@keep-network/tbtc-v2 0.1.1-dev.15 → 0.1.1-dev.16

package/artifacts/solcInputs/{a76c1776cec417d8640e42239e23ea4b.json → 3d68045732e072924745a5b701f4ad2a.json}

@@ -2,7 +2,7 @@
   "language": "Solidity",
   "sources": {
     "contracts/bank/Bank.sol": {
-      "content": "// SPDX-License-Identifier: MIT\n\n// ██████████████     ▐████▌     ██████████████\n// ██████████████     ▐████▌     ██████████████\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n// ██████████████     ▐████▌     ██████████████\n// ██████████████     ▐████▌     ██████████████\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n\npragma solidity ^0.8.9;\n\nimport \"@openzeppelin/contracts/access/Ownable.sol\";\n\nimport \"../vault/IVault.sol\";\n\n/// @title Bitcoin Bank\n/// @notice Bank is a central component tracking Bitcoin balances. Balances can\n///         be transferred between holders and holders can approve their\n///         balances to be spent by others. Balances in the Bank are updated for\n///         depositors who deposit their Bitcoin into the Bridge and only the\n///         Bridge can increase balances.\n/// @dev Bank is a governable contract and the Governance can upgrade the Bridge\n///      address.\ncontract Bank is Ownable {\n    address public bridge;\n\n    /// @notice The balance of a given account in the Bank. Zero by default.\n    mapping(address => uint256) public balanceOf;\n\n    /// @notice The remaining amount of balance a spender will be\n    ///         allowed to transfer on behalf of an owner using\n    ///         `transferBalanceFrom`. Zero by default.\n    mapping(address => mapping(address => uint256)) public allowance;\n\n    /// @notice Returns the current nonce for EIP2612 permission for the\n    ///         provided balance owner for a replay protection. Used to\n    ///         construct EIP2612 signature provided to `permit` function.\n    mapping(address => uint256) public nonce;\n\n    uint256 public immutable cachedChainId;\n    bytes32 public immutable cachedDomainSeparator;\n\n    /// @notice Returns EIP2612 Permit message hash. Used to construct EIP2612\n    ///         signature provided to `permit` function.\n    bytes32 public constant PERMIT_TYPEHASH =\n        keccak256(\n            \"Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)\"\n        );\n\n    event BalanceTransferred(\n        address indexed from,\n        address indexed to,\n        uint256 amount\n    );\n\n    event BalanceApproved(\n        address indexed owner,\n        address indexed spender,\n        uint256 amount\n    );\n\n    event BalanceIncreased(address indexed owner, uint256 amount);\n\n    event BalanceDecreased(address indexed owner, uint256 amount);\n\n    event BridgeUpdated(address newBridge);\n\n    modifier onlyBridge() {\n        require(msg.sender == address(bridge), \"Caller is not the bridge\");\n        _;\n    }\n\n    constructor() {\n        cachedChainId = block.chainid;\n        cachedDomainSeparator = buildDomainSeparator();\n    }\n\n    /// @notice Allows the Governance to upgrade the Bridge address.\n    /// @dev The function does not implement any governance delay and does not\n    ///      check the status of the Bridge. The Governance implementation needs\n    ///      to ensure all requirements for the upgrade are satisfied before\n    ///      executing this function.\n    function updateBridge(address _bridge) external onlyOwner {\n        require(_bridge != address(0), \"Bridge address must not be 0x0\");\n        bridge = _bridge;\n        emit BridgeUpdated(_bridge);\n    }\n\n    /// @notice Moves the given `amount` of balance from the caller to\n    ///         `recipient`.\n    /// @dev Requirements:\n    ///       - `recipient` cannot be the zero address,\n    ///       - the caller must have a balance of at least `amount`.\n    function transferBalance(address recipient, uint256 amount) external {\n        _transferBalance(msg.sender, recipient, amount);\n    }\n\n    /// @notice Sets `amount` as the allowance of `spender` over the caller's\n    ///         balance.\n    /// @dev If the `amount` is set to `type(uint256).max` then\n    ///      `transferBalanceFrom` will not reduce an allowance.\n    ///      Beware that changing an allowance with this function brings the\n    ///      risk that someone may use both the old and the new allowance by\n    ///      unfortunate transaction ordering. Please use\n    ///      `increaseBalanceAllowance` and `decreaseBalanceAllowance` to\n    ///      eliminate the risk.\n    function approveBalance(address spender, uint256 amount) external {\n        _approveBalance(msg.sender, spender, amount);\n    }\n\n    /// @notice Sets `amount` as the allowance of a smart contract `vault` over\n    ///         the caller's balance and calls the vault via\n    ///         `receiveBalanceApproval`.\n    /// @dev If the `amount` is set to `type(uint256).max` then the logic in\n    ///     `receiveBalanceApproval` or later call to `transferBalanceFrom` by\n    ///      the vault will not reduce an allowance. Beware that changing an\n    ///      allowance with this function brings the risk that vault may use\n    ///      both the old and the new allowance by unfortunate transaction\n    ///      ordering. Please use `increaseBalanceAllowance` and\n    ///      `decreaseBalanceAllowance` to eliminate the risk.\n    function approveBalanceAndCall(address vault, uint256 amount) external {\n        _approveBalance(msg.sender, vault, amount);\n        IVault(vault).receiveBalanceApproval(msg.sender, amount);\n    }\n\n    /// @notice Atomically increases the balance allowance granted to `spender`\n    ///         by the caller by the given `addedValue`.\n    function increaseBalanceAllowance(address spender, uint256 addedValue)\n        external\n    {\n        _approveBalance(\n            msg.sender,\n            spender,\n            allowance[msg.sender][spender] + addedValue\n        );\n    }\n\n    /// @notice Atomically decreases the balance allowance granted to `spender`\n    ///         by the caller by the given `subtractedValue`.\n    function decreaseBalanceAllowance(address spender, uint256 subtractedValue)\n        external\n    {\n        uint256 currentAllowance = allowance[msg.sender][spender];\n        require(\n            currentAllowance >= subtractedValue,\n            \"Can not decrease balance allowance below zero\"\n        );\n        unchecked {\n            _approveBalance(\n                msg.sender,\n                spender,\n                currentAllowance - subtractedValue\n            );\n        }\n    }\n\n    /// @notice Moves `amount` of balance from `spender` to `recipient` using the\n    ///         allowance mechanism. `amount` is then deducted from the caller's\n    ///         allowance unless the allowance was made for `type(uint256).max`.\n    /// @dev Requirements:\n    ///      - `recipient` cannot be the zero address,\n    ///      - `spender` must have a balance of at least `amount`,\n    ///      - the caller must have allowance for `spender`'s balance of at\n    ///        least `amount`.\n    function transferBalanceFrom(\n        address spender,\n        address recipient,\n        uint256 amount\n    ) external {\n        uint256 currentAllowance = allowance[spender][msg.sender];\n        if (currentAllowance != type(uint256).max) {\n            require(\n                currentAllowance >= amount,\n                \"Transfer amount exceeds allowance\"\n            );\n            unchecked {\n                _approveBalance(spender, msg.sender, currentAllowance - amount);\n            }\n        }\n        _transferBalance(spender, recipient, amount);\n    }\n\n    /// @notice EIP2612 approval made with secp256k1 signature.\n    ///         Users can authorize a transfer of their balance with a signature\n    ///         conforming EIP712 standard, rather than an on-chain transaction\n    ///         from their address. Anyone can submit this signature on the\n    ///         user's behalf by calling the permit function, paying gas fees,\n    ///         and possibly performing other actions in the same transaction.\n    /// @dev The deadline argument can be set to `type(uint256).max to create\n    ///      permits that effectively never expire.  If the `amount` is set\n    ///      to `type(uint256).max` then `transferBalanceFrom` will not\n    ///      reduce an allowance. Beware that changing an allowance with this\n    ///      function brings the risk that someone may use both the old and the\n    ///      new allowance by unfortunate transaction ordering. Please use\n    ///      `increaseBalanceAllowance` and `decreaseBalanceAllowance` to\n    ///      eliminate the risk.\n    function permit(\n        address owner,\n        address spender,\n        uint256 amount,\n        uint256 deadline,\n        uint8 v,\n        bytes32 r,\n        bytes32 s\n    ) external {\n        /* solhint-disable-next-line not-rely-on-time */\n        require(deadline >= block.timestamp, \"Permission expired\");\n\n        // Validate `s` and `v` values for a malleability concern described in EIP2.\n        // Only signatures with `s` value in the lower half of the secp256k1\n        // curve's order and `v` value of 27 or 28 are considered valid.\n        require(\n            uint256(s) <=\n                0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0,\n            \"Invalid signature 's' value\"\n        );\n        require(v == 27 || v == 28, \"Invalid signature 'v' value\");\n\n        bytes32 digest =\n            keccak256(\n                abi.encodePacked(\n                    \"\\x19\\x01\",\n                    DOMAIN_SEPARATOR(),\n                    keccak256(\n                        abi.encode(\n                            PERMIT_TYPEHASH,\n                            owner,\n                            spender,\n                            amount,\n                            nonce[owner]++,\n                            deadline\n                        )\n                    )\n                )\n            );\n        address recoveredAddress = ecrecover(digest, v, r, s);\n        require(\n            recoveredAddress != address(0) && recoveredAddress == owner,\n            \"Invalid signature\"\n        );\n        _approveBalance(owner, spender, amount);\n    }\n\n    /// @notice Increases balances of the provided `recipients` by the provided\n    ///         `amounts`. Can only be called by the Bridge.\n    /// @dev Requirements:\n    ///       - length of `recipients` and `amounts` must be the same.\n    function increaseBalances(\n        address[] calldata recipients,\n        uint256[] calldata amounts\n    ) external onlyBridge {\n        require(\n            recipients.length == amounts.length,\n            \"Arrays must have the same length\"\n        );\n        for (uint256 i = 0; i < recipients.length; i++) {\n            _increaseBalance(recipients[i], amounts[i]);\n        }\n    }\n\n    /// @notice Increases balance of the provided `recipient` by the provided\n    ///         `amount`. Can only be called by the Bridge.\n    function increaseBalance(address recipient, uint256 amount)\n        external\n        onlyBridge\n    {\n        _increaseBalance(recipient, amount);\n    }\n\n    /// @notice Increases the given smart contract `vault`'s balance and\n    ///         notifies the `vault` contract. Called by the Bridge after\n    ///         the deposits routed by depositors to that `vault` have been\n    ///         swept by the Bridge. This way, the depositor does not have to\n    ///         issue a separate  transaction to the `vault` contract.\n    ///         Can be called only by the Bridge.\n    /// @dev Requirements:\n    ///       - `vault` must implement `IVault` interface,\n    ///       - length of `depositors` and `depositedAmounts` must be the same.\n    /// @param vault Address of `IVault` recipient contract\n    /// @param depositors Addresses of depositors whose deposits have been swept\n    /// @param depositedAmounts Amounts deposited by individual depositors and\n    ///        swept. The `vault`'s balance in the Bank will be increased by the\n    ///        sum of all elements in this array.\n    function increaseBalanceAndCall(\n        address vault,\n        address[] calldata depositors,\n        uint256[] calldata depositedAmounts\n    ) external onlyBridge {\n        require(\n            depositors.length == depositedAmounts.length,\n            \"Arrays must have the same length\"\n        );\n        uint256 totalAmount = 0;\n        for (uint256 i = 0; i < depositedAmounts.length; i++) {\n            totalAmount += depositedAmounts[i];\n        }\n        _increaseBalance(vault, totalAmount);\n        IVault(vault).receiveBalanceIncrease(depositors, depositedAmounts);\n    }\n\n    /// @notice Decreases caller's balance by the provided `amount`. There is no\n    ///         way to restore the balance so do not call this function unless\n    ///         you really know what you are doing!\n    function decreaseBalance(uint256 amount) external {\n        balanceOf[msg.sender] -= amount;\n        emit BalanceDecreased(msg.sender, amount);\n    }\n\n    /// @notice Returns hash of EIP712 Domain struct with `TBTC Bank` as\n    ///         a signing domain and Bank contract as a verifying contract.\n    ///         Used to construct EIP2612 signature provided to `permit`\n    ///         function.\n    /* solhint-disable-next-line func-name-mixedcase */\n    function DOMAIN_SEPARATOR() public view returns (bytes32) {\n        // As explained in EIP-2612, if the DOMAIN_SEPARATOR contains the\n        // chainId and is defined at contract deployment instead of\n        // reconstructed for every signature, there is a risk of possible replay\n        // attacks between chains in the event of a future chain split.\n        // To address this issue, we check the cached chain ID against the\n        // current one and in case they are different, we build domain separator\n        // from scratch.\n        if (block.chainid == cachedChainId) {\n            return cachedDomainSeparator;\n        } else {\n            return buildDomainSeparator();\n        }\n    }\n\n    function _increaseBalance(address recipient, uint256 amount) internal {\n        require(\n            recipient != address(this),\n            \"Can not increase balance for Bank\"\n        );\n        balanceOf[recipient] += amount;\n        emit BalanceIncreased(recipient, amount);\n    }\n\n    function _transferBalance(\n        address spender,\n        address recipient,\n        uint256 amount\n    ) private {\n        require(\n            recipient != address(0),\n            \"Can not transfer to the zero address\"\n        );\n        require(\n            recipient != address(this),\n            \"Can not transfer to the Bank address\"\n        );\n\n        uint256 spenderBalance = balanceOf[spender];\n        require(spenderBalance >= amount, \"Transfer amount exceeds balance\");\n        unchecked {balanceOf[spender] = spenderBalance - amount;}\n        balanceOf[recipient] += amount;\n        emit BalanceTransferred(spender, recipient, amount);\n    }\n\n    function _approveBalance(\n        address owner,\n        address spender,\n        uint256 amount\n    ) private {\n        require(spender != address(0), \"Can not approve to the zero address\");\n        allowance[owner][spender] = amount;\n        emit BalanceApproved(owner, spender, amount);\n    }\n\n    function buildDomainSeparator() private view returns (bytes32) {\n        return\n            keccak256(\n                abi.encode(\n                    keccak256(\n                        \"EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)\"\n                    ),\n                    keccak256(bytes(\"TBTC Bank\")),\n                    keccak256(bytes(\"1\")),\n                    block.chainid,\n                    address(this)\n                )\n            );\n    }\n}\n"
+      "content": "// SPDX-License-Identifier: MIT\n\n// ██████████████     ▐████▌     ██████████████\n// ██████████████     ▐████▌     ██████████████\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n// ██████████████     ▐████▌     ██████████████\n// ██████████████     ▐████▌     ██████████████\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n\npragma solidity ^0.8.9;\n\nimport \"@openzeppelin/contracts/access/Ownable.sol\";\n\nimport \"../vault/IVault.sol\";\n\n/// @title Bitcoin Bank\n/// @notice Bank is a central component tracking Bitcoin balances. Balances can\n///         be transferred between holders and holders can approve their\n///         balances to be spent by others. Balances in the Bank are updated for\n///         depositors who deposit their Bitcoin into the Bridge and only the\n///         Bridge can increase balances.\n/// @dev Bank is a governable contract and the Governance can upgrade the Bridge\n///      address.\ncontract Bank is Ownable {\n    address public bridge;\n\n    /// @notice The balance of a given account in the Bank. Zero by default.\n    mapping(address => uint256) public balanceOf;\n\n    /// @notice The remaining amount of balance a spender will be\n    ///         allowed to transfer on behalf of an owner using\n    ///         `transferBalanceFrom`. Zero by default.\n    mapping(address => mapping(address => uint256)) public allowance;\n\n    /// @notice Returns the current nonce for EIP2612 permission for the\n    ///         provided balance owner for a replay protection. Used to\n    ///         construct EIP2612 signature provided to `permit` function.\n    mapping(address => uint256) public nonce;\n\n    uint256 public immutable cachedChainId;\n    bytes32 public immutable cachedDomainSeparator;\n\n    /// @notice Returns EIP2612 Permit message hash. Used to construct EIP2612\n    ///         signature provided to `permit` function.\n    bytes32 public constant PERMIT_TYPEHASH =\n        keccak256(\n            \"Permit(address owner,address spender,uint256 value,uint256 nonce,uint256 deadline)\"\n        );\n\n    event BalanceTransferred(\n        address indexed from,\n        address indexed to,\n        uint256 amount\n    );\n\n    event BalanceApproved(\n        address indexed owner,\n        address indexed spender,\n        uint256 amount\n    );\n\n    event BalanceIncreased(address indexed owner, uint256 amount);\n\n    event BalanceDecreased(address indexed owner, uint256 amount);\n\n    event BridgeUpdated(address newBridge);\n\n    modifier onlyBridge() {\n        require(msg.sender == address(bridge), \"Caller is not the bridge\");\n        _;\n    }\n\n    constructor() {\n        cachedChainId = block.chainid;\n        cachedDomainSeparator = buildDomainSeparator();\n    }\n\n    /// @notice Allows the Governance to upgrade the Bridge address.\n    /// @dev The function does not implement any governance delay and does not\n    ///      check the status of the Bridge. The Governance implementation needs\n    ///      to ensure all requirements for the upgrade are satisfied before\n    ///      executing this function.\n    function updateBridge(address _bridge) external onlyOwner {\n        require(_bridge != address(0), \"Bridge address must not be 0x0\");\n        bridge = _bridge;\n        emit BridgeUpdated(_bridge);\n    }\n\n    /// @notice Moves the given `amount` of balance from the caller to\n    ///         `recipient`.\n    /// @dev Requirements:\n    ///       - `recipient` cannot be the zero address,\n    ///       - the caller must have a balance of at least `amount`.\n    function transferBalance(address recipient, uint256 amount) external {\n        _transferBalance(msg.sender, recipient, amount);\n    }\n\n    /// @notice Sets `amount` as the allowance of `spender` over the caller's\n    ///         balance.\n    /// @dev If the `amount` is set to `type(uint256).max` then\n    ///      `transferBalanceFrom` will not reduce an allowance.\n    ///      Beware that changing an allowance with this function brings the\n    ///      risk that someone may use both the old and the new allowance by\n    ///      unfortunate transaction ordering. Please use\n    ///      `increaseBalanceAllowance` and `decreaseBalanceAllowance` to\n    ///      eliminate the risk.\n    function approveBalance(address spender, uint256 amount) external {\n        _approveBalance(msg.sender, spender, amount);\n    }\n\n    /// @notice Sets `amount` as the allowance of a smart contract `vault` over\n    ///         the caller's balance and calls the vault via\n    ///         `receiveBalanceApproval`.\n    /// @dev If the `amount` is set to `type(uint256).max` then the logic in\n    ///     `receiveBalanceApproval` or later call to `transferBalanceFrom` by\n    ///      the vault will not reduce an allowance. Beware that changing an\n    ///      allowance with this function brings the risk that vault may use\n    ///      both the old and the new allowance by unfortunate transaction\n    ///      ordering. Please use `increaseBalanceAllowance` and\n    ///      `decreaseBalanceAllowance` to eliminate the risk.\n    function approveBalanceAndCall(address vault, uint256 amount) external {\n        _approveBalance(msg.sender, vault, amount);\n        IVault(vault).receiveBalanceApproval(msg.sender, amount);\n    }\n\n    /// @notice Atomically increases the balance allowance granted to `spender`\n    ///         by the caller by the given `addedValue`.\n    function increaseBalanceAllowance(address spender, uint256 addedValue)\n        external\n    {\n        _approveBalance(\n            msg.sender,\n            spender,\n            allowance[msg.sender][spender] + addedValue\n        );\n    }\n\n    /// @notice Atomically decreases the balance allowance granted to `spender`\n    ///         by the caller by the given `subtractedValue`.\n    function decreaseBalanceAllowance(address spender, uint256 subtractedValue)\n        external\n    {\n        uint256 currentAllowance = allowance[msg.sender][spender];\n        require(\n            currentAllowance >= subtractedValue,\n            \"Can not decrease balance allowance below zero\"\n        );\n        unchecked {\n            _approveBalance(\n                msg.sender,\n                spender,\n                currentAllowance - subtractedValue\n            );\n        }\n    }\n\n    /// @notice Moves `amount` of balance from `spender` to `recipient` using the\n    ///         allowance mechanism. `amount` is then deducted from the caller's\n    ///         allowance unless the allowance was made for `type(uint256).max`.\n    /// @dev Requirements:\n    ///      - `recipient` cannot be the zero address,\n    ///      - `spender` must have a balance of at least `amount`,\n    ///      - the caller must have allowance for `spender`'s balance of at\n    ///        least `amount`.\n    function transferBalanceFrom(\n        address spender,\n        address recipient,\n        uint256 amount\n    ) external {\n        uint256 currentAllowance = allowance[spender][msg.sender];\n        if (currentAllowance != type(uint256).max) {\n            require(\n                currentAllowance >= amount,\n                \"Transfer amount exceeds allowance\"\n            );\n            unchecked {\n                _approveBalance(spender, msg.sender, currentAllowance - amount);\n            }\n        }\n        _transferBalance(spender, recipient, amount);\n    }\n\n    /// @notice EIP2612 approval made with secp256k1 signature.\n    ///         Users can authorize a transfer of their balance with a signature\n    ///         conforming EIP712 standard, rather than an on-chain transaction\n    ///         from their address. Anyone can submit this signature on the\n    ///         user's behalf by calling the permit function, paying gas fees,\n    ///         and possibly performing other actions in the same transaction.\n    /// @dev The deadline argument can be set to `type(uint256).max to create\n    ///      permits that effectively never expire.  If the `amount` is set\n    ///      to `type(uint256).max` then `transferBalanceFrom` will not\n    ///      reduce an allowance. Beware that changing an allowance with this\n    ///      function brings the risk that someone may use both the old and the\n    ///      new allowance by unfortunate transaction ordering. Please use\n    ///      `increaseBalanceAllowance` and `decreaseBalanceAllowance` to\n    ///      eliminate the risk.\n    function permit(\n        address owner,\n        address spender,\n        uint256 amount,\n        uint256 deadline,\n        uint8 v,\n        bytes32 r,\n        bytes32 s\n    ) external {\n        /* solhint-disable-next-line not-rely-on-time */\n        require(deadline >= block.timestamp, \"Permission expired\");\n\n        // Validate `s` and `v` values for a malleability concern described in EIP2.\n        // Only signatures with `s` value in the lower half of the secp256k1\n        // curve's order and `v` value of 27 or 28 are considered valid.\n        require(\n            uint256(s) <=\n                0x7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0,\n            \"Invalid signature 's' value\"\n        );\n        require(v == 27 || v == 28, \"Invalid signature 'v' value\");\n\n        bytes32 digest = keccak256(\n            abi.encodePacked(\n                \"\\x19\\x01\",\n                DOMAIN_SEPARATOR(),\n                keccak256(\n                    abi.encode(\n                        PERMIT_TYPEHASH,\n                        owner,\n                        spender,\n                        amount,\n                        nonce[owner]++,\n                        deadline\n                    )\n                )\n            )\n        );\n        address recoveredAddress = ecrecover(digest, v, r, s);\n        require(\n            recoveredAddress != address(0) && recoveredAddress == owner,\n            \"Invalid signature\"\n        );\n        _approveBalance(owner, spender, amount);\n    }\n\n    /// @notice Increases balances of the provided `recipients` by the provided\n    ///         `amounts`. Can only be called by the Bridge.\n    /// @dev Requirements:\n    ///       - length of `recipients` and `amounts` must be the same.\n    function increaseBalances(\n        address[] calldata recipients,\n        uint256[] calldata amounts\n    ) external onlyBridge {\n        require(\n            recipients.length == amounts.length,\n            \"Arrays must have the same length\"\n        );\n        for (uint256 i = 0; i < recipients.length; i++) {\n            _increaseBalance(recipients[i], amounts[i]);\n        }\n    }\n\n    /// @notice Increases balance of the provided `recipient` by the provided\n    ///         `amount`. Can only be called by the Bridge.\n    function increaseBalance(address recipient, uint256 amount)\n        external\n        onlyBridge\n    {\n        _increaseBalance(recipient, amount);\n    }\n\n    /// @notice Increases the given smart contract `vault`'s balance and\n    ///         notifies the `vault` contract. Called by the Bridge after\n    ///         the deposits routed by depositors to that `vault` have been\n    ///         swept by the Bridge. This way, the depositor does not have to\n    ///         issue a separate  transaction to the `vault` contract.\n    ///         Can be called only by the Bridge.\n    /// @dev Requirements:\n    ///       - `vault` must implement `IVault` interface,\n    ///       - length of `depositors` and `depositedAmounts` must be the same.\n    /// @param vault Address of `IVault` recipient contract\n    /// @param depositors Addresses of depositors whose deposits have been swept\n    /// @param depositedAmounts Amounts deposited by individual depositors and\n    ///        swept. The `vault`'s balance in the Bank will be increased by the\n    ///        sum of all elements in this array.\n    function increaseBalanceAndCall(\n        address vault,\n        address[] calldata depositors,\n        uint256[] calldata depositedAmounts\n    ) external onlyBridge {\n        require(\n            depositors.length == depositedAmounts.length,\n            \"Arrays must have the same length\"\n        );\n        uint256 totalAmount = 0;\n        for (uint256 i = 0; i < depositedAmounts.length; i++) {\n            totalAmount += depositedAmounts[i];\n        }\n        _increaseBalance(vault, totalAmount);\n        IVault(vault).receiveBalanceIncrease(depositors, depositedAmounts);\n    }\n\n    /// @notice Decreases caller's balance by the provided `amount`. There is no\n    ///         way to restore the balance so do not call this function unless\n    ///         you really know what you are doing!\n    function decreaseBalance(uint256 amount) external {\n        balanceOf[msg.sender] -= amount;\n        emit BalanceDecreased(msg.sender, amount);\n    }\n\n    /// @notice Returns hash of EIP712 Domain struct with `TBTC Bank` as\n    ///         a signing domain and Bank contract as a verifying contract.\n    ///         Used to construct EIP2612 signature provided to `permit`\n    ///         function.\n    /* solhint-disable-next-line func-name-mixedcase */\n    function DOMAIN_SEPARATOR() public view returns (bytes32) {\n        // As explained in EIP-2612, if the DOMAIN_SEPARATOR contains the\n        // chainId and is defined at contract deployment instead of\n        // reconstructed for every signature, there is a risk of possible replay\n        // attacks between chains in the event of a future chain split.\n        // To address this issue, we check the cached chain ID against the\n        // current one and in case they are different, we build domain separator\n        // from scratch.\n        if (block.chainid == cachedChainId) {\n            return cachedDomainSeparator;\n        } else {\n            return buildDomainSeparator();\n        }\n    }\n\n    function _increaseBalance(address recipient, uint256 amount) internal {\n        require(\n            recipient != address(this),\n            \"Can not increase balance for Bank\"\n        );\n        balanceOf[recipient] += amount;\n        emit BalanceIncreased(recipient, amount);\n    }\n\n    function _transferBalance(\n        address spender,\n        address recipient,\n        uint256 amount\n    ) private {\n        require(\n            recipient != address(0),\n            \"Can not transfer to the zero address\"\n        );\n        require(\n            recipient != address(this),\n            \"Can not transfer to the Bank address\"\n        );\n\n        uint256 spenderBalance = balanceOf[spender];\n        require(spenderBalance >= amount, \"Transfer amount exceeds balance\");\n        unchecked {\n            balanceOf[spender] = spenderBalance - amount;\n        }\n        balanceOf[recipient] += amount;\n        emit BalanceTransferred(spender, recipient, amount);\n    }\n\n    function _approveBalance(\n        address owner,\n        address spender,\n        uint256 amount\n    ) private {\n        require(spender != address(0), \"Can not approve to the zero address\");\n        allowance[owner][spender] = amount;\n        emit BalanceApproved(owner, spender, amount);\n    }\n\n    function buildDomainSeparator() private view returns (bytes32) {\n        return\n            keccak256(\n                abi.encode(\n                    keccak256(\n                        \"EIP712Domain(string name,string version,uint256 chainId,address verifyingContract)\"\n                    ),\n                    keccak256(bytes(\"TBTC Bank\")),\n                    keccak256(bytes(\"1\")),\n                    block.chainid,\n                    address(this)\n                )\n            );\n    }\n}\n"
     },
     "@openzeppelin/contracts/access/Ownable.sol": {
       "content": "// SPDX-License-Identifier: MIT\n\npragma solidity ^0.8.0;\n\nimport \"../utils/Context.sol\";\n\n/**\n * @dev Contract module which provides a basic access control mechanism, where\n * there is an account (an owner) that can be granted exclusive access to\n * specific functions.\n *\n * By default, the owner account will be the one that deploys the contract. This\n * can later be changed with {transferOwnership}.\n *\n * This module is used through inheritance. It will make available the modifier\n * `onlyOwner`, which can be applied to your functions to restrict their use to\n * the owner.\n */\nabstract contract Ownable is Context {\n    address private _owner;\n\n    event OwnershipTransferred(address indexed previousOwner, address indexed newOwner);\n\n    /**\n     * @dev Initializes the contract setting the deployer as the initial owner.\n     */\n    constructor() {\n        _setOwner(_msgSender());\n    }\n\n    /**\n     * @dev Returns the address of the current owner.\n     */\n    function owner() public view virtual returns (address) {\n        return _owner;\n    }\n\n    /**\n     * @dev Throws if called by any account other than the owner.\n     */\n    modifier onlyOwner() {\n        require(owner() == _msgSender(), \"Ownable: caller is not the owner\");\n        _;\n    }\n\n    /**\n     * @dev Leaves the contract without owner. It will not be possible to call\n     * `onlyOwner` functions anymore. Can only be called by the current owner.\n     *\n     * NOTE: Renouncing ownership will leave the contract without an owner,\n     * thereby removing any functionality that is only available to the owner.\n     */\n    function renounceOwnership() public virtual onlyOwner {\n        _setOwner(address(0));\n    }\n\n    /**\n     * @dev Transfers ownership of the contract to a new account (`newOwner`).\n     * Can only be called by the current owner.\n     */\n    function transferOwnership(address newOwner) public virtual onlyOwner {\n        require(newOwner != address(0), \"Ownable: new owner is the zero address\");\n        _setOwner(newOwner);\n    }\n\n    function _setOwner(address newOwner) private {\n        address oldOwner = _owner;\n        _owner = newOwner;\n        emit OwnershipTransferred(oldOwner, newOwner);\n    }\n}\n"
@@ -80,7 +80,7 @@
       "content": "// SPDX-License-Identifier: MIT\n\npragma solidity ^0.8.9;\n\nlibrary GovernanceUtils {\n    /// @notice Reverts if the governance delay has not passed since\n    ///         the change initiated time or if the change has not been\n    ///         initiated.\n    /// @param changeInitiatedTimestamp The timestamp at which the change has\n    ///        been initiated.\n    /// @param delay Governance delay.\n    function onlyAfterGovernanceDelay(\n        uint256 changeInitiatedTimestamp,\n        uint256 delay\n    ) internal view {\n        require(changeInitiatedTimestamp > 0, \"Change not initiated\");\n        require(\n            /* solhint-disable-next-line not-rely-on-time */\n            block.timestamp - changeInitiatedTimestamp >= delay,\n            \"Governance delay has not elapsed\"\n        );\n    }\n\n    /// @notice Gets the time remaining until the governable parameter update\n    ///         can be committed.\n    /// @param changeInitiatedTimestamp Timestamp indicating the beginning of\n    ///        the change\n    /// @param delay Governance delay\n    /// @return Remaining time in seconds\n    function getRemainingGovernanceDelay(\n        uint256 changeInitiatedTimestamp,\n        uint256 delay\n    ) internal view returns (uint256) {\n        require(changeInitiatedTimestamp > 0, \"Change not initiated\");\n        /* solhint-disable-next-line not-rely-on-time */\n        uint256 elapsed = block.timestamp - changeInitiatedTimestamp;\n        if (elapsed >= delay) {\n            return 0;\n        } else {\n            return delay - elapsed;\n        }\n    }\n}\n"
     },
     "contracts/bridge/Bridge.sol": {
-      "content": "// SPDX-License-Identifier: MIT\n\n// ██████████████     ▐████▌     ██████████████\n// ██████████████     ▐████▌     ██████████████\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n// ██████████████     ▐████▌     ██████████████\n// ██████████████     ▐████▌     ██████████████\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n\npragma solidity ^0.8.9;\n\nimport \"@openzeppelin/contracts/access/Ownable.sol\";\n\nimport {BTCUtils} from \"@keep-network/bitcoin-spv-sol/contracts/BTCUtils.sol\";\nimport {BytesLib} from \"@keep-network/bitcoin-spv-sol/contracts/BytesLib.sol\";\nimport {\n    ValidateSPV\n} from \"@keep-network/bitcoin-spv-sol/contracts/ValidateSPV.sol\";\n\nimport \"../bank/Bank.sol\";\nimport \"./BitcoinTx.sol\";\n\n/// @title Interface for the Bitcoin relay\n/// @notice Contains only the methods needed by tBTC v2. The Bitcoin relay\n///         provides the difficulty of the previous and current epoch. One\n///         difficulty epoch spans 2016 blocks.\ninterface IRelay {\n    /// @notice Returns the difficulty of the current epoch.\n    function getCurrentEpochDifficulty() external view returns (uint256);\n\n    /// @notice Returns the difficulty of the previous epoch.\n    function getPrevEpochDifficulty() external view returns (uint256);\n}\n\n/// @title Bitcoin Bridge\n/// @notice Bridge manages BTC deposit and redemption flow and is increasing and\n///         decreasing balances in the Bank as a result of BTC deposit and\n///         redemption operations performed by depositors and redeemers.\n///\n///         Depositors send BTC funds to the most recently created off-chain\n///         ECDSA wallet of the bridge using pay-to-script-hash (P2SH) or\n///         pay-to-witness-script-hash (P2WSH) containing hashed information\n///         about the depositor’s Ethereum address. Then, the depositor reveals\n///         their Ethereum address along with their deposit blinding factor,\n///         refund public key hash and refund locktime to the Bridge on Ethereum\n///         chain. The off-chain ECDSA wallet listens for these sorts of\n///         messages and when it gets one, it checks the Bitcoin network to make\n///         sure the deposit lines up. If it does, the off-chain ECDSA wallet\n///         may decide to pick the deposit transaction for sweeping, and when\n///         the sweep operation is confirmed on the Bitcoin network, the ECDSA\n///         wallet informs the Bridge about the sweep increasing appropriate\n///         balances in the Bank.\n/// @dev Bridge is an upgradeable component of the Bank.\ncontract Bridge is Ownable {\n    using BTCUtils for bytes;\n    using BTCUtils for uint256;\n    using BytesLib for bytes;\n    using ValidateSPV for bytes;\n    using ValidateSPV for bytes32;\n\n    /// @notice Represents data which must be revealed by the depositor during\n    ///         deposit reveal.\n    struct RevealInfo {\n        // Index of the funding output belonging to the funding transaction.\n        uint32 fundingOutputIndex;\n        // Ethereum depositor address.\n        address depositor;\n        // The blinding factor as 8 bytes. Byte endianness doesn't matter\n        // as this factor is not interpreted as uint.\n        bytes8 blindingFactor;\n        // The compressed Bitcoin public key (33 bytes and 02 or 03 prefix)\n        // of the deposit's wallet hashed in the HASH160 Bitcoin opcode style.\n        bytes20 walletPubKeyHash;\n        // The compressed Bitcoin public key (33 bytes and 02 or 03 prefix)\n        // that can be used to make the deposit refund after the refund\n        // locktime passes. Hashed in the HASH160 Bitcoin opcode style.\n        bytes20 refundPubKeyHash;\n        // The refund locktime (4-byte LE). Interpreted according to locktime\n        // parsing rules described in:\n        // https://developer.bitcoin.org/devguide/transactions.html#locktime-and-sequence-number\n        // and used with OP_CHECKLOCKTIMEVERIFY opcode as described in:\n        // https://github.com/bitcoin/bips/blob/master/bip-0065.mediawiki\n        bytes4 refundLocktime;\n        // Address of the Bank vault to which the deposit is routed to.\n        // Optional, can be 0x0. The vault must be trusted by the Bridge.\n        address vault;\n    }\n\n    /// @notice Represents tBTC deposit data.\n    struct DepositRequest {\n        // Ethereum depositor address.\n        address depositor;\n        // Deposit amount in satoshi.\n        uint64 amount;\n        // UNIX timestamp the deposit was revealed at.\n        uint32 revealedAt;\n        // Address of the Bank vault the deposit is routed to.\n        // Optional, can be 0x0.\n        address vault;\n        // UNIX timestamp the deposit was swept at. Note this is not the\n        // time when the deposit was swept on the Bitcoin chain but actually\n        // the time when the sweep proof was delivered to the Ethereum chain.\n        uint32 sweptAt;\n    }\n\n    /// @notice Represents a redemption request.\n    struct RedemptionRequest {\n        // ETH address of the redeemer who created the request.\n        address redeemer;\n        // Requested TBTC amount in satoshi.\n        uint64 requestedAmount;\n        // Treasury TBTC fee in satoshi at the moment of request creation.\n        uint64 treasuryFee;\n        // Transaction maximum BTC fee in satoshi at the moment of request\n        // creation.\n        uint64 txMaxFee;\n        // UNIX timestamp the request was created at.\n        uint32 requestedAt;\n    }\n\n    /// @notice Represents an outcome of the redemption Bitcoin transaction\n    ///         outputs processing.\n    struct RedemptionTxOutputsInfo {\n        // Total TBTC value in satoshi that should be burned by the Bridge.\n        // It includes the total amount of all BTC redeemed in the transaction\n        // and the fee paid to BTC miners for the redemption transaction.\n        uint64 totalBurnableValue;\n        // Total TBTC value in satoshi that should be transferred to\n        // the treasury. It is a sum of all treasury fees paid by all\n        // redeemers included in the redemption transaction.\n        uint64 totalTreasuryFee;\n        // Index of the change output. The change output becomes\n        // the new main wallet's UTXO.\n        uint32 changeIndex;\n        // Value in satoshi of the change output.\n        uint64 changeValue;\n    }\n\n    /// @notice Represents wallet state:\n    enum WalletState {\n        /// @dev The wallet is unknown to the Bridge.\n        Unknown,\n        /// @dev The wallet can sweep deposits and accept redemption requests.\n        Active,\n        /// @dev The wallet was deemed unhealthy and is expected to move their\n        ///      outstanding funds to another wallet. The wallet can still\n        ///      fulfill their pending redemption requests although new\n        ///      redemption requests and new deposit reveals are not accepted.\n        MovingFunds,\n        /// @dev The wallet moved or redeemed all their funds and cannot\n        ///      perform any action.\n        Closed,\n        /// @dev The wallet committed a fraud that was reported. The wallet is\n        ///      blocked and can not perform any actions in the Bridge.\n        ///      Off-chain coordination with the wallet operators is needed to\n        ///      recover funds.\n        Terminated\n    }\n\n    /// @notice Holds information about a wallet.\n    struct Wallet {\n        // Current state of the wallet.\n        WalletState state;\n        // The total redeemable value of pending redemption requests targeting\n        // that wallet.\n        uint64 pendingRedemptionsValue;\n    }\n\n    /// @notice The number of confirmations on the Bitcoin chain required to\n    ///         successfully evaluate an SPV proof.\n    uint256 public immutable txProofDifficultyFactor;\n\n    /// TODO: Revisit whether it should be governable or not.\n    /// @notice Address of the Bank this Bridge belongs to.\n    Bank public immutable bank;\n\n    /// TODO: Make it governable.\n    /// @notice Handle to the Bitcoin relay.\n    IRelay public immutable relay;\n\n    /// TODO: Revisit whether it should be governable or not.\n    /// @notice Address where the redemptions treasury fees will be sent to.\n    ///         Treasury takes part in the operators rewarding process.\n    address public immutable treasury;\n\n    /// TODO: Make it governable.\n    /// @notice The minimal amount that can be requested for redemption.\n    ///         Value of this parameter should be always bigger than the sum\n    ///         of `redemptionTreasuryFee` and `redemptionTxMaxFee` to make\n    ///         redemptions possible.\n    uint64 public redemptionDustThreshold;\n\n    /// TODO: Make it governable.\n    /// @notice Amount of TBTC that is taken from each redemption request and\n    ///         transferred to the treasury upon successful request finalization.\n    uint64 public redemptionTreasuryFee;\n\n    /// TODO: Make it governable.\n    /// @notice Maximum amount of BTC transaction fee that can be incurred by\n    ///         each redemption request being part of the given redemption\n    ///         transaction. If the maximum BTC transaction fee is exceeded, such\n    ///         transaction is considered a fraud.\n    uint64 public redemptionTxMaxFee;\n\n    /// TODO: Make it governable.\n    /// @notice Time after which the redemption request can be reported as\n    ///         timed out. It is counted from the moment when the redemption\n    ///         request was created via `requestRedemption` call. Reported\n    ///         timed out requests are cancelled and locked TBTC is returned\n    ///         to the redeemer in full amount.\n    uint256 public redemptionTimeout;\n\n    /// @notice Indicates if the vault with the given address is trusted or not.\n    ///         Depositors can route their revealed deposits only to trusted\n    ///         vaults and have trusted vaults notified about new deposits as\n    ///         soon as these deposits get swept. Vaults not trusted by the\n    ///         Bridge can still be used by Bank balance owners on their own\n    ///         responsibility - anyone can approve their Bank balance to any\n    ///         address.\n    mapping(address => bool) public isVaultTrusted;\n\n    /// @notice Collection of all revealed deposits indexed by\n    ///         keccak256(fundingTxHash | fundingOutputIndex).\n    ///         The fundingTxHash is bytes32 (ordered as in Bitcoin internally)\n    ///         and fundingOutputIndex an uint32. This mapping may contain valid\n    ///         and invalid deposits and the wallet is responsible for\n    ///         validating them before attempting to execute a sweep.\n    mapping(uint256 => DepositRequest) public deposits;\n\n    /// @notice Maps the 20-byte wallet public key hash (computed using\n    ///         Bitcoin HASH160 over the compressed ECDSA public key) to\n    ///         the latest wallet's main UTXO computed as\n    ///         keccak256(txHash | txOutputIndex | txOutputValue). The `tx`\n    ///         prefix refers to the transaction which created that main UTXO.\n    ///         The txHash is bytes32 (ordered as in Bitcoin internally),\n    ///         txOutputIndex an uint32, and txOutputValue an uint64 value.\n    mapping(bytes20 => bytes32) public mainUtxos;\n\n    /// @notice Collection of all pending redemption requests indexed by\n    ///         redemption key built as\n    ///         keccak256(walletPubKeyHash | redeemerOutputScript). The\n    ///         walletPubKeyHash is the 20-byte wallet's public key hash\n    ///         (computed using Bitcoin HASH160 over the compressed ECDSA\n    ///         public key) and redeemerOutputScript is a Bitcoin script\n    ///         (P2PKH, P2WPKH, P2SH or P2WSH) that will be used to lock\n    ///         redeemed BTC as requested by the redeemer. Requests are added\n    ///         to this mapping by the `requestRedemption` method (duplicates\n    ///         not allowed) and are removed by one of the following methods:\n    ///         - `submitRedemptionProof` in case the request was handled\n    ///           successfully\n    ///         - `notifyRedemptionTimeout` in case the request was reported\n    ///           to be timed out\n    ///         - `submitRedemptionFraudProof` in case the request was handled\n    ///           in an fraudulent way amount-wise.\n    mapping(uint256 => RedemptionRequest) public pendingRedemptions;\n\n    /// @notice Collection of all timed out redemptions requests indexed by\n    ///         redemption key built as\n    ///         keccak256(walletPubKeyHash | redeemerOutputScript). The\n    ///         walletPubKeyHash is the 20-byte wallet's public key hash\n    ///         (computed using Bitcoin HASH160 over the compressed ECDSA\n    ///         public key) and redeemerOutputScript is the Bitcoin script\n    ///         (P2PKH, P2WPKH, P2SH or P2WSH) that is involved in the timed\n    ///         out request. Timed out requests are stored in this mapping to\n    ///         avoid slashing the wallets multiple times for the same timeout.\n    ///         Only one method can add to this mapping:\n    ///         - `notifyRedemptionTimeout` which puts the redemption key\n    ///           to this mapping basing on a timed out request stored\n    ///           previously in `pendingRedemptions` mapping.\n    ///\n    // TODO: Remove that Slither disable once this variable is used.\n    // slither-disable-next-line uninitialized-state\n    mapping(uint256 => RedemptionRequest) public timedOutRedemptions;\n\n    /// @notice Maps the 20-byte wallet public key hash (computed using\n    ///         Bitcoin HASH160 over the compressed ECDSA public key) to the\n    ///         basic wallet information like state and pending\n    ///         redemptions value.\n    ///\n    // TODO: Remove that Slither disable once this variable is used.\n    // slither-disable-next-line uninitialized-state\n    mapping(bytes20 => Wallet) public wallets;\n\n    event VaultStatusUpdated(address indexed vault, bool isTrusted);\n\n    event DepositRevealed(\n        bytes32 fundingTxHash,\n        uint32 fundingOutputIndex,\n        address depositor,\n        uint64 amount,\n        bytes8 blindingFactor,\n        bytes20 walletPubKeyHash,\n        bytes20 refundPubKeyHash,\n        bytes4 refundLocktime,\n        address vault\n    );\n\n    event DepositsSwept(bytes20 walletPubKeyHash, bytes32 sweepTxHash);\n\n    event RedemptionRequested(\n        bytes20 walletPubKeyHash,\n        bytes redeemerOutputScript,\n        address redeemer,\n        uint64 requestedAmount,\n        uint64 treasuryFee,\n        uint64 txMaxFee\n    );\n\n    event RedemptionsCompleted(\n        bytes20 walletPubKeyHash,\n        bytes32 redemptionTxHash\n    );\n\n    constructor(\n        address _bank,\n        address _relay,\n        address _treasury,\n        uint256 _txProofDifficultyFactor\n    ) {\n        require(_bank != address(0), \"Bank address cannot be zero\");\n        bank = Bank(_bank);\n\n        require(_relay != address(0), \"Relay address cannot be zero\");\n        relay = IRelay(_relay);\n\n        require(_treasury != address(0), \"Treasury address cannot be zero\");\n        treasury = _treasury;\n\n        txProofDifficultyFactor = _txProofDifficultyFactor;\n\n        // TODO: Revisit initial values.\n        redemptionDustThreshold = 1000000; // 1000000 satoshi = 0.01 BTC\n        redemptionTreasuryFee = 100000; // 100000 satoshi\n        redemptionTxMaxFee = 1000; // 1000 satoshi\n        redemptionTimeout = 172800; // 48 hours\n    }\n\n    // TODO: Add function `onNewWalletCreated` according to discussion:\n    //       https://github.com/keep-network/tbtc-v2/pull/128#discussion_r809885230\n\n    /// @notice Allows the Governance to mark the given vault address as trusted\n    ///         or no longer trusted. Vaults are not trusted by default.\n    ///         Trusted vault must meet the following criteria:\n    ///         - `IVault.receiveBalanceIncrease` must have a known, low gas\n    ///           cost.\n    ///         - `IVault.receiveBalanceIncrease` must never revert.\n    /// @dev Without restricting reveal only to trusted vaults, malicious\n    ///      vaults not meeting the criteria would be able to nuke sweep proof\n    ///      transactions executed by ECDSA wallet with  deposits routed to\n    ///      them.\n    /// @param vault The address of the vault\n    /// @param isTrusted flag indicating whether the vault is trusted or not\n    /// @dev Can only be called by the Governance.\n    function setVaultStatus(address vault, bool isTrusted) external onlyOwner {\n        isVaultTrusted[vault] = isTrusted;\n        emit VaultStatusUpdated(vault, isTrusted);\n    }\n\n    /// @notice Used by the depositor to reveal information about their P2(W)SH\n    ///         Bitcoin deposit to the Bridge on Ethereum chain. The off-chain\n    ///         wallet listens for revealed deposit events and may decide to\n    ///         include the revealed deposit in the next executed sweep.\n    ///         Information about the Bitcoin deposit can be revealed before or\n    ///         after the Bitcoin transaction with P2(W)SH deposit is mined on\n    ///         the Bitcoin chain. Worth noting, the gas cost of this function\n    ///         scales with the number of P2(W)SH transaction inputs and\n    ///         outputs. The deposit may be routed to one of the trusted vaults.\n    ///         When a deposit is routed to a vault, vault gets notified when\n    ///         the deposit gets swept and it may execute the appropriate action.\n    /// @param fundingTx Bitcoin funding transaction data, see `BitcoinTx.Info`\n    /// @param reveal Deposit reveal data, see `RevealInfo struct\n    /// @dev Requirements:\n    ///      - `reveal.vault` must be 0x0 or point to a trusted vault\n    ///      - `reveal.fundingOutputIndex` must point to the actual P2(W)SH\n    ///        output of the BTC deposit transaction\n    ///      - `reveal.depositor` must be the Ethereum address used in the\n    ///        P2(W)SH BTC deposit transaction,\n    ///      - `reveal.blindingFactor` must be the blinding factor used in the\n    ///        P2(W)SH BTC deposit transaction,\n    ///      - `reveal.walletPubKeyHash` must be the wallet pub key hash used in\n    ///        the P2(W)SH BTC deposit transaction,\n    ///      - `reveal.refundPubKeyHash` must be the refund pub key hash used in\n    ///        the P2(W)SH BTC deposit transaction,\n    ///      - `reveal.refundLocktime` must be the refund locktime used in the\n    ///        P2(W)SH BTC deposit transaction,\n    ///      - BTC deposit for the given `fundingTxHash`, `fundingOutputIndex`\n    ///        can be revealed only one time.\n    ///\n    ///      If any of these requirements is not met, the wallet _must_ refuse\n    ///      to sweep the deposit and the depositor has to wait until the\n    ///      deposit script unlocks to receive their BTC back.\n    function revealDeposit(\n        BitcoinTx.Info calldata fundingTx,\n        RevealInfo calldata reveal\n    ) external {\n        require(\n            reveal.vault == address(0) || isVaultTrusted[reveal.vault],\n            \"Vault is not trusted\"\n        );\n\n        // TODO: Validate if `walletPubKeyHash` is a known and active wallet.\n        // TODO: Should we enforce a specific locktime at contract level?\n\n        bytes memory expectedScript =\n            abi.encodePacked(\n                hex\"14\", // Byte length of depositor Ethereum address.\n                reveal.depositor,\n                hex\"75\", // OP_DROP\n                hex\"08\", // Byte length of blinding factor value.\n                reveal.blindingFactor,\n                hex\"75\", // OP_DROP\n                hex\"76\", // OP_DUP\n                hex\"a9\", // OP_HASH160\n                hex\"14\", // Byte length of a compressed Bitcoin public key hash.\n                reveal.walletPubKeyHash,\n                hex\"87\", // OP_EQUAL\n                hex\"63\", // OP_IF\n                hex\"ac\", // OP_CHECKSIG\n                hex\"67\", // OP_ELSE\n                hex\"76\", // OP_DUP\n                hex\"a9\", // OP_HASH160\n                hex\"14\", // Byte length of a compressed Bitcoin public key hash.\n                reveal.refundPubKeyHash,\n                hex\"88\", // OP_EQUALVERIFY\n                hex\"04\", // Byte length of refund locktime value.\n                reveal.refundLocktime,\n                hex\"b1\", // OP_CHECKLOCKTIMEVERIFY\n                hex\"75\", // OP_DROP\n                hex\"ac\", // OP_CHECKSIG\n                hex\"68\" // OP_ENDIF\n            );\n\n        bytes memory fundingOutput =\n            fundingTx.outputVector.extractOutputAtIndex(\n                reveal.fundingOutputIndex\n            );\n        bytes memory fundingOutputHash = fundingOutput.extractHash();\n\n        if (fundingOutputHash.length == 20) {\n            // A 20-byte output hash is used by P2SH. That hash is constructed\n            // by applying OP_HASH160 on the locking script. A 20-byte output\n            // hash is used as well by P2PKH and P2WPKH (OP_HASH160 on the\n            // public key). However, since we compare the actual output hash\n            // with an expected locking script hash, this check will succeed only\n            // for P2SH transaction type with expected script hash value. For\n            // P2PKH and P2WPKH, it will fail on the output hash comparison with\n            // the expected locking script hash.\n            require(\n                fundingOutputHash.slice20(0) == expectedScript.hash160View(),\n                \"Wrong 20-byte script hash\"\n            );\n        } else if (fundingOutputHash.length == 32) {\n            // A 32-byte output hash is used by P2WSH. That hash is constructed\n            // by applying OP_SHA256 on the locking script.\n            require(\n                fundingOutputHash.toBytes32() == sha256(expectedScript),\n                \"Wrong 32-byte script hash\"\n            );\n        } else {\n            revert(\"Wrong script hash length\");\n        }\n\n        // Resulting TX hash is in native Bitcoin little-endian format.\n        bytes32 fundingTxHash =\n            abi\n                .encodePacked(\n                fundingTx\n                    .version,\n                fundingTx\n                    .inputVector,\n                fundingTx\n                    .outputVector,\n                fundingTx\n                    .locktime\n            )\n                .hash256View();\n\n        DepositRequest storage deposit =\n            deposits[\n                uint256(\n                    keccak256(\n                        abi.encodePacked(\n                            fundingTxHash,\n                            reveal.fundingOutputIndex\n                        )\n                    )\n                )\n            ];\n        require(deposit.revealedAt == 0, \"Deposit already revealed\");\n\n        uint64 fundingOutputAmount = fundingOutput.extractValue();\n\n        // TODO: Check the amount against the dust threshold.\n\n        deposit.amount = fundingOutputAmount;\n        deposit.depositor = reveal.depositor;\n        /* solhint-disable-next-line not-rely-on-time */\n        deposit.revealedAt = uint32(block.timestamp);\n        deposit.vault = reveal.vault;\n\n        emit DepositRevealed(\n            fundingTxHash,\n            reveal.fundingOutputIndex,\n            reveal.depositor,\n            fundingOutputAmount,\n            reveal.blindingFactor,\n            reveal.walletPubKeyHash,\n            reveal.refundPubKeyHash,\n            reveal.refundLocktime,\n            reveal.vault\n        );\n    }\n\n    /// @notice Used by the wallet to prove the BTC deposit sweep transaction\n    ///         and to update Bank balances accordingly. Sweep is only accepted\n    ///         if it satisfies SPV proof.\n    ///\n    ///         The function is performing Bank balance updates by first\n    ///         computing the Bitcoin fee for the sweep transaction. The fee is\n    ///         divided evenly between all swept deposits. Each depositor\n    ///         receives a balance in the bank equal to the amount inferred\n    ///         during the reveal transaction, minus their fee share.\n    ///\n    ///         It is possible to prove the given sweep only one time.\n    /// @param sweepTx Bitcoin sweep transaction data\n    /// @param sweepProof Bitcoin sweep proof data\n    /// @param mainUtxo Data of the wallet's main UTXO, as currently known on\n    ///        the Ethereum chain. If no main UTXO exists for the given wallet,\n    ///        this parameter is ignored\n    /// @dev Requirements:\n    ///      - `sweepTx` components must match the expected structure. See\n    ///        `BitcoinTx.Info` docs for reference. Their values must exactly\n    ///        correspond to appropriate Bitcoin transaction fields to produce\n    ///        a provable transaction hash.\n    ///      - The `sweepTx` should represent a Bitcoin transaction with 1..n\n    ///        inputs. If the wallet has no main UTXO, all n inputs should\n    ///        correspond to P2(W)SH revealed deposits UTXOs. If the wallet has\n    ///        an existing main UTXO, one of the n inputs must point to that\n    ///        main UTXO and remaining n-1 inputs should correspond to P2(W)SH\n    ///        revealed deposits UTXOs. That transaction must have only\n    ///        one P2(W)PKH output locking funds on the 20-byte wallet public\n    ///        key hash.\n    ///      - `sweepProof` components must match the expected structure. See\n    ///        `BitcoinTx.Proof` docs for reference. The `bitcoinHeaders`\n    ///        field must contain a valid number of block headers, not less\n    ///        than the `txProofDifficultyFactor` contract constant.\n    ///      - `mainUtxo` components must point to the recent main UTXO\n    ///        of the given wallet, as currently known on the Ethereum chain.\n    ///        If there is no main UTXO, this parameter is ignored.\n    function submitSweepProof(\n        BitcoinTx.Info calldata sweepTx,\n        BitcoinTx.Proof calldata sweepProof,\n        BitcoinTx.UTXO calldata mainUtxo\n    ) external {\n        // TODO: Fail early if the function call gets frontrunned. See discussion:\n        //       https://github.com/keep-network/tbtc-v2/pull/106#discussion_r801745204\n\n        // The actual transaction proof is performed here. After that point, we\n        // can assume the transaction happened on Bitcoin chain and has\n        // a sufficient number of confirmations as determined by\n        // `txProofDifficultyFactor` constant.\n        bytes32 sweepTxHash = validateBitcoinTxProof(sweepTx, sweepProof);\n\n        // Process sweep transaction output and extract its target wallet\n        // public key hash and value.\n        (bytes20 walletPubKeyHash, uint64 sweepTxOutputValue) =\n            processSweepTxOutput(sweepTx.outputVector);\n\n        // TODO: Validate if `walletPubKeyHash` is a known and active wallet.\n\n        // Check if the main UTXO for given wallet exists. If so, validate\n        // passed main UTXO data against the stored hash and use them for\n        // further processing. If no main UTXO exists, use empty data.\n        BitcoinTx.UTXO memory resolvedMainUtxo =\n            BitcoinTx.UTXO(bytes32(0), 0, 0);\n        bytes32 mainUtxoHash = mainUtxos[walletPubKeyHash];\n        if (mainUtxoHash != bytes32(0)) {\n            require(\n                keccak256(\n                    abi.encodePacked(\n                        mainUtxo.txHash,\n                        mainUtxo.txOutputIndex,\n                        mainUtxo.txOutputValue\n                    )\n                ) == mainUtxoHash,\n                \"Invalid main UTXO data\"\n            );\n            resolvedMainUtxo = mainUtxo;\n        }\n\n        // Process sweep transaction inputs and extract their value sum and\n        // all information needed to perform deposit bookkeeping.\n        (\n            uint256 sweepTxInputsValue,\n            address[] memory depositors,\n            uint256[] memory depositedAmounts\n        ) = processSweepTxInputs(sweepTx.inputVector, resolvedMainUtxo);\n\n        // Compute the sweep transaction fee which is a difference between\n        // inputs amounts sum and the output amount.\n        // TODO: Check fee against max fee.\n        uint256 fee = sweepTxInputsValue - sweepTxOutputValue;\n        // Calculate fee share by dividing the total fee by deposits count.\n        // TODO: Deal with precision loss by having the last depositor pay\n        //       the higher fee than others if there is a change, just like it has\n        //       been proposed for the redemption flow. See:\n        //       https://github.com/keep-network/tbtc-v2/pull/128#discussion_r800555359.\n        uint256 feeShare = fee / depositedAmounts.length;\n        // Reduce each deposit amount by fee share value.\n        for (uint256 i = 0; i < depositedAmounts.length; i++) {\n            // We don't have to check if `feeShare` is bigger than the amount\n            // since we have the dust threshold preventing against too small\n            // deposits amounts.\n            depositedAmounts[i] -= feeShare;\n        }\n\n        // Record this sweep data and assign them to the wallet public key hash\n        // as new main UTXO. Transaction output index is always 0 as sweep\n        // transaction always contains only one output.\n        mainUtxos[walletPubKeyHash] = keccak256(\n            abi.encodePacked(sweepTxHash, uint32(0), sweepTxOutputValue)\n        );\n\n        emit DepositsSwept(walletPubKeyHash, sweepTxHash);\n\n        // Update depositors balances in the Bank.\n        bank.increaseBalances(depositors, depositedAmounts);\n\n        // TODO: Handle deposits having `vault` set.\n    }\n\n    /// @notice Validates the SPV proof of the Bitcoin transaction.\n    ///         Reverts in case the validation or proof verification fail.\n    /// @param txInfo Bitcoin transaction data\n    /// @param proof Bitcoin proof data\n    /// @return txHash Proven 32-byte transaction hash.\n    function validateBitcoinTxProof(\n        BitcoinTx.Info calldata txInfo,\n        BitcoinTx.Proof calldata proof\n    ) internal view returns (bytes32 txHash) {\n        require(\n            txInfo.inputVector.validateVin(),\n            \"Invalid input vector provided\"\n        );\n        require(\n            txInfo.outputVector.validateVout(),\n            \"Invalid output vector provided\"\n        );\n\n        txHash = abi\n            .encodePacked(\n            txInfo\n                .version,\n            txInfo\n                .inputVector,\n            txInfo\n                .outputVector,\n            txInfo\n                .locktime\n        )\n            .hash256View();\n\n        checkProofFromTxHash(txHash, proof);\n\n        return txHash;\n    }\n\n    /// @notice Checks the given Bitcoin transaction hash against the SPV proof.\n    ///         Reverts in case the check fails.\n    /// @param txHash 32-byte hash of the checked Bitcoin transaction\n    /// @param proof Bitcoin proof data\n    function checkProofFromTxHash(\n        bytes32 txHash,\n        BitcoinTx.Proof calldata proof\n    ) internal view {\n        require(\n            txHash.prove(\n                proof.bitcoinHeaders.extractMerkleRootLE(),\n                proof.merkleProof,\n                proof.txIndexInBlock\n            ),\n            \"Tx merkle proof is not valid for provided header and tx hash\"\n        );\n\n        evaluateProofDifficulty(proof.bitcoinHeaders);\n    }\n\n    /// @notice Evaluates the given Bitcoin proof difficulty against the actual\n    ///         Bitcoin chain difficulty provided by the relay oracle.\n    ///         Reverts in case the evaluation fails.\n    /// @param bitcoinHeaders Bitcoin headers chain being part of the SPV\n    ///        proof. Used to extract the observed proof difficulty\n    function evaluateProofDifficulty(bytes memory bitcoinHeaders)\n        internal\n        view\n    {\n        uint256 requestedDiff = 0;\n        uint256 currentDiff = relay.getCurrentEpochDifficulty();\n        uint256 previousDiff = relay.getPrevEpochDifficulty();\n        uint256 firstHeaderDiff =\n            bitcoinHeaders.extractTarget().calculateDifficulty();\n\n        if (firstHeaderDiff == currentDiff) {\n            requestedDiff = currentDiff;\n        } else if (firstHeaderDiff == previousDiff) {\n            requestedDiff = previousDiff;\n        } else {\n            revert(\"Not at current or previous difficulty\");\n        }\n\n        uint256 observedDiff = bitcoinHeaders.validateHeaderChain();\n\n        require(\n            observedDiff != ValidateSPV.getErrBadLength(),\n            \"Invalid length of the headers chain\"\n        );\n        require(\n            observedDiff != ValidateSPV.getErrInvalidChain(),\n            \"Invalid headers chain\"\n        );\n        require(\n            observedDiff != ValidateSPV.getErrLowWork(),\n            \"Insufficient work in a header\"\n        );\n\n        require(\n            observedDiff >= requestedDiff * txProofDifficultyFactor,\n            \"Insufficient accumulated difficulty in header chain\"\n        );\n    }\n\n    /// @notice Processes the Bitcoin sweep transaction output vector by\n    ///         extracting the single output and using it to gain additional\n    ///         information required for further processing (e.g. value and\n    ///         wallet public key hash).\n    /// @param sweepTxOutputVector Bitcoin sweep transaction output vector.\n    ///        This function assumes vector's structure is valid so it must be\n    ///        validated using e.g. `BTCUtils.validateVout` function before\n    ///        it is passed here\n    /// @return walletPubKeyHash 20-byte wallet public key hash.\n    /// @return value 8-byte sweep transaction output value.\n    function processSweepTxOutput(bytes memory sweepTxOutputVector)\n        internal\n        pure\n        returns (bytes20 walletPubKeyHash, uint64 value)\n    {\n        // To determine the total number of sweep transaction outputs, we need to\n        // parse the compactSize uint (VarInt) the output vector is prepended by.\n        // That compactSize uint encodes the number of vector elements using the\n        // format presented in:\n        // https://developer.bitcoin.org/reference/transactions.html#compactsize-unsigned-integers\n        // We don't need asserting the compactSize uint is parseable since it\n        // was already checked during `validateVout` validation.\n        // See `BitcoinTx.outputVector` docs for more details.\n        (, uint256 outputsCount) = sweepTxOutputVector.parseVarInt();\n        require(\n            outputsCount == 1,\n            \"Sweep transaction must have a single output\"\n        );\n\n        bytes memory output = sweepTxOutputVector.extractOutputAtIndex(0);\n        value = output.extractValue();\n        bytes memory walletPubKeyHashBytes = output.extractHash();\n        // The sweep transaction output should always be P2PKH or P2WPKH.\n        // In both cases, the wallet public key hash should be 20 bytes length.\n        require(\n            walletPubKeyHashBytes.length == 20,\n            \"Wallet public key hash should have 20 bytes\"\n        );\n        /* solhint-disable-next-line no-inline-assembly */\n        assembly {\n            walletPubKeyHash := mload(add(walletPubKeyHashBytes, 32))\n        }\n\n        return (walletPubKeyHash, value);\n    }\n\n    /// @notice Processes the Bitcoin sweep transaction input vector. It\n    ///         extracts each input and tries to obtain associated deposit or\n    ///         main UTXO data, depending on the input type. Reverts\n    ///         if one of the inputs cannot be recognized as a pointer to a\n    ///         revealed deposit or expected main UTXO.\n    ///         This function also marks each processed deposit as swept.\n    /// @param sweepTxInputVector Bitcoin sweep transaction input vector.\n    ///        This function assumes vector's structure is valid so it must be\n    ///        validated using e.g. `BTCUtils.validateVin` function before\n    ///        it is passed here\n    /// @param mainUtxo Data of the wallet's main UTXO. If no main UTXO\n    ///        exists for the given the wallet, this parameter's fields should\n    ///        be zeroed to bypass the main UTXO validation\n    /// @return inputsTotalValue Sum of all inputs values i.e. all deposits and\n    ///         main UTXO value, if present.\n    /// @return depositors Addresses of depositors who performed processed\n    ///         deposits. Ordered in the same order as deposits inputs in the\n    ///         input vector. Size of this array is either equal to the\n    ///         number of inputs (main UTXO doesn't exist) or less by one\n    ///         (main UTXO exists and is pointed by one of the inputs).\n    /// @return depositedAmounts Amounts of deposits corresponding to processed\n    ///         deposits. Ordered in the same order as deposits inputs in the\n    ///         input vector. Size of this array is either equal to the\n    ///         number of inputs (main UTXO doesn't exist) or less by one\n    ///         (main UTXO exists and is pointed by one of the inputs).\n    function processSweepTxInputs(\n        bytes memory sweepTxInputVector,\n        BitcoinTx.UTXO memory mainUtxo\n    )\n        internal\n        returns (\n            uint256 inputsTotalValue,\n            address[] memory depositors,\n            uint256[] memory depositedAmounts\n        )\n    {\n        // If the passed `mainUtxo` parameter's values are zeroed, the main UTXO\n        // for the given wallet doesn't exist and it is not expected to be\n        // included in the sweep transaction input vector.\n        bool mainUtxoExpected = mainUtxo.txHash != bytes32(0);\n        bool mainUtxoFound = false;\n\n        // Determining the total number of sweep transaction inputs in the same\n        // way as for number of outputs. See `BitcoinTx.inputVector` docs for\n        // more details.\n        (uint256 inputsCompactSizeUintLength, uint256 inputsCount) =\n            sweepTxInputVector.parseVarInt();\n\n        // To determine the first input starting index, we must jump over\n        // the compactSize uint which prepends the input vector. One byte\n        // must be added because `BtcUtils.parseVarInt` does not include\n        // compactSize uint tag in the returned length.\n        //\n        // For >= 0 && <= 252, `BTCUtils.determineVarIntDataLengthAt`\n        // returns `0`, so we jump over one byte of compactSize uint.\n        //\n        // For >= 253 && <= 0xffff there is `0xfd` tag,\n        // `BTCUtils.determineVarIntDataLengthAt` returns `2` (no\n        // tag byte included) so we need to jump over 1+2 bytes of\n        // compactSize uint.\n        //\n        // Please refer `BTCUtils` library and compactSize uint\n        // docs in `BitcoinTx` library for more details.\n        uint256 inputStartingIndex = 1 + inputsCompactSizeUintLength;\n\n        // Determine the swept deposits count. If main UTXO is NOT expected,\n        // all inputs should be deposits. If main UTXO is expected, one input\n        // should point to that main UTXO.\n        depositors = new address[](\n            !mainUtxoExpected ? inputsCount : inputsCount - 1\n        );\n        depositedAmounts = new uint256[](depositors.length);\n\n        // Initialize helper variables.\n        uint256 processedDepositsCount = 0;\n\n        // Inputs processing loop.\n        for (uint256 i = 0; i < inputsCount; i++) {\n            (\n                bytes32 outpointTxHash,\n                uint32 outpointIndex,\n                uint256 inputLength\n            ) = parseTxInputAt(sweepTxInputVector, inputStartingIndex);\n\n            DepositRequest storage deposit =\n                deposits[\n                    uint256(\n                        keccak256(\n                            abi.encodePacked(outpointTxHash, outpointIndex)\n                        )\n                    )\n                ];\n\n            if (deposit.revealedAt != 0) {\n                // If we entered here, that means the input was identified as\n                // a revealed deposit.\n                require(deposit.sweptAt == 0, \"Deposit already swept\");\n\n                if (processedDepositsCount == depositors.length) {\n                    // If this condition is true, that means a deposit input\n                    // took place of an expected main UTXO input.\n                    // In other words, there is no expected main UTXO\n                    // input and all inputs come from valid, revealed deposits.\n                    revert(\n                        \"Expected main UTXO not present in sweep transaction inputs\"\n                    );\n                }\n\n                /* solhint-disable-next-line not-rely-on-time */\n                deposit.sweptAt = uint32(block.timestamp);\n\n                depositors[processedDepositsCount] = deposit.depositor;\n                depositedAmounts[processedDepositsCount] = deposit.amount;\n                inputsTotalValue += depositedAmounts[processedDepositsCount];\n\n                processedDepositsCount++;\n            } else if (\n                mainUtxoExpected != mainUtxoFound &&\n                mainUtxo.txHash == outpointTxHash\n            ) {\n                // If we entered here, that means the input was identified as\n                // the expected main UTXO.\n                inputsTotalValue += mainUtxo.txOutputValue;\n                mainUtxoFound = true;\n            } else {\n                revert(\"Unknown input type\");\n            }\n\n            // Make the `inputStartingIndex` pointing to the next input by\n            // increasing it by current input's length.\n            inputStartingIndex += inputLength;\n        }\n\n        // Construction of the input processing loop guarantees that:\n        // `processedDepositsCount == depositors.length == depositedAmounts.length`\n        // is always true at this point. We just use the first variable\n        // to assert the total count of swept deposit is bigger than zero.\n        require(\n            processedDepositsCount > 0,\n            \"Sweep transaction must process at least one deposit\"\n        );\n\n        // Assert the main UTXO was used as one of current sweep's inputs if\n        // it was actually expected.\n        require(\n            mainUtxoExpected == mainUtxoFound,\n            \"Expected main UTXO not present in sweep transaction inputs\"\n        );\n\n        return (inputsTotalValue, depositors, depositedAmounts);\n    }\n\n    /// @notice Parses a Bitcoin transaction input starting at the given index.\n    /// @param inputVector Bitcoin transaction input vector\n    /// @param inputStartingIndex Index the given input starts at\n    /// @return outpointTxHash 32-byte hash of the Bitcoin transaction which is\n    ///         pointed in the given input's outpoint.\n    /// @return outpointIndex 4-byte index of the Bitcoin transaction output\n    ///         which is pointed in the given input's outpoint.\n    /// @return inputLength Byte length of the given input.\n    /// @dev This function assumes vector's structure is valid so it must be\n    ///      validated using e.g. `BTCUtils.validateVin` function before it\n    ///      is passed here.\n    function parseTxInputAt(\n        bytes memory inputVector,\n        uint256 inputStartingIndex\n    )\n        internal\n        pure\n        returns (\n            bytes32 outpointTxHash,\n            uint32 outpointIndex,\n            uint256 inputLength\n        )\n    {\n        outpointTxHash = inputVector.extractInputTxIdLeAt(inputStartingIndex);\n\n        outpointIndex = BTCUtils.reverseUint32(\n            uint32(inputVector.extractTxIndexLeAt(inputStartingIndex))\n        );\n\n        inputLength = inputVector.determineInputLengthAt(inputStartingIndex);\n\n        return (outpointTxHash, outpointIndex, inputLength);\n    }\n\n    /// @notice Requests redemption of the given amount from the specified\n    ///         wallet to the redeemer Bitcoin output script.\n    /// @param walletPubKeyHash The 20-byte wallet public key hash (computed\n    //         using Bitcoin HASH160 over the compressed ECDSA public key)\n    /// @param mainUtxo Data of the wallet's main UTXO, as currently known on\n    ///        the Ethereum chain\n    /// @param redeemerOutputScript The redeemer's length-prefixed output\n    ///        script (P2PKH, P2WPKH, P2SH or P2WSH) that will be used to lock\n    ///        redeemed BTC\n    /// @param amount Requested amount in satoshi. This is also the TBTC amount\n    ///        that is taken from redeemer's balance in the Bank upon request.\n    ///        Once the request is handled, the actual amount of BTC locked\n    ///        on the redeemer output script will be always lower than this value\n    ///        since the treasury and Bitcoin transaction fees must be incurred.\n    ///        The minimal amount satisfying the request can be computed as:\n    ///        `amount - redemptionTreasuryFee - redemptionTxMaxFee`.\n    ///        Fees values are taken at the moment of request creation.\n    /// @dev Requirements:\n    ///      - Wallet behind `walletPubKeyHash` must be active\n    ///      - `mainUtxo` components must point to the recent main UTXO\n    ///        of the given wallet, as currently known on the Ethereum chain.\n    ///      - `redeemerOutputScript` must be a proper Bitcoin script\n    ///      - `redeemerOutputScript` cannot have wallet PKH as payload\n    ///      - `amount` must be above or equal the `redemptionDustThreshold`\n    ///      - Given `walletPubKeyHash` and `redeemerOutputScript` pair can be\n    ///        used for only one pending request at the same time\n    ///      - Wallet must have enough Bitcoin balance to proceed the request\n    ///      - Redeemer must make an allowance in the Bank that the Bridge\n    ///        contract can spend the given `amount`.\n    function requestRedemption(\n        bytes20 walletPubKeyHash,\n        BitcoinTx.UTXO calldata mainUtxo,\n        bytes calldata redeemerOutputScript,\n        uint64 amount\n    ) external {\n        require(\n            wallets[walletPubKeyHash].state == WalletState.Active,\n            \"Wallet must be in Active state\"\n        );\n\n        bytes32 mainUtxoHash = mainUtxos[walletPubKeyHash];\n        require(\n            mainUtxoHash != bytes32(0),\n            \"No main UTXO for the given wallet\"\n        );\n        require(\n            keccak256(\n                abi.encodePacked(\n                    mainUtxo.txHash,\n                    mainUtxo.txOutputIndex,\n                    mainUtxo.txOutputValue\n                )\n            ) == mainUtxoHash,\n            \"Invalid main UTXO data\"\n        );\n\n        // TODO: Confirm if `walletPubKeyHash` should be validated by checking\n        //       if it is the oldest one who can handle the request. This will\n        //       be suggested by the dApp but may not be respected by users who\n        //       interact directly with the contract. Do we need to enforce it\n        //       here? One option is not to enforce it, to save on gas, but if\n        //       we see this rule is not respected, upgrade Bridge contract to\n        //       require it.\n\n        // Validate if redeemer output script is a correct standard type\n        // (P2PKH, P2WPKH, P2SH or P2WSH). This is done by building a stub\n        // output with 0 as value and using `BTCUtils.extractHash` on it. Such\n        // a function extracts the payload properly only from standard outputs\n        // so if it succeeds, we have a guarantee the redeemer output script\n        // is proper. Worth to note `extractHash` ignores the value at all\n        // so this is why we can use 0 safely. This way of validation is the\n        // same as in tBTC v1.\n        bytes memory redeemerOutputScriptPayload =\n            abi.encodePacked(bytes8(0), redeemerOutputScript).extractHash();\n        require(\n            redeemerOutputScriptPayload.length > 0,\n            \"Redeemer output script must be a standard type\"\n        );\n        // Check if the redeemer output script payload does not point to the\n        // wallet public key hash.\n        require(\n            keccak256(abi.encodePacked(walletPubKeyHash)) !=\n                keccak256(redeemerOutputScriptPayload),\n            \"Redeemer output script must not point to the wallet PKH\"\n        );\n\n        require(\n            amount >= redemptionDustThreshold,\n            \"Redemption amount too small\"\n        );\n\n        // The redemption key is built on top of the wallet public key hash\n        // and redeemer output script pair. That means there can be only one\n        // request asking for redemption from the given wallet to the given\n        // BTC script at the same time.\n        uint256 redemptionKey =\n            uint256(\n                keccak256(\n                    abi.encodePacked(walletPubKeyHash, redeemerOutputScript)\n                )\n            );\n\n        // Check if given redemption key is not used by a pending redemption.\n        // There is no need to check for existence in `timedOutRedemptions`\n        // since the wallet's state is changed to other than Active after\n        // first time out is reported so making new requests is not possible.\n        // slither-disable-next-line incorrect-equality\n        require(\n            pendingRedemptions[redemptionKey].requestedAt == 0,\n            \"There is a pending redemption request from this wallet to the same address\"\n        );\n\n        uint64 treasuryFee = redemptionTreasuryFee;\n        uint64 txMaxFee = redemptionTxMaxFee;\n\n        // The main wallet UTXO's value doesn't include all pending redemptions.\n        // To determine if the requested redemption can be performed by the\n        // wallet we need to subtract the total value of all pending redemptions\n        // from that wallet's main UTXO value. Given that the treasury fee is\n        // not redeemed from the wallet, we are subtracting it.\n        wallets[walletPubKeyHash].pendingRedemptionsValue +=\n            amount -\n            treasuryFee;\n        require(\n            mainUtxo.txOutputValue >=\n                wallets[walletPubKeyHash].pendingRedemptionsValue,\n            \"Insufficient wallet funds\"\n        );\n\n        pendingRedemptions[redemptionKey] = RedemptionRequest(\n            msg.sender,\n            amount,\n            treasuryFee,\n            txMaxFee,\n            /* solhint-disable-next-line not-rely-on-time */\n            uint32(block.timestamp)\n        );\n\n        emit RedemptionRequested(\n            walletPubKeyHash,\n            redeemerOutputScript,\n            msg.sender,\n            amount,\n            treasuryFee,\n            txMaxFee\n        );\n\n        bank.transferBalanceFrom(msg.sender, address(this), amount);\n    }\n\n    /// @notice Used by the wallet to prove the BTC redemption transaction\n    ///         and to make the necessary bookkeeping. Redemption is only\n    ///         accepted if it satisfies SPV proof.\n    ///\n    ///         The function is performing Bank balance updates by burning\n    ///         the total redeemed Bitcoin amount from Bridge balance and\n    ///         transferring the treasury fee sum to the treasury address.\n    ///\n    ///         It is possible to prove the given redemption only one time.\n    /// @param redemptionTx Bitcoin redemption transaction data\n    /// @param redemptionProof Bitcoin redemption proof data\n    /// @param mainUtxo Data of the wallet's main UTXO, as currently known on\n    ///        the Ethereum chain\n    /// @param walletPubKeyHash 20-byte public key hash (computed using Bitcoin\n    ///        HASH160 over the compressed ECDSA public key) of the wallet which\n    ///        performed the redemption transaction\n    /// @dev Requirements:\n    ///      - `redemptionTx` components must match the expected structure. See\n    ///        `BitcoinTx.Info` docs for reference. Their values must exactly\n    ///        correspond to appropriate Bitcoin transaction fields to produce\n    ///        a provable transaction hash.\n    ///      - The `redemptionTx` should represent a Bitcoin transaction with\n    ///        exactly 1 input that refers to the wallet's main UTXO. That\n    ///        transaction should have 1..n outputs handling existing pending\n    ///        redemption requests or pointing to reported timed out requests.\n    ///        There can be also 1 optional output representing the\n    ///        change and pointing back to the 20-byte wallet public key hash.\n    ///        The change should be always present if the redeemed value sum\n    ///        is lower than the total wallet's BTC balance.\n    ///      - `redemptionProof` components must match the expected structure.\n    ///        See `BitcoinTx.Proof` docs for reference. The `bitcoinHeaders`\n    ///        field must contain a valid number of block headers, not less\n    ///        than the `txProofDifficultyFactor` contract constant.\n    ///      - `mainUtxo` components must point to the recent main UTXO\n    ///        of the given wallet, as currently known on the Ethereum chain.\n    ///        Additionally, the recent main UTXO on Ethereum must be set.\n    ///      - `walletPubKeyHash` must be connected with the main UTXO used\n    ///        as transaction single input.\n    ///      Other remarks:\n    ///      - Putting the change output as the first transaction output can\n    ///        save some gas because the output processing loop begins each\n    ///        iteration by checking whether the given output is the change\n    ///        thus uses some gas for making the comparison. Once the change\n    ///        is identified, that check is omitted in further iterations.\n    function submitRedemptionProof(\n        BitcoinTx.Info calldata redemptionTx,\n        BitcoinTx.Proof calldata redemptionProof,\n        BitcoinTx.UTXO calldata mainUtxo,\n        bytes20 walletPubKeyHash\n    ) external {\n        // TODO: Just as for `submitSweepProof`, fail early if the function\n        //       call gets frontrunned. See discussion:\n        //       https://github.com/keep-network/tbtc-v2/pull/106#discussion_r801745204\n\n        // The actual transaction proof is performed here. After that point, we\n        // can assume the transaction happened on Bitcoin chain and has\n        // a sufficient number of confirmations as determined by\n        // `txProofDifficultyFactor` constant.\n        bytes32 redemptionTxHash =\n            validateBitcoinTxProof(redemptionTx, redemptionProof);\n\n        // Perform validation of the redemption transaction input. Specifically,\n        // check if it refers to the expected wallet's main UTXO.\n        validateRedemptionTxInput(\n            redemptionTx.inputVector,\n            mainUtxo,\n            walletPubKeyHash\n        );\n\n        WalletState walletState = wallets[walletPubKeyHash].state;\n        require(\n            walletState == WalletState.Active ||\n                walletState == WalletState.MovingFunds,\n            \"Wallet must be in Active or MovingFuds state\"\n        );\n\n        // Process redemption transaction outputs to extract some info required\n        // for further processing.\n        RedemptionTxOutputsInfo memory outputsInfo =\n            processRedemptionTxOutputs(\n                redemptionTx.outputVector,\n                walletPubKeyHash\n            );\n\n        if (outputsInfo.changeValue > 0) {\n            // If the change value is grater than zero, it means the change\n            // output exists and can be used as new wallet's main UTXO.\n            mainUtxos[walletPubKeyHash] = keccak256(\n                abi.encodePacked(\n                    redemptionTxHash,\n                    outputsInfo.changeIndex,\n                    outputsInfo.changeValue\n                )\n            );\n        } else {\n            // If the change value is zero, it means the change output doesn't\n            // exists and no funds left on the wallet. Delete the main UTXO\n            // for that wallet to represent that state in a proper way.\n            delete mainUtxos[walletPubKeyHash];\n        }\n\n        wallets[walletPubKeyHash].pendingRedemptionsValue -= outputsInfo\n            .totalBurnableValue;\n\n        emit RedemptionsCompleted(walletPubKeyHash, redemptionTxHash);\n\n        bank.decreaseBalance(outputsInfo.totalBurnableValue);\n        bank.transferBalance(treasury, outputsInfo.totalTreasuryFee);\n    }\n\n    /// @notice Validates whether the redemption Bitcoin transaction input\n    ///         vector contains a single input referring to the wallet's main\n    ///         UTXO. Reverts in case the validation fails.\n    /// @param redemptionTxInputVector Bitcoin redemption transaction input\n    ///        vector. This function assumes vector's structure is valid so it\n    ///        must be validated using e.g. `BTCUtils.validateVin` function\n    ///        before it is passed here\n    /// @param mainUtxo Data of the wallet's main UTXO, as currently known on\n    ///        the Ethereum chain.\n    /// @param walletPubKeyHash 20-byte public key hash (computed using Bitcoin\n    //         HASH160 over the compressed ECDSA public key) of the wallet which\n    ///        performed the redemption transaction.\n    function validateRedemptionTxInput(\n        bytes memory redemptionTxInputVector,\n        BitcoinTx.UTXO calldata mainUtxo,\n        bytes20 walletPubKeyHash\n    ) internal view {\n        // Assert that main UTXO for passed wallet exists in storage.\n        bytes32 mainUtxoHash = mainUtxos[walletPubKeyHash];\n        require(mainUtxoHash != bytes32(0), \"No main UTXO for given wallet\");\n\n        // Assert that passed main UTXO parameter is the same as in storage and\n        // can be used for further processing.\n        require(\n            keccak256(\n                abi.encodePacked(\n                    mainUtxo.txHash,\n                    mainUtxo.txOutputIndex,\n                    mainUtxo.txOutputValue\n                )\n            ) == mainUtxoHash,\n            \"Invalid main UTXO data\"\n        );\n\n        // Assert that the single redemption transaction input actually\n        // refers to the wallet's main UTXO.\n        (bytes32 redemptionTxOutpointTxHash, uint32 redemptionTxOutpointIndex) =\n            processRedemptionTxInput(redemptionTxInputVector);\n        require(\n            mainUtxo.txHash == redemptionTxOutpointTxHash &&\n                mainUtxo.txOutputIndex == redemptionTxOutpointIndex,\n            \"Redemption transaction input must point to the wallet's main UTXO\"\n        );\n    }\n\n    /// @notice Processes the Bitcoin redemption transaction input vector. It\n    ///         extracts the single input then the transaction hash and output\n    ///         index from its outpoint.\n    /// @param redemptionTxInputVector Bitcoin redemption transaction input\n    ///        vector. This function assumes vector's structure is valid so it\n    ///        must be validated using e.g. `BTCUtils.validateVin` function\n    ///        before it is passed here\n    /// @return outpointTxHash 32-byte hash of the Bitcoin transaction which is\n    ///         pointed in the input's outpoint.\n    /// @return outpointIndex 4-byte index of the Bitcoin transaction output\n    ///         which is pointed in the input's outpoint.\n    function processRedemptionTxInput(bytes memory redemptionTxInputVector)\n        internal\n        pure\n        returns (bytes32 outpointTxHash, uint32 outpointIndex)\n    {\n        // To determine the total number of redemption transaction inputs,\n        // we need to parse the compactSize uint (VarInt) the input vector is\n        // prepended by. That compactSize uint encodes the number of vector\n        // elements using the format presented in:\n        // https://developer.bitcoin.org/reference/transactions.html#compactsize-unsigned-integers\n        // We don't need asserting the compactSize uint is parseable since it\n        // was already checked during `validateVin` validation.\n        // See `BitcoinTx.inputVector` docs for more details.\n        (, uint256 inputsCount) = redemptionTxInputVector.parseVarInt();\n        require(\n            inputsCount == 1,\n            \"Redemption transaction must have a single input\"\n        );\n\n        bytes memory input = redemptionTxInputVector.extractInputAtIndex(0);\n\n        outpointTxHash = input.extractInputTxIdLE();\n\n        outpointIndex = BTCUtils.reverseUint32(\n            uint32(input.extractTxIndexLE())\n        );\n\n        // There is only one input in the transaction. Input has an outpoint\n        // field that is a reference to the transaction being spent (see\n        // `BitcoinTx` docs). The outpoint contains the hash of the transaction\n        // to spend (`outpointTxHash`) and the index of the specific output\n        // from that transaction (`outpointIndex`).\n        return (outpointTxHash, outpointIndex);\n    }\n\n    /// @notice Processes the Bitcoin redemption transaction output vector.\n    ///         It extracts each output and tries to identify it as a pending\n    ///         redemption request, reported timed out request, or change.\n    ///         Reverts if one of the outputs cannot be recognized properly.\n    ///         This function also marks each request as processed by removing\n    ///         them from `pendingRedemptions` mapping.\n    /// @param redemptionTxOutputVector Bitcoin redemption transaction output\n    ///        vector. This function assumes vector's structure is valid so it\n    ///        must be validated using e.g. `BTCUtils.validateVout` function\n    ///        before it is passed here\n    /// @param walletPubKeyHash 20-byte public key hash (computed using Bitcoin\n    //         HASH160 over the compressed ECDSA public key) of the wallet which\n    ///        performed the redemption transaction.\n    /// @return info Outcomes of the processing.\n    function processRedemptionTxOutputs(\n        bytes memory redemptionTxOutputVector,\n        bytes20 walletPubKeyHash\n    ) internal returns (RedemptionTxOutputsInfo memory info) {\n        // Determining the total number of redemption transaction outputs in\n        // the same way as for number of inputs. See `BitcoinTx.outputVector`\n        // docs for more details.\n        (uint256 outputsCompactSizeUintLength, uint256 outputsCount) =\n            redemptionTxOutputVector.parseVarInt();\n\n        // To determine the first output starting index, we must jump over\n        // the compactSize uint which prepends the output vector. One byte\n        // must be added because `BtcUtils.parseVarInt` does not include\n        // compactSize uint tag in the returned length.\n        //\n        // For >= 0 && <= 252, `BTCUtils.determineVarIntDataLengthAt`\n        // returns `0`, so we jump over one byte of compactSize uint.\n        //\n        // For >= 253 && <= 0xffff there is `0xfd` tag,\n        // `BTCUtils.determineVarIntDataLengthAt` returns `2` (no\n        // tag byte included) so we need to jump over 1+2 bytes of\n        // compactSize uint.\n        //\n        // Please refer `BTCUtils` library and compactSize uint\n        // docs in `BitcoinTx` library for more details.\n        uint256 outputStartingIndex = 1 + outputsCompactSizeUintLength;\n\n        // Calculate the keccak256 for two possible wallet's P2PKH or P2WPKH\n        // scripts that can be used to lock the change. This is done upfront to\n        // save on gas. Both scripts have a strict format defined by Bitcoin.\n        //\n        // The P2PKH script has format <0x1976a914> <20-byte PKH> <0x88ac>.\n        bytes32 walletP2PKHScriptKeccak =\n            keccak256(\n                abi.encodePacked(hex\"1976a914\", walletPubKeyHash, hex\"88ac\")\n            );\n        // The P2WPKH script has format <0x160014> <20-byte PKH>.\n        bytes32 walletP2WPKHScriptKeccak =\n            keccak256(abi.encodePacked(hex\"160014\", walletPubKeyHash));\n\n        // Helper variable that counts the number of processed redemption\n        // outputs. Redemptions can be either pending or reported as timed out.\n        // TODO: Revisit the approach with redemptions count according to\n        //       https://github.com/keep-network/tbtc-v2/pull/128#discussion_r808237765\n        uint256 processedRedemptionsCount = 0;\n\n        // Outputs processing loop.\n        for (uint256 i = 0; i < outputsCount; i++) {\n            // TODO: Check if we can optimize gas costs by adding\n            //       `extractValueAt` and `extractHashAt` in `bitcoin-spv-sol`\n            //       in order to avoid allocating bytes in memory.\n            uint256 outputLength =\n                redemptionTxOutputVector.determineOutputLengthAt(\n                    outputStartingIndex\n                );\n            bytes memory output =\n                redemptionTxOutputVector.slice(\n                    outputStartingIndex,\n                    outputLength\n                );\n\n            // Extract the value from given output.\n            uint64 outputValue = output.extractValue();\n            // The output consists of an 8-byte value and a variable length\n            // script. To extract that script we slice the output staring from\n            // 9th byte until the end.\n            bytes memory outputScript = output.slice(8, output.length - 8);\n\n            if (\n                info.changeValue == 0 &&\n                (keccak256(outputScript) == walletP2PKHScriptKeccak ||\n                    keccak256(outputScript) == walletP2WPKHScriptKeccak) &&\n                outputValue > 0\n            ) {\n                // If we entered here, that means the change output with a\n                // proper non-zero value was found.\n                info.changeIndex = uint32(i);\n                info.changeValue = outputValue;\n            } else {\n                // If we entered here, that the means the given output is\n                // supposed to represent a redemption. Build the redemption key\n                // to perform that check.\n                uint256 redemptionKey =\n                    uint256(\n                        keccak256(\n                            abi.encodePacked(walletPubKeyHash, outputScript)\n                        )\n                    );\n\n                if (pendingRedemptions[redemptionKey].requestedAt != 0) {\n                    // If we entered here, that means the output was identified\n                    // as a pending redemption request.\n                    RedemptionRequest storage request =\n                        pendingRedemptions[redemptionKey];\n                    // Compute the request's redeemable amount as the requested\n                    // amount reduced by the treasury fee. The request's\n                    // minimal amount is then the redeemable amount reduced by\n                    // the maximum transaction fee.\n                    uint64 redeemableAmount =\n                        request.requestedAmount - request.treasuryFee;\n                    // Output value must fit between the request's redeemable\n                    // and minimal amounts to be deemed valid.\n                    require(\n                        redeemableAmount - request.txMaxFee <= outputValue &&\n                            outputValue <= redeemableAmount,\n                        \"Output value is not within the acceptable range of the pending request\"\n                    );\n                    // Add the redeemable amount to the total burnable value\n                    // the Bridge will use to decrease its balance in the Bank.\n                    info.totalBurnableValue += redeemableAmount;\n                    // Add the request's treasury fee to the total treasury fee\n                    // value the Bridge will transfer to the treasury.\n                    info.totalTreasuryFee += request.treasuryFee;\n                    // Request was properly handled so remove its redemption\n                    // key from the mapping to make it reusable for further\n                    // requests.\n                    delete pendingRedemptions[redemptionKey];\n\n                    processedRedemptionsCount++;\n                } else {\n                    // If we entered here, the output is not a redemption\n                    // request but there is still a chance the given output is\n                    // related to a reported timed out redemption request.\n                    // If so, check if the output value matches the request\n                    // amount to confirm this is an overdue request fulfillment\n                    // then bypass this output and process the subsequent\n                    // ones. That also means the wallet was already punished\n                    // for the inactivity. Otherwise, just revert.\n                    RedemptionRequest storage request =\n                        timedOutRedemptions[redemptionKey];\n\n                    require(\n                        request.requestedAt != 0,\n                        \"Output is a non-requested redemption\"\n                    );\n\n                    uint64 redeemableAmount =\n                        request.requestedAmount - request.treasuryFee;\n\n                    require(\n                        redeemableAmount - request.txMaxFee <= outputValue &&\n                            outputValue <= redeemableAmount,\n                        \"Output value is not within the acceptable range of the timed out request\"\n                    );\n\n                    processedRedemptionsCount++;\n                }\n            }\n\n            // Make the `outputStartingIndex` pointing to the next output by\n            // increasing it by current output's length.\n            outputStartingIndex += outputLength;\n        }\n\n        // Protect against the cases when there is only a single change output\n        // referring back to the wallet PKH and just burning main UTXO value\n        // for transaction fees.\n        require(\n            processedRedemptionsCount > 0,\n            \"Redemption transaction must process at least one redemption\"\n        );\n\n        return info;\n    }\n\n    // TODO: Function `notifyRedemptionTimeout. That function must:\n    //       1. Take a the `walletPubKey` and `redeemerOutputScript` as params.\n    //       2. Build the redemption key using those params.\n    //       3. Use the redemption key and take the request from\n    //          `pendingRedemptions` mapping.\n    //       4. If request doesn't exist in mapping - revert.\n    //       5. If request exits, and is timed out - remove the redemption key\n    //          from `pendingRedemptions` and put it to `timedOutRedemptions`\n    //          by copying the entire `RedemptionRequest` struct there. No need\n    //          to check if `timedOutRedemptions` mapping already contains\n    //          that key because `requestRedemption` blocks requests targeting\n    //          non-active wallets. Because `notifyRedemptionTimeout` changes\n    //          wallet state after first call (point 9), there is no possibility\n    //          that the given redemption key could be reported as timed out\n    //          multiple times. At the same time, if the given redemption key\n    //          was already marked as fraudulent due to an amount-related fraud,\n    //          it will not be possible to report a time out on it since it\n    //          won't be present in `pendingRedemptions` mapping.\n    //       6. Return the `requestedAmount` to the `redeemer`.\n    //       7. Reduce the `pendingRedemptionsValue` (`wallets` mapping) for\n    //          given wallet by request's redeemable amount computed as\n    //          `requestedAmount - treasuryFee`.\n    //       8. Punish the wallet, probably by slashing its operators.\n    //       9. Change wallet's state in `wallets` mapping to `MovingFunds` in\n    //          order to prevent against new redemption requests hitting\n    //          that wallet.\n    //      10. Expect the wallet to transfer its funds to another healthy\n    //          wallet (just as in case of failed heartbeat). The wallet is\n    //          expected to finish the already queued redemption requests\n    //          before moving funds but we are not going to enforce it on-chain.\n\n    // TODO: Function `submitRedemptionFraudProof`\n    //\n    //       Deposit and redemption fraud proofs are challenging to implement\n    //       and it may happen we will have to rely on the coverage pool\n    //       (https://github.com/keep-network/coverage-pools) and DAO to\n    //       reimburse unlucky depositors and bring back the balance to the\n    //       system in case  of a wallet fraud by liquidating a part of the\n    //       coverage pool manually.\n    //\n    //       The probability of 51-of-100 wallet being fraudulent is negligible:\n    //       https://github.com/keep-network/tbtc-v2/blob/main/docs/rfc/rfc-2.adoc#111-group-size-and-threshold\n    //       and the coverage pool would be there to bring the balance back in\n    //       case we are unlucky and malicious wallet emerges.\n    //\n    //       We do not want to slash for a misbehavior that is not provable\n    //       on-chain and it is possible to construct such a Bitcoin transaction\n    //       that is not provable on Ethereum, see\n    //       https://consensys.net/diligence/blog/2020/05/tbtc-navigating-the-cross-chain-conundrum\n    //\n    //       The algorithm described below assumes we will be able to prove the\n    //       TX on Ethereum which may not always be the case. Consider the steps\n    //       below as an idea, and not necessarily how this function will be\n    //       implemented because it may happen this function will never be\n    //       implemented, given the Bitcoin transaction size problems.\n    //\n    //       The algorithm:\n    //       1. Take a `BitcoinTx.Info` and `BitcoinTx.Proof` of the\n    //          fraudulent transaction. It should also accept `walletPubKeyHash`\n    //          and index of fraudulent output. Probably index of fraudulent\n    //          input will be also required if the transaction is supposed\n    //          to have a bad input vector.\n    //       2. Perform SPV proof to make sure it occurred on Bitcoin chain.\n    //          If not - revert.\n    //       3. Check if wallet state is Active or MovingFunds. If not, revert.\n    //       4. Validate the number of inputs. If there is one input and it\n    //          points to the wallet's main UTXO - move to point 5. If there\n    //          are multiple inputs and there is wallet's main UTXO in the set,\n    //          check if this is  a sweep transaction. If it's not a sweep,\n    //          consider it as fraudulent and move to point 6.\n    //          In all other cases revert the call.\n    //       5. Extract the output and analyze its type. The output is not\n    //          a fraud and the call should be reverted ONLY IF one of the\n    //          following conditions is true:\n    //          - Output is a requested redemption held by `pendingRedemptions`\n    //            and output value fulfills the request range. There is an\n    //            open question if a misfunded request should be removed\n    //            from `pendingRedemptions` (probably yes) and whether the\n    //            redeemer should be reimbursed in case of an underfund.\n    //          - Output is a timed out redemption held by `timedOutRedemptions`\n    //            and output value fulfills the request range.\n    //          - Output is a proper change i.e. a single output targeting\n    //            the wallet PKH back and having a non-zero value.\n    //          - Wallet is in MovingFunds state, the output points to the\n    //            expected target wallet, have non-zero value, and is a single\n    //            output in the vector.\n    //          In all other cases consider the transaction as fraud and\n    //          proceed to point 6.\n    //       6. Punish the wallet, probably by severely slashing its operators.\n    //       7. Change wallet's state in `wallets` mapping to `Terminated` in\n    //          order to prevent against new redemption requests hitting\n    //          that wallet. This also prevents against reporting a fraud\n    //          multiple times for one transaction (see point 3) and blocks\n    //          submission of sweep and redemption proofs. `Terminated` wallet\n    //          is blocked in the Bridge forever. If the fraud was a mistake\n    //          done by the wallet and the wallet is still honest deep in its\n    //          heart, the wallet can coordinate off-chain to recover the BTC\n    //          and donate it to another wallet. If they recover all of the\n    //          remaining BTC, DAO might decide to reward them with tokens so\n    //          that they can have at least some portion of their slashed\n    //          tokens back.\n}\n"
+      "content": "// SPDX-License-Identifier: MIT\n\n// ██████████████     ▐████▌     ██████████████\n// ██████████████     ▐████▌     ██████████████\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n// ██████████████     ▐████▌     ██████████████\n// ██████████████     ▐████▌     ██████████████\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n//               ▐████▌    ▐████▌\n\npragma solidity ^0.8.9;\n\nimport \"@openzeppelin/contracts/access/Ownable.sol\";\n\nimport {BTCUtils} from \"@keep-network/bitcoin-spv-sol/contracts/BTCUtils.sol\";\nimport {BytesLib} from \"@keep-network/bitcoin-spv-sol/contracts/BytesLib.sol\";\nimport {ValidateSPV} from \"@keep-network/bitcoin-spv-sol/contracts/ValidateSPV.sol\";\n\nimport \"../bank/Bank.sol\";\nimport \"./BitcoinTx.sol\";\n\n/// @title Interface for the Bitcoin relay\n/// @notice Contains only the methods needed by tBTC v2. The Bitcoin relay\n///         provides the difficulty of the previous and current epoch. One\n///         difficulty epoch spans 2016 blocks.\ninterface IRelay {\n    /// @notice Returns the difficulty of the current epoch.\n    function getCurrentEpochDifficulty() external view returns (uint256);\n\n    /// @notice Returns the difficulty of the previous epoch.\n    function getPrevEpochDifficulty() external view returns (uint256);\n}\n\n/// @title Bitcoin Bridge\n/// @notice Bridge manages BTC deposit and redemption flow and is increasing and\n///         decreasing balances in the Bank as a result of BTC deposit and\n///         redemption operations performed by depositors and redeemers.\n///\n///         Depositors send BTC funds to the most recently created off-chain\n///         ECDSA wallet of the bridge using pay-to-script-hash (P2SH) or\n///         pay-to-witness-script-hash (P2WSH) containing hashed information\n///         about the depositor’s Ethereum address. Then, the depositor reveals\n///         their Ethereum address along with their deposit blinding factor,\n///         refund public key hash and refund locktime to the Bridge on Ethereum\n///         chain. The off-chain ECDSA wallet listens for these sorts of\n///         messages and when it gets one, it checks the Bitcoin network to make\n///         sure the deposit lines up. If it does, the off-chain ECDSA wallet\n///         may decide to pick the deposit transaction for sweeping, and when\n///         the sweep operation is confirmed on the Bitcoin network, the ECDSA\n///         wallet informs the Bridge about the sweep increasing appropriate\n///         balances in the Bank.\n/// @dev Bridge is an upgradeable component of the Bank.\ncontract Bridge is Ownable {\n    using BTCUtils for bytes;\n    using BTCUtils for uint256;\n    using BytesLib for bytes;\n    using ValidateSPV for bytes;\n    using ValidateSPV for bytes32;\n\n    /// @notice Represents data which must be revealed by the depositor during\n    ///         deposit reveal.\n    struct RevealInfo {\n        // Index of the funding output belonging to the funding transaction.\n        uint32 fundingOutputIndex;\n        // Ethereum depositor address.\n        address depositor;\n        // The blinding factor as 8 bytes. Byte endianness doesn't matter\n        // as this factor is not interpreted as uint.\n        bytes8 blindingFactor;\n        // The compressed Bitcoin public key (33 bytes and 02 or 03 prefix)\n        // of the deposit's wallet hashed in the HASH160 Bitcoin opcode style.\n        bytes20 walletPubKeyHash;\n        // The compressed Bitcoin public key (33 bytes and 02 or 03 prefix)\n        // that can be used to make the deposit refund after the refund\n        // locktime passes. Hashed in the HASH160 Bitcoin opcode style.\n        bytes20 refundPubKeyHash;\n        // The refund locktime (4-byte LE). Interpreted according to locktime\n        // parsing rules described in:\n        // https://developer.bitcoin.org/devguide/transactions.html#locktime-and-sequence-number\n        // and used with OP_CHECKLOCKTIMEVERIFY opcode as described in:\n        // https://github.com/bitcoin/bips/blob/master/bip-0065.mediawiki\n        bytes4 refundLocktime;\n        // Address of the Bank vault to which the deposit is routed to.\n        // Optional, can be 0x0. The vault must be trusted by the Bridge.\n        address vault;\n    }\n\n    /// @notice Represents tBTC deposit data.\n    struct DepositRequest {\n        // Ethereum depositor address.\n        address depositor;\n        // Deposit amount in satoshi.\n        uint64 amount;\n        // UNIX timestamp the deposit was revealed at.\n        uint32 revealedAt;\n        // Address of the Bank vault the deposit is routed to.\n        // Optional, can be 0x0.\n        address vault;\n        // UNIX timestamp the deposit was swept at. Note this is not the\n        // time when the deposit was swept on the Bitcoin chain but actually\n        // the time when the sweep proof was delivered to the Ethereum chain.\n        uint32 sweptAt;\n    }\n\n    /// @notice Represents a redemption request.\n    struct RedemptionRequest {\n        // ETH address of the redeemer who created the request.\n        address redeemer;\n        // Requested TBTC amount in satoshi.\n        uint64 requestedAmount;\n        // Treasury TBTC fee in satoshi at the moment of request creation.\n        uint64 treasuryFee;\n        // Transaction maximum BTC fee in satoshi at the moment of request\n        // creation.\n        uint64 txMaxFee;\n        // UNIX timestamp the request was created at.\n        uint32 requestedAt;\n    }\n\n    /// @notice Represents an outcome of the redemption Bitcoin transaction\n    ///         outputs processing.\n    struct RedemptionTxOutputsInfo {\n        // Total TBTC value in satoshi that should be burned by the Bridge.\n        // It includes the total amount of all BTC redeemed in the transaction\n        // and the fee paid to BTC miners for the redemption transaction.\n        uint64 totalBurnableValue;\n        // Total TBTC value in satoshi that should be transferred to\n        // the treasury. It is a sum of all treasury fees paid by all\n        // redeemers included in the redemption transaction.\n        uint64 totalTreasuryFee;\n        // Index of the change output. The change output becomes\n        // the new main wallet's UTXO.\n        uint32 changeIndex;\n        // Value in satoshi of the change output.\n        uint64 changeValue;\n    }\n\n    /// @notice Represents wallet state:\n    enum WalletState {\n        /// @dev The wallet is unknown to the Bridge.\n        Unknown,\n        /// @dev The wallet can sweep deposits and accept redemption requests.\n        Active,\n        /// @dev The wallet was deemed unhealthy and is expected to move their\n        ///      outstanding funds to another wallet. The wallet can still\n        ///      fulfill their pending redemption requests although new\n        ///      redemption requests and new deposit reveals are not accepted.\n        MovingFunds,\n        /// @dev The wallet moved or redeemed all their funds and cannot\n        ///      perform any action.\n        Closed,\n        /// @dev The wallet committed a fraud that was reported. The wallet is\n        ///      blocked and can not perform any actions in the Bridge.\n        ///      Off-chain coordination with the wallet operators is needed to\n        ///      recover funds.\n        Terminated\n    }\n\n    /// @notice Holds information about a wallet.\n    struct Wallet {\n        // Current state of the wallet.\n        WalletState state;\n        // The total redeemable value of pending redemption requests targeting\n        // that wallet.\n        uint64 pendingRedemptionsValue;\n    }\n\n    /// @notice The number of confirmations on the Bitcoin chain required to\n    ///         successfully evaluate an SPV proof.\n    uint256 public immutable txProofDifficultyFactor;\n\n    /// TODO: Revisit whether it should be governable or not.\n    /// @notice Address of the Bank this Bridge belongs to.\n    Bank public immutable bank;\n\n    /// TODO: Make it governable.\n    /// @notice Handle to the Bitcoin relay.\n    IRelay public immutable relay;\n\n    /// TODO: Revisit whether it should be governable or not.\n    /// @notice Address where the redemptions treasury fees will be sent to.\n    ///         Treasury takes part in the operators rewarding process.\n    address public immutable treasury;\n\n    /// TODO: Make it governable.\n    /// @notice The minimal amount that can be requested for redemption.\n    ///         Value of this parameter should be always bigger than the sum\n    ///         of `redemptionTreasuryFee` and `redemptionTxMaxFee` to make\n    ///         redemptions possible.\n    uint64 public redemptionDustThreshold;\n\n    /// TODO: Make it governable.\n    /// @notice Amount of TBTC that is taken from each redemption request and\n    ///         transferred to the treasury upon successful request finalization.\n    uint64 public redemptionTreasuryFee;\n\n    /// TODO: Make it governable.\n    /// @notice Maximum amount of BTC transaction fee that can be incurred by\n    ///         each redemption request being part of the given redemption\n    ///         transaction. If the maximum BTC transaction fee is exceeded, such\n    ///         transaction is considered a fraud.\n    uint64 public redemptionTxMaxFee;\n\n    /// TODO: Make it governable.\n    /// @notice Time after which the redemption request can be reported as\n    ///         timed out. It is counted from the moment when the redemption\n    ///         request was created via `requestRedemption` call. Reported\n    ///         timed out requests are cancelled and locked TBTC is returned\n    ///         to the redeemer in full amount.\n    uint256 public redemptionTimeout;\n\n    /// @notice Indicates if the vault with the given address is trusted or not.\n    ///         Depositors can route their revealed deposits only to trusted\n    ///         vaults and have trusted vaults notified about new deposits as\n    ///         soon as these deposits get swept. Vaults not trusted by the\n    ///         Bridge can still be used by Bank balance owners on their own\n    ///         responsibility - anyone can approve their Bank balance to any\n    ///         address.\n    mapping(address => bool) public isVaultTrusted;\n\n    /// @notice Collection of all revealed deposits indexed by\n    ///         keccak256(fundingTxHash | fundingOutputIndex).\n    ///         The fundingTxHash is bytes32 (ordered as in Bitcoin internally)\n    ///         and fundingOutputIndex an uint32. This mapping may contain valid\n    ///         and invalid deposits and the wallet is responsible for\n    ///         validating them before attempting to execute a sweep.\n    mapping(uint256 => DepositRequest) public deposits;\n\n    /// @notice Maps the 20-byte wallet public key hash (computed using\n    ///         Bitcoin HASH160 over the compressed ECDSA public key) to\n    ///         the latest wallet's main UTXO computed as\n    ///         keccak256(txHash | txOutputIndex | txOutputValue). The `tx`\n    ///         prefix refers to the transaction which created that main UTXO.\n    ///         The txHash is bytes32 (ordered as in Bitcoin internally),\n    ///         txOutputIndex an uint32, and txOutputValue an uint64 value.\n    mapping(bytes20 => bytes32) public mainUtxos;\n\n    /// @notice Collection of all pending redemption requests indexed by\n    ///         redemption key built as\n    ///         keccak256(walletPubKeyHash | redeemerOutputScript). The\n    ///         walletPubKeyHash is the 20-byte wallet's public key hash\n    ///         (computed using Bitcoin HASH160 over the compressed ECDSA\n    ///         public key) and redeemerOutputScript is a Bitcoin script\n    ///         (P2PKH, P2WPKH, P2SH or P2WSH) that will be used to lock\n    ///         redeemed BTC as requested by the redeemer. Requests are added\n    ///         to this mapping by the `requestRedemption` method (duplicates\n    ///         not allowed) and are removed by one of the following methods:\n    ///         - `submitRedemptionProof` in case the request was handled\n    ///           successfully\n    ///         - `notifyRedemptionTimeout` in case the request was reported\n    ///           to be timed out\n    ///         - `submitRedemptionFraudProof` in case the request was handled\n    ///           in an fraudulent way amount-wise.\n    mapping(uint256 => RedemptionRequest) public pendingRedemptions;\n\n    /// @notice Collection of all timed out redemptions requests indexed by\n    ///         redemption key built as\n    ///         keccak256(walletPubKeyHash | redeemerOutputScript). The\n    ///         walletPubKeyHash is the 20-byte wallet's public key hash\n    ///         (computed using Bitcoin HASH160 over the compressed ECDSA\n    ///         public key) and redeemerOutputScript is the Bitcoin script\n    ///         (P2PKH, P2WPKH, P2SH or P2WSH) that is involved in the timed\n    ///         out request. Timed out requests are stored in this mapping to\n    ///         avoid slashing the wallets multiple times for the same timeout.\n    ///         Only one method can add to this mapping:\n    ///         - `notifyRedemptionTimeout` which puts the redemption key\n    ///           to this mapping basing on a timed out request stored\n    ///           previously in `pendingRedemptions` mapping.\n    ///\n    // TODO: Remove that Slither disable once this variable is used.\n    // slither-disable-next-line uninitialized-state\n    mapping(uint256 => RedemptionRequest) public timedOutRedemptions;\n\n    /// @notice Maps the 20-byte wallet public key hash (computed using\n    ///         Bitcoin HASH160 over the compressed ECDSA public key) to the\n    ///         basic wallet information like state and pending\n    ///         redemptions value.\n    ///\n    // TODO: Remove that Slither disable once this variable is used.\n    // slither-disable-next-line uninitialized-state\n    mapping(bytes20 => Wallet) public wallets;\n\n    event VaultStatusUpdated(address indexed vault, bool isTrusted);\n\n    event DepositRevealed(\n        bytes32 fundingTxHash,\n        uint32 fundingOutputIndex,\n        address depositor,\n        uint64 amount,\n        bytes8 blindingFactor,\n        bytes20 walletPubKeyHash,\n        bytes20 refundPubKeyHash,\n        bytes4 refundLocktime,\n        address vault\n    );\n\n    event DepositsSwept(bytes20 walletPubKeyHash, bytes32 sweepTxHash);\n\n    event RedemptionRequested(\n        bytes20 walletPubKeyHash,\n        bytes redeemerOutputScript,\n        address redeemer,\n        uint64 requestedAmount,\n        uint64 treasuryFee,\n        uint64 txMaxFee\n    );\n\n    event RedemptionsCompleted(\n        bytes20 walletPubKeyHash,\n        bytes32 redemptionTxHash\n    );\n\n    constructor(\n        address _bank,\n        address _relay,\n        address _treasury,\n        uint256 _txProofDifficultyFactor\n    ) {\n        require(_bank != address(0), \"Bank address cannot be zero\");\n        bank = Bank(_bank);\n\n        require(_relay != address(0), \"Relay address cannot be zero\");\n        relay = IRelay(_relay);\n\n        require(_treasury != address(0), \"Treasury address cannot be zero\");\n        treasury = _treasury;\n\n        txProofDifficultyFactor = _txProofDifficultyFactor;\n\n        // TODO: Revisit initial values.\n        redemptionDustThreshold = 1000000; // 1000000 satoshi = 0.01 BTC\n        redemptionTreasuryFee = 100000; // 100000 satoshi\n        redemptionTxMaxFee = 1000; // 1000 satoshi\n        redemptionTimeout = 172800; // 48 hours\n    }\n\n    // TODO: Add function `onNewWalletCreated` according to discussion:\n    //       https://github.com/keep-network/tbtc-v2/pull/128#discussion_r809885230\n\n    /// @notice Allows the Governance to mark the given vault address as trusted\n    ///         or no longer trusted. Vaults are not trusted by default.\n    ///         Trusted vault must meet the following criteria:\n    ///         - `IVault.receiveBalanceIncrease` must have a known, low gas\n    ///           cost.\n    ///         - `IVault.receiveBalanceIncrease` must never revert.\n    /// @dev Without restricting reveal only to trusted vaults, malicious\n    ///      vaults not meeting the criteria would be able to nuke sweep proof\n    ///      transactions executed by ECDSA wallet with  deposits routed to\n    ///      them.\n    /// @param vault The address of the vault\n    /// @param isTrusted flag indicating whether the vault is trusted or not\n    /// @dev Can only be called by the Governance.\n    function setVaultStatus(address vault, bool isTrusted) external onlyOwner {\n        isVaultTrusted[vault] = isTrusted;\n        emit VaultStatusUpdated(vault, isTrusted);\n    }\n\n    /// @notice Used by the depositor to reveal information about their P2(W)SH\n    ///         Bitcoin deposit to the Bridge on Ethereum chain. The off-chain\n    ///         wallet listens for revealed deposit events and may decide to\n    ///         include the revealed deposit in the next executed sweep.\n    ///         Information about the Bitcoin deposit can be revealed before or\n    ///         after the Bitcoin transaction with P2(W)SH deposit is mined on\n    ///         the Bitcoin chain. Worth noting, the gas cost of this function\n    ///         scales with the number of P2(W)SH transaction inputs and\n    ///         outputs. The deposit may be routed to one of the trusted vaults.\n    ///         When a deposit is routed to a vault, vault gets notified when\n    ///         the deposit gets swept and it may execute the appropriate action.\n    /// @param fundingTx Bitcoin funding transaction data, see `BitcoinTx.Info`\n    /// @param reveal Deposit reveal data, see `RevealInfo struct\n    /// @dev Requirements:\n    ///      - `reveal.vault` must be 0x0 or point to a trusted vault\n    ///      - `reveal.fundingOutputIndex` must point to the actual P2(W)SH\n    ///        output of the BTC deposit transaction\n    ///      - `reveal.depositor` must be the Ethereum address used in the\n    ///        P2(W)SH BTC deposit transaction,\n    ///      - `reveal.blindingFactor` must be the blinding factor used in the\n    ///        P2(W)SH BTC deposit transaction,\n    ///      - `reveal.walletPubKeyHash` must be the wallet pub key hash used in\n    ///        the P2(W)SH BTC deposit transaction,\n    ///      - `reveal.refundPubKeyHash` must be the refund pub key hash used in\n    ///        the P2(W)SH BTC deposit transaction,\n    ///      - `reveal.refundLocktime` must be the refund locktime used in the\n    ///        P2(W)SH BTC deposit transaction,\n    ///      - BTC deposit for the given `fundingTxHash`, `fundingOutputIndex`\n    ///        can be revealed only one time.\n    ///\n    ///      If any of these requirements is not met, the wallet _must_ refuse\n    ///      to sweep the deposit and the depositor has to wait until the\n    ///      deposit script unlocks to receive their BTC back.\n    function revealDeposit(\n        BitcoinTx.Info calldata fundingTx,\n        RevealInfo calldata reveal\n    ) external {\n        require(\n            reveal.vault == address(0) || isVaultTrusted[reveal.vault],\n            \"Vault is not trusted\"\n        );\n\n        // TODO: Validate if `walletPubKeyHash` is a known and active wallet.\n        // TODO: Should we enforce a specific locktime at contract level?\n\n        bytes memory expectedScript = abi.encodePacked(\n            hex\"14\", // Byte length of depositor Ethereum address.\n            reveal.depositor,\n            hex\"75\", // OP_DROP\n            hex\"08\", // Byte length of blinding factor value.\n            reveal.blindingFactor,\n            hex\"75\", // OP_DROP\n            hex\"76\", // OP_DUP\n            hex\"a9\", // OP_HASH160\n            hex\"14\", // Byte length of a compressed Bitcoin public key hash.\n            reveal.walletPubKeyHash,\n            hex\"87\", // OP_EQUAL\n            hex\"63\", // OP_IF\n            hex\"ac\", // OP_CHECKSIG\n            hex\"67\", // OP_ELSE\n            hex\"76\", // OP_DUP\n            hex\"a9\", // OP_HASH160\n            hex\"14\", // Byte length of a compressed Bitcoin public key hash.\n            reveal.refundPubKeyHash,\n            hex\"88\", // OP_EQUALVERIFY\n            hex\"04\", // Byte length of refund locktime value.\n            reveal.refundLocktime,\n            hex\"b1\", // OP_CHECKLOCKTIMEVERIFY\n            hex\"75\", // OP_DROP\n            hex\"ac\", // OP_CHECKSIG\n            hex\"68\" // OP_ENDIF\n        );\n\n        bytes memory fundingOutput = fundingTx\n            .outputVector\n            .extractOutputAtIndex(reveal.fundingOutputIndex);\n        bytes memory fundingOutputHash = fundingOutput.extractHash();\n\n        if (fundingOutputHash.length == 20) {\n            // A 20-byte output hash is used by P2SH. That hash is constructed\n            // by applying OP_HASH160 on the locking script. A 20-byte output\n            // hash is used as well by P2PKH and P2WPKH (OP_HASH160 on the\n            // public key). However, since we compare the actual output hash\n            // with an expected locking script hash, this check will succeed only\n            // for P2SH transaction type with expected script hash value. For\n            // P2PKH and P2WPKH, it will fail on the output hash comparison with\n            // the expected locking script hash.\n            require(\n                fundingOutputHash.slice20(0) == expectedScript.hash160View(),\n                \"Wrong 20-byte script hash\"\n            );\n        } else if (fundingOutputHash.length == 32) {\n            // A 32-byte output hash is used by P2WSH. That hash is constructed\n            // by applying OP_SHA256 on the locking script.\n            require(\n                fundingOutputHash.toBytes32() == sha256(expectedScript),\n                \"Wrong 32-byte script hash\"\n            );\n        } else {\n            revert(\"Wrong script hash length\");\n        }\n\n        // Resulting TX hash is in native Bitcoin little-endian format.\n        bytes32 fundingTxHash = abi\n            .encodePacked(\n                fundingTx.version,\n                fundingTx.inputVector,\n                fundingTx.outputVector,\n                fundingTx.locktime\n            )\n            .hash256View();\n\n        DepositRequest storage deposit = deposits[\n            uint256(\n                keccak256(\n                    abi.encodePacked(fundingTxHash, reveal.fundingOutputIndex)\n                )\n            )\n        ];\n        require(deposit.revealedAt == 0, \"Deposit already revealed\");\n\n        uint64 fundingOutputAmount = fundingOutput.extractValue();\n\n        // TODO: Check the amount against the dust threshold.\n\n        deposit.amount = fundingOutputAmount;\n        deposit.depositor = reveal.depositor;\n        /* solhint-disable-next-line not-rely-on-time */\n        deposit.revealedAt = uint32(block.timestamp);\n        deposit.vault = reveal.vault;\n\n        emit DepositRevealed(\n            fundingTxHash,\n            reveal.fundingOutputIndex,\n            reveal.depositor,\n            fundingOutputAmount,\n            reveal.blindingFactor,\n            reveal.walletPubKeyHash,\n            reveal.refundPubKeyHash,\n            reveal.refundLocktime,\n            reveal.vault\n        );\n    }\n\n    /// @notice Used by the wallet to prove the BTC deposit sweep transaction\n    ///         and to update Bank balances accordingly. Sweep is only accepted\n    ///         if it satisfies SPV proof.\n    ///\n    ///         The function is performing Bank balance updates by first\n    ///         computing the Bitcoin fee for the sweep transaction. The fee is\n    ///         divided evenly between all swept deposits. Each depositor\n    ///         receives a balance in the bank equal to the amount inferred\n    ///         during the reveal transaction, minus their fee share.\n    ///\n    ///         It is possible to prove the given sweep only one time.\n    /// @param sweepTx Bitcoin sweep transaction data\n    /// @param sweepProof Bitcoin sweep proof data\n    /// @param mainUtxo Data of the wallet's main UTXO, as currently known on\n    ///        the Ethereum chain. If no main UTXO exists for the given wallet,\n    ///        this parameter is ignored\n    /// @dev Requirements:\n    ///      - `sweepTx` components must match the expected structure. See\n    ///        `BitcoinTx.Info` docs for reference. Their values must exactly\n    ///        correspond to appropriate Bitcoin transaction fields to produce\n    ///        a provable transaction hash.\n    ///      - The `sweepTx` should represent a Bitcoin transaction with 1..n\n    ///        inputs. If the wallet has no main UTXO, all n inputs should\n    ///        correspond to P2(W)SH revealed deposits UTXOs. If the wallet has\n    ///        an existing main UTXO, one of the n inputs must point to that\n    ///        main UTXO and remaining n-1 inputs should correspond to P2(W)SH\n    ///        revealed deposits UTXOs. That transaction must have only\n    ///        one P2(W)PKH output locking funds on the 20-byte wallet public\n    ///        key hash.\n    ///      - `sweepProof` components must match the expected structure. See\n    ///        `BitcoinTx.Proof` docs for reference. The `bitcoinHeaders`\n    ///        field must contain a valid number of block headers, not less\n    ///        than the `txProofDifficultyFactor` contract constant.\n    ///      - `mainUtxo` components must point to the recent main UTXO\n    ///        of the given wallet, as currently known on the Ethereum chain.\n    ///        If there is no main UTXO, this parameter is ignored.\n    function submitSweepProof(\n        BitcoinTx.Info calldata sweepTx,\n        BitcoinTx.Proof calldata sweepProof,\n        BitcoinTx.UTXO calldata mainUtxo\n    ) external {\n        // TODO: Fail early if the function call gets frontrunned. See discussion:\n        //       https://github.com/keep-network/tbtc-v2/pull/106#discussion_r801745204\n\n        // The actual transaction proof is performed here. After that point, we\n        // can assume the transaction happened on Bitcoin chain and has\n        // a sufficient number of confirmations as determined by\n        // `txProofDifficultyFactor` constant.\n        bytes32 sweepTxHash = validateBitcoinTxProof(sweepTx, sweepProof);\n\n        // Process sweep transaction output and extract its target wallet\n        // public key hash and value.\n        (\n            bytes20 walletPubKeyHash,\n            uint64 sweepTxOutputValue\n        ) = processSweepTxOutput(sweepTx.outputVector);\n\n        // TODO: Validate if `walletPubKeyHash` is a known and active wallet.\n\n        // Check if the main UTXO for given wallet exists. If so, validate\n        // passed main UTXO data against the stored hash and use them for\n        // further processing. If no main UTXO exists, use empty data.\n        BitcoinTx.UTXO memory resolvedMainUtxo = BitcoinTx.UTXO(\n            bytes32(0),\n            0,\n            0\n        );\n        bytes32 mainUtxoHash = mainUtxos[walletPubKeyHash];\n        if (mainUtxoHash != bytes32(0)) {\n            require(\n                keccak256(\n                    abi.encodePacked(\n                        mainUtxo.txHash,\n                        mainUtxo.txOutputIndex,\n                        mainUtxo.txOutputValue\n                    )\n                ) == mainUtxoHash,\n                \"Invalid main UTXO data\"\n            );\n            resolvedMainUtxo = mainUtxo;\n        }\n\n        // Process sweep transaction inputs and extract their value sum and\n        // all information needed to perform deposit bookkeeping.\n        (\n            uint256 sweepTxInputsValue,\n            address[] memory depositors,\n            uint256[] memory depositedAmounts\n        ) = processSweepTxInputs(sweepTx.inputVector, resolvedMainUtxo);\n\n        // Compute the sweep transaction fee which is a difference between\n        // inputs amounts sum and the output amount.\n        // TODO: Check fee against max fee.\n        uint256 fee = sweepTxInputsValue - sweepTxOutputValue;\n        // Calculate fee share by dividing the total fee by deposits count.\n        // TODO: Deal with precision loss by having the last depositor pay\n        //       the higher fee than others if there is a change, just like it has\n        //       been proposed for the redemption flow. See:\n        //       https://github.com/keep-network/tbtc-v2/pull/128#discussion_r800555359.\n        uint256 feeShare = fee / depositedAmounts.length;\n        // Reduce each deposit amount by fee share value.\n        for (uint256 i = 0; i < depositedAmounts.length; i++) {\n            // We don't have to check if `feeShare` is bigger than the amount\n            // since we have the dust threshold preventing against too small\n            // deposits amounts.\n            depositedAmounts[i] -= feeShare;\n        }\n\n        // Record this sweep data and assign them to the wallet public key hash\n        // as new main UTXO. Transaction output index is always 0 as sweep\n        // transaction always contains only one output.\n        mainUtxos[walletPubKeyHash] = keccak256(\n            abi.encodePacked(sweepTxHash, uint32(0), sweepTxOutputValue)\n        );\n\n        emit DepositsSwept(walletPubKeyHash, sweepTxHash);\n\n        // Update depositors balances in the Bank.\n        bank.increaseBalances(depositors, depositedAmounts);\n\n        // TODO: Handle deposits having `vault` set.\n    }\n\n    /// @notice Validates the SPV proof of the Bitcoin transaction.\n    ///         Reverts in case the validation or proof verification fail.\n    /// @param txInfo Bitcoin transaction data\n    /// @param proof Bitcoin proof data\n    /// @return txHash Proven 32-byte transaction hash.\n    function validateBitcoinTxProof(\n        BitcoinTx.Info calldata txInfo,\n        BitcoinTx.Proof calldata proof\n    ) internal view returns (bytes32 txHash) {\n        require(\n            txInfo.inputVector.validateVin(),\n            \"Invalid input vector provided\"\n        );\n        require(\n            txInfo.outputVector.validateVout(),\n            \"Invalid output vector provided\"\n        );\n\n        txHash = abi\n            .encodePacked(\n                txInfo.version,\n                txInfo.inputVector,\n                txInfo.outputVector,\n                txInfo.locktime\n            )\n            .hash256View();\n\n        checkProofFromTxHash(txHash, proof);\n\n        return txHash;\n    }\n\n    /// @notice Checks the given Bitcoin transaction hash against the SPV proof.\n    ///         Reverts in case the check fails.\n    /// @param txHash 32-byte hash of the checked Bitcoin transaction\n    /// @param proof Bitcoin proof data\n    function checkProofFromTxHash(\n        bytes32 txHash,\n        BitcoinTx.Proof calldata proof\n    ) internal view {\n        require(\n            txHash.prove(\n                proof.bitcoinHeaders.extractMerkleRootLE(),\n                proof.merkleProof,\n                proof.txIndexInBlock\n            ),\n            \"Tx merkle proof is not valid for provided header and tx hash\"\n        );\n\n        evaluateProofDifficulty(proof.bitcoinHeaders);\n    }\n\n    /// @notice Evaluates the given Bitcoin proof difficulty against the actual\n    ///         Bitcoin chain difficulty provided by the relay oracle.\n    ///         Reverts in case the evaluation fails.\n    /// @param bitcoinHeaders Bitcoin headers chain being part of the SPV\n    ///        proof. Used to extract the observed proof difficulty\n    function evaluateProofDifficulty(bytes memory bitcoinHeaders)\n        internal\n        view\n    {\n        uint256 requestedDiff = 0;\n        uint256 currentDiff = relay.getCurrentEpochDifficulty();\n        uint256 previousDiff = relay.getPrevEpochDifficulty();\n        uint256 firstHeaderDiff = bitcoinHeaders\n            .extractTarget()\n            .calculateDifficulty();\n\n        if (firstHeaderDiff == currentDiff) {\n            requestedDiff = currentDiff;\n        } else if (firstHeaderDiff == previousDiff) {\n            requestedDiff = previousDiff;\n        } else {\n            revert(\"Not at current or previous difficulty\");\n        }\n\n        uint256 observedDiff = bitcoinHeaders.validateHeaderChain();\n\n        require(\n            observedDiff != ValidateSPV.getErrBadLength(),\n            \"Invalid length of the headers chain\"\n        );\n        require(\n            observedDiff != ValidateSPV.getErrInvalidChain(),\n            \"Invalid headers chain\"\n        );\n        require(\n            observedDiff != ValidateSPV.getErrLowWork(),\n            \"Insufficient work in a header\"\n        );\n\n        require(\n            observedDiff >= requestedDiff * txProofDifficultyFactor,\n            \"Insufficient accumulated difficulty in header chain\"\n        );\n    }\n\n    /// @notice Processes the Bitcoin sweep transaction output vector by\n    ///         extracting the single output and using it to gain additional\n    ///         information required for further processing (e.g. value and\n    ///         wallet public key hash).\n    /// @param sweepTxOutputVector Bitcoin sweep transaction output vector.\n    ///        This function assumes vector's structure is valid so it must be\n    ///        validated using e.g. `BTCUtils.validateVout` function before\n    ///        it is passed here\n    /// @return walletPubKeyHash 20-byte wallet public key hash.\n    /// @return value 8-byte sweep transaction output value.\n    function processSweepTxOutput(bytes memory sweepTxOutputVector)\n        internal\n        pure\n        returns (bytes20 walletPubKeyHash, uint64 value)\n    {\n        // To determine the total number of sweep transaction outputs, we need to\n        // parse the compactSize uint (VarInt) the output vector is prepended by.\n        // That compactSize uint encodes the number of vector elements using the\n        // format presented in:\n        // https://developer.bitcoin.org/reference/transactions.html#compactsize-unsigned-integers\n        // We don't need asserting the compactSize uint is parseable since it\n        // was already checked during `validateVout` validation.\n        // See `BitcoinTx.outputVector` docs for more details.\n        (, uint256 outputsCount) = sweepTxOutputVector.parseVarInt();\n        require(\n            outputsCount == 1,\n            \"Sweep transaction must have a single output\"\n        );\n\n        bytes memory output = sweepTxOutputVector.extractOutputAtIndex(0);\n        value = output.extractValue();\n        bytes memory walletPubKeyHashBytes = output.extractHash();\n        // The sweep transaction output should always be P2PKH or P2WPKH.\n        // In both cases, the wallet public key hash should be 20 bytes length.\n        require(\n            walletPubKeyHashBytes.length == 20,\n            \"Wallet public key hash should have 20 bytes\"\n        );\n        /* solhint-disable-next-line no-inline-assembly */\n        assembly {\n            walletPubKeyHash := mload(add(walletPubKeyHashBytes, 32))\n        }\n\n        return (walletPubKeyHash, value);\n    }\n\n    /// @notice Processes the Bitcoin sweep transaction input vector. It\n    ///         extracts each input and tries to obtain associated deposit or\n    ///         main UTXO data, depending on the input type. Reverts\n    ///         if one of the inputs cannot be recognized as a pointer to a\n    ///         revealed deposit or expected main UTXO.\n    ///         This function also marks each processed deposit as swept.\n    /// @param sweepTxInputVector Bitcoin sweep transaction input vector.\n    ///        This function assumes vector's structure is valid so it must be\n    ///        validated using e.g. `BTCUtils.validateVin` function before\n    ///        it is passed here\n    /// @param mainUtxo Data of the wallet's main UTXO. If no main UTXO\n    ///        exists for the given the wallet, this parameter's fields should\n    ///        be zeroed to bypass the main UTXO validation\n    /// @return inputsTotalValue Sum of all inputs values i.e. all deposits and\n    ///         main UTXO value, if present.\n    /// @return depositors Addresses of depositors who performed processed\n    ///         deposits. Ordered in the same order as deposits inputs in the\n    ///         input vector. Size of this array is either equal to the\n    ///         number of inputs (main UTXO doesn't exist) or less by one\n    ///         (main UTXO exists and is pointed by one of the inputs).\n    /// @return depositedAmounts Amounts of deposits corresponding to processed\n    ///         deposits. Ordered in the same order as deposits inputs in the\n    ///         input vector. Size of this array is either equal to the\n    ///         number of inputs (main UTXO doesn't exist) or less by one\n    ///         (main UTXO exists and is pointed by one of the inputs).\n    function processSweepTxInputs(\n        bytes memory sweepTxInputVector,\n        BitcoinTx.UTXO memory mainUtxo\n    )\n        internal\n        returns (\n            uint256 inputsTotalValue,\n            address[] memory depositors,\n            uint256[] memory depositedAmounts\n        )\n    {\n        // If the passed `mainUtxo` parameter's values are zeroed, the main UTXO\n        // for the given wallet doesn't exist and it is not expected to be\n        // included in the sweep transaction input vector.\n        bool mainUtxoExpected = mainUtxo.txHash != bytes32(0);\n        bool mainUtxoFound = false;\n\n        // Determining the total number of sweep transaction inputs in the same\n        // way as for number of outputs. See `BitcoinTx.inputVector` docs for\n        // more details.\n        (\n            uint256 inputsCompactSizeUintLength,\n            uint256 inputsCount\n        ) = sweepTxInputVector.parseVarInt();\n\n        // To determine the first input starting index, we must jump over\n        // the compactSize uint which prepends the input vector. One byte\n        // must be added because `BtcUtils.parseVarInt` does not include\n        // compactSize uint tag in the returned length.\n        //\n        // For >= 0 && <= 252, `BTCUtils.determineVarIntDataLengthAt`\n        // returns `0`, so we jump over one byte of compactSize uint.\n        //\n        // For >= 253 && <= 0xffff there is `0xfd` tag,\n        // `BTCUtils.determineVarIntDataLengthAt` returns `2` (no\n        // tag byte included) so we need to jump over 1+2 bytes of\n        // compactSize uint.\n        //\n        // Please refer `BTCUtils` library and compactSize uint\n        // docs in `BitcoinTx` library for more details.\n        uint256 inputStartingIndex = 1 + inputsCompactSizeUintLength;\n\n        // Determine the swept deposits count. If main UTXO is NOT expected,\n        // all inputs should be deposits. If main UTXO is expected, one input\n        // should point to that main UTXO.\n        depositors = new address[](\n            !mainUtxoExpected ? inputsCount : inputsCount - 1\n        );\n        depositedAmounts = new uint256[](depositors.length);\n\n        // Initialize helper variables.\n        uint256 processedDepositsCount = 0;\n\n        // Inputs processing loop.\n        for (uint256 i = 0; i < inputsCount; i++) {\n            (\n                bytes32 outpointTxHash,\n                uint32 outpointIndex,\n                uint256 inputLength\n            ) = parseTxInputAt(sweepTxInputVector, inputStartingIndex);\n\n            DepositRequest storage deposit = deposits[\n                uint256(\n                    keccak256(abi.encodePacked(outpointTxHash, outpointIndex))\n                )\n            ];\n\n            if (deposit.revealedAt != 0) {\n                // If we entered here, that means the input was identified as\n                // a revealed deposit.\n                require(deposit.sweptAt == 0, \"Deposit already swept\");\n\n                if (processedDepositsCount == depositors.length) {\n                    // If this condition is true, that means a deposit input\n                    // took place of an expected main UTXO input.\n                    // In other words, there is no expected main UTXO\n                    // input and all inputs come from valid, revealed deposits.\n                    revert(\n                        \"Expected main UTXO not present in sweep transaction inputs\"\n                    );\n                }\n\n                /* solhint-disable-next-line not-rely-on-time */\n                deposit.sweptAt = uint32(block.timestamp);\n\n                depositors[processedDepositsCount] = deposit.depositor;\n                depositedAmounts[processedDepositsCount] = deposit.amount;\n                inputsTotalValue += depositedAmounts[processedDepositsCount];\n\n                processedDepositsCount++;\n            } else if (\n                mainUtxoExpected != mainUtxoFound &&\n                mainUtxo.txHash == outpointTxHash\n            ) {\n                // If we entered here, that means the input was identified as\n                // the expected main UTXO.\n                inputsTotalValue += mainUtxo.txOutputValue;\n                mainUtxoFound = true;\n            } else {\n                revert(\"Unknown input type\");\n            }\n\n            // Make the `inputStartingIndex` pointing to the next input by\n            // increasing it by current input's length.\n            inputStartingIndex += inputLength;\n        }\n\n        // Construction of the input processing loop guarantees that:\n        // `processedDepositsCount == depositors.length == depositedAmounts.length`\n        // is always true at this point. We just use the first variable\n        // to assert the total count of swept deposit is bigger than zero.\n        require(\n            processedDepositsCount > 0,\n            \"Sweep transaction must process at least one deposit\"\n        );\n\n        // Assert the main UTXO was used as one of current sweep's inputs if\n        // it was actually expected.\n        require(\n            mainUtxoExpected == mainUtxoFound,\n            \"Expected main UTXO not present in sweep transaction inputs\"\n        );\n\n        return (inputsTotalValue, depositors, depositedAmounts);\n    }\n\n    /// @notice Parses a Bitcoin transaction input starting at the given index.\n    /// @param inputVector Bitcoin transaction input vector\n    /// @param inputStartingIndex Index the given input starts at\n    /// @return outpointTxHash 32-byte hash of the Bitcoin transaction which is\n    ///         pointed in the given input's outpoint.\n    /// @return outpointIndex 4-byte index of the Bitcoin transaction output\n    ///         which is pointed in the given input's outpoint.\n    /// @return inputLength Byte length of the given input.\n    /// @dev This function assumes vector's structure is valid so it must be\n    ///      validated using e.g. `BTCUtils.validateVin` function before it\n    ///      is passed here.\n    function parseTxInputAt(\n        bytes memory inputVector,\n        uint256 inputStartingIndex\n    )\n        internal\n        pure\n        returns (\n            bytes32 outpointTxHash,\n            uint32 outpointIndex,\n            uint256 inputLength\n        )\n    {\n        outpointTxHash = inputVector.extractInputTxIdLeAt(inputStartingIndex);\n\n        outpointIndex = BTCUtils.reverseUint32(\n            uint32(inputVector.extractTxIndexLeAt(inputStartingIndex))\n        );\n\n        inputLength = inputVector.determineInputLengthAt(inputStartingIndex);\n\n        return (outpointTxHash, outpointIndex, inputLength);\n    }\n\n    /// @notice Requests redemption of the given amount from the specified\n    ///         wallet to the redeemer Bitcoin output script.\n    /// @param walletPubKeyHash The 20-byte wallet public key hash (computed\n    //         using Bitcoin HASH160 over the compressed ECDSA public key)\n    /// @param mainUtxo Data of the wallet's main UTXO, as currently known on\n    ///        the Ethereum chain\n    /// @param redeemerOutputScript The redeemer's length-prefixed output\n    ///        script (P2PKH, P2WPKH, P2SH or P2WSH) that will be used to lock\n    ///        redeemed BTC\n    /// @param amount Requested amount in satoshi. This is also the TBTC amount\n    ///        that is taken from redeemer's balance in the Bank upon request.\n    ///        Once the request is handled, the actual amount of BTC locked\n    ///        on the redeemer output script will be always lower than this value\n    ///        since the treasury and Bitcoin transaction fees must be incurred.\n    ///        The minimal amount satisfying the request can be computed as:\n    ///        `amount - redemptionTreasuryFee - redemptionTxMaxFee`.\n    ///        Fees values are taken at the moment of request creation.\n    /// @dev Requirements:\n    ///      - Wallet behind `walletPubKeyHash` must be active\n    ///      - `mainUtxo` components must point to the recent main UTXO\n    ///        of the given wallet, as currently known on the Ethereum chain.\n    ///      - `redeemerOutputScript` must be a proper Bitcoin script\n    ///      - `redeemerOutputScript` cannot have wallet PKH as payload\n    ///      - `amount` must be above or equal the `redemptionDustThreshold`\n    ///      - Given `walletPubKeyHash` and `redeemerOutputScript` pair can be\n    ///        used for only one pending request at the same time\n    ///      - Wallet must have enough Bitcoin balance to proceed the request\n    ///      - Redeemer must make an allowance in the Bank that the Bridge\n    ///        contract can spend the given `amount`.\n    function requestRedemption(\n        bytes20 walletPubKeyHash,\n        BitcoinTx.UTXO calldata mainUtxo,\n        bytes calldata redeemerOutputScript,\n        uint64 amount\n    ) external {\n        require(\n            wallets[walletPubKeyHash].state == WalletState.Active,\n            \"Wallet must be in Active state\"\n        );\n\n        bytes32 mainUtxoHash = mainUtxos[walletPubKeyHash];\n        require(\n            mainUtxoHash != bytes32(0),\n            \"No main UTXO for the given wallet\"\n        );\n        require(\n            keccak256(\n                abi.encodePacked(\n                    mainUtxo.txHash,\n                    mainUtxo.txOutputIndex,\n                    mainUtxo.txOutputValue\n                )\n            ) == mainUtxoHash,\n            \"Invalid main UTXO data\"\n        );\n\n        // TODO: Confirm if `walletPubKeyHash` should be validated by checking\n        //       if it is the oldest one who can handle the request. This will\n        //       be suggested by the dApp but may not be respected by users who\n        //       interact directly with the contract. Do we need to enforce it\n        //       here? One option is not to enforce it, to save on gas, but if\n        //       we see this rule is not respected, upgrade Bridge contract to\n        //       require it.\n\n        // Validate if redeemer output script is a correct standard type\n        // (P2PKH, P2WPKH, P2SH or P2WSH). This is done by building a stub\n        // output with 0 as value and using `BTCUtils.extractHash` on it. Such\n        // a function extracts the payload properly only from standard outputs\n        // so if it succeeds, we have a guarantee the redeemer output script\n        // is proper. Worth to note `extractHash` ignores the value at all\n        // so this is why we can use 0 safely. This way of validation is the\n        // same as in tBTC v1.\n        bytes memory redeemerOutputScriptPayload = abi\n            .encodePacked(bytes8(0), redeemerOutputScript)\n            .extractHash();\n        require(\n            redeemerOutputScriptPayload.length > 0,\n            \"Redeemer output script must be a standard type\"\n        );\n        // Check if the redeemer output script payload does not point to the\n        // wallet public key hash.\n        require(\n            keccak256(abi.encodePacked(walletPubKeyHash)) !=\n                keccak256(redeemerOutputScriptPayload),\n            \"Redeemer output script must not point to the wallet PKH\"\n        );\n\n        require(\n            amount >= redemptionDustThreshold,\n            \"Redemption amount too small\"\n        );\n\n        // The redemption key is built on top of the wallet public key hash\n        // and redeemer output script pair. That means there can be only one\n        // request asking for redemption from the given wallet to the given\n        // BTC script at the same time.\n        uint256 redemptionKey = uint256(\n            keccak256(abi.encodePacked(walletPubKeyHash, redeemerOutputScript))\n        );\n\n        // Check if given redemption key is not used by a pending redemption.\n        // There is no need to check for existence in `timedOutRedemptions`\n        // since the wallet's state is changed to other than Active after\n        // first time out is reported so making new requests is not possible.\n        // slither-disable-next-line incorrect-equality\n        require(\n            pendingRedemptions[redemptionKey].requestedAt == 0,\n            \"There is a pending redemption request from this wallet to the same address\"\n        );\n\n        uint64 treasuryFee = redemptionTreasuryFee;\n        uint64 txMaxFee = redemptionTxMaxFee;\n\n        // The main wallet UTXO's value doesn't include all pending redemptions.\n        // To determine if the requested redemption can be performed by the\n        // wallet we need to subtract the total value of all pending redemptions\n        // from that wallet's main UTXO value. Given that the treasury fee is\n        // not redeemed from the wallet, we are subtracting it.\n        wallets[walletPubKeyHash].pendingRedemptionsValue +=\n            amount -\n            treasuryFee;\n        require(\n            mainUtxo.txOutputValue >=\n                wallets[walletPubKeyHash].pendingRedemptionsValue,\n            \"Insufficient wallet funds\"\n        );\n\n        pendingRedemptions[redemptionKey] = RedemptionRequest(\n            msg.sender,\n            amount,\n            treasuryFee,\n            txMaxFee,\n            /* solhint-disable-next-line not-rely-on-time */\n            uint32(block.timestamp)\n        );\n\n        emit RedemptionRequested(\n            walletPubKeyHash,\n            redeemerOutputScript,\n            msg.sender,\n            amount,\n            treasuryFee,\n            txMaxFee\n        );\n\n        bank.transferBalanceFrom(msg.sender, address(this), amount);\n    }\n\n    /// @notice Used by the wallet to prove the BTC redemption transaction\n    ///         and to make the necessary bookkeeping. Redemption is only\n    ///         accepted if it satisfies SPV proof.\n    ///\n    ///         The function is performing Bank balance updates by burning\n    ///         the total redeemed Bitcoin amount from Bridge balance and\n    ///         transferring the treasury fee sum to the treasury address.\n    ///\n    ///         It is possible to prove the given redemption only one time.\n    /// @param redemptionTx Bitcoin redemption transaction data\n    /// @param redemptionProof Bitcoin redemption proof data\n    /// @param mainUtxo Data of the wallet's main UTXO, as currently known on\n    ///        the Ethereum chain\n    /// @param walletPubKeyHash 20-byte public key hash (computed using Bitcoin\n    ///        HASH160 over the compressed ECDSA public key) of the wallet which\n    ///        performed the redemption transaction\n    /// @dev Requirements:\n    ///      - `redemptionTx` components must match the expected structure. See\n    ///        `BitcoinTx.Info` docs for reference. Their values must exactly\n    ///        correspond to appropriate Bitcoin transaction fields to produce\n    ///        a provable transaction hash.\n    ///      - The `redemptionTx` should represent a Bitcoin transaction with\n    ///        exactly 1 input that refers to the wallet's main UTXO. That\n    ///        transaction should have 1..n outputs handling existing pending\n    ///        redemption requests or pointing to reported timed out requests.\n    ///        There can be also 1 optional output representing the\n    ///        change and pointing back to the 20-byte wallet public key hash.\n    ///        The change should be always present if the redeemed value sum\n    ///        is lower than the total wallet's BTC balance.\n    ///      - `redemptionProof` components must match the expected structure.\n    ///        See `BitcoinTx.Proof` docs for reference. The `bitcoinHeaders`\n    ///        field must contain a valid number of block headers, not less\n    ///        than the `txProofDifficultyFactor` contract constant.\n    ///      - `mainUtxo` components must point to the recent main UTXO\n    ///        of the given wallet, as currently known on the Ethereum chain.\n    ///        Additionally, the recent main UTXO on Ethereum must be set.\n    ///      - `walletPubKeyHash` must be connected with the main UTXO used\n    ///        as transaction single input.\n    ///      Other remarks:\n    ///      - Putting the change output as the first transaction output can\n    ///        save some gas because the output processing loop begins each\n    ///        iteration by checking whether the given output is the change\n    ///        thus uses some gas for making the comparison. Once the change\n    ///        is identified, that check is omitted in further iterations.\n    function submitRedemptionProof(\n        BitcoinTx.Info calldata redemptionTx,\n        BitcoinTx.Proof calldata redemptionProof,\n        BitcoinTx.UTXO calldata mainUtxo,\n        bytes20 walletPubKeyHash\n    ) external {\n        // TODO: Just as for `submitSweepProof`, fail early if the function\n        //       call gets frontrunned. See discussion:\n        //       https://github.com/keep-network/tbtc-v2/pull/106#discussion_r801745204\n\n        // The actual transaction proof is performed here. After that point, we\n        // can assume the transaction happened on Bitcoin chain and has\n        // a sufficient number of confirmations as determined by\n        // `txProofDifficultyFactor` constant.\n        bytes32 redemptionTxHash = validateBitcoinTxProof(\n            redemptionTx,\n            redemptionProof\n        );\n\n        // Perform validation of the redemption transaction input. Specifically,\n        // check if it refers to the expected wallet's main UTXO.\n        validateRedemptionTxInput(\n            redemptionTx.inputVector,\n            mainUtxo,\n            walletPubKeyHash\n        );\n\n        WalletState walletState = wallets[walletPubKeyHash].state;\n        require(\n            walletState == WalletState.Active ||\n                walletState == WalletState.MovingFunds,\n            \"Wallet must be in Active or MovingFuds state\"\n        );\n\n        // Process redemption transaction outputs to extract some info required\n        // for further processing.\n        RedemptionTxOutputsInfo memory outputsInfo = processRedemptionTxOutputs(\n            redemptionTx.outputVector,\n            walletPubKeyHash\n        );\n\n        if (outputsInfo.changeValue > 0) {\n            // If the change value is grater than zero, it means the change\n            // output exists and can be used as new wallet's main UTXO.\n            mainUtxos[walletPubKeyHash] = keccak256(\n                abi.encodePacked(\n                    redemptionTxHash,\n                    outputsInfo.changeIndex,\n                    outputsInfo.changeValue\n                )\n            );\n        } else {\n            // If the change value is zero, it means the change output doesn't\n            // exists and no funds left on the wallet. Delete the main UTXO\n            // for that wallet to represent that state in a proper way.\n            delete mainUtxos[walletPubKeyHash];\n        }\n\n        wallets[walletPubKeyHash].pendingRedemptionsValue -= outputsInfo\n            .totalBurnableValue;\n\n        emit RedemptionsCompleted(walletPubKeyHash, redemptionTxHash);\n\n        bank.decreaseBalance(outputsInfo.totalBurnableValue);\n        bank.transferBalance(treasury, outputsInfo.totalTreasuryFee);\n    }\n\n    /// @notice Validates whether the redemption Bitcoin transaction input\n    ///         vector contains a single input referring to the wallet's main\n    ///         UTXO. Reverts in case the validation fails.\n    /// @param redemptionTxInputVector Bitcoin redemption transaction input\n    ///        vector. This function assumes vector's structure is valid so it\n    ///        must be validated using e.g. `BTCUtils.validateVin` function\n    ///        before it is passed here\n    /// @param mainUtxo Data of the wallet's main UTXO, as currently known on\n    ///        the Ethereum chain.\n    /// @param walletPubKeyHash 20-byte public key hash (computed using Bitcoin\n    //         HASH160 over the compressed ECDSA public key) of the wallet which\n    ///        performed the redemption transaction.\n    function validateRedemptionTxInput(\n        bytes memory redemptionTxInputVector,\n        BitcoinTx.UTXO calldata mainUtxo,\n        bytes20 walletPubKeyHash\n    ) internal view {\n        // Assert that main UTXO for passed wallet exists in storage.\n        bytes32 mainUtxoHash = mainUtxos[walletPubKeyHash];\n        require(mainUtxoHash != bytes32(0), \"No main UTXO for given wallet\");\n\n        // Assert that passed main UTXO parameter is the same as in storage and\n        // can be used for further processing.\n        require(\n            keccak256(\n                abi.encodePacked(\n                    mainUtxo.txHash,\n                    mainUtxo.txOutputIndex,\n                    mainUtxo.txOutputValue\n                )\n            ) == mainUtxoHash,\n            \"Invalid main UTXO data\"\n        );\n\n        // Assert that the single redemption transaction input actually\n        // refers to the wallet's main UTXO.\n        (\n            bytes32 redemptionTxOutpointTxHash,\n            uint32 redemptionTxOutpointIndex\n        ) = processRedemptionTxInput(redemptionTxInputVector);\n        require(\n            mainUtxo.txHash == redemptionTxOutpointTxHash &&\n                mainUtxo.txOutputIndex == redemptionTxOutpointIndex,\n            \"Redemption transaction input must point to the wallet's main UTXO\"\n        );\n    }\n\n    /// @notice Processes the Bitcoin redemption transaction input vector. It\n    ///         extracts the single input then the transaction hash and output\n    ///         index from its outpoint.\n    /// @param redemptionTxInputVector Bitcoin redemption transaction input\n    ///        vector. This function assumes vector's structure is valid so it\n    ///        must be validated using e.g. `BTCUtils.validateVin` function\n    ///        before it is passed here\n    /// @return outpointTxHash 32-byte hash of the Bitcoin transaction which is\n    ///         pointed in the input's outpoint.\n    /// @return outpointIndex 4-byte index of the Bitcoin transaction output\n    ///         which is pointed in the input's outpoint.\n    function processRedemptionTxInput(bytes memory redemptionTxInputVector)\n        internal\n        pure\n        returns (bytes32 outpointTxHash, uint32 outpointIndex)\n    {\n        // To determine the total number of redemption transaction inputs,\n        // we need to parse the compactSize uint (VarInt) the input vector is\n        // prepended by. That compactSize uint encodes the number of vector\n        // elements using the format presented in:\n        // https://developer.bitcoin.org/reference/transactions.html#compactsize-unsigned-integers\n        // We don't need asserting the compactSize uint is parseable since it\n        // was already checked during `validateVin` validation.\n        // See `BitcoinTx.inputVector` docs for more details.\n        (, uint256 inputsCount) = redemptionTxInputVector.parseVarInt();\n        require(\n            inputsCount == 1,\n            \"Redemption transaction must have a single input\"\n        );\n\n        bytes memory input = redemptionTxInputVector.extractInputAtIndex(0);\n\n        outpointTxHash = input.extractInputTxIdLE();\n\n        outpointIndex = BTCUtils.reverseUint32(\n            uint32(input.extractTxIndexLE())\n        );\n\n        // There is only one input in the transaction. Input has an outpoint\n        // field that is a reference to the transaction being spent (see\n        // `BitcoinTx` docs). The outpoint contains the hash of the transaction\n        // to spend (`outpointTxHash`) and the index of the specific output\n        // from that transaction (`outpointIndex`).\n        return (outpointTxHash, outpointIndex);\n    }\n\n    /// @notice Processes the Bitcoin redemption transaction output vector.\n    ///         It extracts each output and tries to identify it as a pending\n    ///         redemption request, reported timed out request, or change.\n    ///         Reverts if one of the outputs cannot be recognized properly.\n    ///         This function also marks each request as processed by removing\n    ///         them from `pendingRedemptions` mapping.\n    /// @param redemptionTxOutputVector Bitcoin redemption transaction output\n    ///        vector. This function assumes vector's structure is valid so it\n    ///        must be validated using e.g. `BTCUtils.validateVout` function\n    ///        before it is passed here\n    /// @param walletPubKeyHash 20-byte public key hash (computed using Bitcoin\n    //         HASH160 over the compressed ECDSA public key) of the wallet which\n    ///        performed the redemption transaction.\n    /// @return info Outcomes of the processing.\n    function processRedemptionTxOutputs(\n        bytes memory redemptionTxOutputVector,\n        bytes20 walletPubKeyHash\n    ) internal returns (RedemptionTxOutputsInfo memory info) {\n        // Determining the total number of redemption transaction outputs in\n        // the same way as for number of inputs. See `BitcoinTx.outputVector`\n        // docs for more details.\n        (\n            uint256 outputsCompactSizeUintLength,\n            uint256 outputsCount\n        ) = redemptionTxOutputVector.parseVarInt();\n\n        // To determine the first output starting index, we must jump over\n        // the compactSize uint which prepends the output vector. One byte\n        // must be added because `BtcUtils.parseVarInt` does not include\n        // compactSize uint tag in the returned length.\n        //\n        // For >= 0 && <= 252, `BTCUtils.determineVarIntDataLengthAt`\n        // returns `0`, so we jump over one byte of compactSize uint.\n        //\n        // For >= 253 && <= 0xffff there is `0xfd` tag,\n        // `BTCUtils.determineVarIntDataLengthAt` returns `2` (no\n        // tag byte included) so we need to jump over 1+2 bytes of\n        // compactSize uint.\n        //\n        // Please refer `BTCUtils` library and compactSize uint\n        // docs in `BitcoinTx` library for more details.\n        uint256 outputStartingIndex = 1 + outputsCompactSizeUintLength;\n\n        // Calculate the keccak256 for two possible wallet's P2PKH or P2WPKH\n        // scripts that can be used to lock the change. This is done upfront to\n        // save on gas. Both scripts have a strict format defined by Bitcoin.\n        //\n        // The P2PKH script has format <0x1976a914> <20-byte PKH> <0x88ac>.\n        bytes32 walletP2PKHScriptKeccak = keccak256(\n            abi.encodePacked(hex\"1976a914\", walletPubKeyHash, hex\"88ac\")\n        );\n        // The P2WPKH script has format <0x160014> <20-byte PKH>.\n        bytes32 walletP2WPKHScriptKeccak = keccak256(\n            abi.encodePacked(hex\"160014\", walletPubKeyHash)\n        );\n\n        // Helper variable that counts the number of processed redemption\n        // outputs. Redemptions can be either pending or reported as timed out.\n        // TODO: Revisit the approach with redemptions count according to\n        //       https://github.com/keep-network/tbtc-v2/pull/128#discussion_r808237765\n        uint256 processedRedemptionsCount = 0;\n\n        // Outputs processing loop.\n        for (uint256 i = 0; i < outputsCount; i++) {\n            // TODO: Check if we can optimize gas costs by adding\n            //       `extractValueAt` and `extractHashAt` in `bitcoin-spv-sol`\n            //       in order to avoid allocating bytes in memory.\n            uint256 outputLength = redemptionTxOutputVector\n                .determineOutputLengthAt(outputStartingIndex);\n            bytes memory output = redemptionTxOutputVector.slice(\n                outputStartingIndex,\n                outputLength\n            );\n\n            // Extract the value from given output.\n            uint64 outputValue = output.extractValue();\n            // The output consists of an 8-byte value and a variable length\n            // script. To extract that script we slice the output staring from\n            // 9th byte until the end.\n            bytes memory outputScript = output.slice(8, output.length - 8);\n\n            if (\n                info.changeValue == 0 &&\n                (keccak256(outputScript) == walletP2PKHScriptKeccak ||\n                    keccak256(outputScript) == walletP2WPKHScriptKeccak) &&\n                outputValue > 0\n            ) {\n                // If we entered here, that means the change output with a\n                // proper non-zero value was found.\n                info.changeIndex = uint32(i);\n                info.changeValue = outputValue;\n            } else {\n                // If we entered here, that the means the given output is\n                // supposed to represent a redemption. Build the redemption key\n                // to perform that check.\n                uint256 redemptionKey = uint256(\n                    keccak256(abi.encodePacked(walletPubKeyHash, outputScript))\n                );\n\n                if (pendingRedemptions[redemptionKey].requestedAt != 0) {\n                    // If we entered here, that means the output was identified\n                    // as a pending redemption request.\n                    RedemptionRequest storage request = pendingRedemptions[\n                        redemptionKey\n                    ];\n                    // Compute the request's redeemable amount as the requested\n                    // amount reduced by the treasury fee. The request's\n                    // minimal amount is then the redeemable amount reduced by\n                    // the maximum transaction fee.\n                    uint64 redeemableAmount = request.requestedAmount -\n                        request.treasuryFee;\n                    // Output value must fit between the request's redeemable\n                    // and minimal amounts to be deemed valid.\n                    require(\n                        redeemableAmount - request.txMaxFee <= outputValue &&\n                            outputValue <= redeemableAmount,\n                        \"Output value is not within the acceptable range of the pending request\"\n                    );\n                    // Add the redeemable amount to the total burnable value\n                    // the Bridge will use to decrease its balance in the Bank.\n                    info.totalBurnableValue += redeemableAmount;\n                    // Add the request's treasury fee to the total treasury fee\n                    // value the Bridge will transfer to the treasury.\n                    info.totalTreasuryFee += request.treasuryFee;\n                    // Request was properly handled so remove its redemption\n                    // key from the mapping to make it reusable for further\n                    // requests.\n                    delete pendingRedemptions[redemptionKey];\n\n                    processedRedemptionsCount++;\n                } else {\n                    // If we entered here, the output is not a redemption\n                    // request but there is still a chance the given output is\n                    // related to a reported timed out redemption request.\n                    // If so, check if the output value matches the request\n                    // amount to confirm this is an overdue request fulfillment\n                    // then bypass this output and process the subsequent\n                    // ones. That also means the wallet was already punished\n                    // for the inactivity. Otherwise, just revert.\n                    RedemptionRequest storage request = timedOutRedemptions[\n                        redemptionKey\n                    ];\n\n                    require(\n                        request.requestedAt != 0,\n                        \"Output is a non-requested redemption\"\n                    );\n\n                    uint64 redeemableAmount = request.requestedAmount -\n                        request.treasuryFee;\n\n                    require(\n                        redeemableAmount - request.txMaxFee <= outputValue &&\n                            outputValue <= redeemableAmount,\n                        \"Output value is not within the acceptable range of the timed out request\"\n                    );\n\n                    processedRedemptionsCount++;\n                }\n            }\n\n            // Make the `outputStartingIndex` pointing to the next output by\n            // increasing it by current output's length.\n            outputStartingIndex += outputLength;\n        }\n\n        // Protect against the cases when there is only a single change output\n        // referring back to the wallet PKH and just burning main UTXO value\n        // for transaction fees.\n        require(\n            processedRedemptionsCount > 0,\n            \"Redemption transaction must process at least one redemption\"\n        );\n\n        return info;\n    }\n\n    // TODO: Function `notifyRedemptionTimeout. That function must:\n    //       1. Take a the `walletPubKey` and `redeemerOutputScript` as params.\n    //       2. Build the redemption key using those params.\n    //       3. Use the redemption key and take the request from\n    //          `pendingRedemptions` mapping.\n    //       4. If request doesn't exist in mapping - revert.\n    //       5. If request exits, and is timed out - remove the redemption key\n    //          from `pendingRedemptions` and put it to `timedOutRedemptions`\n    //          by copying the entire `RedemptionRequest` struct there. No need\n    //          to check if `timedOutRedemptions` mapping already contains\n    //          that key because `requestRedemption` blocks requests targeting\n    //          non-active wallets. Because `notifyRedemptionTimeout` changes\n    //          wallet state after first call (point 9), there is no possibility\n    //          that the given redemption key could be reported as timed out\n    //          multiple times. At the same time, if the given redemption key\n    //          was already marked as fraudulent due to an amount-related fraud,\n    //          it will not be possible to report a time out on it since it\n    //          won't be present in `pendingRedemptions` mapping.\n    //       6. Return the `requestedAmount` to the `redeemer`.\n    //       7. Reduce the `pendingRedemptionsValue` (`wallets` mapping) for\n    //          given wallet by request's redeemable amount computed as\n    //          `requestedAmount - treasuryFee`.\n    //       8. Punish the wallet, probably by slashing its operators.\n    //       9. Change wallet's state in `wallets` mapping to `MovingFunds` in\n    //          order to prevent against new redemption requests hitting\n    //          that wallet.\n    //      10. Expect the wallet to transfer its funds to another healthy\n    //          wallet (just as in case of failed heartbeat). The wallet is\n    //          expected to finish the already queued redemption requests\n    //          before moving funds but we are not going to enforce it on-chain.\n\n    // TODO: Function `submitRedemptionFraudProof`\n    //\n    //       Deposit and redemption fraud proofs are challenging to implement\n    //       and it may happen we will have to rely on the coverage pool\n    //       (https://github.com/keep-network/coverage-pools) and DAO to\n    //       reimburse unlucky depositors and bring back the balance to the\n    //       system in case  of a wallet fraud by liquidating a part of the\n    //       coverage pool manually.\n    //\n    //       The probability of 51-of-100 wallet being fraudulent is negligible:\n    //       https://github.com/keep-network/tbtc-v2/blob/main/docs/rfc/rfc-2.adoc#111-group-size-and-threshold\n    //       and the coverage pool would be there to bring the balance back in\n    //       case we are unlucky and malicious wallet emerges.\n    //\n    //       We do not want to slash for a misbehavior that is not provable\n    //       on-chain and it is possible to construct such a Bitcoin transaction\n    //       that is not provable on Ethereum, see\n    //       https://consensys.net/diligence/blog/2020/05/tbtc-navigating-the-cross-chain-conundrum\n    //\n    //       The algorithm described below assumes we will be able to prove the\n    //       TX on Ethereum which may not always be the case. Consider the steps\n    //       below as an idea, and not necessarily how this function will be\n    //       implemented because it may happen this function will never be\n    //       implemented, given the Bitcoin transaction size problems.\n    //\n    //       The algorithm:\n    //       1. Take a `BitcoinTx.Info` and `BitcoinTx.Proof` of the\n    //          fraudulent transaction. It should also accept `walletPubKeyHash`\n    //          and index of fraudulent output. Probably index of fraudulent\n    //          input will be also required if the transaction is supposed\n    //          to have a bad input vector.\n    //       2. Perform SPV proof to make sure it occurred on Bitcoin chain.\n    //          If not - revert.\n    //       3. Check if wallet state is Active or MovingFunds. If not, revert.\n    //       4. Validate the number of inputs. If there is one input and it\n    //          points to the wallet's main UTXO - move to point 5. If there\n    //          are multiple inputs and there is wallet's main UTXO in the set,\n    //          check if this is  a sweep transaction. If it's not a sweep,\n    //          consider it as fraudulent and move to point 6.\n    //          In all other cases revert the call.\n    //       5. Extract the output and analyze its type. The output is not\n    //          a fraud and the call should be reverted ONLY IF one of the\n    //          following conditions is true:\n    //          - Output is a requested redemption held by `pendingRedemptions`\n    //            and output value fulfills the request range. There is an\n    //            open question if a misfunded request should be removed\n    //            from `pendingRedemptions` (probably yes) and whether the\n    //            redeemer should be reimbursed in case of an underfund.\n    //          - Output is a timed out redemption held by `timedOutRedemptions`\n    //            and output value fulfills the request range.\n    //          - Output is a proper change i.e. a single output targeting\n    //            the wallet PKH back and having a non-zero value.\n    //          - Wallet is in MovingFunds state, the output points to the\n    //            expected target wallet, have non-zero value, and is a single\n    //            output in the vector.\n    //          In all other cases consider the transaction as fraud and\n    //          proceed to point 6.\n    //       6. Punish the wallet, probably by severely slashing its operators.\n    //       7. Change wallet's state in `wallets` mapping to `Terminated` in\n    //          order to prevent against new redemption requests hitting\n    //          that wallet. This also prevents against reporting a fraud\n    //          multiple times for one transaction (see point 3) and blocks\n    //          submission of sweep and redemption proofs. `Terminated` wallet\n    //          is blocked in the Bridge forever. If the fraud was a mistake\n    //          done by the wallet and the wallet is still honest deep in its\n    //          heart, the wallet can coordinate off-chain to recover the BTC\n    //          and donate it to another wallet. If they recover all of the\n    //          remaining BTC, DAO might decide to reward them with tokens so\n    //          that they can have at least some portion of their slashed\n    //          tokens back.\n}\n"
     },
     "@keep-network/bitcoin-spv-sol/contracts/BTCUtils.sol": {
       "content": "pragma solidity ^0.8.4;\n\n/** @title BitcoinSPV */\n/** @author Summa (https://summa.one) */\n\nimport {BytesLib} from \"./BytesLib.sol\";\nimport {SafeMath} from \"./SafeMath.sol\";\n\nlibrary BTCUtils {\n    using BytesLib for bytes;\n    using SafeMath for uint256;\n\n    // The target at minimum Difficulty. Also the target of the genesis block\n    uint256 public constant DIFF1_TARGET = 0xffff0000000000000000000000000000000000000000000000000000;\n\n    uint256 public constant RETARGET_PERIOD = 2 * 7 * 24 * 60 * 60;  // 2 weeks in seconds\n    uint256 public constant RETARGET_PERIOD_BLOCKS = 2016;  // 2 weeks in blocks\n\n    uint256 public constant ERR_BAD_ARG = 0xffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffffff;\n\n    /* ***** */\n    /* UTILS */\n    /* ***** */\n\n    /// @notice         Determines the length of a VarInt in bytes\n    /// @dev            A VarInt of >1 byte is prefixed with a flag indicating its length\n    /// @param _flag    The first byte of a VarInt\n    /// @return         The number of non-flag bytes in the VarInt\n    function determineVarIntDataLength(bytes memory _flag) internal pure returns (uint8) {\n        return determineVarIntDataLengthAt(_flag, 0);\n    }\n\n    /// @notice         Determines the length of a VarInt in bytes\n    /// @dev            A VarInt of >1 byte is prefixed with a flag indicating its length\n    /// @param _b       The byte array containing a VarInt\n    /// @param _at      The position of the VarInt in the array\n    /// @return         The number of non-flag bytes in the VarInt\n    function determineVarIntDataLengthAt(bytes memory _b, uint256 _at) internal pure returns (uint8) {\n        if (uint8(_b[_at]) == 0xff) {\n            return 8;  // one-byte flag, 8 bytes data\n        }\n        if (uint8(_b[_at]) == 0xfe) {\n            return 4;  // one-byte flag, 4 bytes data\n        }\n        if (uint8(_b[_at]) == 0xfd) {\n            return 2;  // one-byte flag, 2 bytes data\n        }\n\n        return 0;  // flag is data\n    }\n\n    /// @notice     Parse a VarInt into its data length and the number it represents\n    /// @dev        Useful for Parsing Vins and Vouts. Returns ERR_BAD_ARG if insufficient bytes.\n    ///             Caller SHOULD explicitly handle this case (or bubble it up)\n    /// @param _b   A byte-string starting with a VarInt\n    /// @return     number of bytes in the encoding (not counting the tag), the encoded int\n    function parseVarInt(bytes memory _b) internal pure returns (uint256, uint256) {\n        return parseVarIntAt(_b, 0);\n    }\n\n    /// @notice     Parse a VarInt into its data length and the number it represents\n    /// @dev        Useful for Parsing Vins and Vouts. Returns ERR_BAD_ARG if insufficient bytes.\n    ///             Caller SHOULD explicitly handle this case (or bubble it up)\n    /// @param _b   A byte-string containing a VarInt\n    /// @param _at  The position of the VarInt\n    /// @return     number of bytes in the encoding (not counting the tag), the encoded int\n    function parseVarIntAt(bytes memory _b, uint256 _at) internal pure returns (uint256, uint256) {\n        uint8 _dataLen = determineVarIntDataLengthAt(_b, _at);\n\n        if (_dataLen == 0) {\n            return (0, uint8(_b[_at]));\n        }\n        if (_b.length < 1 + _dataLen + _at) {\n            return (ERR_BAD_ARG, 0);\n        }\n        uint256 _number;\n        if (_dataLen == 2) {\n            _number = reverseUint16(uint16(_b.slice2(1 + _at)));\n        } else if (_dataLen == 4) {\n            _number = reverseUint32(uint32(_b.slice4(1 + _at)));\n        } else if (_dataLen == 8) {\n            _number = reverseUint64(uint64(_b.slice8(1 + _at)));\n        }\n        return (_dataLen, _number);\n    }\n\n    /// @notice          Changes the endianness of a byte array\n    /// @dev             Returns a new, backwards, bytes\n    /// @param _b        The bytes to reverse\n    /// @return          The reversed bytes\n    function reverseEndianness(bytes memory _b) internal pure returns (bytes memory) {\n        bytes memory _newValue = new bytes(_b.length);\n\n        for (uint i = 0; i < _b.length; i++) {\n            _newValue[_b.length - i - 1] = _b[i];\n        }\n\n        return _newValue;\n    }\n\n    /// @notice          Changes the endianness of a uint256\n    /// @dev             https://graphics.stanford.edu/~seander/bithacks.html#ReverseParallel\n    /// @param _b        The unsigned integer to reverse\n    /// @return v        The reversed value\n    function reverseUint256(uint256 _b) internal pure returns (uint256 v) {\n        v = _b;\n\n        // swap bytes\n        v = ((v >> 8) & 0x00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF) |\n            ((v & 0x00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF00FF) << 8);\n        // swap 2-byte long pairs\n        v = ((v >> 16) & 0x0000FFFF0000FFFF0000FFFF0000FFFF0000FFFF0000FFFF0000FFFF0000FFFF) |\n            ((v & 0x0000FFFF0000FFFF0000FFFF0000FFFF0000FFFF0000FFFF0000FFFF0000FFFF) << 16);\n        // swap 4-byte long pairs\n        v = ((v >> 32) & 0x00000000FFFFFFFF00000000FFFFFFFF00000000FFFFFFFF00000000FFFFFFFF) |\n            ((v & 0x00000000FFFFFFFF00000000FFFFFFFF00000000FFFFFFFF00000000FFFFFFFF) << 32);\n        // swap 8-byte long pairs\n        v = ((v >> 64) & 0x0000000000000000FFFFFFFFFFFFFFFF0000000000000000FFFFFFFFFFFFFFFF) |\n            ((v & 0x0000000000000000FFFFFFFFFFFFFFFF0000000000000000FFFFFFFFFFFFFFFF) << 64);\n        // swap 16-byte long pairs\n        v = (v >> 128) | (v << 128);\n    }\n\n    /// @notice          Changes the endianness of a uint64\n    /// @param _b        The unsigned integer to reverse\n    /// @return v        The reversed value\n    function reverseUint64(uint64 _b) internal pure returns (uint64 v) {\n        v = _b;\n\n        // swap bytes\n        v = ((v >> 8) & 0x00FF00FF00FF00FF) |\n            ((v & 0x00FF00FF00FF00FF) << 8);\n        // swap 2-byte long pairs\n        v = ((v >> 16) & 0x0000FFFF0000FFFF) |\n            ((v & 0x0000FFFF0000FFFF) << 16);\n        // swap 4-byte long pairs\n        v = (v >> 32) | (v << 32);\n    }\n\n    /// @notice          Changes the endianness of a uint32\n    /// @param _b        The unsigned integer to reverse\n    /// @return v        The reversed value\n    function reverseUint32(uint32 _b) internal pure returns (uint32 v) {\n        v = _b;\n\n        // swap bytes\n        v = ((v >> 8) & 0x00FF00FF) |\n            ((v & 0x00FF00FF) << 8);\n        // swap 2-byte long pairs\n        v = (v >> 16) | (v << 16);\n    }\n\n    /// @notice          Changes the endianness of a uint24\n    /// @param _b        The unsigned integer to reverse\n    /// @return v        The reversed value\n    function reverseUint24(uint24 _b) internal pure returns (uint24 v) {\n        v =  (_b << 16) | (_b & 0x00FF00) | (_b >> 16);\n    }\n\n    /// @notice          Changes the endianness of a uint16\n    /// @param _b        The unsigned integer to reverse\n    /// @return v        The reversed value\n    function reverseUint16(uint16 _b) internal pure returns (uint16 v) {\n        v =  (_b << 8) | (_b >> 8);\n    }\n\n\n    /// @notice          Converts big-endian bytes to a uint\n    /// @dev             Traverses the byte array and sums the bytes\n    /// @param _b        The big-endian bytes-encoded integer\n    /// @return          The integer representation\n    function bytesToUint(bytes memory _b) internal pure returns (uint256) {\n        uint256 _number;\n\n        for (uint i = 0; i < _b.length; i++) {\n            _number = _number + uint8(_b[i]) * (2 ** (8 * (_b.length - (i + 1))));\n        }\n\n        return _number;\n    }\n\n    /// @notice          Get the last _num bytes from a byte array\n    /// @param _b        The byte array to slice\n    /// @param _num      The number of bytes to extract from the end\n    /// @return          The last _num bytes of _b\n    function lastBytes(bytes memory _b, uint256 _num) internal pure returns (bytes memory) {\n        uint256 _start = _b.length.sub(_num);\n\n        return _b.slice(_start, _num);\n    }\n\n    /// @notice          Implements bitcoin's hash160 (rmd160(sha2()))\n    /// @dev             abi.encodePacked changes the return to bytes instead of bytes32\n    /// @param _b        The pre-image\n    /// @return          The digest\n    function hash160(bytes memory _b) internal pure returns (bytes memory) {\n        return abi.encodePacked(ripemd160(abi.encodePacked(sha256(_b))));\n    }\n\n    /// @notice          Implements bitcoin's hash160 (sha2 + ripemd160)\n    /// @dev             sha2 precompile at address(2), ripemd160 at address(3)\n    /// @param _b        The pre-image\n    /// @return res      The digest\n    function hash160View(bytes memory _b) internal view returns (bytes20 res) {\n        // solium-disable-next-line security/no-inline-assembly\n        assembly {\n            pop(staticcall(gas(), 2, add(_b, 32), mload(_b), 0x00, 32))\n            pop(staticcall(gas(), 3, 0x00, 32, 0x00, 32))\n            // read from position 12 = 0c\n            res := mload(0x0c)\n        }\n    }\n\n    /// @notice          Implements bitcoin's hash256 (double sha2)\n    /// @dev             abi.encodePacked changes the return to bytes instead of bytes32\n    /// @param _b        The pre-image\n    /// @return          The digest\n    function hash256(bytes memory _b) internal pure returns (bytes32) {\n        return sha256(abi.encodePacked(sha256(_b)));\n    }\n\n    /// @notice          Implements bitcoin's hash256 (double sha2)\n    /// @dev             sha2 is precompiled smart contract located at address(2)\n    /// @param _b        The pre-image\n    /// @return res      The digest\n    function hash256View(bytes memory _b) internal view returns (bytes32 res) {\n        // solium-disable-next-line security/no-inline-assembly\n        assembly {\n            pop(staticcall(gas(), 2, add(_b, 32), mload(_b), 0x00, 32))\n            pop(staticcall(gas(), 2, 0x00, 32, 0x00, 32))\n            res := mload(0x00)\n        }\n    }\n\n    /// @notice          Implements bitcoin's hash256 on a pair of bytes32\n    /// @dev             sha2 is precompiled smart contract located at address(2)\n    /// @param _a        The first bytes32 of the pre-image\n    /// @param _b        The second bytes32 of the pre-image\n    /// @return res      The digest\n    function hash256Pair(bytes32 _a, bytes32 _b) internal view returns (bytes32 res) {\n        // solium-disable-next-line security/no-inline-assembly\n        assembly {\n            mstore(0x00, _a)\n            mstore(0x20, _b)\n            pop(staticcall(gas(), 2, 0x00, 64, 0x00, 32))\n            pop(staticcall(gas(), 2, 0x00, 32, 0x00, 32))\n            res := mload(0x00)\n        }\n    }\n\n    /* ************ */\n    /* Legacy Input */\n    /* ************ */\n\n    /// @notice          Extracts the nth input from the vin (0-indexed)\n    /// @dev             Iterates over the vin. If you need to extract several, write a custom function\n    /// @param _vin      The vin as a tightly-packed byte array\n    /// @param _index    The 0-indexed location of the input to extract\n    /// @return          The input as a byte array\n    function extractInputAtIndex(bytes memory _vin, uint256 _index) internal pure returns (bytes memory) {\n        uint256 _varIntDataLen;\n        uint256 _nIns;\n\n        (_varIntDataLen, _nIns) = parseVarInt(_vin);\n        require(_varIntDataLen != ERR_BAD_ARG, \"Read overrun during VarInt parsing\");\n        require(_index < _nIns, \"Vin read overrun\");\n\n        uint256 _len = 0;\n        uint256 _offset = 1 + _varIntDataLen;\n\n        for (uint256 _i = 0; _i < _index; _i ++) {\n            _len = determineInputLengthAt(_vin, _offset);\n            require(_len != ERR_BAD_ARG, \"Bad VarInt in scriptSig\");\n            _offset = _offset + _len;\n        }\n\n        _len = determineInputLengthAt(_vin, _offset);\n        require(_len != ERR_BAD_ARG, \"Bad VarInt in scriptSig\");\n        return _vin.slice(_offset, _len);\n    }\n\n    /// @notice          Determines whether an input is legacy\n    /// @dev             False if no scriptSig, otherwise True\n    /// @param _input    The input\n    /// @return          True for legacy, False for witness\n    function isLegacyInput(bytes memory _input) internal pure returns (bool) {\n        return _input[36] != hex\"00\";\n    }\n\n    /// @notice          Determines the length of a scriptSig in an input\n    /// @dev             Will return 0 if passed a witness input.\n    /// @param _input    The LEGACY input\n    /// @return          The length of the script sig\n    function extractScriptSigLen(bytes memory _input) internal pure returns (uint256, uint256) {\n        return extractScriptSigLenAt(_input, 0);\n    }\n\n    /// @notice          Determines the length of a scriptSig in an input\n    ///                  starting at the specified position\n    /// @dev             Will return 0 if passed a witness input.\n    /// @param _input    The byte array containing the LEGACY input\n    /// @param _at       The position of the input in the array\n    /// @return          The length of the script sig\n    function extractScriptSigLenAt(bytes memory _input, uint256 _at) internal pure returns (uint256, uint256) {\n        if (_input.length < 37 + _at) {\n            return (ERR_BAD_ARG, 0);\n        }\n\n        uint256 _varIntDataLen;\n        uint256 _scriptSigLen;\n        (_varIntDataLen, _scriptSigLen) = parseVarIntAt(_input, _at + 36);\n\n        return (_varIntDataLen, _scriptSigLen);\n    }\n\n    /// @notice          Determines the length of an input from its scriptSig\n    /// @dev             36 for outpoint, 1 for scriptSig length, 4 for sequence\n    /// @param _input    The input\n    /// @return          The length of the input in bytes\n    function determineInputLength(bytes memory _input) internal pure returns (uint256) {\n        return determineInputLengthAt(_input, 0);\n    }\n\n    /// @notice          Determines the length of an input from its scriptSig,\n    ///                  starting at the specified position\n    /// @dev             36 for outpoint, 1 for scriptSig length, 4 for sequence\n    /// @param _input    The byte array containing the input\n    /// @param _at       The position of the input in the array\n    /// @return          The length of the input in bytes\n    function determineInputLengthAt(bytes memory _input, uint256 _at) internal pure returns (uint256) {\n        uint256 _varIntDataLen;\n        uint256 _scriptSigLen;\n        (_varIntDataLen, _scriptSigLen) = extractScriptSigLenAt(_input, _at);\n        if (_varIntDataLen == ERR_BAD_ARG) {\n            return ERR_BAD_ARG;\n        }\n\n        return 36 + 1 + _varIntDataLen + _scriptSigLen + 4;\n    }\n\n    /// @notice          Extracts the LE sequence bytes from an input\n    /// @dev             Sequence is used for relative time locks\n    /// @param _input    The LEGACY input\n    /// @return          The sequence bytes (LE uint)\n    function extractSequenceLELegacy(bytes memory _input) internal pure returns (bytes4) {\n        uint256 _varIntDataLen;\n        uint256 _scriptSigLen;\n        (_varIntDataLen, _scriptSigLen) = extractScriptSigLen(_input);\n        require(_varIntDataLen != ERR_BAD_ARG, \"Bad VarInt in scriptSig\");\n        return _input.slice4(36 + 1 + _varIntDataLen + _scriptSigLen);\n    }\n\n    /// @notice          Extracts the sequence from the input\n    /// @dev             Sequence is a 4-byte little-endian number\n    /// @param _input    The LEGACY input\n    /// @return          The sequence number (big-endian uint)\n    function extractSequenceLegacy(bytes memory _input) internal pure returns (uint32) {\n        uint32 _leSeqence = uint32(extractSequenceLELegacy(_input));\n        uint32 _beSequence = reverseUint32(_leSeqence);\n        return _beSequence;\n    }\n    /// @notice          Extracts the VarInt-prepended scriptSig from the input in a tx\n    /// @dev             Will return hex\"00\" if passed a witness input\n    /// @param _input    The LEGACY input\n    /// @return          The length-prepended scriptSig\n    function extractScriptSig(bytes memory _input) internal pure returns (bytes memory) {\n        uint256 _varIntDataLen;\n        uint256 _scriptSigLen;\n        (_varIntDataLen, _scriptSigLen) = extractScriptSigLen(_input);\n        require(_varIntDataLen != ERR_BAD_ARG, \"Bad VarInt in scriptSig\");\n        return _input.slice(36, 1 + _varIntDataLen + _scriptSigLen);\n    }\n\n\n    /* ************* */\n    /* Witness Input */\n    /* ************* */\n\n    /// @notice          Extracts the LE sequence bytes from an input\n    /// @dev             Sequence is used for relative time locks\n    /// @param _input    The WITNESS input\n    /// @return          The sequence bytes (LE uint)\n    function extractSequenceLEWitness(bytes memory _input) internal pure returns (bytes4) {\n        return _input.slice4(37);\n    }\n\n    /// @notice          Extracts the sequence from the input in a tx\n    /// @dev             Sequence is a 4-byte little-endian number\n    /// @param _input    The WITNESS input\n    /// @return          The sequence number (big-endian uint)\n    function extractSequenceWitness(bytes memory _input) internal pure returns (uint32) {\n        uint32 _leSeqence = uint32(extractSequenceLEWitness(_input));\n        uint32 _inputeSequence = reverseUint32(_leSeqence);\n        return _inputeSequence;\n    }\n\n    /// @notice          Extracts the outpoint from the input in a tx\n    /// @dev             32-byte tx id with 4-byte index\n    /// @param _input    The input\n    /// @return          The outpoint (LE bytes of prev tx hash + LE bytes of prev tx index)\n    function extractOutpoint(bytes memory _input) internal pure returns (bytes memory) {\n        return _input.slice(0, 36);\n    }\n\n    /// @notice          Extracts the outpoint tx id from an input\n    /// @dev             32-byte tx id\n    /// @param _input    The input\n    /// @return          The tx id (little-endian bytes)\n    function extractInputTxIdLE(bytes memory _input) internal pure returns (bytes32) {\n        return _input.slice32(0);\n    }\n\n    /// @notice          Extracts the outpoint tx id from an input\n    ///                  starting at the specified position\n    /// @dev             32-byte tx id\n    /// @param _input    The byte array containing the input\n    /// @param _at       The position of the input\n    /// @return          The tx id (little-endian bytes)\n    function extractInputTxIdLeAt(bytes memory _input, uint256 _at) internal pure returns (bytes32) {\n        return _input.slice32(_at);\n    }\n\n    /// @notice          Extracts the LE tx input index from the input in a tx\n    /// @dev             4-byte tx index\n    /// @param _input    The input\n    /// @return          The tx index (little-endian bytes)\n    function extractTxIndexLE(bytes memory _input) internal pure returns (bytes4) {\n        return _input.slice4(32);\n    }\n\n    /// @notice          Extracts the LE tx input index from the input in a tx\n    ///                  starting at the specified position\n    /// @dev             4-byte tx index\n    /// @param _input    The byte array containing the input\n    /// @param _at       The position of the input\n    /// @return          The tx index (little-endian bytes)\n    function extractTxIndexLeAt(bytes memory _input, uint256 _at) internal pure returns (bytes4) {\n        return _input.slice4(32 + _at);\n    }\n\n    /* ****** */\n    /* Output */\n    /* ****** */\n\n    /// @notice          Determines the length of an output\n    /// @dev             Works with any properly formatted output\n    /// @param _output   The output\n    /// @return          The length indicated by the prefix, error if invalid length\n    function determineOutputLength(bytes memory _output) internal pure returns (uint256) {\n        return determineOutputLengthAt(_output, 0);\n    }\n\n    /// @notice          Determines the length of an output\n    ///                  starting at the specified position\n    /// @dev             Works with any properly formatted output\n    /// @param _output   The byte array containing the output\n    /// @param _at       The position of the output\n    /// @return          The length indicated by the prefix, error if invalid length\n    function determineOutputLengthAt(bytes memory _output, uint256 _at) internal pure returns (uint256) {\n        if (_output.length < 9 + _at) {\n            return ERR_BAD_ARG;\n        }\n        uint256 _varIntDataLen;\n        uint256 _scriptPubkeyLength;\n        (_varIntDataLen, _scriptPubkeyLength) = parseVarIntAt(_output, 8 + _at);\n\n        if (_varIntDataLen == ERR_BAD_ARG) {\n            return ERR_BAD_ARG;\n        }\n\n        // 8-byte value, 1-byte for tag itself\n        return 8 + 1 + _varIntDataLen + _scriptPubkeyLength;\n    }\n\n    /// @notice          Extracts the output at a given index in the TxOuts vector\n    /// @dev             Iterates over the vout. If you need to extract multiple, write a custom function\n    /// @param _vout     The _vout to extract from\n    /// @param _index    The 0-indexed location of the output to extract\n    /// @return          The specified output\n    function extractOutputAtIndex(bytes memory _vout, uint256 _index) internal pure returns (bytes memory) {\n        uint256 _varIntDataLen;\n        uint256 _nOuts;\n\n        (_varIntDataLen, _nOuts) = parseVarInt(_vout);\n        require(_varIntDataLen != ERR_BAD_ARG, \"Read overrun during VarInt parsing\");\n        require(_index < _nOuts, \"Vout read overrun\");\n\n        uint256 _len = 0;\n        uint256 _offset = 1 + _varIntDataLen;\n\n        for (uint256 _i = 0; _i < _index; _i ++) {\n            _len = determineOutputLengthAt(_vout, _offset);\n            require(_len != ERR_BAD_ARG, \"Bad VarInt in scriptPubkey\");\n            _offset += _len;\n        }\n\n        _len = determineOutputLengthAt(_vout, _offset);\n        require(_len != ERR_BAD_ARG, \"Bad VarInt in scriptPubkey\");\n        return _vout.slice(_offset, _len);\n    }\n\n    /// @notice          Extracts the value bytes from the output in a tx\n    /// @dev             Value is an 8-byte little-endian number\n    /// @param _output   The output\n    /// @return          The output value as LE bytes\n    function extractValueLE(bytes memory _output) internal pure returns (bytes8) {\n        return _output.slice8(0);\n    }\n\n    /// @notice          Extracts the value from the output in a tx\n    /// @dev             Value is an 8-byte little-endian number\n    /// @param _output   The output\n    /// @return          The output value\n    function extractValue(bytes memory _output) internal pure returns (uint64) {\n        uint64 _leValue = uint64(extractValueLE(_output));\n        uint64 _beValue = reverseUint64(_leValue);\n        return _beValue;\n    }\n\n    /// @notice          Extracts the data from an op return output\n    /// @dev             Returns hex\"\" if no data or not an op return\n    /// @param _output   The output\n    /// @return          Any data contained in the opreturn output, null if not an op return\n    function extractOpReturnData(bytes memory _output) internal pure returns (bytes memory) {\n        if (_output[9] != hex\"6a\") {\n            return hex\"\";\n        }\n        bytes1 _dataLen = _output[10];\n        return _output.slice(11, uint256(uint8(_dataLen)));\n    }\n\n    /// @notice          Extracts the hash from the output script\n    /// @dev             Determines type by the length prefix and validates format\n    /// @param _output   The output\n    /// @return          The hash committed to by the pk_script, or null for errors\n    function extractHash(bytes memory _output) internal pure returns (bytes memory) {\n        uint8 _scriptLen = uint8(_output[8]);\n\n        // don't have to worry about overflow here.\n        // if _scriptLen + 9 overflows, then output.length would have to be < 9\n        // for this check to pass. if it's < 9, then we errored when assigning\n        // _scriptLen\n        if (_scriptLen + 9 != _output.length) {\n            return hex\"\";\n        }\n\n        if (uint8(_output[9]) == 0) {\n            if (_scriptLen < 2) {\n                return hex\"\";\n            }\n            uint256 _payloadLen = uint8(_output[10]);\n            // Check for maliciously formatted witness outputs.\n            // No need to worry about underflow as long b/c of the `< 2` check\n            if (_payloadLen != _scriptLen - 2 || (_payloadLen != 0x20 && _payloadLen != 0x14)) {\n                return hex\"\";\n            }\n            return _output.slice(11, _payloadLen);\n        } else {\n            bytes3 _tag = _output.slice3(8);\n            // p2pkh\n            if (_tag == hex\"1976a9\") {\n                // Check for maliciously formatted p2pkh\n                // No need to worry about underflow, b/c of _scriptLen check\n                if (uint8(_output[11]) != 0x14 ||\n                    _output.slice2(_output.length - 2) != hex\"88ac\") {\n                    return hex\"\";\n                }\n                return _output.slice(12, 20);\n            //p2sh\n            } else if (_tag == hex\"17a914\") {\n                // Check for maliciously formatted p2sh\n                // No need to worry about underflow, b/c of _scriptLen check\n                if (uint8(_output[_output.length - 1]) != 0x87) {\n                    return hex\"\";\n                }\n                return _output.slice(11, 20);\n            }\n        }\n        return hex\"\";  /* NB: will trigger on OPRETURN and any non-standard that doesn't overrun */\n    }\n\n    /* ********** */\n    /* Witness TX */\n    /* ********** */\n\n\n    /// @notice      Checks that the vin passed up is properly formatted\n    /// @dev         Consider a vin with a valid vout in its scriptsig\n    /// @param _vin  Raw bytes length-prefixed input vector\n    /// @return      True if it represents a validly formatted vin\n    function validateVin(bytes memory _vin) internal pure returns (bool) {\n        uint256 _varIntDataLen;\n        uint256 _nIns;\n\n        (_varIntDataLen, _nIns) = parseVarInt(_vin);\n\n        // Not valid if it says there are too many or no inputs\n        if (_nIns == 0 || _varIntDataLen == ERR_BAD_ARG) {\n            return false;\n        }\n\n        uint256 _offset = 1 + _varIntDataLen;\n\n        for (uint256 i = 0; i < _nIns; i++) {\n            // If we're at the end, but still expect more\n            if (_offset >= _vin.length) {\n                return false;\n            }\n\n            // Grab the next input and determine its length.\n            uint256 _nextLen = determineInputLengthAt(_vin, _offset);\n            if (_nextLen == ERR_BAD_ARG) {\n                return false;\n            }\n\n            // Increase the offset by that much\n            _offset += _nextLen;\n        }\n\n        // Returns false if we're not exactly at the end\n        return _offset == _vin.length;\n    }\n\n    /// @notice      Checks that the vout passed up is properly formatted\n    /// @dev         Consider a vout with a valid scriptpubkey\n    /// @param _vout Raw bytes length-prefixed output vector\n    /// @return      True if it represents a validly formatted vout\n    function validateVout(bytes memory _vout) internal pure returns (bool) {\n        uint256 _varIntDataLen;\n        uint256 _nOuts;\n\n        (_varIntDataLen, _nOuts) = parseVarInt(_vout);\n\n        // Not valid if it says there are too many or no outputs\n        if (_nOuts == 0 || _varIntDataLen == ERR_BAD_ARG) {\n            return false;\n        }\n\n        uint256 _offset = 1 + _varIntDataLen;\n\n        for (uint256 i = 0; i < _nOuts; i++) {\n            // If we're at the end, but still expect more\n            if (_offset >= _vout.length) {\n                return false;\n            }\n\n            // Grab the next output and determine its length.\n            // Increase the offset by that much\n            uint256 _nextLen = determineOutputLengthAt(_vout, _offset);\n            if (_nextLen == ERR_BAD_ARG) {\n                return false;\n            }\n\n            _offset += _nextLen;\n        }\n\n        // Returns false if we're not exactly at the end\n        return _offset == _vout.length;\n    }\n\n\n\n    /* ************ */\n    /* Block Header */\n    /* ************ */\n\n    /// @notice          Extracts the transaction merkle root from a block header\n    /// @dev             Use verifyHash256Merkle to verify proofs with this root\n    /// @param _header   The header\n    /// @return          The merkle root (little-endian)\n    function extractMerkleRootLE(bytes memory _header) internal pure returns (bytes32) {\n        return _header.slice32(36);\n    }\n\n    /// @notice          Extracts the target from a block header\n    /// @dev             Target is a 256-bit number encoded as a 3-byte mantissa and 1-byte exponent\n    /// @param _header   The header\n    /// @return          The target threshold\n    function extractTarget(bytes memory _header) internal pure returns (uint256) {\n        uint24 _m = uint24(_header.slice3(72));\n        uint8 _e = uint8(_header[75]);\n        uint256 _mantissa = uint256(reverseUint24(_m));\n        uint _exponent = _e - 3;\n\n        return _mantissa * (256 ** _exponent);\n    }\n\n    /// @notice          Calculate difficulty from the difficulty 1 target and current target\n    /// @dev             Difficulty 1 is 0x1d00ffff on mainnet and testnet\n    /// @dev             Difficulty 1 is a 256-bit number encoded as a 3-byte mantissa and 1-byte exponent\n    /// @param _target   The current target\n    /// @return          The block difficulty (bdiff)\n    function calculateDifficulty(uint256 _target) internal pure returns (uint256) {\n        // Difficulty 1 calculated from 0x1d00ffff\n        return DIFF1_TARGET.div(_target);\n    }\n\n    /// @notice          Extracts the previous block's hash from a block header\n    /// @dev             Block headers do NOT include block number :(\n    /// @param _header   The header\n    /// @return          The previous block's hash (little-endian)\n    function extractPrevBlockLE(bytes memory _header) internal pure returns (bytes32) {\n        return _header.slice32(4);\n    }\n\n    /// @notice          Extracts the timestamp from a block header\n    /// @dev             Time is not 100% reliable\n    /// @param _header   The header\n    /// @return          The timestamp (little-endian bytes)\n    function extractTimestampLE(bytes memory _header) internal pure returns (bytes4) {\n        return _header.slice4(68);\n    }\n\n    /// @notice          Extracts the timestamp from a block header\n    /// @dev             Time is not 100% reliable\n    /// @param _header   The header\n    /// @return          The timestamp (uint)\n    function extractTimestamp(bytes memory _header) internal pure returns (uint32) {\n        return reverseUint32(uint32(extractTimestampLE(_header)));\n    }\n\n    /// @notice          Extracts the expected difficulty from a block header\n    /// @dev             Does NOT verify the work\n    /// @param _header   The header\n    /// @return          The difficulty as an integer\n    function extractDifficulty(bytes memory _header) internal pure returns (uint256) {\n        return calculateDifficulty(extractTarget(_header));\n    }\n\n    /// @notice          Concatenates and hashes two inputs for merkle proving\n    /// @param _a        The first hash\n    /// @param _b        The second hash\n    /// @return          The double-sha256 of the concatenated hashes\n    function _hash256MerkleStep(bytes memory _a, bytes memory _b) internal view returns (bytes32) {\n        return hash256View(abi.encodePacked(_a, _b));\n    }\n\n    /// @notice          Concatenates and hashes two inputs for merkle proving\n    /// @param _a        The first hash\n    /// @param _b        The second hash\n    /// @return          The double-sha256 of the concatenated hashes\n    function _hash256MerkleStep(bytes32 _a, bytes32 _b) internal view returns (bytes32) {\n        return hash256Pair(_a, _b);\n    }\n\n\n    /// @notice          Verifies a Bitcoin-style merkle tree\n    /// @dev             Leaves are 0-indexed. Inefficient version.\n    /// @param _proof    The proof. Tightly packed LE sha256 hashes. The last hash is the root\n    /// @param _index    The index of the leaf\n    /// @return          true if the proof is valid, else false\n    function verifyHash256Merkle(bytes memory _proof, uint _index) internal view returns (bool) {\n        // Not an even number of hashes\n        if (_proof.length % 32 != 0) {\n            return false;\n        }\n\n        // Special case for coinbase-only blocks\n        if (_proof.length == 32) {\n            return true;\n        }\n\n        // Should never occur\n        if (_proof.length == 64) {\n            return false;\n        }\n\n        bytes32 _root = _proof.slice32(_proof.length - 32);\n        bytes32 _current = _proof.slice32(0);\n        bytes memory _tree = _proof.slice(32, _proof.length - 64);\n\n        return verifyHash256Merkle(_current, _tree, _root, _index);\n    }\n\n    /// @notice          Verifies a Bitcoin-style merkle tree\n    /// @dev             Leaves are 0-indexed. Efficient version.\n    /// @param _leaf     The leaf of the proof. LE sha256 hash.\n    /// @param _tree     The intermediate nodes in the proof.\n    ///                  Tightly packed LE sha256 hashes.\n    /// @param _root     The root of the proof. LE sha256 hash.\n    /// @param _index    The index of the leaf\n    /// @return          true if the proof is valid, else false\n    function verifyHash256Merkle(\n        bytes32 _leaf,\n        bytes memory _tree,\n        bytes32 _root,\n        uint _index\n    ) internal view returns (bool) {\n        // Not an even number of hashes\n        if (_tree.length % 32 != 0) {\n            return false;\n        }\n\n        // Should never occur\n        if (_tree.length == 0) {\n            return false;\n        }\n\n        uint _idx = _index;\n        bytes32 _current = _leaf;\n\n        // i moves in increments of 32\n        for (uint i = 0; i < _tree.length; i += 32) {\n            if (_idx % 2 == 1) {\n                _current = _hash256MerkleStep(_tree.slice32(i), _current);\n            } else {\n                _current = _hash256MerkleStep(_current, _tree.slice32(i));\n            }\n            _idx = _idx >> 1;\n        }\n        return _current == _root;\n    }\n\n    /*\n    NB: https://github.com/bitcoin/bitcoin/blob/78dae8caccd82cfbfd76557f1fb7d7557c7b5edb/src/pow.cpp#L49-L72\n    NB: We get a full-bitlength target from this. For comparison with\n        header-encoded targets we need to mask it with the header target\n        e.g. (full & truncated) == truncated\n    */\n    /// @notice                 performs the bitcoin difficulty retarget\n    /// @dev                    implements the Bitcoin algorithm precisely\n    /// @param _previousTarget  the target of the previous period\n    /// @param _firstTimestamp  the timestamp of the first block in the difficulty period\n    /// @param _secondTimestamp the timestamp of the last block in the difficulty period\n    /// @return                 the new period's target threshold\n    function retargetAlgorithm(\n        uint256 _previousTarget,\n        uint256 _firstTimestamp,\n        uint256 _secondTimestamp\n    ) internal pure returns (uint256) {\n        uint256 _elapsedTime = _secondTimestamp.sub(_firstTimestamp);\n\n        // Normalize ratio to factor of 4 if very long or very short\n        if (_elapsedTime < RETARGET_PERIOD.div(4)) {\n            _elapsedTime = RETARGET_PERIOD.div(4);\n        }\n        if (_elapsedTime > RETARGET_PERIOD.mul(4)) {\n            _elapsedTime = RETARGET_PERIOD.mul(4);\n        }\n\n        /*\n          NB: high targets e.g. ffff0020 can cause overflows here\n              so we divide it by 256**2, then multiply by 256**2 later\n              we know the target is evenly divisible by 256**2, so this isn't an issue\n        */\n\n        uint256 _adjusted = _previousTarget.div(65536).mul(_elapsedTime);\n        return _adjusted.div(RETARGET_PERIOD).mul(65536);\n    }\n}\n"