bitcoinrb 1.12.1 → 1.14.0

data/lib/bitcoin/psbt/input.rb

@@ -55,8 +55,9 @@ module Bitcoin
             found_sep = true
             break
           end
-          key_type = buf.read(1).unpack1('C')
-          key = buf.read(key_len - 1)
+          key_start = buf.pos
+          key_type = Bitcoin.unpack_var_int_from_io(buf)
+          key = buf.read(key_len - (buf.pos - key_start))
           value = buf.read(Bitcoin.unpack_var_int_from_io(buf))
 
           case key_type
@@ -79,7 +80,8 @@ module Bitcoin
           when PSBT_IN_TYPES[:sighash]
             raise ArgumentError, 'Invalid input sighash type typed key.' unless key_len == 1
             raise ArgumentError, 'Duplicate Key, input sighash type already provided.' if input.sighash_type
-            input.sighash_type = value.unpack1('I')
+            raise ArgumentError, 'Invalid input sighash type value.' unless value.bytesize == 4
+            input.sighash_type = value.unpack1('V')
           when PSBT_IN_TYPES[:redeem_script]
             raise ArgumentError, 'Invalid redeemscript typed key.' unless key_len == 1
             raise ArgumentError, 'Duplicate Key, input redeemScript already provided.' if input.redeem_script
@@ -117,10 +119,12 @@ module Bitcoin
             raise ArgumentError, 'Duplicate Key, input hash256 preimage already provided' if input.hash256_preimages[key.bth]
             input.hash256_preimages[key.bth] = value.bth
           when PSBT_IN_TYPES[:proprietary]
-            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if input.proprietaries.any?{|p| p.key == key}
-            input.proprietaries << Proprietary.new(key, value)
+            proprietary = Proprietary.new(key, value)
+            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if input.proprietaries.any?{|p| p.key == proprietary.key}
+            input.proprietaries << proprietary
           when PSBT_IN_TYPES[:tap_key_sig]
             raise ArgumentError, 'Size of key was not the expected size for the type tap key sig' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, input tap key sig already provided.' if input.tap_key_sig
             raise ArgumentError, 'Invalid schnorr signature size for the type tap key sig' unless [64, 65].include?(value.bytesize)
             input.tap_key_sig = value.bth
           when PSBT_IN_TYPES[:tap_script_sig]
@@ -142,14 +146,16 @@ module Bitcoin
             input.tap_bip32_derivations[key.bth] = value.bth
           when PSBT_IN_TYPES[:tap_internal_key]
             raise ArgumentError, 'Size of key was not the expected size for the type tap internal key' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, input tap internal key already provided.' if input.tap_internal_key
             raise ArgumentError, 'Invalid x-only public key size for the type tap internal key' unless value.bytesize == X_ONLY_PUBKEY_SIZE
             input.tap_internal_key = value.bth
           when PSBT_IN_TYPES[:tap_merkle_root]
             raise ArgumentError, 'Size of key was not the expected size for the type tap merkle root' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, input tap merkle root already provided.' if input.tap_merkle_root
             raise ArgumentError, 'Invalid merkle root hash size for the type tap merkle root' unless value.bytesize == 32
             input.tap_merkle_root = value.bth
           else
-            unknown_key = ([key_type].pack('C') + key).bth
+            unknown_key = (Bitcoin.pack_var_int(key_type) + key).bth
             raise ArgumentError, 'Duplicate Key, key for unknown value already provided.' if input.unknowns[unknown_key]
             input.unknowns[unknown_key] = value
           end
@@ -163,23 +169,21 @@ module Bitcoin
         payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:non_witness_utxo], value:
             (witness_utxo && valid_witness_input?) ? non_witness_utxo.serialize_old_format : non_witness_utxo.to_payload) if non_witness_utxo
         payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:witness_utxo], value: witness_utxo.to_payload) if witness_utxo
-        if final_script_sig.nil? && final_script_witness.nil?
-          payload << partial_sigs.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:partial_sig], key: k.htb, value: v)}.join
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:sighash], value: [sighash_type].pack('I')) if sighash_type
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:redeem_script], value: redeem_script.to_payload) if redeem_script
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:witness_script], value: witness_script.to_payload) if witness_script
-          payload << hd_key_paths.values.map(&:to_payload).join
-          payload << ripemd160_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:ripemd160], key: k.htb, value: v.htb)}.join
-          payload << sha256_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:sha256], key: k.htb, value: v.htb)}.join
-          payload << hash160_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:hash160], key: k.htb, value: v.htb)}.join
-          payload << hash256_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:hash256], key: k.htb, value: v.htb)}.join
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_key_sig], value: tap_key_sig.htb) if tap_key_sig
-          payload << tap_script_sigs.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_script_sig], key: k.htb, value: v.htb)}.join
-          payload << tap_leaf_scripts.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_leaf_script], key: k.to_payload, value: v.htb)}.join
-          payload << tap_bip32_derivations.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_bip32_derivation], key: k.htb, value: v.htb)}.join
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_internal_key], value: tap_internal_key.htb) if tap_internal_key
-          payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_merkle_root], value: tap_merkle_root.htb) if tap_merkle_root
-        end
+        payload << partial_sigs.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:partial_sig], key: k.htb, value: v)}.join
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:sighash], value: [sighash_type].pack('V')) if sighash_type
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:redeem_script], value: redeem_script.to_payload) if redeem_script
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:witness_script], value: witness_script.to_payload) if witness_script
+        payload << hd_key_paths.values.map(&:to_payload).join
+        payload << ripemd160_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:ripemd160], key: k.htb, value: v.htb)}.join
+        payload << sha256_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:sha256], key: k.htb, value: v.htb)}.join
+        payload << hash160_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:hash160], key: k.htb, value: v.htb)}.join
+        payload << hash256_preimages.map{|k, v|PSBT.serialize_to_vector(PSBT_IN_TYPES[:hash256], key: k.htb, value: v.htb)}.join
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_key_sig], value: tap_key_sig.htb) if tap_key_sig
+        payload << tap_script_sigs.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_script_sig], key: k.htb, value: v.htb)}.join
+        payload << tap_leaf_scripts.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_leaf_script], key: k.to_payload, value: v.htb)}.join
+        payload << tap_bip32_derivations.map{|k, v| PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_bip32_derivation], key: k.htb, value: v.htb)}.join
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_internal_key], value: tap_internal_key.htb) if tap_internal_key
+        payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:tap_merkle_root], value: tap_merkle_root.htb) if tap_merkle_root
         payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:script_sig], value: final_script_sig.to_payload) if final_script_sig
         payload << PSBT.serialize_to_vector(PSBT_IN_TYPES[:script_witness], value: final_script_witness.to_payload) if final_script_witness
         payload << proprietaries.map(&:to_payload).join
@@ -188,13 +192,23 @@ module Bitcoin
         payload
       end
 
+      # Get the previous output this input spends.
+      # @param [Integer] index The index of the outpoint this input refers to.
+      # @return [Bitcoin::TxOut] The previous output, or nil if this input does not carry it.
+      def utxo(index)
+        (non_witness_utxo ? non_witness_utxo.out[index] : nil) || witness_utxo
+      end
+
       # Check whether input's scriptPubkey is correct witness.
       # @return [Boolean]
       def valid_witness_input?
-        return true if witness_utxo&.script_pubkey.p2wpkh? # P2WPKH
-        return true if witness_utxo&.script_pubkey.p2wsh? && witness_utxo&.script_pubkey == redeem_script.to_p2wsh # P2WSH
+        return false unless witness_utxo
+        return true if witness_utxo.script_pubkey.p2wpkh? # P2WPKH
+        # P2WSH. The scriptPubkey commits to the witness script directly, so a redeem script is not used.
+        return true if witness_utxo.script_pubkey.p2wsh? && witness_script &&
+          Bitcoin::Script.to_p2wsh(witness_script) == witness_utxo.script_pubkey
         # segwit nested in P2SH
-        if witness_utxo&.script_pubkey.p2sh? && redeem_script&.witness_program? && redeem_script.to_p2sh == witness_utxo&.script_pubkey
+        if witness_utxo.script_pubkey.p2sh? && redeem_script&.witness_program? && redeem_script.to_p2sh == witness_utxo.script_pubkey
           return true if redeem_script.p2wpkh?# nested p2wpkh
           return true if witness_script&.to_sha256 == redeem_script.witness_data[1].bth # nested p2wsh
         end
@@ -235,19 +249,19 @@ module Bitcoin
       # @return [Bitcoin::PSBT::Input] combined object.
       def merge(psbi)
         raise ArgumentError, 'The argument psbt must be an instance of Bitcoin::PSBT::Input.' unless psbi.is_a?(Bitcoin::PSBT::Input)
-        raise ArgumentError, 'The Partially Signed Input\'s non_witness_utxo are different.' unless non_witness_utxo == psbi.non_witness_utxo
-        raise ArgumentError, 'The Partially Signed Input\'s witness_utxo are different.' unless witness_utxo == psbi.witness_utxo
+        raise ArgumentError, 'The Partially Signed Input\'s non_witness_utxo are different.' unless same_field?(non_witness_utxo, psbi.non_witness_utxo)
+        raise ArgumentError, 'The Partially Signed Input\'s witness_utxo are different.' unless same_field?(witness_utxo, psbi.witness_utxo)
         raise ArgumentError, 'The Partially Signed Input\'s sighash_type are different.' if sighash_type && psbi.sighash_type && sighash_type != psbi.sighash_type
-        raise ArgumentError, 'The Partially Signed Input\'s redeem_script are different.' unless redeem_script == psbi.redeem_script
-        raise ArgumentError, 'The Partially Signed Input\'s witness_script are different.' unless witness_script == psbi.witness_script
+        raise ArgumentError, 'The Partially Signed Input\'s redeem_script are different.' unless same_field?(redeem_script, psbi.redeem_script)
+        raise ArgumentError, 'The Partially Signed Input\'s witness_script are different.' unless same_field?(witness_script, psbi.witness_script)
         combined = Bitcoin::PSBT::Input.new(non_witness_utxo: non_witness_utxo, witness_utxo: witness_utxo)
         combined.unknowns = Hash[unknowns.merge(psbi.unknowns).sort]
         combined.redeem_script = redeem_script
         combined.witness_script = witness_script
         combined.sighash_type = sighash_type
         sigs = Hash[partial_sigs.merge(psbi.partial_sigs)]
-        redeem_script.get_multisig_pubkeys.each{|pubkey|combined.partial_sigs[pubkey.bth] = sigs[pubkey.bth]} if redeem_script&.multisig?
-        witness_script.get_multisig_pubkeys.each{|pubkey|combined.partial_sigs[pubkey.bth] = sigs[pubkey.bth]} if witness_script&.multisig?
+        redeem_script.get_multisig_pubkeys.each{|pubkey|combined.partial_sigs[pubkey.bth] = sigs[pubkey.bth] if sigs[pubkey.bth]} if redeem_script&.multisig?
+        witness_script.get_multisig_pubkeys.each{|pubkey|combined.partial_sigs[pubkey.bth] = sigs[pubkey.bth] if sigs[pubkey.bth]} if witness_script&.multisig?
         combined.hd_key_paths = hd_key_paths.merge(psbi.hd_key_paths)
         combined
       end
@@ -288,7 +302,7 @@ module Bitcoin
         h[:non_witness_utxo] = non_witness_utxo.to_h if non_witness_utxo
         h[:witness_utxo] = witness_utxo.to_h if witness_utxo
         h[:redeem_script] = redeem_script.to_h if redeem_script
-        h[:witness_script] = witness_script.to_h if redeem_script
+        h[:witness_script] = witness_script.to_h if witness_script
         h[:final_script_sig] = final_script_sig.to_h if final_script_sig
         h[:final_script_witness] = final_script_witness.to_h if final_script_witness
         h[:bip32_derivs] = hd_key_paths.values.map(&:to_h) unless hd_key_paths.empty?
@@ -309,6 +323,17 @@ module Bitcoin
         h
       end
 
+      private
+
+      # Whether +a+ and +b+ are the same field value. Unlike ==, this does not raise
+      # NoMethodError when only one of them is nil.
+      # @return [Boolean]
+      def same_field?(a, b)
+        return true if a.nil? && b.nil?
+        return false if a.nil? || b.nil?
+        a == b
+      end
+
     end
 
   end

data/lib/bitcoin/psbt/key_origin_info.rb

@@ -15,11 +15,11 @@ module Bitcoin
 
       def self.parse_from_payload(payload)
         buf = StringIO.new(payload)
-        self.new(fingerprint: buf.read(4).bth, key_paths: buf.read.unpack('I*'))
+        self.new(fingerprint: buf.read(4).bth, key_paths: buf.read.unpack('V*'))
       end
 
       def to_payload
-        fingerprint.htb + key_paths.pack('I*')
+        fingerprint.htb + key_paths.pack('V*')
       end
 
       def to_h

data/lib/bitcoin/psbt/output.rb

@@ -32,8 +32,9 @@ module Bitcoin
             found_sep = true
             break
           end
-          key_type = buf.read(1).unpack1('C')
-          key = buf.read(key_len - 1)
+          key_start = buf.pos
+          key_type = Bitcoin.unpack_var_int_from_io(buf)
+          key = buf.read(key_len - (buf.pos - key_start))
           value = buf.read(Bitcoin.unpack_var_int_from_io(buf))
           case key_type
           when PSBT_OUT_TYPES[:redeem_script]
@@ -48,21 +49,24 @@ module Bitcoin
             raise ArgumentError, 'Duplicate Key, pubkey derivation path already provided' if output.hd_key_paths[key.bth]
             output.hd_key_paths[key.bth] = Bitcoin::PSBT::HDKeyPath.new(key, Bitcoin::PSBT::KeyOriginInfo.parse_from_payload(value))
           when PSBT_OUT_TYPES[:proprietary]
-            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if output.proprietaries.any?{|p| p.key == key}
-            output.proprietaries << Proprietary.new(key, value)
+            proprietary = Proprietary.new(key, value)
+            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if output.proprietaries.any?{|p| p.key == proprietary.key}
+            output.proprietaries << proprietary
           when PSBT_OUT_TYPES[:tap_internal_key]
             raise ArgumentError, 'Invalid output tap internal key typed key.' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, output tap internal key already provided.' if output.tap_internal_key
             raise ArgumentError, 'Invalid x-only public key size for the type tap internal key' unless value.bytesize == X_ONLY_PUBKEY_SIZE
             output.tap_internal_key = value.bth
           when PSBT_OUT_TYPES[:tap_tree]
             raise ArgumentError, 'Invalid output tap tree typed key.' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, output tap tree already provided.' if output.tap_tree
             output.tap_tree = value.bth # TODO implement builder.
           when PSBT_OUT_TYPES[:tap_bip32_derivation]
             raise ArgumentError, 'Duplicate Key, key for tap bip32 derivation value already provided.' if output.tap_bip32_derivations[key.bth]
             raise ArgumentError, 'Size of key was not the expected size for the type tap bip32 derivation' unless key.bytesize == X_ONLY_PUBKEY_SIZE
             output.tap_bip32_derivations[key.bth] = value.bth
           else
-            unknown_key = ([key_type].pack('C') + key).bth
+            unknown_key = (Bitcoin.pack_var_int(key_type) + key).bth
             raise ArgumentError, 'Duplicate Key, key for unknown value already provided' if output.unknowns[unknown_key]
             output.unknowns[unknown_key] = value
           end

data/lib/bitcoin/psbt/tx.rb

@@ -68,8 +68,9 @@ module Bitcoin
             found_sep = true
             break
           end
+          key_start = buf.pos
           key_type = Bitcoin.unpack_var_int_from_io(buf)
-          key = buf.read(key_len - 1)
+          key = buf.read(key_len - (buf.pos - key_start))
           value = buf.read(Bitcoin.unpack_var_int_from_io(buf))
 
           case key_type
@@ -89,14 +90,19 @@ module Bitcoin
             raise ArgumentError, "global xpub's depth and the number of indexes not matched." unless xpub.depth == info.key_paths.size
             partial_tx.xpubs << Bitcoin::PSBT::GlobalXpub.new(xpub, info)
           when PSBT_GLOBAL_TYPES[:ver]
+            raise ArgumentError, 'Invalid global version typed key.' unless key_len == 1
+            raise ArgumentError, 'Duplicate Key, global version already provided.' if partial_tx.version_number
+            raise ArgumentError, 'Invalid global version value.' unless value.bytesize == 4
             partial_tx.version_number = value.unpack1('V')
             raise ArgumentError, "An unsupported version was detected." if SUPPORT_VERSION < partial_tx.version_number
           when PSBT_GLOBAL_TYPES[:proprietary]
-            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if partial_tx.proprietaries.any?{|p| p.key == key}
-            partial_tx.proprietaries << Proprietary.new(key, value)
+            proprietary = Proprietary.new(key, value)
+            raise ArgumentError, 'Duplicate Key, key for proprietary value already provided.' if partial_tx.proprietaries.any?{|p| p.key == proprietary.key}
+            partial_tx.proprietaries << proprietary
           else
-            raise ArgumentError, 'Duplicate Key, key for unknown value already provided.' if partial_tx.unknowns[key]
-            partial_tx.unknowns[([key_type].pack('C') + key).bth] = value
+            unknown_key = (Bitcoin.pack_var_int(key_type) + key).bth
+            raise ArgumentError, 'Duplicate Key, key for unknown value already provided.' if partial_tx.unknowns[unknown_key]
+            partial_tx.unknowns[unknown_key] = value
           end
         end
 
@@ -206,7 +212,6 @@ module Bitcoin
             inputs[i].redeem_script = redeem_script if redeem_script
             inputs[i].witness_script = witness_script if witness_script
             inputs[i].hd_key_paths = hd_key_paths.map(&:pubkey).zip(hd_key_paths).to_h
-            break
           end
         end
       end
@@ -267,20 +272,22 @@ module Bitcoin
       # extract final tx.
       # @return [Bitcoin::Tx] final tx.
       def extract_tx
-        extract_tx = tx.dup
+        extract_tx = Bitcoin::Tx.parse_from_payload(tx.to_payload)
         inputs.each_with_index do |input, index|
           extract_tx.in[index].script_sig = input.final_script_sig if input.final_script_sig
           extract_tx.in[index].script_witness = input.final_script_witness if input.final_script_witness
         end
+        # A taproot sighash commits to every prevout of the tx, see BIP-341, so they are all
+        # collected before any input is verified.
+        prevouts = extract_tx.in.each_with_index.map do |tx_in, index|
+          utxo = inputs[index].utxo(tx_in.out_point.index)
+          raise ArgumentError, "input[#{index}] does not have utxo." unless utxo
+          utxo
+        end
         # validate signature
-        tx.in.each_with_index do |tx_in, index|
-          input = inputs[index]
-          if input.non_witness_utxo
-            utxo = input.non_witness_utxo.out[tx_in.out_point.index]
-            raise "input[#{index}]'s signature is invalid.'" unless tx.verify_input_sig(index, utxo.script_pubkey)
-          else
-            utxo = input.witness_utxo
-            raise "input[#{index}]'s signature is invalid.'" unless tx.verify_input_sig(index, utxo.script_pubkey, amount: input.witness_utxo.value)
+        prevouts.each_with_index do |utxo, index|
+          unless extract_tx.verify_input_sig(index, utxo.script_pubkey, amount: utxo.value, prevouts: prevouts)
+            raise "input[#{index}]'s signature is invalid.'"
           end
         end
         extract_tx

data/lib/bitcoin/psbt.rb

@@ -55,7 +55,7 @@ module Bitcoin
     module_function
 
     def self.serialize_to_vector(key_type, key: nil, value: nil)
-      key_len = key_type.itb.bytesize
+      key_len = Bitcoin.pack_var_int(key_type).bytesize
       key_len += key.bytesize if key
       s = Bitcoin.pack_var_int(key_len) << Bitcoin.pack_var_int(key_type)
       s << key if key

data/lib/bitcoin/rpc/bitcoin_core_client.rb

@@ -61,8 +61,9 @@ module Bitcoin
         request.content_type = 'application/json'
         request.body = data.to_json
         response = http.request(request)
-        body = response.body
-        json_data = JSON.parse(body.gsub(/\\u([\da-fA-F]{4})/) { [$1].pack('H*').unpack('n*').pack('U*').encode('ISO-8859-1').force_encoding('UTF-8') })
+        # Unescape \uXXXX with JSON.parse itself. Doing it beforehand lets a " contained in
+        # a string value close that string and inject arbitrary JSON into the parsed result.
+        json_data = JSON.parse(response.body)
         response = convert_floats_to_strings(json_data)
         raise response['error'].to_json if response['error']
         response['result']

data/lib/bitcoin/script/script.rb

@@ -100,12 +100,22 @@ module Bitcoin
         if opcode
           script << (v =~ /^\d/ && Opcodes.small_int_to_opcode(v.ord) ? v.ord : opcode)
         else
-          script << (v =~ /^[0-9]+$/ ? v.to_i : v)
+          script << (number_token?(v) ? v.to_i : v)
         end
       end
       script
     end
 
+    # Whether +token+ is a script number rather than pushed data with hex format.
+    # A digit only token is ambiguous since #to_s emits pushed data as hex. #to_s never emits
+    # a number with more than 10 digits, so a longer even-length token must be pushed data.
+    # @param [String] token a token of the script string.
+    # @return [Boolean] whether +token+ should be interpreted as a script number.
+    def self.number_token?(token)
+      return false unless token =~ /^[0-9]+$/
+      token.length < 12 || token.length.odd?
+    end
+
     # generate script from addr.
     # @param [String] addr address.
     # @return [Bitcoin::Script] parsed script.
@@ -114,7 +124,7 @@ module Bitcoin
         segwit_addr = Bech32::SegwitAddr.new(addr)
         raise ArgumentError, 'Invalid address.' unless Bitcoin.chain_params.bech32_hrp == segwit_addr.hrp
         Bitcoin::Script.parse_from_payload(segwit_addr.to_script_pubkey.htb)
-      rescue Exception => e
+      rescue StandardError => e
         begin
         hex, addr_version = Bitcoin.decode_base58_address(addr)
         rescue
@@ -491,11 +501,11 @@ module Bitcoin
       size = data.bytesize
       header = if size < OP_PUSHDATA1
                  [size].pack('C')
-               elsif size < 0xff
+               elsif size <= 0xff
                  [OP_PUSHDATA1, size].pack('CC')
-               elsif size < 0xffff
+               elsif size <= 0xffff
                  [OP_PUSHDATA2, size].pack('Cv')
-               elsif size < 0xffffffff
+               elsif size <= 0xffffffff
                  [OP_PUSHDATA4, size].pack('CV')
                else
                  raise ArgumentError, 'data size is too big.'

data/lib/bitcoin/script/script_interpreter.rb

@@ -568,7 +568,7 @@ module Bitcoin
         end
       rescue ScriptNumError => e
         return set_error(SCRIPT_ERR_SCRIPTNUM, e.message)
-      rescue Exception => e
+      rescue StandardError => e
         return set_error(SCRIPT_ERR_UNKNOWN_ERROR, e.message)
       end
 

data/lib/bitcoin/script/tx_checker.rb

@@ -30,7 +30,7 @@ module Bitcoin
       begin
         key = Key.new(pubkey: pubkey, key_type: key_type, allow_hybrid: allow_hybrid)
         key.verify(sig, sighash)
-      rescue Exception
+      rescue StandardError
         false
       end
     end
@@ -40,9 +40,14 @@ module Bitcoin
     # @param [String] pubkey a public key with hex format.
     # @param [Symbol] sig_version whether :taproot or :tapscript
     # @return [Boolean] verification result
+    # @raise [ArgumentError] If +prevouts+ does not cover every input of the tx.
     def check_schnorr_sig(sig, pubkey, sig_version, opts = {})
       return false unless [:taproot, :tapscript].include?(sig_version)
-      return false if prevouts.size < input_index
+      # A taproot sighash commits to the amount and scriptPubkey of every prevout, so a partial
+      # set does not fail to verify, it verifies against a sighash consensus never computes.
+      # Checked here rather than left to the generator, since the rescue below would turn it
+      # into a script error.
+      raise ArgumentError, 'prevouts must be specified for all inputs.' unless prevouts.size == tx.in.size
 
       sig = sig.htb
       return set_error(SCRIPT_ERR_SCHNORR_SIG_SIZE) unless [64, 65].include?(sig.bytesize)

data/lib/bitcoin/secp256k1/native.rb

@@ -6,7 +6,8 @@ module Bitcoin
   module Secp256k1
 
     # binding for secp256k1 (https://github.com/bitcoin-core/secp256k1/)
-    # tag: v0.4.0
+    # tag: v0.8.0, which secp256k1rb 0.8.0 binds the public API of. An older library is missing
+    # symbols the gem attaches, such as secp256k1_ec_pubkey_sort and the musig module.
     # this is not included by default, to enable set shared object path to ENV['SECP256K1_LIB_PATH']
     # for linux, ENV['SECP256K1_LIB_PATH'] = '/usr/local/lib/libsecp256k1.so' or '/usr/lib64/libsecp256k1.so'
     # for mac,
@@ -98,6 +99,54 @@ module Bitcoin
           raise ArgumentError, "unknown algo: #{algo}"
         end
       end
+
+      # Whether the loaded library supports BIP-352 silent payments.
+      # The module exists in libsecp256k1 v0.8.0 or later.
+      # @return [Boolean]
+      def sp_available?
+        silentpayments_available?
+      end
+
+      # Create the silent payment outputs for +recipients+.
+      # @param [Array] recipients An array of [scan public key, spend public key], both with hex
+      # format(33 bytes). A recipient may appear more than once.
+      # @param [String] outpoint_smallest The lexicographically smallest outpoint of the tx inputs
+      # with hex format(36 bytes).
+      # @param [Array] plain_seckeys Private keys of the non-taproot inputs with hex format.
+      # @param [Array] taproot_seckeys Private keys of the taproot inputs with hex format.
+      # @return [Array] An x-only public key with hex format for each recipient, in the same order.
+      # @raise [Secp256k1::Error] If the outputs could not be created.
+      def sp_create_outputs(recipients, outpoint_smallest, plain_seckeys: [], taproot_seckeys: [])
+        silentpayments_sender_create_outputs(
+          recipients, outpoint_smallest, plain_seckeys: plain_seckeys, taproot_seckeys: taproot_seckeys)
+      end
+
+      # Create the label and the label tweak of the +m+ th label of +scan_key+.
+      # @param [String] scan_key The recipient's scan private key with hex format(32 bytes).
+      # @param [Integer] m The label index.
+      # @return [Array] The serialized label(33 bytes) and its tweak(32 bytes), both with hex format.
+      def sp_create_label(scan_key, m)
+        silentpayments_create_label(scan_key, m)
+      end
+
+      # Scan +tx_outputs+ for the silent payment outputs of the recipient.
+      # @param [Array] tx_outputs The x-only public key of each taproot output with hex format.
+      # @param [String] scan_key The recipient's scan private key with hex format(32 bytes).
+      # @param [String] outpoint_smallest The lexicographically smallest outpoint of the tx inputs
+      # with hex format(36 bytes).
+      # @param [String] spend_pubkey The recipient's spend public key with hex format(33 bytes).
+      # @param [Array] plain_pubkeys Public keys of the non-taproot inputs with hex format(33 bytes).
+      # @param [Array] xonly_pubkeys X-only public keys of the taproot inputs with hex format.
+      # @param [Hash] labels A serialized label to label tweak map, both with hex format.
+      # @return [Array] A hash per found output, with the :output, :tweak and :label keys.
+      # @raise [Secp256k1::Error] If the tx is not a silent payment transaction.
+      def sp_scan_outputs(tx_outputs, scan_key, outpoint_smallest, spend_pubkey,
+                          plain_pubkeys: [], xonly_pubkeys: [], labels: {})
+        summary = silentpayments_create_prevouts_summary(
+          outpoint_smallest, plain_pubkeys: plain_pubkeys, xonly_pubkeys: xonly_pubkeys)
+        silentpayments_scan_outputs(
+          tx_outputs, scan_key, summary, spend_pubkey, labels: labels.empty? ? nil : labels)
+      end
     end
   end
 end

data/lib/bitcoin/secp256k1/rfc6979.rb

@@ -26,10 +26,13 @@ module Bitcoin
         # 3.2.g
         v = Bitcoin.hmac_sha256(k, v)
         # 3.2.h
-        t = ''
         10000.times do
-          v = Bitcoin.hmac_sha256(k, v)
-          t = (t + v)
+          # T is reset for each candidate, otherwise a retry can never produce a value below the order.
+          t = ''
+          while t.bytesize < 32
+            v = Bitcoin.hmac_sha256(k, v)
+            t = (t + v)
+          end
           t_num = t.bth.to_i(16)
           return t_num if 1 <= t_num && t_num < Bitcoin::Secp256k1::GROUP.order
           k = Bitcoin.hmac_sha256(k, v + '00'.htb)

data/lib/bitcoin/secp256k1/ruby.rb

@@ -45,7 +45,7 @@ module Bitcoin
         return false unless pubkey.bytesize == X_ONLY_PUBKEY_SIZE
         begin
           ECDSA::Format::PointOctetString.decode(pubkey, ECDSA::Group::Secp256k1)
-        rescue Exception
+        rescue StandardError
           return false
         end
         true
@@ -201,7 +201,7 @@ module Bitcoin
           k = ECDSA::Format::PointOctetString.decode(repack_pubkey(pubkey), GROUP)
           signature = ECDSA::Format::SignatureDerString.decode(sig)
           ECDSA.valid_signature?(k, data, signature)
-        rescue Exception
+        rescue StandardError
           false
         end
       end
@@ -210,6 +210,119 @@ module Bitcoin
         Schnorr.valid_sig?(data, pubkey.htb, sig)
       end
 
+      # Whether this module supports BIP-352 silent payments.
+      # @return [Boolean]
+      def sp_available?
+        true
+      end
+
+      # Create the silent payment outputs for +recipients+.
+      # See Bitcoin::Secp256k1::Native#sp_create_outputs for the parameters.
+      # @return [Array] An x-only public key with hex format for each recipient, in the same order.
+      # @raise [ArgumentError] If the input private keys sum to zero.
+      def sp_create_outputs(recipients, outpoint_smallest, plain_seckeys: [], taproot_seckeys: [])
+        field = ECDSA::PrimeField.new(GROUP.order)
+        sum = sp_sum_seckeys(plain_seckeys, taproot_seckeys, field)
+        raise ArgumentError, 'The input private keys sum to zero.' if sum.zero?
+        agg_pubkey = (GROUP.generator.to_jacobian * sum).to_affine
+        input_hash = Bitcoin.tagged_hash('BIP0352/Inputs', outpoint_smallest.htb + agg_pubkey.to_hex.htb)
+
+        # k counts up within the group of recipients sharing a scan key, but an output keeps the
+        # position of the recipient it pays.
+        groups = {}
+        recipients.each_with_index do |(scan_pubkey, spend_pubkey), index|
+          (groups[scan_pubkey] ||= []) << [spend_pubkey, index]
+        end
+        results = Array.new(recipients.length)
+        groups.each do |scan_pubkey, spends|
+          scan_point = Bitcoin::Key.new(pubkey: scan_pubkey).to_point.to_jacobian
+          shared_secret = (scan_point * field.mod(input_hash.bti * sum)).to_affine.to_hex.htb
+          spends.each_with_index do |(spend_pubkey, index), k|
+            t_k = Bitcoin.tagged_hash('BIP0352/SharedSecret', shared_secret + [k].pack('N'))
+            spend_point = Bitcoin::Key.new(pubkey: spend_pubkey).to_point.to_jacobian
+            output = (spend_point + GROUP.generator.to_jacobian * t_k.bti).to_affine
+            results[index] = sp_xonly(output.x)
+          end
+        end
+        results
+      end
+
+      # Create the label and the label tweak of the +m+ th label of +scan_key+.
+      # See Bitcoin::Secp256k1::Native#sp_create_label for the parameters.
+      # @return [Array] The serialized label(33 bytes) and its tweak(32 bytes), both with hex format.
+      def sp_create_label(scan_key, m)
+        tweak = Bitcoin.tagged_hash('BIP0352/Label', scan_key.htb + [m].pack('N'))
+        [(GROUP.generator.to_jacobian * tweak.bti).to_affine.to_hex(true), tweak.bth]
+      end
+
+      # Scan +tx_outputs+ for the silent payment outputs of the recipient.
+      # See Bitcoin::Secp256k1::Native#sp_scan_outputs for the parameters.
+      # @return [Array] A hash per found output, with the :output, :tweak and :label keys.
+      # @raise [ArgumentError] If the input public keys sum to the point at infinity.
+      def sp_scan_outputs(tx_outputs, scan_key, outpoint_smallest, spend_pubkey,
+                          plain_pubkeys: [], xonly_pubkeys: [], labels: {})
+        field = ECDSA::PrimeField.new(GROUP.order)
+        sum_pubkeys = GROUP.infinity.to_jacobian
+        plain_pubkeys.each { |p| sum_pubkeys += Bitcoin::Key.new(pubkey: p).to_point.to_jacobian }
+        xonly_pubkeys.each { |p| sum_pubkeys += Bitcoin::Key.from_xonly_pubkey(p).to_point.to_jacobian }
+        raise ArgumentError, 'The input public keys sum to the point at infinity.' if sum_pubkeys.infinity?
+
+        input_hash = Bitcoin.tagged_hash(
+          'BIP0352/Inputs', outpoint_smallest.htb + sum_pubkeys.to_affine.to_hex.htb)
+        shared_secret = (sum_pubkeys * field.mod(input_hash.bti * scan_key.to_i(16))).to_affine.to_hex.htb
+        spend_point = Bitcoin::Key.new(pubkey: spend_pubkey).to_point.to_jacobian
+        # A labeled output is P_k + label. Only the x coordinate is compared, which covers the
+        # label of either parity without negating the output.
+        label_points = labels.map do |label, tweak|
+          [label, tweak, Bitcoin::Key.new(pubkey: label).to_point.to_jacobian]
+        end
+
+        results = []
+        remaining = tx_outputs.map(&:downcase)
+        k = 0
+        while k < Bitcoin::SilentPayment::K_MAX
+          t_k = Bitcoin.tagged_hash('BIP0352/SharedSecret', shared_secret + [k].pack('N'))
+          p_k = GROUP.generator.to_jacobian * t_k.bti + spend_point
+          index = remaining.index(sp_xonly(p_k.to_affine.x))
+          found = if index
+                    {output: remaining.delete_at(index), tweak: t_k.bth, label: nil}
+                  else
+                    sp_find_labeled(p_k, remaining, label_points, t_k, field)
+                  end
+          break unless found
+          results << found
+          k += 1
+        end
+        results
+      end
+
+      # Sum the private keys of the inputs, negating a taproot key whose public key has odd y.
+      def sp_sum_seckeys(plain_seckeys, taproot_seckeys, field)
+        sum = plain_seckeys.inject(0) { |total, sk| field.mod(total + sk.to_i(16)) }
+        taproot_seckeys.inject(sum) do |total, sk|
+          d = sk.to_i(16)
+          d = field.mod(-d) unless (GROUP.generator.to_jacobian * d).to_affine.has_even_y?
+          field.mod(total + d)
+        end
+      end
+
+      # Find the output +p_k+ pays through one of +label_points+, or nil.
+      def sp_find_labeled(p_k, remaining, label_points, t_k, field)
+        label_points.each do |label, tweak, point|
+          index = remaining.index(sp_xonly((p_k + point).to_affine.x))
+          next unless index
+          return {output: remaining.delete_at(index),
+                  tweak: sp_xonly(field.mod(t_k.bti + tweak.to_i(16))),
+                  label: label}
+        end
+        nil
+      end
+
+      # Serialize a field element as a 32 byte value with hex format.
+      def sp_xonly(value)
+        ECDSA::Format::IntegerOctetString.encode(value, 32).bth
+      end
+
     end
   end
 end