bitcoinrb 1.14.0 → 1.16.0

data/lib/bitcoin/message/network_addr.rb

@@ -106,46 +106,46 @@ module Bitcoin
         buf = payload.is_a?(String) ? StringIO.new(payload) : payload
         has_time = buf.size > 26
         addr = NetworkAddr.new(time: nil)
-        addr.time = buf.read(4).unpack1('V') if has_time
-        addr.services = buf.read(8).unpack1('Q<')
-        addr.addr = IPAddr::new_ntoh(buf.read(16))
-        addr.port = buf.read(2).unpack1('n')
+        addr.time = Bitcoin.read_exact(buf, 4).unpack1('V') if has_time
+        addr.services = Bitcoin.read_exact(buf, 8).unpack1('Q<')
+        addr.addr = IPAddr::new_ntoh(Bitcoin.read_exact(buf, 16))
+        addr.port = Bitcoin.read_exact(buf, 2).unpack1('n')
         addr
       end
 
       # Load addr payload with addr v2 format.
       def self.load_addr_v2_payload(payload)
         buf = payload.is_a?(String) ? StringIO.new(payload) : payload
-        addr = NetworkAddr.new(time: buf.read(4).unpack1('V'))
+        addr = NetworkAddr.new(time: Bitcoin.read_exact(buf, 4).unpack1('V'))
         addr.services = Bitcoin.unpack_var_int_from_io(buf)
-        addr.net = buf.read(1).unpack1('C')
+        addr.net = Bitcoin.read_exact(buf, 1).unpack1('C')
         raise Bitcoin::Message::Error, "Unknown network id: #{addr.net}" unless NETWORK_ID.value?(addr.net)
         addr_len = Bitcoin.unpack_var_int_from_io(buf)
         addr.addr = case addr.net 
                     when NETWORK_ID[:ipv4]
                       raise Bitcoin::Message::Error, "Invalid IPv4 address." unless addr_len == 4
-                      IPAddr::new_ntoh(buf.read(addr_len))
+                      IPAddr::new_ntoh(Bitcoin.read_exact(buf, addr_len))
                     when NETWORK_ID[:ipv6]
                       raise Bitcoin::Message::Error, "Invalid IPv6 address." unless addr_len == 16
-                      a = IPAddr::new_ntoh(buf.read(addr_len))
+                      a = IPAddr::new_ntoh(Bitcoin.read_exact(buf, addr_len))
                       raise Bitcoin::Message::Error, "Invalid IPv6 address." if a.ipv4_mapped?
                       a
                     when NETWORK_ID[:tor_v2]
                       raise Bitcoin::Message::Error, "Invalid Tor v2 address." unless addr_len == 10
-                      buf.read(addr_len).bth
+                      Bitcoin.read_exact(buf, addr_len).bth
                     when NETWORK_ID[:tor_v3]
                       raise Bitcoin::Message::Error, "Invalid Tor v3 address." unless addr_len == 32
-                      buf.read(addr_len).bth
+                      Bitcoin.read_exact(buf, addr_len).bth
                     when NETWORK_ID[:i2p]
                       raise Bitcoin::Message::Error, "Invalid I2P address." unless addr_len == 32
-                      buf.read(addr_len).bth
+                      Bitcoin.read_exact(buf, addr_len).bth
                     when NETWORK_ID[:cjdns]
                       raise Bitcoin::Message::Error, "Invalid CJDNS address." unless addr_len == 16
-                      a = IPAddr::new_ntoh(buf.read(addr_len))
+                      a = IPAddr::new_ntoh(Bitcoin.read_exact(buf, addr_len))
                       raise Bitcoin::Message::Error, "Invalid CJDNS address." unless a.to_s.start_with?('fc00:')
                       a
                     end
-        addr.port = buf.read(2).unpack1('n')
+        addr.port = Bitcoin.read_exact(buf, 2).unpack1('n')
         addr
       end
 

data/lib/bitcoin/message/ping.rb

@@ -14,6 +14,7 @@ module Bitcoin
       end
 
       def self.parse_from_payload(payload)
+        raise Bitcoin::Message::Error, 'Payload must be empty or 8 bytes.' unless payload.empty? || payload.bytesize == 8
         new(payload.unpack1('Q<'))
       end
 

data/lib/bitcoin/message/pong.rb

@@ -14,6 +14,7 @@ module Bitcoin
       end
 
       def self.parse_from_payload(payload)
+        raise Bitcoin::Message::Error, 'Payload must be 8 bytes.' unless payload.bytesize == 8
         new(payload.unpack1('Q<'))
       end
 

data/lib/bitcoin/message/reject.rb

@@ -31,6 +31,7 @@ module Bitcoin
       def self.parse_from_payload(payload)
         message, payload = Bitcoin.unpack_var_string(payload)
         code, payload = payload.unpack('Ca*')
+        raise Bitcoin::Message::Error, 'Reject payload is too short.' if code.nil?
         reason, payload = Bitcoin.unpack_var_string(payload)
         extra = ['tx', 'block'].include?(message) ? payload.bth : payload
         new(message, code, reason, extra)

data/lib/bitcoin/message/send_cmpct.rb

@@ -21,8 +21,8 @@ module Bitcoin
 
       def self.parse_from_payload(payload)
         buf = StringIO.new(payload)
-        mode = buf.read(1).unpack1('c')
-        version = buf.read(8).unpack1('Q<')
+        mode = Bitcoin.read_exact(buf, 1).unpack1('c')
+        version = Bitcoin.read_exact(buf, 8).unpack1('Q<')
         new(mode, version)
       end
 

data/lib/bitcoin/message/send_tx_rcncl.rb

@@ -23,7 +23,7 @@ module Bitcoin
 
       def self.parse_from_payload(payload)
         buf = StringIO.new(payload)
-        version, salt = buf.read(16).unpack('VQ<')
+        version, salt = Bitcoin.read_exact(buf, 12).unpack('VQ<')
         SendTxRcncl.new(version, salt)
       end
 

data/lib/bitcoin/message/version.rb

@@ -31,19 +31,34 @@ module Bitcoin
         @relay = opts[:relay] || false
       end
 
+      # The part every version message has: version, services, timestamp and the receiving address.
+      MIN_PAYLOAD_SIZE = 4 + 8 + 8 + 26
+
+      # Parse a version message. As Bitcoin Core does, the sending address and nonce, the user agent, the
+      # start height and the relay flag are each read only when the payload still has data, so a message
+      # from an old protocol version which stops early is accepted with the remaining fields empty.
       def self.parse_from_payload(payload)
-        version, services, timestamp, local_addr, remote_addr, nonce, rest = payload.unpack('VQ<Q<a26a26Q<a*')
-        v = new
+        raise Bitcoin::Message::Error, 'Version payload is too short.' if payload.bytesize < MIN_PAYLOAD_SIZE
+        version, services, timestamp, local_addr, rest = payload.unpack('VQ<Q<a26a*')
+        v = new(remote_addr: NetworkAddr.new(time: nil), nonce: 0, user_agent: '', start_height: 0)
         v.version = version
         v.services = services
         v.timestamp = timestamp
         v.local_addr = NetworkAddr.parse_from_payload(local_addr)
-        v.remote_addr = NetworkAddr.parse_from_payload(remote_addr)
-        v.nonce = nonce
-        user_agent, rest = unpack_var_string(rest)
-        start_height, rest = rest.unpack('Va*')
-        v.user_agent = user_agent
-        v.start_height = start_height
+        unless rest.empty?
+          raise Bitcoin::Message::Error, 'Version payload is truncated.' if rest.bytesize < 26 + 8
+          remote_addr, nonce, rest = rest.unpack('a26Q<a*')
+          v.remote_addr = NetworkAddr.parse_from_payload(remote_addr)
+          v.nonce = nonce
+        end
+        unless rest.empty?
+          v.user_agent, rest = unpack_var_string(rest)
+          raise Bitcoin::Message::Error, "user agent size #{v.user_agent.bytesize} exceeds #{MAX_SUBVERSION_LENGTH}." if v.user_agent.bytesize > MAX_SUBVERSION_LENGTH
+        end
+        unless rest.empty?
+          raise Bitcoin::Message::Error, 'Version payload is truncated.' if rest.bytesize < 4
+          v.start_height, rest = rest.unpack('Va*')
+        end
         v.relay = v.unpack_relay_field(rest).first
         v
       end

data/lib/bitcoin/message.rb

@@ -1,6 +1,21 @@
 module Bitcoin
   module Message
 
+    # The most addresses an addr or addrv2 message may carry (MAX_ADDR_TO_SEND in Bitcoin Core).
+    MAX_ADDR_TO_SEND = 1000
+    # The most inventories an inv, getdata or notfound message may carry (MAX_INV_SZ).
+    MAX_INV_SZ = 50_000
+    # The most hashes a block locator may carry (MAX_LOCATOR_SZ).
+    MAX_LOCATOR_SZ = 101
+    # The longest user agent of a version message (MAX_SUBVERSION_LENGTH).
+    MAX_SUBVERSION_LENGTH = 256
+    # The most filter headers a cfheaders message may carry (MAX_GETCFHEADERS_SIZE).
+    MAX_CFHEADERS_RESULTS = 2000
+    # The most transactions a compact block or its blocktxn may refer to. No block holds more, since a
+    # transaction serializes to at least MIN_SERIALIZABLE_TRANSACTION_WEIGHT.
+    MAX_COMPACT_BLOCK_TX_COUNT = MAX_BLOCK_WEIGHT / MIN_SERIALIZABLE_TRANSACTION_WEIGHT
+
+
     autoload :Base, 'bitcoin/message/base'
     autoload :Inventory, 'bitcoin/message/inventory'
     autoload :InventoriesParser, 'bitcoin/message/inventories_parser'

data/lib/bitcoin/message_sign.rb

@@ -4,6 +4,22 @@ module Bitcoin
 
     class Error < StandardError; end
 
+    # A checker which enforces the BIP-322 rule that all signatures use SIGHASH_ALL, or SIGHASH_DEFAULT
+    # where the output type supports it. A signature with any other hash type fails, as if it did not verify.
+    class BIP322Checker < Bitcoin::TxChecker
+
+      def check_sig(sig, pubkey, script_code, sig_version, allow_hybrid: false)
+        return false unless sig.empty? || sig.htb[-1].unpack1('C') == SIGHASH_TYPE[:all]
+        super
+      end
+
+      def check_schnorr_sig(sig, pubkey, sig_version, opts = {})
+        bytes = sig.htb
+        return set_error(SCRIPT_ERR_SCHNORR_SIG_HASHTYPE) if bytes.bytesize == 65 && bytes[-1].unpack1('C') != SIGHASH_TYPE[:all]
+        super
+      end
+    end
+
     module_function
 
     FORMAT_LEGACY = :legacy
@@ -15,7 +31,9 @@ module Bitcoin
     SIGNATURE_PREFIX_FULL = 'ful'
     SIGNATURE_PREFIX_POF = 'pof'
 
-    # BIP-322 Required rules
+    # BIP-322 required rules, and its upgradeable rules: a proof which relies on a reserved NOP, a witness
+    # version above 1, an unknown taproot leaf version, an OP_SUCCESSx or an unknown public key type is not
+    # valid, since such a script succeeds without any signature.
     BIP322_VERIFY_FLAGS = [
       SCRIPT_VERIFY_P2SH, SCRIPT_VERIFY_DERSIG, SCRIPT_VERIFY_STRICTENC,
       SCRIPT_VERIFY_LOW_S, SCRIPT_VERIFY_NULLFAIL, SCRIPT_VERIFY_MINIMALDATA,
@@ -23,7 +41,10 @@ module Bitcoin
       SCRIPT_VERIFY_CONST_SCRIPTCODE,
       SCRIPT_VERIFY_WITNESS, SCRIPT_VERIFY_TAPROOT,
       SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS,
-      SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM
+      SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM,
+      SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_TAPROOT_VERSION,
+      SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS,
+      SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_PUBKEYTYPE
     ].inject(:|)
 
     # Sign a message.
@@ -33,6 +54,7 @@ module Bitcoin
     # @param [String] format Format of signature data. Default is +FORMAT_LEGACY+.
     # @param [String] prefix (Optional) Prefix used in legacy format.
     # @return [String] Signature, base64 encoded.
+    # @raise [ArgumentError] If +address+ is not supported, or +key+ does not correspond to it.
     def sign_message(key, message, prefix: Bitcoin.chain_params.message_magic, format: FORMAT_LEGACY, address: nil)
       validate_format!(format)
       digest = message_hash(message, prefix: prefix, legacy: format == FORMAT_LEGACY)
@@ -43,20 +65,15 @@ module Bitcoin
             else
               validate_address!(address)
               addr = Bitcoin::Script.parse_from_addr(address)
-              sig_ver, algo = if addr.p2wpkh? || addr.p2wsh?
-                                [:witness_v0, :ecdsa]
-                              elsif addr.p2tr?
-                                [:taproot, :schnorr]
-                              else
-
-                              end
               tx = to_sign_tx(digest, address)
               prev_out = Bitcoin::TxOut.new(script_pubkey: addr, value: 0)
               if addr.p2tr?
-                sighash = tx.sighash_for_input(0, addr, sig_version: :taproot, prevouts: [prev_out], hash_type: Bitcoin::SIGHASH_TYPE[:default])
                 tweaked = Bitcoin::Taproot.tweak_private_key(key, '')
+                validate_key!(Bitcoin::Script.to_p2tr(tweaked), addr, address)
+                sighash = tx.sighash_for_input(0, addr, sig_version: :taproot, prevouts: [prev_out], hash_type: Bitcoin::SIGHASH_TYPE[:default])
                 tx.in[0].script_witness.stack << tweaked.sign(sighash, algo: :schnorr)
-              elsif addr.p2wpkh? || addr.p2wsh?
+              elsif addr.p2wpkh?
+                validate_key!(Bitcoin::Script.to_p2wpkh(key.hash160), addr, address)
                 sighash = tx.sighash_for_input(0, addr, sig_version: :witness_v0, amount: 0, prevouts: [prev_out])
                 ecdsa  = key.sign(sighash, algo: :ecdsa) + [Bitcoin::SIGHASH_TYPE[:all]].pack('C')
                 tx.in[0].script_witness.stack << ecdsa
@@ -75,7 +92,9 @@ module Bitcoin
     # @param [String] signature The signature in base64 format.
     # @param [String] message The message that was signed.
     # @return [Boolean] Verification result.
+    # @raise [ArgumentError] If +signature+ is not a String or cannot be decoded.
     def verify_message(address, signature, message, prefix: Bitcoin.chain_params.message_magic)
+      raise ArgumentError, 'signature must be a String.' unless signature.is_a?(String)
       addr_script = Bitcoin::Script.parse_from_addr(address)
       variant, body = case signature
                       when ''
@@ -103,7 +122,8 @@ module Bitcoin
         verify_simple(addr_script, payload, message, prefix: prefix)
       when :full
         begin
-          tx = Bitcoin::Tx.parse_from_payload(payload)
+          # strict rejects bytes after the tx, as Bitcoin Core's DecodeTx does.
+          tx = Bitcoin::Tx.parse_from_payload(payload, strict: true)
         rescue StandardError
           raise ArgumentError, 'error parsing signature as full variant'
         end
@@ -128,9 +148,26 @@ module Bitcoin
       Bitcoin::Script.parse_from_addr(address)
     end
 
+    # Ensure the signing key can satisfy +address+.
+    # A key the address does not commit to still produces a signature, and BIP-322 carries
+    # nothing that would report it verifies against no one.
+    # @param [Bitcoin::Script] derived The script the signing key produces.
+    # @param [Bitcoin::Script] expected The script of the address to be signed for.
+    # @param [String] address The address to be signed for, for the error message.
+    # @raise [ArgumentError] If the key does not correspond to +address+.
+    def validate_key!(derived, expected, address)
+      return if derived == expected
+      message = "Key does not correspond to #{address}."
+      if expected.p2tr?
+        message += ' A P2TR address holds the output key, which is the internal key this key' \
+                   ' holds tweaked with an empty merkle root. See Bitcoin::Key#to_p2tr.'
+      end
+      raise ArgumentError, message
+    end
+
     def validate_format!(format)
       unless [FORMAT_LEGACY, FORMAT_FULL, FORMAT_SIMPLE].include?(format)
-        raise ArgumentError "Invalid format specified."
+        raise ArgumentError, "Invalid format specified."
       end
     end
 
@@ -169,10 +206,23 @@ module Bitcoin
     def verify_simple(addr_script, witness_payload, message, prefix:)
       digest = message_hash(message, prefix: prefix, legacy: false)
       tx = to_sign_tx(digest, addr_script.to_addr)
-      tx.in[0].script_witness = Bitcoin::ScriptWitness.parse_from_payload(witness_payload)
+      tx.in[0].script_witness = parse_simple_witness(witness_payload)
       run_interpreter(tx, addr_script)
     end
 
+    # Parse the witness of a simple signature, which has to be exactly one serialized witness.
+    # @raise [ArgumentError] If the witness is truncated or followed by other bytes.
+    def parse_simple_witness(payload)
+      buf = StringIO.new(payload)
+      begin
+        witness = Bitcoin::ScriptWitness.parse_from_payload(buf)
+      rescue StandardError
+        raise ArgumentError, 'error parsing signature as simple variant'
+      end
+      raise ArgumentError, 'error parsing signature as simple variant' unless buf.eof?
+      witness
+    end
+
     def verify_full(addr_script, tx, message, prefix:)
       digest = message_hash(message, prefix: prefix, legacy: false)
       to_spend = to_spend_tx(digest, addr_script.to_addr)
@@ -183,7 +233,7 @@ module Bitcoin
 
     def run_interpreter(tx, script_pubkey)
       tx_out = Bitcoin::TxOut.new(script_pubkey: script_pubkey)
-      checker = Bitcoin::TxChecker.new(tx: tx, input_index: 0, prevouts: [tx_out])
+      checker = BIP322Checker.new(tx: tx, input_index: 0, prevouts: [tx_out])
       interpreter = Bitcoin::ScriptInterpreter.new(flags: BIP322_VERIFY_FLAGS, checker: checker)
       interpreter.verify_script(tx.in[0].script_sig, script_pubkey, tx.in[0].script_witness)
     end
@@ -197,10 +247,12 @@ module Bitcoin
     end
 
     private_class_method :validate_address!
+    private_class_method :validate_key!
     private_class_method :validate_format!
     private_class_method :validate_to_sign_tx!
     private_class_method :run_interpreter
     private_class_method :verify_simple
+    private_class_method :parse_simple_witness
     private_class_method :verify_full
     private_class_method :verify_legacy
   end

data/lib/bitcoin/mnemonic.rb

@@ -8,6 +8,11 @@ module Bitcoin
 
     attr_reader :language
 
+    # The number of words of a valid mnemonic sentence (BIP-39).
+    WORD_COUNTS = [12, 15, 18, 21, 24].freeze
+    # The number of bytes of a valid entropy (BIP-39).
+    ENTROPY_BYTES = [16, 20, 24, 28, 32].freeze
+
     def initialize(language)
       raise ArgumentError, 'specified language is not supported.' unless Mnemonic.word_lists.include?(language)
       @language = language
@@ -22,6 +27,8 @@ module Bitcoin
     # @param [Array[String]] words the array of mnemonic word.
     # @return [String] an entropy with hex format.
     def to_entropy(words)
+      # BIP-39: the entropy is 128 to 256 bits in steps of 32, which gives 12, 15, 18, 21 or 24 words.
+      raise ArgumentError, 'Invalid mnemonic length.' unless words.is_a?(Array) && WORD_COUNTS.include?(words.size)
       word_master = load_words
       mnemonic = words.map do |w|
         index = word_master.index(normalize(w).downcase)
@@ -39,6 +46,7 @@ module Bitcoin
     # @return [Array] the array of mnemonic word.
     def to_mnemonic(entropy)
       raise ArgumentError, 'entropy is empty.' if entropy.nil? || entropy.empty?
+      raise ArgumentError, 'Invalid entropy length.' unless ENTROPY_BYTES.include?(entropy.htb.bytesize)
       e = entropy.htb.unpack1('B*')
       seed = e + checksum(e)
       mnemonic_index = seed.chars.each_slice(11).map{|i|i.join.to_i(2)}

data/lib/bitcoin/out_point.rb

@@ -25,7 +25,7 @@ module Bitcoin
     # @return [Bitcoin::OutPoint]
     def self.parse_from_payload(payload)
       buf = payload.is_a?(String) ? StringIO.new(payload) : payload
-      hash, index = buf.read(36).unpack('a32V')
+      hash, index = Bitcoin.read_exact(buf, 36).unpack('a32V')
       OutPoint.new(hash.bth, index)
     end
 
@@ -33,7 +33,11 @@ module Bitcoin
       tx_hash == COINBASE_HASH && index == COINBASE_INDEX
     end
 
+    # @raise [ArgumentError] If the index does not fit in 4 bytes. -1, the default, is written as 0xffffffff.
     def to_payload
+      unless index.is_a?(Integer) && index.between?(-1, COINBASE_INDEX)
+        raise ArgumentError, 'index must be an integer from 0 to 0xffffffff.'
+      end
       [tx_hash.htb, index].pack('a32V')
     end
 
@@ -42,7 +46,7 @@ module Bitcoin
     end
 
     def valid?
-      index >= 0 && (!coinbase? && tx_hash != COINBASE_HASH)
+      index.is_a?(Integer) && index.between?(0, COINBASE_INDEX) && (!coinbase? && tx_hash != COINBASE_HASH)
     end
 
     # convert hash to txid

data/lib/bitcoin/partial_tree.rb

@@ -19,6 +19,9 @@ module Bitcoin
     end
 
     # https://bitcoin.org/en/developer-reference#creating-a-merkleblock-message
+    # The tree is read depth first the way Bitcoin Core's CPartialMerkleTree::TraverseAndExtract does, and
+    # like Core it is rejected when the flags or the hashes run out, when a hash is left over, or when a flag
+    # bit outside the padding of the last byte is left over.
     # @param [Integer] tx_count The number of transactions in the block.
     # @param [Array] hashes Array of hash values with hex format.
     # @param [String] flags The sequence of bits, a string of '0' and '1'.
@@ -26,24 +29,12 @@ module Bitcoin
     # @raise [ArgumentError] If the given parameters are out of range or inconsistent.
     def self.build(tx_count, hashes, flags)
       validate!(tx_count, hashes, flags)
-      flags = flags.each_char.map(&:to_i)
+      bits = flags.each_char.map(&:to_i)
       root = build_initial_tree( Array.new(tx_count) { Node.new })
-      current_node = root
-      hash_index = 0
-      flags.each do |f|
-        current_node.flag = f
-        if f.zero? || current_node.leaf?
-          current_node.value = hashes[hash_index]
-          hash_index += 1
-        end
-        current_node = current_node.next_partial
-        if hash_index == hashes.size
-          if current_node&.leaf?
-            current_node.value = hashes.last
-          end
-          break
-        end
-      end
+      used = { bits: 0, hashes: 0 }
+      traverse(root, bits, hashes, used)
+      raise ArgumentError, 'Invalid partial tree. Not every hash was used.' unless used[:hashes] == hashes.size
+      raise ArgumentError, 'Invalid partial tree. Not every flag bit was used.' unless (used[:bits] + 7) / 8 == (bits.size + 7) / 8
       new(root)
     end
 
@@ -61,13 +52,36 @@ module Bitcoin
       raise ArgumentError, 'flags must have at least one bit per hash.' if flags.size < hashes.size
     end
 
+    # Read the flag bit of +node+ and, for a node which is neither a leaf nor the parent of a match, the
+    # hash which stands for it. The right child of the last node of an odd level repeats the left one and
+    # has no flag or hash of its own.
+    # @raise [ArgumentError] If the flags or the hashes run out.
+    def self.traverse(node, bits, hashes, used)
+      raise ArgumentError, 'Invalid partial tree. The flags ran out.' if used[:bits] >= bits.size
+      node.flag = bits[used[:bits]]
+      used[:bits] += 1
+      if node.flag.zero? || node.leaf?
+        raise ArgumentError, 'Invalid partial tree. The hashes ran out.' if used[:hashes] >= hashes.size
+        node.value = hashes[used[:hashes]]
+        used[:hashes] += 1
+      else
+        traverse(node.left, bits, hashes, used)
+        if node.right.duplicated
+          node.right.value = node.left.value
+        else
+          traverse(node.right, bits, hashes, used)
+        end
+      end
+    end
+    private_class_method :traverse
+
     def self.build_initial_tree(nodes)
       raise ArgumentError, 'nodes must not be empty.' if nodes.empty?
       while nodes.size != 1
         nodes = nodes.each_slice(2).map { |m|
           parent = Node.new
           parent.left = m[0]
-          parent.right = m[1] ? m[1] : m[0].dup
+          parent.right = m[1] ? m[1] : m[0].dup.tap { |n| n.duplicated = true }
           parent
         }
       end
@@ -86,9 +100,13 @@ module Bitcoin
       attr_accessor :parent
       attr_accessor :left
       attr_accessor :right
+      # Whether this node stands in for a missing right child, as the last node of a level with an odd
+      # count is paired with a copy of itself. Such a copy is equal to its sibling by construction.
+      attr_accessor :duplicated
 
       def initialize(value = nil)
         @value = value
+        @duplicated = false
       end
 
       def left=(node)
@@ -103,8 +121,11 @@ module Bitcoin
 
       def value
         return @value if @value
-        self.right = left.dup unless right
-        Bitcoin.double_sha256([left.value + right.value].pack('H*')).bth
+        left_value, right_value = left.value, right.value
+        # Two identical branches mean the hashes under them are not unique, which is how the duplicated
+        # tx of CVE-2012-2459 hides in a merkleblock. Bitcoin Core marks such a tree as bad.
+        raise ArgumentError, 'Invalid partial tree. The left and right branches are identical.' if !right.duplicated && left_value == right_value
+        Bitcoin.double_sha256([left_value + right_value].pack('H*')).bth
       end
 
       def root?
@@ -119,14 +140,6 @@ module Bitcoin
         !flag.nil?
       end
 
-      def next_partial
-        return nil if root? && (flag.zero? || (left.nil? && right.nil?) || (left.partial? && right.partial?))
-        return parent.next_partial if flag.zero? || leaf?
-        return left unless left.partial?
-        self.right = left.dup unless right
-        right.partial? ? parent.next_partial : right
-      end
-
       # calculate the depth of this node in the tree.
       def depth
         d = 0

data/lib/bitcoin/payment_code.rb

@@ -7,10 +7,15 @@ module Bitcoin
 
     attr_accessor :x_value
     attr_accessor :sign
+    attr_accessor :features_bits # the features byte with hex format. Only bit 0 may be set.
+    attr_accessor :reserve_field # the 13 reserved bytes with hex format, zero unless a future version says otherwise.
 
     VERSION_BYTE = '47'
     SUPPORT_VERSIONS = ['01']
     SUPPORT_SIGNS = ['02', '03']
+    PAYLOAD_SIZE = 80 # version, features, sign, x value, chain code and the reserved bytes.
+    # The Base58Check form: the 0x47 version byte, the payload and the checksum.
+    BASE58_PAYLOAD_SIZE = 1 + PAYLOAD_SIZE + 4
 
     def initialize
       @version = '01'
@@ -26,6 +31,9 @@ module Bitcoin
 
       payment_code = PaymentCode.new
       payment_code.depth = master_ext_key.depth
+      payment_code.number = master_ext_key.number
+      payment_code.parent_fingerprint = master_ext_key.parent_fingerprint
+      payment_code.ver = master_ext_key.ver
       payment_code.key = master_ext_key.key
       payment_code.sign = compressed_pubkey[0..1]
       payment_code.x_value = compressed_pubkey[2..-1]
@@ -50,28 +58,38 @@ module Bitcoin
     end
 
     # decode base58 encoded payment code
+    # The serialization is the 85 bytes of BIP-47: the 0x47 version byte, the 80 byte payload and the
+    # checksum. The features byte may only have bit 0 set, and the reserved bytes are kept as they are.
     # @params [String] base58_payment_code base58 encoded payment code
+    # @return [String] the 80 byte payload with binary format.
+    # @raise [ArgumentError] If +base58_payment_code+ is not a payment code.
     def self.from_base58(base58_payment_code)
+      raise ArgumentError, 'payment code must be string.' unless base58_payment_code.is_a?(String)
       hex = Bitcoin::Base58.decode(base58_payment_code)
+      raise ArgumentError, 'invalid payment code length' unless hex.length == BASE58_PAYLOAD_SIZE * 2
+      raise ArgumentError, 'invalid version byte' unless hex[0..1] == VERSION_BYTE
+      payment_code = hex[0...-8]
+      raise ArgumentError, Errors::Messages::INVALID_CHECKSUM unless Bitcoin.calc_checksum(payment_code) == hex[-8..-1]
+
       version = hex[2..3]
+      features = hex[4..5]
       sign = hex[6..7]
-      public_key = hex[8..71]
-      payment_code = hex[0...-8]
+      x_value = hex[8..71]
+      chain_code_hex = hex[72..135]
+      reserved = hex[136..161]
 
-      raise ArgumentError, 'invalid version byte' unless hex[0..1] == VERSION_BYTE
       raise ArgumentError, 'invalid version' unless PaymentCode.support_version?(version)
+      raise ArgumentError, 'invalid features' unless (features.to_i(16) & 0xfe).zero?
       raise ArgumentError, 'invalid sign' unless PaymentCode.support_sign?(sign)
-      raise ArgumentError, Errors::Messages::INVALID_PUBLIC_KEY unless Bitcoin::Key.new(pubkey: sign + public_key).fully_valid_pubkey?
-      raise ArgumentError, Errors::Messages::INVALID_CHECKSUM unless Bitcoin.calc_checksum(payment_code) == hex[-8..-1]
-
-      x_value = payment_code[8..71]
-      chain_code_hex = payment_code[72..135]
+      raise ArgumentError, Errors::Messages::INVALID_PUBLIC_KEY unless Bitcoin::Key.new(pubkey: sign + x_value).fully_valid_pubkey?
 
       payment_code_pubkey = PaymentCode.new
       payment_code_pubkey.depth = 3
+      payment_code_pubkey.features_bits = features
       payment_code_pubkey.sign = sign
       payment_code_pubkey.x_value = x_value
       payment_code_pubkey.chain_code = [chain_code_hex].pack('H*')
+      payment_code_pubkey.reserve_field = reserved
 
       payment_code_pubkey.to_payload
     end

data/lib/bitcoin/psbt/hd_key_path.rb

@@ -11,8 +11,7 @@ module Bitcoin
       def initialize(pubkey, info)
         pubkey = pubkey.encoding == Encoding::ASCII_8BIT ? pubkey : pubkey.htb
         raise ArgumentError, 'Size of key was not the expected size for the type BIP32 keypath.' unless [Bitcoin::Key::PUBLIC_KEY_SIZE, Bitcoin::Key::COMPRESSED_PUBLIC_KEY_SIZE].include?(pubkey.bytesize)
-        pubkey = Bitcoin::Key.new(pubkey: pubkey.bth)
-        raise ArgumentError, Errors::Messages::INVALID_PUBLIC_KEY unless pubkey.fully_valid_pubkey?
+        pubkey = PSBT.parse_pubkey(pubkey.bth)
         @pubkey = pubkey.pubkey
         @info = info
       end