bitcoinrb 1.15.0 → 1.16.0

data/lib/bitcoin/constants.rb

@@ -60,7 +60,16 @@ module Bitcoin
   SCRIPT_VERIFY_DISCOURAGE_OP_SUCCESS = (1 << 19) # Making unknown OP_SUCCESS non-standard
   SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_PUBKEYTYPE = (1 << 20) # Making unknown public key versions (in BIP 342 scripts) non-standard
 
-  MANDATORY_SCRIPT_VERIFY_FLAGS = SCRIPT_VERIFY_P2SH
+  # Script verification flags of the rules which every block has to follow, the soft forks which are now consensus.
+  MANDATORY_SCRIPT_VERIFY_FLAGS = [
+    SCRIPT_VERIFY_P2SH,
+    SCRIPT_VERIFY_DERSIG,
+    SCRIPT_VERIFY_NULLDUMMY,
+    SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY,
+    SCRIPT_VERIFY_CHECKSEQUENCEVERIFY,
+    SCRIPT_VERIFY_WITNESS,
+    SCRIPT_VERIFY_TAPROOT
+  ].inject(SCRIPT_VERIFY_NONE){|flags, f| flags |= f}
 
   # Standard script verification flags that standard transactions will comply with.
   STANDARD_SCRIPT_VERIFY_FLAGS = [
@@ -127,8 +136,9 @@ module Bitcoin
   # Maximum number length in bytes
   DEFAULT_MAX_NUM_SIZE = 4
 
-  # 80 bytes of data, +1 for OP_RETURN, +2 for the pushdata opcodes.
-  MAX_OP_RETURN_RELAY = 83
+  # The default -datacarriersize of Bitcoin Core, the total size of the OP_RETURN scriptPubKeys a standard tx may have.
+  # It is MAX_STANDARD_TX_WEIGHT / WITNESS_SCALE_FACTOR, so that the size of a standard tx is the only limit.
+  MAX_OP_RETURN_RELAY = 100_000
 
   # for script error
   SCRIPT_ERR_OK = 0

data/lib/bitcoin/descriptor/combo.rb

@@ -7,8 +7,20 @@ module Bitcoin
         :combo
       end
 
-      def to_hex
+      def initialize(key)
+        super(key)
+        validate_not_xonly!(key)
+      end
+
+      # combo() stands for several scripts, see #to_scripts.
+      # @raise [ArgumentError] always.
+      def to_script
         raise ArgumentError, 'musig() is not allowed in top-level combo().' if musig?
+        raise ArgumentError, 'combo() expands to several scripts. Use #to_scripts.'
+      end
+
+      def to_hex
+        to_script
       end
 
       def to_scripts

data/lib/bitcoin/descriptor/expression.rb

@@ -54,16 +54,17 @@ module Bitcoin
         if key.start_with?('[') # BIP32 fingerprint
           raise ArgumentError, "Multiple ']' characters found for a single pubkey." if key.count('[') > 1 || key.count(']') > 1
           info = key[1...key.index(']')]
-          fingerprint, *paths = info.split('/')
-          raise ArgumentError, "Fingerprint '#{fingerprint}' is not hex." unless fingerprint.valid_hex?
+          fingerprint, *paths = info.split('/', -1) # keep a trailing empty element, so that a trailing '/' is rejected
           raise ArgumentError, "Fingerprint '#{fingerprint}' is not 4 bytes." unless fingerprint.size == 8
+          raise ArgumentError, "Fingerprint '#{fingerprint}' is not hex." unless fingerprint.valid_hex?
+          paths.each { |path| parse_path_element(path) } # The origin path is not derived, but it has to be a path.
           key = key[(key.index(']') + 1)..-1]
         else
           raise ArgumentError, 'Invalid key origin.' if key.include?(']')
         end
 
         # check BIP32 derivation path
-        key, *paths = key.split('/')
+        key, *paths = key.split('/', -1)
 
         raise ArgumentError, "No key provided." unless key
 
@@ -97,24 +98,43 @@ module Bitcoin
       def derive_path(key, paths)
         is_private = key.is_a?(Bitcoin::ExtKey)
         paths.each do |path|
-          raise ArgumentError, 'xpub can not derive hardened key.' if !is_private && path.end_with?("'")
           raise ArgumentError, 'Key ranges are not supported.' if path.include?("*")
           raise ArgumentError, 'Key multipath are not supported.' if path.include?("<")
-          if is_private
-            hardened = path.end_with?("'")
-            path = hardened ? path[0..-2] : path
-            raise ArgumentError, 'Key path value is not a valid value.' unless path =~ /^[0-9]+$/
-            raise ArgumentError, 'Key path value is out of range.' if !hardened && path.to_i >= Bitcoin::HARDENED_THRESHOLD
-            key = key.derive(path.to_i, hardened)
-          else
-            raise ArgumentError, 'Key path value is not a valid value.' unless path =~ /^[0-9]+$/
-            raise ArgumentError, 'Key path value is out of range.' if path.to_i >= Bitcoin::HARDENED_THRESHOLD
-            key = key.derive(path.to_i)
-          end
+          index, hardened = parse_path_element(path)
+          raise ArgumentError, 'xpub can not derive hardened key.' if hardened && !is_private
+          key = is_private ? key.derive(index, hardened) : key.derive(index)
         end
         key
       end
 
+      # Parse one element of a derivation path. A hardened index is marked with ' or h, as BIP-380 allows.
+      # @param [String] path The element, e.g. "0", "0'" or "0h".
+      # @return [Array(Integer, Boolean)] the index and whether it is hardened.
+      # @raise [ArgumentError] If it is not a number below 2^31.
+      def parse_path_element(path)
+        hardened = path.end_with?("'", 'h')
+        index = hardened ? path[0..-2] : path
+        raise ArgumentError, 'Key path value is not a valid value.' unless index =~ /\A[0-9]+\z/
+        raise ArgumentError, 'Key path value is out of range.' if index.to_i >= Bitcoin::HARDENED_THRESHOLD
+        [index.to_i, hardened]
+      end
+
+      # Whether +key+ is given as a 32 byte x-only public key. Such a key is only valid inside tr().
+      # @param [String, MuSig] key KEY string.
+      # @return [Boolean]
+      def xonly_key?(key)
+        return false unless key.is_a?(String)
+        key = key[(key.index(']') + 1)..-1] if key.include?(']')
+        key = key.split('/').first.to_s
+        key.length == 64 && key.valid_hex?
+      end
+
+      # Raise unless +key+ is usable outside tr().
+      # @raise [ArgumentError]
+      def validate_not_xonly!(key)
+        raise ArgumentError, 'x-only public key is only allowed inside tr().' if xonly_key?(key)
+      end
+
       def ==(other)
         return false unless other.is_a?(Expression)
         type == other.type && to_script == other.to_script

data/lib/bitcoin/descriptor/multi.rb

@@ -37,12 +37,20 @@ module Bitcoin
 
       private
 
+      # Whether the keys may be x-only. Only the tapscript variants allow it.
+      def xonly_allowed?
+        false
+      end
+
       def validate!(threshold, keys)
         raise ArgumentError, "Multisig threshold '#{threshold}' is not valid." unless threshold.is_a?(Integer)
         raise ArgumentError, 'Multisig threshold cannot be 0, must be at least 1.' unless threshold > 0
         raise ArgumentError, 'Multisig threshold cannot be larger than the number of keys.' if threshold > keys.size
         raise ArgumentError, "Multisig must have between 1 and #{Bitcoin::MAX_PUBKEYS_PER_MULTISIG} keys, inclusive." if keys.size > Bitcoin::MAX_PUBKEYS_PER_MULTISIG
-        keys.each{|key| extract_pubkey(key) }
+        keys.each do |key|
+          validate_not_xonly!(key) unless xonly_allowed?
+          extract_pubkey(key)
+        end
       end
     end
   end

data/lib/bitcoin/descriptor/multi_a.rb

@@ -19,6 +19,10 @@ module Bitcoin
 
       private
 
+      def xonly_allowed?
+        true
+      end
+
       def multisig_script(keys)
         script = Bitcoin::Script.new
         keys.each.with_index do |k, i|

data/lib/bitcoin/descriptor/musig.rb

@@ -18,6 +18,7 @@ module Bitcoin
       # @return [Bitcoin::Descriptor::MuSig]
       def initialize(keys, path = nil)
         raise ArgumentError, "keys must be an array." unless keys.is_a?(Array)
+        raise ArgumentError, 'musig() requires at least one key.' if keys.empty?
         unless path.nil?
           raise ArgumentError, "path must be String." unless path.is_a?(String)
           raise ArgumentError, "path must be start with /." unless path.start_with?("/")

data/lib/bitcoin/descriptor/pk.rb

@@ -17,9 +17,16 @@ module Bitcoin
 
       def to_hex
         raise ArgumentError, 'musig() is not allowed in top-level pk().' if musig?
+        validate_not_xonly!(key)
         super
       end
 
+      # Whether the key is given as an x-only key, which only a tr() tree can hold.
+      # @return [Boolean]
+      def xonly_key?(k = key)
+        super(k)
+      end
+
       # Convert to bitcoin script.
       # @return [Bitcoin::Script]
       def to_script

data/lib/bitcoin/descriptor/pkh.rb

@@ -7,6 +7,11 @@ module Bitcoin
         :pkh
       end
 
+      def initialize(key)
+        super(key)
+        validate_not_xonly!(key)
+      end
+
       def to_hex
         raise ArgumentError, 'musig() is not allowed in top-level pkh().' if musig?
         super

data/lib/bitcoin/descriptor/raw.rb

@@ -8,7 +8,7 @@ module Bitcoin
       # @param [String] hex
       def initialize(hex)
         raise ArgumentError, "Raw script must be string." unless hex.is_a?(String)
-        raise ArgumentError, "Raw script is not hex." unless hex.valid_hex?
+        raise ArgumentError, "Raw script is not hex." if hex.empty? || !hex.valid_hex?
         @hex = hex
       end
 

data/lib/bitcoin/descriptor/sh.rb

@@ -20,6 +20,7 @@ module Bitcoin
       def validate!(script)
         super(script)
         raise ArgumentError, 'A function is needed within P2SH.' unless script.is_a?(Expression)
+        raise ArgumentError, 'x-only public key is only allowed inside tr().' if script.is_a?(Pk) && script.xonly_key?
         script_size = script.to_script.size
         if script_size > Bitcoin::MAX_SCRIPT_ELEMENT_SIZE
           raise ArgumentError,

data/lib/bitcoin/descriptor/sp.rb

@@ -92,10 +92,10 @@ module Bitcoin
       end
 
       # Silent payment descriptors do not produce a single script.
-      # Use to_address to get the silent payment address.
+      # Use to_addr to get the silent payment address.
       # @raise [RuntimeError]
       def to_script
-        raise RuntimeError, "sp() descriptor does not produce a fixed script. Use to_address instead."
+        raise RuntimeError, "sp() descriptor does not produce a fixed script. Use to_addr instead."
       end
 
       private

data/lib/bitcoin/descriptor/tr.rb

@@ -55,7 +55,7 @@ module Bitcoin
           if item.is_a?(Array)
             items << parse_tree_items(item)
           elsif item.is_a?(Expression)
-            item.xonly = true
+            item.xonly = true if item.respond_to?(:xonly=)
             items << Bitcoin::Taproot::LeafNode.new(item.to_script)
           else
             raise RuntimeError, "Unsupported item #{item}"
@@ -65,8 +65,10 @@ module Bitcoin
       end
 
       def validate_tree!(tree)
-        return if tree.nil? || tree.is_a?(Expression)
-        if tree.is_a?(Array)
+        return if tree.nil?
+        if tree.is_a?(Expression)
+          validate_leaf!(tree)
+        elsif tree.is_a?(Array)
           tree.each do |item|
             validate_tree!(item)
           end
@@ -75,6 +77,30 @@ module Bitcoin
         end
       end
 
+      # Check that +leaf+ can be a tapscript leaf. Bitcoin Core allows pk(), multi_a(), sortedmulti_a() and
+      # miniscript inside tr(); miniscript is not supported here. Any other expression, such as a wrapper
+      # which produces a scriptPubKey, would end up as a tapleaf nobody can spend.
+      # @param [Bitcoin::Descriptor::Expression] leaf
+      # @raise [ArgumentError]
+      def validate_leaf!(leaf)
+        message = case leaf.type
+                  when :pk, :multi_a, :sortedmulti_a then nil
+                  when :multi, :sortedmulti then 'Can only have multi/sortedmulti at top level, in sh(), or in wsh().'
+                  when :wpkh then 'Can only have wpkh() at top level or inside sh().'
+                  when :sh then 'Can only have sh() at top level.'
+                  when :wsh then 'Can only have wsh() at top level or inside sh().'
+                  when :addr then 'Can only have addr() at top level.'
+                  when :combo then 'Can only have combo() at top level.'
+                  when :raw then 'Can only have raw() at top level.'
+                  when :tr then 'Can only have tr() at top level.'
+                  when :rawtr then 'Can only have rawtr() at top level.'
+                  else "#{leaf.type}() is not allowed in a tr() tree."
+                  end
+        raise ArgumentError, message if message
+        keys = leaf.is_a?(KeyExpression) ? [leaf.extracted_key] : leaf.keys.map { |k| leaf.extract_pubkey(k) }
+        raise ArgumentError, "Uncompressed key are not allowed." unless keys.all?(&:compressed?)
+      end
+
       def tree_string(tree)
         buffer = '{'
         left, right = tree

data/lib/bitcoin/descriptor/wpkh.rb

@@ -5,6 +5,7 @@ module Bitcoin
       def initialize(key)
         raise ArgumentError, 'musig() is not allowed in wpkh().' if key.is_a?(MuSig)
         super(key)
+        validate_not_xonly!(key)
         raise ArgumentError, "Uncompressed key are not allowed." unless extract_pubkey(key).compressed?
       end
 

data/lib/bitcoin/descriptor/wsh.rb

@@ -18,6 +18,7 @@ module Bitcoin
       def validate!(script)
         super(script)
         raise ArgumentError, 'A function is needed within P2WSH.' unless script.is_a?(Expression)
+        raise ArgumentError, 'x-only public key is only allowed inside tr().' if script.is_a?(Pk) && script.xonly_key?
         if script.is_a?(Wpkh) || script.is_a?(Wsh)
           raise ArgumentError, "Can only have #{script.type}() at top level or inside sh()."
         end

data/lib/bitcoin/descriptor.rb

@@ -153,8 +153,13 @@ module Bitcoin
     def parse(string, top_level = true)
       validate_checksum!(string)
       content, _ = string.split('#')
-      exp, args_str, path = content.match(/(\w+)\((.+)\)(.*)/).captures # split "tag(10, 20)/0/1"
+      matched = content.to_s.match(/\A(\w+)\((.*)\)(.*)\z/) # split "tag(10, 20)/0/1"
+      raise ArgumentError, "Invalid descriptor format: '#{string}'." unless matched
+      exp, args_str, path = matched.captures
       raise ArgumentError, 'Invalid format.' if exp != 'musig' && !path.empty?
+      if %w[pk pkh wpkh sh wsh combo raw addr rawtr].include?(exp) && split_two(args_str)[1]
+        raise ArgumentError, "#{exp}() takes one argument."
+      end
 
       case exp
       when 'pk'
@@ -175,6 +180,8 @@ module Bitcoin
         combo(args_str)
       when 'multi', 'sortedmulti', 'multi_a', 'sortedmulti_a'
         args = args_str.split(',')
+        # Only a plain decimal number, as ToIntegral in Bitcoin Core: no sign, no space, no other characters.
+        raise ArgumentError, "Multisig threshold '#{args[0]}' is not valid." unless args[0] =~ /\A[0-9]+\z/
         threshold = args[0].to_i
         keys = args[1..-1]
         case exp
@@ -196,13 +203,7 @@ module Bitcoin
       when 'tr'
         key, tree = split_two(args_str)
         key = parse(key) if key.include?('(')
-        if tree.nil?
-          tr(key)
-        elsif tree.start_with?('{')
-          tr(key, parse_nested_string(tree))
-        else
-          tr(key, parse(tree, false))
-        end
+        tree.nil? ? tr(key) : tr(key, parse_tree_string(tree))
       when 'rawtr'
         if args_str.include?('(')
           rawtr(parse(args_str, false))
@@ -242,35 +243,58 @@ module Bitcoin
       end
     end
 
-    def parse_nested_string(string)
-      return nil if string.nil?
-      stack = []
-      current = []
-      buffer = ""
-      string.each_char do |c|
-        case c
-        when '{'
-          stack << current
-          current = []
-        when '}'
-          unless buffer.empty?
-            current << parse(buffer, false)
-            buffer = ""
-          end
-          nested = current
-          current = stack.pop
-          current << nested
-        when ','
-          unless buffer.empty?
-            current << parse(buffer, false)
-            buffer = ""
-          end
-        else
-          buffer << c
+    # Parse the script tree of a tr() expression the way Bitcoin Core does. A tree is a script expression or
+    # '{' tree ',' tree '}', and nothing may follow it.
+    # @param [String] string The arguments of tr() after the key.
+    # @return [Bitcoin::Descriptor::Expression, Array] A leaf, or a two element Array of subtrees.
+    # @raise [ArgumentError] If +string+ is not a tree.
+    def parse_tree_string(string)
+      rest = string
+      branches = [] # one entry per open brace: false while in its left subtree, true while in its right one
+      lefts = []    # the finished left subtree of every brace which is in its right subtree
+      tree = loop do
+        while rest.start_with?('{')
+          rest = rest[1..]
+          branches << false
+          raise ArgumentError, "tr() supports at most #{TAPROOT_CONTROL_MAX_NODE_COUNT} nesting levels." if branches.size > TAPROOT_CONTROL_MAX_NODE_COUNT
+        end
+        leaf, rest = take_expression(rest)
+        raise ArgumentError, 'tr(): expected script expression.' if leaf.empty?
+        node = parse(leaf, false)
+        # Close every brace whose right subtree this finishes.
+        while branches.any? && branches.last
+          raise ArgumentError, "tr(): expected '}' after script expression." unless rest.start_with?('}')
+          rest = rest[1..]
+          branches.pop
+          node = [lefts.pop, node]
+        end
+        break node if branches.empty?
+        # This finishes the left subtree of a brace, so its right one follows a comma.
+        raise ArgumentError, "tr(): expected ',' after script expression." unless rest.start_with?(',')
+        rest = rest[1..]
+        branches[-1] = true
+        lefts << node
+      end
+      raise ArgumentError, "tr(): expected ')' after script expression." unless rest.empty?
+      tree
+    end
+
+    # Split off the leading script or key expression of +string+. It ends at the first ',', ')' or '}'
+    # outside any parentheses or braces, as Expr does in Bitcoin Core.
+    # @param [String] string
+    # @return [Array] The expression and the rest of +string+.
+    def take_expression(string)
+      level = 0
+      string.each_char.with_index do |c, i|
+        if c == '(' || c == '{'
+          level += 1
+        elsif level > 0 && (c == ')' || c == '}')
+          level -= 1
+        elsif level.zero? && (c == ')' || c == '}' || c == ',')
+          return [string[0...i], string[i..]]
         end
       end
-      current << parse(buffer, false) unless buffer.empty?
-      current.first
+      [string, '']
     end
 
     def split_two(content)

data/lib/bitcoin/ext/array_ext.rb

@@ -6,7 +6,10 @@ module Bitcoin
 
         # resize array content with +initial_value+.
         # expect to behave like vec#resize in c++.
+        # @raise [ArgumentError] If +new_size+ is not a non-negative integer. A negative size would
+        # otherwise empty the array.
         def resize!(new_size, initial_value = 0)
+          raise ArgumentError, 'new_size must be a non-negative integer.' unless new_size.is_a?(Integer) && new_size >= 0
           if size < new_size
             (new_size - size).times{self.<< initial_value}
           elsif size > new_size

data/lib/bitcoin/ext/ecdsa.rb

@@ -21,7 +21,13 @@ module ::ECDSA::Format::PointOctetString
     raise ECDSA::Format::DecodeError, 'Point octet string is empty.' if string.empty?
     if [6, 7].include?(string[0].ord)
       raise ECDSA::Format::DecodeError, 'Unrecognized start byte for point octet string: 0x%x' % string[0].ord unless allow_hybrid
-      decode_uncompressed string, group if allow_hybrid
+      point = decode_uncompressed(string, group)
+      # A hybrid encoding carries the parity of y in its first byte, 0x06 for even and 0x07 for odd, and
+      # libsecp256k1 rejects the point when the byte does not match the y it carries.
+      unless point.infinity? || (string[0].ord == 6) == point.y.even?
+        raise ECDSA::Format::DecodeError, 'Hybrid point octet string has a parity byte which does not match y.'
+      end
+      point
     else
       base_decode(string, group)
     end

data/lib/bitcoin/ext_key.rb

@@ -21,6 +21,9 @@ module Bitcoin
     # generate master key from seed.
     # @params [String] seed a seed data with hex format.
     def self.generate_master(seed)
+      # BIP-32: the seed is between 128 and 512 bits.
+      raise ArgumentError, 'The seed must be a hex string.' unless seed.is_a?(String)
+      raise ArgumentError, 'The seed must be 16 to 64 bytes.' unless (16..64).cover?(seed.htb.bytesize)
       ext_key = ExtKey.new
       ext_key.depth = ext_key.number = 0
       ext_key.parent_fingerprint = MASTER_FINGERPRINT
@@ -95,6 +98,10 @@ module Bitcoin
     # @param [Boolean] harden whether hardened key or not. If true, 2^31 is added to +number+.
     # @return [Bitcoin::ExtKey] derived new key.
     def derive(number, harden = false)
+      # A child index is 31 bits plus the hardened bit. Anything else was packed with 'N' and silently
+      # wrapped, giving a key whose serialized index differs from the one it was derived with.
+      limit = harden ? Bitcoin::HARDENED_THRESHOLD : 2**32
+      raise ArgumentError, 'Child index is out of range.' unless number.is_a?(Integer) && number >= 0 && number < limit
       number += Bitcoin::HARDENED_THRESHOLD if harden
       new_key = ExtKey.new
       new_key.depth = depth + 1
@@ -144,6 +151,7 @@ module Bitcoin
     end
 
     def self.parse_from_payload(payload)
+      raise ArgumentError, 'Invalid extended key length.' unless payload.bytesize == BIP32_EXTKEY_WITH_VERSION_SIZE
       buf = StringIO.new(payload)
       ext_key = ExtKey.new
       ext_key.ver = buf.read(4).bth # version
@@ -273,6 +281,7 @@ module Bitcoin
 
     # derive child key
     def derive(number)
+      raise ArgumentError, 'Child index is out of range.' unless number.is_a?(Integer) && number >= 0 && number < 2**32
       new_key = ExtPubkey.new
       new_key.depth = depth + 1
       raise IndexError, 'Depth over 255.' if new_key.depth > Bitcoin::ExtKey::MAX_DEPTH
@@ -318,6 +327,7 @@ module Bitcoin
     end
 
     def self.parse_from_payload(payload)
+      raise ArgumentError, 'Invalid extended key length.' unless payload.bytesize == BIP32_EXTKEY_WITH_VERSION_SIZE
       buf = StringIO.new(payload)
       ext_pubkey = ExtPubkey.new
       ext_pubkey.ver = buf.read(4).bth # version

data/lib/bitcoin/gcs_filter.rb

@@ -21,14 +21,18 @@ module Bitcoin
     # @param [Array] elements the filter elements.
     # @param [String] encoded_filter encoded filter with hex format.
     # @return [Bitcoin::GCSFilter]
+    # @raise [ArgumentError] If a parameter is out of range, or +encoded_filter+ is not the encoding of
+    # exactly N elements, as Bitcoin Core's GCSFilter checks it.
     def initialize(key, p, m, elements: nil, encoded_filter: nil)
-      raise 'specify either elements or encoded_filter.' if elements.nil? && encoded_filter.nil?
-      raise 'p must be <= 32' if p > 32
-      @key = key
+      raise ArgumentError, 'specify either elements or encoded_filter.' if elements.nil? && encoded_filter.nil?
+      raise ArgumentError, 'key must be 16 bytes.' unless key.is_a?(String) && key.bytesize == 16
+      raise ArgumentError, 'p must be between 0 and 32.' unless p.is_a?(Integer) && p.between?(0, 32)
+      raise ArgumentError, 'm must be a positive integer.' unless m.is_a?(Integer) && m > 0
+      @key = key.b
       @p = p
       @m = m
       if elements
-        raise 'elements size must be < 2**32.' if elements.size >= MAX_ELEMENTS_SIZE
+        raise ArgumentError, 'elements size must be < 2**32.' if elements.size >= MAX_ELEMENTS_SIZE
         @n = elements.size
         encoded = Bitcoin.pack_var_int(@n)
         bit_writer = Bitcoin::BitStreamWriter.new
@@ -45,8 +49,19 @@ module Bitcoin
         encoded << bit_writer.stream
         @encoded = encoded.bth
       else
+        raise ArgumentError, 'encoded_filter must be a hex string.' unless encoded_filter.is_a?(String) && encoded_filter.valid_hex?
         @encoded = encoded_filter
-        @n, payload = Bitcoin.unpack_var_int(encoded_filter.htb)
+        buf = StringIO.new(encoded_filter.htb)
+        @n = Bitcoin.unpack_var_int_from_io(buf)
+        raise ArgumentError, 'N must be < 2**32.' if @n >= MAX_ELEMENTS_SIZE
+        # The filter has to hold exactly N elements: neither fewer, nor bytes after the last one.
+        bit_reader = Bitcoin::BitStreamReader.new(buf.read)
+        begin
+          @n.times { golomb_rice_decode(bit_reader, p) }
+        rescue IOError
+          raise ArgumentError, 'encoded_filter is truncated.'
+        end
+        raise ArgumentError, 'encoded_filter contains excess data.' unless bit_reader.stream.eof?
       end
     end
 
@@ -59,7 +74,7 @@ module Bitcoin
     # @param [String] element with binary format.
     # @return [Integer]
     def hash_to_range(element)
-      hash = SipHash.digest(key, element)
+      hash = SipHash.digest(key, element.b) # bytes, whatever the encoding of the string says
       map_into_range(hash, f)
     end