raise ArgumentError, 'Invalid input sighash type typed key.' unless key_len == 1
             raise ArgumentError, 'Duplicate Key, input sighash type already provided.' if input.sighash_type
-            input.sighash_type = value.unpack1('I')
+            raise ArgumentError, 'Invalid input sighash type value.' unless value.bytesize == 4
+            input.sighash_type = value.unpack1('V')
           when PSBT_IN_TYPES[:redeem_script]
             raise ArgumentError, 'Invalid redeemscript typed key.' unless key_len == 1
             raise ArgumentError, 'Duplicate Key, input redeemScript already provided.' if input.redeem_script
@@ -117,10 +119,12 @@ module Bitcoin
             raise ArgumentError, 'Duplicate Key, input hash256 preimage already provided' if input.hash256_preimages[key.bth]
             input.hash256_preimages[key.bth] = value.bth
           when PSBT_IN_TYPES[:proprietary]
-            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if input.proprietaries.any?{|p| p.key == key}
-            input.proprietaries << Proprietary.new(key, value)
+            proprietary = Proprietary.new(key, value)
+            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if input.proprietaries.any?{|p| p.key == proprietary.key}
+            input.proprietaries << proprietary
           when PSBT_IN_TYPES[:tap_key_sig]
             raise ArgumentError, 'Size of key was not the expected size for the type tap key sig' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, input tap key sig already provided.' if input.tap_key_sig
             raise ArgumentError, 'Invalid schnorr signature size for the type tap key sig' unless [64, 65].include?(value.bytesize)
             input.tap_key_sig = value.bth
           when PSBT_IN_TYPES[:tap_script_sig]
@@ -142,14 +146,16 @@ module Bitcoin
             input.tap_bip32_derivations[key.bth] = value.bth
           when PSBT_IN_TYPES[:tap_internal_key]
             raise ArgumentError, 'Size of key was not the expected size for the type tap internal key' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, input tap internal key already provided.' if input.tap_internal_key
             raise ArgumentError, 'Invalid x-only public key size for the type tap internal key' unless value.bytesize == X_ONLY_PUBKEY_SIZE
             input.tap_internal_key = value.bth
           when PSBT_IN_TYPES[:tap_merkle_root]
             raise ArgumentError, 'Size of key was not the expected size for the type tap merkle root' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, input tap merkle root already provided.' if input.tap_merkle_root
             raise ArgumentError, 'Invalid merkle root hash size for the type tap merkle root' unless value.bytesize == 32
             input.tap_merkle_root = value.bth
           else
-            unknown_key = ([key_type].pack('C') + key).bth
+            unknown_key = (Bitcoin.pack_var_int(key_type) + key).bth
             raise ArgumentError, 'Duplicate Key, key for unknown value already provided.' if input.unknowns[unknown_key]
             input.unknowns[unknown_key] = value
           end
@@ -163,23 +169,21 @@ module Bitcoin
         payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:non_witness_utxo], value:
             (witness_utxo && valid_witness_input?) ? non_witness_utxo.serialize_old_format : non_witness_utxo.to_payload) if non_witness_utxo
         payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:witness_utxo], value: witness_utxo.to_payload) if witness_utxo
-        if final_script_sig.nil? && final_script_witness.nil?
-          payload << partial_sigs.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:partial_sig], key: k.htb, value: v)}.join
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:sighash], value: [sighash_type].pack('I')) if sighash_type
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:redeem_script], value: redeem_script.to_payload) if redeem_script
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:witness_script], value: witness_script.to_payload) if witness_script
-          payload << hd_key_paths.values.map(&:to_payload).join
-          payload << ripemd160_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:ripemd160], key: k.htb, value: v.htb)}.join
-          payload << sha256_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:sha256], key: k.htb, value: v.htb)}.join
-          payload << hash160_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:hash160], key: k.htb, value: v.htb)}.join
-          payload << hash256_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:hash256], key: k.htb, value: v.htb)}.join
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_key_sig], value: tap_key_sig.htb) if tap_key_sig
-          payload << tap_script_sigs.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_script_sig], key: k.htb, value: v.htb)}.join
-          payload << tap_leaf_scripts.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_leaf_script], key: k.to_payload, value: v.htb)}.join
-          payload << tap_bip32_derivations.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_bip32_derivation], key: k.htb, value: v.htb)}.join
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_internal_key], value: tap_internal_key.htb) if tap_internal_key
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_merkle_root], value: tap_merkle_root.htb) if tap_merkle_root
-        end
+        payload << partial_sigs.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:partial_sig], key: k.htb, value: v)}.join
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:sighash], value: [sighash_type].pack('V')) if sighash_type
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:redeem_script], value: redeem_script.to_payload) if redeem_script
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:witness_script], value: witness_script.to_payload) if witness_script
+        payload << hd_key_paths.values.map(&:to_payload).join
+        payload << ripemd160_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:ripemd160], key: k.htb, value: v.htb)}.join
+        payload << sha256_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:sha256], key: k.htb, value: v.htb)}.join
+        payload << hash160_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:hash160], key: k.htb, value: v.htb)}.join
+        payload << hash256_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:hash256], key: k.htb, value: v.htb)}.join
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_key_sig], value: tap_key_sig.htb) if tap_key_sig
+        payload << tap_script_sigs.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_script_sig], key: k.htb, value: v.htb)}.join
+        payload << tap_leaf_scripts.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_leaf_script], key: k.to_payload, value: v.htb)}.join
+        payload << tap_bip32_derivations.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_bip32_derivation], key: k.htb, value: v.htb)}.join
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_internal_key], value: tap_internal_key.htb) if tap_internal_key
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_merkle_root], value: tap_merkle_root.htb) if tap_merkle_root
         payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:script_sig], value: final_script_sig.to_payload) if final_script_sig
         payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:script_witness], value: final_script_witness.to_payload) if final_script_witness
         payload << proprietaries.map(&:to_payload).join
@@ -191,10 +195,13 @@ module Bitcoin
       # Check whether input's scriptPubkey is correct witness.
       # @return [Boolean]
       def valid_witness_input?
-        return true if witness_utxo&.script_pubkey.p2wpkh? # P2WPKH
-        return true if witness_utxo&.script_pubkey.p2wsh? && witness_utxo&.script_pubkey == redeem_script.to_p2wsh # P2WSH
+        return false unless witness_utxo
+        return true if witness_utxo.script_pubkey.p2wpkh? # P2WPKH
+        # P2WSH. The scriptPubkey commits to the witness script directly, so a redeem script is not used.
+        return true if witness_utxo.script_pubkey.p2wsh? && witness_script &&
+          Bitcoin::Script.to_p2wsh(witness_script) == witness_utxo.script_pubkey
         # segwit nested in P2SH
-        if witness_utxo&.script_pubkey.p2sh? && redeem_script&.witness_program? && redeem_script.to_p2sh == witness_utxo&.script_pubkey
+        if witness_utxo.script_pubkey.p2sh? && redeem_script&.witness_program? && redeem_script.to_p2sh == witness_utxo.script_pubkey
           return true if redeem_script.p2wpkh?# nested p2wpkh
           return true if witness_script&.to_sha256 == redeem_script.witness_data[1].bth # nested p2wsh
         end
@@ -235,19 +242,19 @@ module Bitcoin
       # @return [Bitcoin::PSBT::Input] combined object.
       def merge(psbi)
         raise ArgumentError, 'The argument psbt must be an instance of Bitcoin::PSBT::Input.' unless psbi.is_a?(Bitcoin::PSBT::Input)
-        raise ArgumentError, 'The Partially Signed Input\'s non_witness_utxo are different.' unless non_witness_utxo == psbi.non_witness_utxo
-        raise ArgumentError, 'The Partially Signed Input\'s witness_utxo are different.' unless witness_utxo == psbi.witness_utxo
+        raise ArgumentError, 'The Partially Signed Input\'s non_witness_utxo are different.' unless same_field?(non_witness_utxo, psbi.non_witness_utxo)
+        raise ArgumentError, 'The Partially Signed Input\'s witness_utxo are different.' unless same_field?(witness_utxo, psbi.witness_utxo)
         raise ArgumentError, 'The Partially Signed Input\'s sighash_type are different.' if sighash_type && psbi.sighash_type && sighash_type != psbi.sighash_type
-        raise ArgumentError, 'The Partially Signed Input\'s redeem_script are different.' unless redeem_script == psbi.redeem_script
-        raise ArgumentError, 'The Partially Signed Input\'s witness_script are different.' unless witness_script == psbi.witness_script
+        raise ArgumentError, 'The Partially Signed Input\'s redeem_script are different.' unless same_field?(redeem_script, psbi.redeem_script)
+        raise ArgumentError, 'The Partially Signed Input\'s witness_script are different.' unless same_field?(witness_script, psbi.witness_script)
         combined = Bitcoin::PSBT::Input.new(non_witness_utxo: non_witness_utxo, witness_utxo: witness_utxo)
         combined.unknowns = Hash[unknowns.merge(psbi.unknowns).sort]
         combined.redeem_script = redeem_script
         combined.witness_script = witness_script
         combined.sighash_type = sighash_type
         sigs = Hash[partial_sigs.merge(psbi.partial_sigs)]
-        redeem_script.get_multisig_pubkeys.each{|pubkey|combined.partial_sigs[pubkey.bth] = sigs[pubkey.bth]} if redeem_script&.multisig?
-        witness_script.get_multisig_pubkeys.each{|pubkey|combined.partial_sigs[pubkey.bth] = sigs[pubkey.bth]} if witness_script&.multisig?
+        redeem_script.get_multisig_pubkeys.each{|pubkey|combined.partial_sigs[pubkey.bth] = sigs[pubkey.bth] if sigs[pubkey.bth]} if redeem_script&.multisig?
+        witness_script.get_multisig_pubkeys.each{|pubkey|combined.partial_sigs[pubkey.bth] = sigs[pubkey.bth] if sigs[pubkey.bth]} if witness_script&.multisig?
         combined.hd_key_paths = hd_key_paths.merge(psbi.hd_key_paths)
         combined
       end
@@ -288,7 +295,7 @@ module Bitcoin
         h[:non_witness_utxo] = non_witness_utxo.to_h if non_witness_utxo
         h[:witness_utxo] = witness_utxo.to_h if witness_utxo
         h[:redeem_script] = redeem_script.to_h if redeem_script
-        h[:witness_script] = witness_script.to_h if redeem_script
+        h[:witness_script] = witness_script.to_h if witness_script
         h[:final_script_sig] = final_script_sig.to_h if final_script_sig
         h[:final_script_witness] = final_script_witness.to_h if final_script_witness
         h[:bip32_derivs] = hd_key_paths.values.map(&:to_h) unless hd_key_paths.empty?
@@ -309,6 +316,17 @@ module Bitcoin
         h
       end
 
+      private
+
+      # Whether +a+ and +b+ are the same field value. Unlike ==, this does not raise
+      # NoMethodError when only one of them is nil.
+      # @return [Boolean]
+      def same_field?(a, b)
+        return true if a.nil? && b.nil?
+        return false if a.nil? || b.nil?
+        a == b
+      end
+
     end
 
   end

data/lib/bitcoin/psbt/key_origin_info.rb

@@ -15,11 +15,11 @@ module Bitcoin
 
       def self.parse_from_payload(payload)
         buf = StringIO.new(payload)
-        self.new(fingerprint: buf.read(4).bth, key_paths: buf.read.unpack('I*'))
+        self.new(fingerprint: buf.read(4).bth, key_paths: buf.read.unpack('V*'))
       end
 
       def to_payload
-        fingerprint.htb + key_paths.pack('I*')
+        fingerprint.htb + key_paths.pack('V*')
       end
 
       def to_h

data/lib/bitcoin/psbt/output.rb

@@ -32,8 +32,9 @@ module Bitcoin
             found_sep = true
             break
           end
-          key_type = buf.read(1).unpack1('C')
-          key = buf.read(key_len - 1)
+          key_start = buf.pos
+          key_type = Bitcoin.unpack_var_int_from_io(buf)
+          key = buf.read(key_len - (buf.pos - key_start))
           value = buf.read(Bitcoin.unpack_var_int_from_io(buf))
           case key_type
           when PSBT_OUT_TYPES[:redeem_script]
@@ -48,21 +49,24 @@ module Bitcoin
             raise ArgumentError, 'Duplicate Key, pubkey derivation path already provided' if output.hd_key_paths[key.bth]
             output.hd_key_paths[key.bth] = Bitcoin::PSBT::HDKeyPath.new(key, Bitcoin::PSBT::KeyOriginInfo.parse_from_payload(value))
           when PSBT_OUT_TYPES[:proprietary]
-            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if output.proprietaries.any?{|p| p.key == key}
-            output.proprietaries << Proprietary.new(key, value)
+            proprietary = Proprietary.new(key, value)
+            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if output.proprietaries.any?{|p| p.key == proprietary.key}
+            output.proprietaries << proprietary
           when PSBT_OUT_TYPES[:tap_internal_key]
             raise ArgumentError, 'Invalid output tap internal key typed key.' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, output tap internal key already provided.' if output.tap_internal_key
             raise ArgumentError, 'Invalid x-only public key size for the type tap internal key' unless value.bytesize == X_ONLY_PUBKEY_SIZE
             output.tap_internal_key = value.bth
           when PSBT_OUT_TYPES[:tap_tree]
             raise ArgumentError, 'Invalid output tap tree typed key.' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, output tap tree already provided.' if output.tap_tree
             output.tap_tree = value.bth # TODO implement builder.
           when PSBT_OUT_TYPES[:tap_bip32_derivation]
             raise ArgumentError, 'Duplicate Key, key for tap bip32 derivation value already provided.' if output.tap_bip32_derivations[key.bth]
             raise ArgumentError, 'Size of key was not the expected size for the type tap bip32 derivation' unless key.bytesize == X_ONLY_PUBKEY_SIZE
             output.tap_bip32_derivations[key.bth] = value.bth
           else
-            unknown_key = ([key_type].pack('C') + key).bth
+            unknown_key = (Bitcoin.pack_var_int(key_type) + key).bth
             raise ArgumentError, 'Duplicate Key, key for unknown value already provided' if output.unknowns[unknown_key]
             output.unknowns[unknown_key] = value
           end

data/lib/bitcoin/psbt/tx.rb

@@ -68,8 +68,9 @@ module Bitcoin
             found_sep = true
             break
           end
+          key_start = buf.pos
           key_type = Bitcoin.unpack_var_int_from_io(buf)
-          key = buf.read(key_len - 1)
+          key = buf.read(key_len - (buf.pos - key_start))
           value = buf.read(Bitcoin.unpack_var_int_from_io(buf))
 
           case key_type
@@ -89,14 +90,19 @@ module Bitcoin
             raise ArgumentError, "global xpub's depth and the number of indexes not matched." unless xpub.depth == info.key_paths.size
             partial_tx.xpubs << Bitcoin::PSBT::GlobalXpub.new(xpub, info)
           when PSBT_GLOBAL_TYPES[:ver]
+            raise ArgumentError, 'Invalid global version typed key.' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, global version already provided.' if partial_tx.version_number
+            raise ArgumentError, 'Invalid global version value.' unless value.bytesize == 4
             partial_tx.version_number = value.unpack1('V')
             raise ArgumentError, "An unsupported version was detected." if SUPPORT_VERSION < partial_tx.version_number
           when PSBT_GLOBAL_TYPES[:proprietary]
-            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if partial_tx.proprietaries.any?{|p| p.key == key}
-            partial_tx.proprietaries << Proprietary.new(key, value)
+            proprietary = Proprietary.new(key, value)
+            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if partial_tx.proprietaries.any?{|p| p.key == proprietary.key}
+            partial_tx.proprietaries << proprietary
           else
-            raise ArgumentError, 'Duplicate Key, key for unknown value already provided.' if partial_tx.unknowns[key]
-            partial_tx.unknowns[([key_type].pack('C') + key).bth] = value
+            unknown_key = (Bitcoin.pack_var_int(key_type) + key).bth
+            raise ArgumentError, 'Duplicate Key, key for unknown value already provided.' if partial_tx.unknowns[unknown_key]
+            partial_tx.unknowns[unknown_key] = value
           end
         end
 
@@ -206,7 +212,6 @@ module Bitcoin
             inputs[i].redeem_script = redeem_script if redeem_script
             inputs[i].witness_script = witness_script if witness_script
             inputs[i].hd_key_paths = hd_key_paths.map(&:pubkey).zip(hd_key_paths).to_h
-            break
           end
         end
       end
@@ -267,20 +272,21 @@ module Bitcoin
       # extract final tx.
       # @return [Bitcoin::Tx] final tx.
       def extract_tx
-        extract_tx = tx.dup
+        extract_tx = Bitcoin::Tx.parse_from_payload(tx.to_payload)
         inputs.each_with_index do |input, index|
           extract_tx.in[index].script_sig = input.final_script_sig if input.final_script_sig
           extract_tx.in[index].script_witness = input.final_script_witness if input.final_script_witness
         end
         # validate signature
-        tx.in.each_with_index do |tx_in, index|
+        extract_tx.in.each_with_index do |tx_in, index|
           input = inputs[index]
           if input.non_witness_utxo
             utxo = input.non_witness_utxo.out[tx_in.out_point.index]
-            raise "input[#{index}]'s signature is invalid.'" unless tx.verify_input_sig(index, utxo.script_pubkey)
+            raise "input[#{index}]'s signature is invalid.'" unless extract_tx.verify_input_sig(index, utxo.script_pubkey)
           else
             utxo = input.witness_utxo
-            raise "input[#{index}]'s signature is invalid.'" unless tx.verify_input_sig(index, utxo.script_pubkey, amount: input.witness_utxo.value)
+            raise ArgumentError, "input[#{index}] does not have utxo." unless utxo
+            raise "input[#{index}]'s signature is invalid.'" unless extract_tx.verify_input_sig(index, utxo.script_pubkey, amount: utxo.value)
           end
         end
         extract_tx