bitcoinrb 1.15.0 → 1.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 5da84e4a456d4b5a47fba7e5cfcfceabbfbdb9fe757f6080519130d2ebabc41c
-  data.tar.gz: 903301aa0eb0f349bc08c7133ebe80b9c731646fece6a407b75ace1bf6161aa8
+  metadata.gz: 3e3ac48f9f618bd15f40353c7ad8bf122f0600d2fc6ab53d07aaa0827cb8a766
+  data.tar.gz: 47c187e47c83ec2e13343200cd48ebee2690b4b2b67485115a199473390fdfa4
 SHA512:
-  metadata.gz: 39a539b3380c6dba3ac091a2b3706508e790d16d4367ff91f715c9804ac5803dc56893f5aaf4c3bc4dec71d4a1c03a2d4da481e0b060c291a913a96cc3a7f1db
-  data.tar.gz: dec61d2d90e67665aa4277de65b68a86c00779b820d5980e8d2facc85d0a0a4ba5c10989a43982fafc88463f40c02dfbfd3421b6f89f3e08620af4c008fa22fd
+  metadata.gz: af9833c6b9e3592ef67d41a0df565c0993654892629ff94842d111e1e04458f3c5386474735fa6056def1b8b3c6649dfc383688adb22fc041d52999e99eb26b5
+  data.tar.gz: '08a894cf0539aad6a5e01fc37c261f674f47e74c78c8491e8bbc600b451435c163aacc84816065dc35ccc7369074ce86fa3cb8aa6b3349297b2fb4e0db69e535'

data/bitcoinrb.gemspec

@@ -20,14 +20,15 @@ Gem::Specification.new do |spec|
   spec.executables   = spec.files.grep(%r{^exe/}) { |f| File.basename(f) }
   spec.require_paths = ["lib"]
 
-  spec.add_runtime_dependency 'ecdsa_ext', '~> 0.5.1'
+  spec.add_runtime_dependency 'ecdsa_ext', '~> 0.6.0'
   spec.add_runtime_dependency 'murmurhash3', '~> 0.1.7'
-  spec.add_runtime_dependency 'bech32', '>= 1.5.0'
+  spec.add_runtime_dependency 'bech32', '>= 1.6.0'
   spec.add_runtime_dependency 'siphash'
-  spec.add_runtime_dependency 'bip-schnorr', '>= 0.7.0'
+  spec.add_runtime_dependency 'bip-schnorr', '>= 0.8.0'
   spec.add_runtime_dependency 'base32', '>= 0.3.4'
   spec.add_runtime_dependency 'base64', '~> 0.2.0'
-  spec.add_runtime_dependency 'secp256k1rb', '0.8.0'
+  spec.add_runtime_dependency 'bigdecimal'
+  spec.add_runtime_dependency 'secp256k1rb', '0.8.1'
   spec.add_runtime_dependency 'logger'
   spec.add_runtime_dependency 'merkle', '1.0.0'
   spec.add_runtime_dependency 'dnsruby', '1.73.0'

data/lib/bitcoin/bip321_uri.rb

@@ -1,5 +1,6 @@
 require 'uri'
 require 'cgi'
+require 'bigdecimal'
 
 module Bitcoin
   # BIP-321 URI
@@ -42,6 +43,7 @@ module Bitcoin
       if amount
         amount = BigDecimal(amount) if amount.is_a?(Integer)
         raise ArgumentError, "amount must be BigDecimal or integer." unless amount.is_a?(BigDecimal)
+        validate_amount!(amount)
         @amount = amount
       end
       raise ArgumentError, "label must be string." if label && !label.is_a?(String)
@@ -81,54 +83,105 @@ module Bitcoin
       end
 
       raise ArgumentError, "other_params must be Hash." unless other_params.is_a?(Hash)
-      other_params.keys.each do |key|
-        raise ArgumentError, 'An unsupported reqparam is included.' if key.start_with?('req-')
+      other_params.each do |key, value|
+        raise ArgumentError, 'other_params keys must be String.' unless key.is_a?(String)
+        raise ArgumentError, 'An unsupported reqparam is included.' if key.downcase.start_with?('req-')
+        # A key without a value is nil, and a key given more than once holds its values in an Array.
+        values = value.is_a?(Array) ? value : [value]
+        unless !values.empty? && values.all? { |v| v.nil? || v.is_a?(String) }
+          raise ArgumentError, "other_params['#{key}'] must be a String, nil or an Array of them."
+        end
       end
       @other_params = other_params
+
+      # BIP-321: the address may be left empty only if a query parameter carries a payment instruction.
+      # label, message, pop and amount describe a payment but are not one. A key this class does not know
+      # may be a payment instruction added after it, so it counts as one.
+      unless @addr || @query_addrs.any? || @lightning || @lno || @pay || @sp || @other_params.any?
+        raise ArgumentError, 'A URI without an address must have at least one payment instruction.'
+      end
     end
 
+    # The keys which hold one value. BIP-321 forbids a second label, message, pop or amount, and this
+    # class holds one value for the other payment instructions it knows.
+    SINGLE_VALUE_KEYS = %w[amount label message pop lightning lno pay sp].freeze
+    # The largest amount a URI may ask for, in BTC.
+    MAX_AMOUNT = BigDecimal(21_000_000)
+
     # Parse BIP-321 URI string.
+    # The scheme and the query keys are case-insensitive, values are percent-decoded as RFC 3986 says
+    # (a '+' stays a '+'), the amount has to match the grammar *digit ["." *digit], and a key which is not
+    # known here may appear more than once, in which case its values are collected in an Array.
     # @param [String] BIP-321 URI.
     # @return [Bitcoin::BIP321URI]
     # @raise [ArgumentError]
     def self.parse(uri)
       raise ArgumentError, "uri must be string." unless uri.is_a?(String)
       raise ArgumentError, "Invalid uri scheme." unless uri.downcase.start_with?('bitcoin:')
-      uri = uri[8..-1]
-      addr, params = uri.split('?', 2)
+      body, query = uri[8..-1].split('?', 2)
+      addr = body.nil? || body.empty? ? nil : body
+      params = {}
+      others = {}
       req_pop = false
       query_addrs = []
-      params = if params
-                 decoded = URI.decode_www_form(params)
-                 decoded = decoded.map do |k, v|
-                   if k == 'req-pop'
-                     req_pop = true
-                     k = 'pop'
-                   end
-                   if %w[bc tb bcrt].include?(k.downcase)
-                     raise ArgumentError, "#{k} not allowed in current network." unless Bitcoin.chain_params.bech32_hrp == k.downcase
-                     query_addrs << v
-                     nil
-                   else
-                     [k, v]
-                   end
-                 end.compact
-                 keys = decoded.map(&:first)
-                 duplicate_key = keys.detect { |key| keys.count(key) > 1 }
-                 raise ArgumentError, "#{duplicate_key} must not appear twice." if duplicate_key
-                 decoded.to_h.except('')
-               else
-                 {}
-               end
-      addr = nil if addr.empty?
-      amount = params['amount'] ? BigDecimal(params['amount']) : nil
-      excluded_keys = %w[amount label message pop lightning lno pay sp]
-      others = params.except(*excluded_keys)
+      (query ? query.split('&') : []).each do |pair|
+        next if pair.empty?
+        raw_key, raw_value = pair.split('=', 2)
+        key = percent_decode(raw_key).downcase
+        next if key.empty?
+        value = raw_value.nil? ? nil : percent_decode(raw_value)
+        if key == 'req-pop'
+          req_pop = true
+          key = 'pop'
+        end
+        if %w[bc tb bcrt].include?(key)
+          raise ArgumentError, "#{key} not allowed in current network." unless Bitcoin.chain_params.bech32_hrp == key
+          # The key names the human readable part of the address it carries.
+          raise ArgumentError, "#{key} must hold a bech32 address with the prefix #{key}." unless value.to_s.downcase.start_with?("#{key}1")
+          query_addrs << value
+        elsif SINGLE_VALUE_KEYS.include?(key)
+          raise ArgumentError, "#{key} must not appear twice." if params.key?(key)
+          params[key] = value
+        else
+          raise ArgumentError, 'An unsupported reqparam is included.' if key.start_with?('req-')
+          # BIP-321: a key this implementation does not know may appear more than once. The values are kept in
+          # order, and a key given without a value is kept as nil.
+          others[key] = if others.key?(key)
+                          values = others[key].is_a?(Array) ? others[key] : [others[key]]
+                          values + [value]
+                        else
+                          value
+                        end
+        end
+      end
+      amount = params['amount'] ? parse_amount(params['amount']) : nil
       BIP321URI.new(address: addr, amount: amount, label: params['label'], message: params['message'],
                     pop: params['pop'], lightning: params['lightning'], lno: params['lno'],
                     pay: params['pay'], sp: params['sp'], other_params: others, req_pop: req_pop, query_addrs: query_addrs)
     end
 
+    # Parse the value of an amount parameter.
+    # @param [String] str The value, which has to be *digit ["." *digit] with at most 8 decimal places.
+    # @return [BigDecimal]
+    # @raise [ArgumentError]
+    def self.parse_amount(str)
+      m = str.match(/\A([0-9]*)(?:\.([0-9]*))?\z/)
+      raise ArgumentError, "Invalid amount: #{str}" if m.nil? || (m[1].empty? && m[2].to_s.empty?)
+      raise ArgumentError, "Invalid amount: #{str}. An amount has at most 8 decimal places." if m[2].to_s.length > 8
+      amount = BigDecimal(str.end_with?('.') ? str + '0' : (str.start_with?('.') ? '0' + str : str))
+      raise ArgumentError, "Invalid amount: #{str}. It exceeds #{MAX_AMOUNT.to_i} BTC." if amount > MAX_AMOUNT
+      amount
+    end
+
+    # Percent-decode a URI component as RFC 3986 does. Unlike form decoding, a '+' is a literal '+'.
+    # @param [String] str
+    # @return [String]
+    def self.percent_decode(str)
+      URI.decode_www_form_component(str.gsub('+', '%2B'))
+    end
+
+    private_class_method :parse_amount, :percent_decode
+
     # Get all addresses contained in the URI body and query parameters
     # @return [Array] An array of address.
     def addresses
@@ -158,12 +211,22 @@ module Bitcoin
       base_params['pay'] = pay if pay
 
       all_params = base_params.merge other_params
-      params = all_params.map do |k, v|
-        "#{k}=#{CGI.escape(v).gsub('+', '%20')}"
+      params = all_params.flat_map do |k, values|
+        values = values.nil? ? [nil] : Array(values) # a key given without a value is written as the key alone
+        values.map { |v| v.nil? ? k : "#{k}=#{CGI.escape(v).gsub('+', '%20')}" }
       end
       params += query_addrs.map {|addr| "#{Bitcoin.chain_params.bech32_hrp}=#{addr}"}
       uri << "?#{params.join('&')}" unless params.empty?
       uri
     end
+
+    private
+
+    # @raise [ArgumentError] If +amount+ is negative, above MAX_AMOUNT or finer than a satoshi.
+    def validate_amount!(amount)
+      raise ArgumentError, 'amount must not be negative.' if amount.negative?
+      raise ArgumentError, "amount must not exceed #{MAX_AMOUNT.to_i} BTC." if amount > MAX_AMOUNT
+      raise ArgumentError, 'amount must not have more than 8 decimal places.' unless (amount * 100_000_000).frac.zero?
+    end
   end
 end

data/lib/bitcoin/bip324/ell_swift_pubkey.rb

@@ -26,7 +26,9 @@ module Bitcoin
           u = key[0...32].bth
           t = key[32..-1].bth
           x = BIP324.xswiftec(u, t)
-          Bitcoin::Key.new(pubkey: "03#{x}")
+            # The Y coordinate has the parity of t, as BIP-324 and libsecp256k1 decode it.
+          prefix = BIP324::FIELD.mod(t.hex).odd? ? '03' : '02'
+          Bitcoin::Key.new(pubkey: "#{prefix}#{x}", key_type: Bitcoin::Key::TYPES[:compressed])
         end
       end
 

data/lib/bitcoin/bip324/fs_chacha20.rb

@@ -121,6 +121,9 @@ module Bitcoin
         if (self.chunk_counter + 1) % rekey_interval == 0
           self.key = key_stream_bytes(32)
           self.block_counter = 0
+          # The rest of the current block belongs to the old key. The reference implementation starts the
+          # new key with a fresh keystream, and so does Bitcoin Core by seeking the cipher after SetKey.
+          self.key_stream = ''.b
         end
         self.chunk_counter += 1
         ret

data/lib/bitcoin/bip324.rb

@@ -99,7 +99,7 @@ module Bitcoin
     # @return [String] ElligatorSwift public key with hex format.
     def xelligatorswift(x)
       loop do
-        u = SecureRandom.random_number(1..ECDSA::Group::Secp256k1.order).to_s(16)
+        u = SecureRandom.random_number(1...FIELD_SIZE).to_s(16) # a non-zero field element
         c = SecureRandom.random_number(CASE_COUNT)
         t = xswiftec_inv(x, u, c)
         unless t.nil?

data/lib/bitcoin/bip85_entropy.rb

@@ -18,23 +18,40 @@ module Bitcoin
       self.new(key)
     end
 
+    # The alphabet of the Base85 encoding BIP-85 uses, which is the one of RFC 1924 and Python's base64.b85encode.
+    BASE85_ALPHABET = '0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz!#$%&()*+-;<=>?@^_`{|}~'.freeze
+
     # derive entropy
-    # @param [String] path derive path.
+    # The applications of BIP-85 are understood: BIP39 (39'), HD-Seed WIF (2'), XPRV (32'), HEX (128169'),
+    # PWD BASE64 (707764') and PWD BASE85 (707785'). For any other application the 64 byte entropy is returned
+    # as it is.
+    # @param [String] path derive path. Every index has to be hardened.
     # @return [Tuple(String, Object)] a tuple of entropy with hex format and results depending the application.
+    # @raise [ArgumentError] If +path+ is not a BIP-85 path, or a parameter of the application is out of range.
     def derive(path)
       raise ArgumentError, "Invalid BIP85 path format." unless path.start_with?("m/83696968'")
+      numbers = parse_key_path(path)
+      raise ArgumentError, 'Every index of a BIP85 path must be hardened.' unless numbers.all? { |n| n >= HARDENED_THRESHOLD }
       derived_key = root_key
-      parse_key_path(path).each{|num| derived_key = derived_key.derive(num)}
+      numbers.each{|num| derived_key = derived_key.derive(num)}
       derived_key = derived_key.priv
       entropy = Bitcoin.hmac_sha512("bip-entropy-from-k", derived_key.htb).bth
-      app_no = path.split('/')[2]
+      app_no, *params = numbers[1..-1].map { |n| n - HARDENED_THRESHOLD }
       case app_no
-      when "39'"
-        bip39_entropy(path, entropy)
-      when "2'"
+      when 39
+        bip39_entropy(params, entropy)
+      when 2
+        validate_params!(params, 1)
         hd_seed_entropy(entropy)
-      when "32'"
+      when 32
+        validate_params!(params, 1)
         xprv_entropy(entropy)
+      when 128169
+        hex_entropy(params, entropy)
+      when 707764
+        pwd_base64_entropy(params, entropy)
+      when 707785
+        pwd_base85_entropy(params, entropy)
       else
         [entropy, entropy]
       end
@@ -46,21 +63,21 @@ module Bitcoin
       @root_key = root_key
     end
 
+    # Check that the application has +count+ parameters after its number, the last one being the index.
+    def validate_params!(params, count)
+      raise ArgumentError, "Invalid BIP85 path format." unless params.size == count
+    end
+
     # derive BIP39 entropy.
-    def bip39_entropy(path, entropy)
-      params = path.split('/')
-      word_len = params[4]
-      language = code_to_language(params[3])
-      entropy = case word_len
-                when "12'"
-                  entropy[0...32]
-                when "18'"
-                  entropy[0...48]
-                when "24'"
-                  entropy[0...64]
-                else
-                  raise ArgumentError, "Word length #{word_len} does not supported."
-                end
+    # @param [Array[Integer]] params language, word count and index.
+    def bip39_entropy(params, entropy)
+      validate_params!(params, 3)
+      language = code_to_language(params[0])
+      words = params[1]
+      unless Bitcoin::Mnemonic::WORD_COUNTS.include?(words)
+        raise ArgumentError, "Word length #{words}' does not supported."
+      end
+      entropy = entropy[0...(words / 3 * 8)] # 12 words use 128 bits, and every 3 words add 32 bits.
       mnemonic = Bitcoin::Mnemonic.new(language)
       [entropy, mnemonic.to_mnemonic(entropy)]
     end
@@ -84,25 +101,58 @@ module Bitcoin
       [entropy, ext_key.to_base58]
     end
 
+    # derive HEX entropy: the first num_bytes bytes, 16 <= num_bytes <= 64.
+    # @param [Array[Integer]] params num_bytes and index.
+    def hex_entropy(params, entropy)
+      validate_params!(params, 2)
+      num_bytes = params[0]
+      raise ArgumentError, "num_bytes #{num_bytes}' must be between 16 and 64." unless num_bytes.between?(16, 64)
+      result = entropy[0...(num_bytes * 2)]
+      [result, result]
+    end
+
+    # derive PWD BASE64: the first pwd_len characters of the Base64 encoding of the entropy, 20 <= pwd_len <= 86.
+    # @param [Array[Integer]] params pwd_len and index.
+    def pwd_base64_entropy(params, entropy)
+      validate_params!(params, 2)
+      pwd_len = params[0]
+      raise ArgumentError, "pwd_len #{pwd_len}' must be between 20 and 86." unless pwd_len.between?(20, 86)
+      [entropy, Base64.strict_encode64(entropy.htb)[0, pwd_len]]
+    end
+
+    # derive PWD BASE85: the first pwd_len characters of the Base85 encoding of the entropy, 10 <= pwd_len <= 80.
+    # @param [Array[Integer]] params pwd_len and index.
+    def pwd_base85_entropy(params, entropy)
+      validate_params!(params, 2)
+      pwd_len = params[0]
+      raise ArgumentError, "pwd_len #{pwd_len}' must be between 10 and 80." unless pwd_len.between?(10, 80)
+      [entropy, base85(entropy.htb)[0, pwd_len]]
+    end
+
+    # Base85 encode +data+, whose size is a multiple of 4 bytes, as Python's base64.b85encode does.
+    def base85(data)
+      data.unpack('N*').flat_map { |word| 5.times.map { |i| BASE85_ALPHABET[(word / 85**(4 - i)) % 85] } }.join
+    end
+
     # convert language code to language string.
     def code_to_language(code)
       case code
-      when "0'"
+      when 0
         "english"
-      when "1'"
+      when 1
         "japanese"
-      when "3'"
+      when 3
         "spanish"
-      when "4'"
+      when 4
         "chinese_simplified"
-      when "5'"
+      when 5
         "chinese_traditional"
-      when "6'"
+      when 6
         "french"
-      when "7'"
+      when 7
         "italian"
       else
-        raise ArgumentError, "bitcoinrb does not support language: #{code}"
+        raise ArgumentError, "bitcoinrb does not support language: #{code}'"
       end
     end
 

data/lib/bitcoin/bit_stream.rb

@@ -15,7 +15,7 @@ module Bitcoin
     end
 
     def write(data, nbits)
-      raise "nbits must be between 0 and 64" if nbits < 0 || nbits > 64
+      raise ArgumentError, 'nbits must be between 0 and 64' if nbits < 0 || nbits > 64
       while nbits > 0
         bits = [8 - offset, nbits].min
         tmp = (data << (64 - nbits)) & 0b1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111_1111
@@ -49,7 +49,7 @@ module Bitcoin
 
     # offset
     def read(nbits)
-      raise 'nbits must be between 0 and 64' if nbits < 0 || nbits > 64
+      raise ArgumentError, 'nbits must be between 0 and 64' if nbits < 0 || nbits > 64
       data = 0
       while nbits > 0
         if offset == 8

data/lib/bitcoin/block.rb

@@ -66,26 +66,62 @@ module Bitcoin
     end
 
     # check the merkle root in the block header matches merkle root calculated from tx list.
+    # A tx list with the duplication of CVE-2012-2459 is reported as invalid even though its root
+    # matches, as Bitcoin Core does, since the same root also belongs to the list without the duplicate.
+    # A block without any tx has no merkle root, and is not valid (bad-blk-length in Bitcoin Core).
     def valid_merkle_root?
-      calculate_merkle_root == header.merkle_root
+      return false if transactions.empty?
+      !merkle_root_mutated? && calculate_merkle_root == header.merkle_root
+    end
+
+    # Whether the tx list is a mutation of another list with the same merkle root (CVE-2012-2459).
+    # Duplicating the last tx of a level with an odd count leaves the root unchanged, and it shows up as
+    # two identical hashes next to each other at some level of the tree. The last hash of an odd level is
+    # paired with itself by construction and is not a mutation. See ComputeMerkleRoot in Bitcoin Core.
+    # @return [Boolean]
+    def merkle_root_mutated?
+      hashes = transactions.map(&:tx_hash)
+      while hashes.size > 1
+        hashes.each_slice(2) { |left, right| return true if right && left == right }
+        hashes << hashes.last if hashes.size.odd?
+        hashes = hashes.each_slice(2).map { |left, right| Bitcoin.double_sha256([left + right].pack('H*')).bth }
+      end
+      false
     end
 
     # calculate merkle root from tx list.
+    # @raise [ArgumentError] If the block has no tx.
     def calculate_merkle_root
+      raise ArgumentError, 'A block without any tx has no merkle root.' if transactions.empty?
       tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin(element_encoding: :hex), leaves: transactions.map(&:tx_hash))
       tree.compute_root
     end
 
     # check the witness commitment in coinbase tx matches witness commitment calculated from tx list.
+    # As in Bitcoin Core, the commitment is the last output of the coinbase which looks like one, and the
+    # witness of the coinbase input has to be exactly one item of 32 bytes, the witness reserved value.
+    # A block without a commitment output is not valid here.
     def valid_witness_commitment?
-      transactions[0].witness_commitment == calculate_witness_commitment
+      return false if transactions.empty?
+      commitment = transactions[0].witness_commitment
+      return false if commitment.nil? || !valid_witness_reserved_value?
+      commitment == calculate_witness_commitment
+    end
+
+    # Whether the witness of the coinbase input is one item of 32 bytes, see valid_witness_commitment?.
+    # @return [Boolean]
+    def valid_witness_reserved_value?
+      stack = transactions[0]&.inputs&.first&.script_witness&.stack
+      !stack.nil? && stack.size == 1 && stack[0].bytesize == 32
     end
 
     # calculate witness commitment from tx list.
+    # @raise [ArgumentError] If the coinbase input does not carry the witness reserved value.
     def calculate_witness_commitment
+      raise ArgumentError, 'The witness reserved value is missing.' unless valid_witness_reserved_value?
       witness_hashes = [COINBASE_WTXID]
       witness_hashes += (transactions[1..-1].map(&:witness_hash))
-      reserved_value = transactions[0].inputs[0].script_witness.stack.map(&:bth).join
+      reserved_value = transactions[0].inputs[0].script_witness.stack[0].bth
       tree = Merkle::BinaryTree.new(config: Merkle::Config.bitcoin(element_encoding: :hex), leaves: witness_hashes)
       root_hash = tree.compute_root
       Bitcoin.double_sha256([root_hash + reserved_value].pack('H*')).bth
@@ -96,10 +132,13 @@ module Bitcoin
     def height
       return nil if header.version < 2
       coinbase_tx = transactions[0]
-      return nil unless coinbase_tx.coinbase_tx?
-      buf = StringIO.new(coinbase_tx.inputs[0].script_sig.to_payload)
-      len = Bitcoin.unpack_var_int_from_io(buf)
-      buf.read(len).reverse.bth.to_i(16)
+      return nil unless coinbase_tx&.coinbase_tx?
+      # BIP-34: the height is the first push of the coinbase scriptSig, as a script number. A height from
+      # 1 to 16 is pushed with OP_1 to OP_16, which is not a data push.
+      chunk = coinbase_tx.inputs[0].script_sig.chunks.first
+      return nil if chunk.nil?
+      return Bitcoin::Script.decode_number(chunk.pushed_data.bth) if chunk.pushdata?
+      Bitcoin::Opcodes.opcode_to_small_int(chunk.opcode)
     end
 
   end

data/lib/bitcoin/block_filter.rb

@@ -45,15 +45,16 @@ module Bitcoin
 
     # Decode Block Filter from encoded filter
     # @param [Integer] filter_type filter type.
-    # @param [String] block_hash block hash with hex format. not little endian.
+    # @param [String] block_hash block hash with hex format, in the byte order Bitcoin::Block#block_hash returns it.
     # @param [String] encoded encoded_filter with hex format.
     # @return [Bitcoin::BlockFilter] block filter object.
+    # @raise [ArgumentError] If +encoded+ is not a well formed filter, see Bitcoin::GCSFilter.
     def self.decode(filter_type, block_hash, encoded)
       filter = case filter_type
                when TYPE[:basic]
                 GCSFilter.new(block_hash.htb[0...16], BASIC_FILTER_P, BASIC_FILTER_M, encoded_filter: encoded)
               else
-                raise "unknown filter type: #{filter_type}."
+                raise ArgumentError, "unknown filter type: #{filter_type}."
                end
       BlockFilter.new(filter_type, filter, block_hash)
     end

data/lib/bitcoin/block_header.rb

@@ -26,7 +26,7 @@ module Bitcoin
     # @return [Bitcoin::BlockHeader]
     def self.parse_from_payload(payload)
       buf = payload.is_a?(String) ? StringIO.new(payload) : payload
-      version, prev_hash, merkle_root, time, bits, nonce = buf.read(80).unpack('Va32a32VVV')
+      version, prev_hash, merkle_root, time, bits, nonce = Bitcoin.read_exact(buf, 80).unpack('Va32a32VVV')
       new(version, prev_hash.bth, merkle_root.bth, time, bits, nonce)
     end
 
@@ -34,12 +34,30 @@ module Bitcoin
       [version, prev_hash.htb, merkle_root.htb, time, bits, nonce].pack('Va32a32VVV')
     end
 
+    # Decode a compact target the way Bitcoin Core's arith_uint256::SetCompact does.
+    # @param [Integer] compact The 32 bit compact encoding, such as the bits of a block header.
+    # @return [Integer] The target. It is negative when the sign bit is set, and it may not fit in
+    # 256 bits, see .compact_overflow?.
+    def self.decode_compact(compact)
+      exponent = (compact >> 24) & 0xff
+      mantissa = compact & 0x7fffff
+      target = exponent <= 3 ? mantissa >> (8 * (3 - exponent)) : mantissa << (8 * (exponent - 3))
+      (compact & 0x800000).zero? ? target : -target
+    end
+
+    # Whether the target of +compact+ does not fit in 256 bits, as Bitcoin Core's SetCompact reports it.
+    # @param [Integer] compact The 32 bit compact encoding.
+    # @return [Boolean]
+    def self.compact_overflow?(compact)
+      exponent = (compact >> 24) & 0xff
+      mantissa = compact & 0x7fffff
+      mantissa != 0 && (exponent > 34 || (mantissa > 0xff && exponent > 33) || (mantissa > 0xffff && exponent > 32))
+    end
+
     # compute difficulty target from bits.
+    # @return [Integer] see .decode_compact.
     def difficulty_target
-      exponent = ((bits >> 24) & 0xff)
-      mantissa = bits & 0x7fffff
-      mantissa *= -1 if (bits & 0x800000) > 0
-      (mantissa * 2 ** (8 * (exponent - 3)))
+      BlockHeader.decode_compact(bits)
     end
 
     def hash
@@ -60,9 +78,14 @@ module Bitcoin
       valid_pow? && valid_timestamp?
     end
 
-    # evaluate valid proof of work.
+    # evaluate valid proof of work, as Bitcoin Core's CheckProofOfWork does: the target has to be positive,
+    # fit in 256 bits and be no easier than the proof of work limit of the current chain, and the block
+    # hash has to be no greater than the target.
     def valid_pow?
-      block_id.hex < difficulty_target
+      target = difficulty_target
+      return false if target <= 0 || BlockHeader.compact_overflow?(bits)
+      return false if target > BlockHeader.decode_compact(Bitcoin.chain_params.proof_of_work_limit)
+      block_id.hex <= target
     end
 
     # evaluate valid timestamp.
@@ -75,7 +98,7 @@ module Bitcoin
     # @return [Integer] a chain work.
     def work
       target = difficulty_target
-      return 0 if target < 1
+      return 0 if target < 1 || BlockHeader.compact_overflow?(bits)
       115792089237316195423570985008687907853269984665640564039457584007913129639936.div(target + 1) # 115792089237316195423570985008687907853269984665640564039457584007913129639936 is 2**256
     end
 

data/lib/bitcoin/bloom_filter.rb

@@ -19,12 +19,15 @@ module Bitcoin
     # @param [Integer] elements_length the number of elements
     # @param [Float] fp_rate the false positive rate chosen by the client
     # @param [Integer] tweak A random value to add to the seed value in the hash function used by the bloom filter
+    # @raise [ArgumentError] If +elements_length+ is not a positive integer.
     def self.create_filter(elements_length, fp_rate, tweak = 0)
+      raise ArgumentError, 'elements_length must be a positive integer.' unless elements_length.is_a?(Integer) && elements_length > 0
       # The size S of the filter in bytes is given by (-1 / pow(log(2), 2) * N * log(P)) / 8
       len = [[(-elements_length * Math.log(fp_rate) / (LN2_SQUARED * 8)).to_i, MAX_BLOOM_FILTER_SIZE].min, 1].max
       filter = Array.new(len, 0)
-      # The number of hash functions required is given by S * 8 / N * log(2)
-      hash_funcs = [[(filter.size * 8 * LN2 / elements_length).to_i, MAX_HASH_FUNCS].min, 1].max
+      # The number of hash functions required is given by S * 8 / N * log(2).
+      # S * 8 / N is an integer division, as in Bitcoin Core's CBloomFilter, so the same parameters make the same filter.
+      hash_funcs = [[(filter.size * 8 / elements_length * LN2).to_i, MAX_HASH_FUNCS].min, 1].max
       BloomFilter.new(filter, hash_funcs, tweak)
     end
 

data/lib/bitcoin/chainparams/regtest.yml

@@ -34,4 +34,3 @@ genesis:
   version: 1
   prev_hash: "0000000000000000000000000000000000000000000000000000000000000000"
 bip44_coin_type: 1
-dust_relay_fee: 3600

data/lib/bitcoin/chainparams/signet.yml

@@ -23,7 +23,7 @@ retarget_time: 1209600 # 2 weeks
 target_spacing: 600 # block interval
 max_money: 21000000
 bip34_height: 1
-proof_of_work_limit: 0x1d00ffff
+proof_of_work_limit: 0x1e0377ae
 dns_seeds:
   - "seed.signet.bitcoin.sprovoost.nl"
   - "seed.signet.achownodes.xyz"