@smartledger/bsv 5.4.2 → 5.5.1

package/test/script/string_ops.js

@@ -0,0 +1,72 @@
+'use strict'
+
+/* global describe, it */
+require('chai').should()
+var bsv = require('../..')
+var Interpreter = bsv.Script.Interpreter
+var Script = bsv.Script
+var Opcode = bsv.Opcode
+var Transaction = bsv.Transaction
+
+// OP_SUBSTR / OP_LEFT / OP_RIGHT — re-enabled BSV (Chronicle) string opcodes,
+// original Satoshi semantics. Declared in the opcode map at 0xb3/0xb4/0xb5 but
+// previously unimplemented (BAD_OPCODE). These tests verify behavior end-to-end.
+describe('String opcodes OP_SUBSTR / OP_LEFT / OP_RIGHT', function () {
+  var DATA = Buffer.from('aabbccdd', 'hex')
+
+  // Build `<DATA> <ops...>` and assert the top of stack equals `expected`.
+  function yields (buildOps, expectedHex) {
+    var lock = new Script().add(DATA)
+    buildOps(lock)
+    lock.add(Buffer.from(expectedHex, 'hex')).add(Opcode.OP_EQUAL)
+    var interp = new Interpreter()
+    return interp.verify(new Script(), lock, new Transaction(), 0, 0)
+  }
+  function errors (buildOps) {
+    var lock = new Script().add(DATA)
+    buildOps(lock)
+    var interp = new Interpreter()
+    var ok
+    try { ok = interp.verify(new Script(), lock, new Transaction(), 0, 0) } catch (e) { ok = false }
+    return ok === false
+  }
+
+  it('OP_LEFT keeps the first n bytes', function () {
+    yields(function (s) { s.add(Opcode.OP_2).add(Opcode.OP_LEFT) }, 'aabb').should.equal(true)
+  })
+
+  it('OP_RIGHT keeps the last n bytes', function () {
+    yields(function (s) { s.add(Opcode.OP_2).add(Opcode.OP_RIGHT) }, 'ccdd').should.equal(true)
+  })
+
+  it('OP_RIGHT 0 yields the empty string (not the whole string)', function () {
+    yields(function (s) { s.add(Opcode.OP_0).add(Opcode.OP_RIGHT) }, '').should.equal(true)
+  })
+
+  it('OP_LEFT 0 yields the empty string', function () {
+    yields(function (s) { s.add(Opcode.OP_0).add(Opcode.OP_LEFT) }, '').should.equal(true)
+  })
+
+  it('OP_SUBSTR extracts in[begin : begin+size]', function () {
+    // begin=1 size=2 -> bbcc.  Stack order is (in begin size -- out).
+    yields(function (s) { s.add(Opcode.OP_1).add(Opcode.OP_2).add(Opcode.OP_SUBSTR) }, 'bbcc').should.equal(true)
+  })
+
+  it('OP_LEFT clamps n greater than the length', function () {
+    yields(function (s) { s.add(Opcode.OP_10).add(Opcode.OP_LEFT) }, 'aabbccdd').should.equal(true)
+  })
+
+  it('OP_RIGHT clamps n greater than the length', function () {
+    yields(function (s) { s.add(Opcode.OP_10).add(Opcode.OP_RIGHT) }, 'aabbccdd').should.equal(true)
+  })
+
+  it('rejects a negative size', function () {
+    errors(function (s) { s.add(Opcode.OP_1NEGATE).add(Opcode.OP_LEFT) }).should.equal(true)
+  })
+
+  it('rejects OP_LEFT with too few stack items', function () {
+    var interp = new Interpreter()
+    var lock = new Script().add(Opcode.OP_LEFT) // nothing to operate on
+    interp.verify(new Script(), lock, new Transaction(), 0, 0).should.equal(false)
+  })
+})

package/test/smart_contract/covenants.js

@@ -0,0 +1,247 @@
+'use strict'
+
+/* global describe, it, before, after */
+require('chai').should()
+var bsv = require('../..')
+var SC = bsv.SmartContract
+var PrivateKey = bsv.PrivateKey
+var Script = bsv.Script
+var Transaction = bsv.Transaction
+
+var Locks = SC.Locks
+var PushTx = SC.PushTx
+var Token = SC.Token
+var help = SC.CovenantHelpers
+var fundAndSpend = help.fundAndSpend
+var p2pkhOutput = help.p2pkhOutput
+var verify = help.verify
+
+var SATS = 100000
+
+describe('SmartContract covenants (v4.2.0)', function () {
+  this.timeout(20000)
+  var I = bsv.Script.Interpreter
+  var saved
+
+  before(function () {
+    saved = { el: I.MAX_SCRIPT_ELEMENT_SIZE, num: I.MAXIMUM_ELEMENT_SIZE, ops: I.MAX_OPS_PER_SCRIPT }
+    SC.enableGenesis() // OP_PUSH_TX covenants need post-Genesis limits
+  })
+  after(function () {
+    I.MAX_SCRIPT_ELEMENT_SIZE = saved.el
+    I.MAXIMUM_ELEMENT_SIZE = saved.num
+    I.MAX_OPS_PER_SCRIPT = saved.ops
+  })
+
+  var alice = PrivateKey.fromRandom()
+  var bob = PrivateKey.fromRandom()
+  var carol = PrivateKey.fromRandom()
+
+  function spendOf (lock, sats, outputs) {
+    return fundAndSpend(lock, sats, { outputs: outputs }).spend
+  }
+
+  describe('Locks', function () {
+    it('hash-lock accepts the right secret and rejects a wrong one', function () {
+      var secret = Buffer.from('correct horse battery staple')
+      var c = Locks.hashLock(secret)
+      var spend = spendOf(c.lock, SATS, [p2pkhOutput(alice, SATS - 500)])
+      spend.inputs[0].setScript(c.unlock(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      spend = spendOf(c.lock, SATS, [p2pkhOutput(alice, SATS - 500)])
+      spend.inputs[0].setScript(c.unlock(spend, SATS, Buffer.from('wrong')))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('P2PKH verifies a valid signature', function () {
+      var c = Locks.p2pkh(alice)
+      var spend = spendOf(c.lock, SATS, [p2pkhOutput(bob, SATS - 500)])
+      spend.inputs[0].setScript(c.unlock(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+    })
+
+    it('CLTV accepts a matured spend and rejects an immature one', function () {
+      var lt = 800000
+      var c = Locks.timeLockCLTV(alice, lt)
+      var spend = spendOf(c.lock, SATS, [p2pkhOutput(alice, SATS - 500)])
+      spend.nLockTime = lt; spend.inputs[0].sequenceNumber = 0xfffffffe
+      spend.inputs[0].setScript(c.unlock(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      spend = spendOf(c.lock, SATS, [p2pkhOutput(alice, SATS - 500)])
+      spend.nLockTime = lt - 1; spend.inputs[0].sequenceNumber = 0xfffffffe
+      spend.inputs[0].setScript(c.unlock(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('2-of-3 multisig verifies with two valid signatures', function () {
+      var c = Locks.multisig(2, [alice, bob, carol])
+      var spend = spendOf(c.lock, SATS, [p2pkhOutput(bob, SATS - 500)])
+      spend.inputs[0].setScript(c.unlock(spend, SATS, [alice, bob]))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+    })
+
+    it('HTLC supports claim and rejects an early refund', function () {
+      var secret = Buffer.from('lightning-preimage-32bytes------')
+      var timeout = 750000
+      var c = Locks.htlc({ secret: secret, receiver: bob, sender: alice, timeout: timeout })
+      var spend = spendOf(c.lock, SATS, [p2pkhOutput(bob, SATS - 500)])
+      spend.inputs[0].setScript(c.unlockClaim(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      spend = spendOf(c.lock, SATS, [p2pkhOutput(alice, SATS - 500)])
+      spend.nLockTime = timeout - 1; spend.inputs[0].sequenceNumber = 0xfffffffe
+      spend.inputs[0].setScript(c.unlockRefund(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+  })
+
+  describe('OP_PUSH_TX', function () {
+    it('accepts an authentic preimage and rejects a tampered one', function () {
+      var lock = PushTx.authenticator()
+      var spend = spendOf(lock, SATS, [p2pkhOutput(alice, SATS - 500)])
+      var g = PushTx.grind(spend, 0, lock, SATS)
+      spend.inputs[0].setScript(new Script().add(g.preimage))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      var bad = Buffer.from(g.preimage); bad[bad.length - 5] ^= 0xff
+      spend.inputs[0].setScript(new Script().add(bad))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('value covenant forces coins to the required outputs', function () {
+      var beneficiary = PrivateKey.fromRandom()
+      var attacker = PrivateKey.fromRandom()
+      var required = [p2pkhOutput(beneficiary, SATS - 500)]
+      var lock = PushTx.valueCovenant(PushTx.hashOutputs(required))
+
+      var spend = spendOf(lock, SATS, required)
+      spend.inputs[0].setScript(new Script().add(PushTx.grind(spend, 0, lock, SATS).preimage))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      spend = spendOf(lock, SATS, [p2pkhOutput(attacker, SATS - 500)])
+      spend.inputs[0].setScript(new Script().add(PushTx.grind(spend, 0, lock, SATS).preimage))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('grind yields a CANONICAL low-S signature, enforced under SCRIPT_VERIFY_LOW_S', function () {
+      var BN = bsv.crypto.BN
+      var Hash = bsv.crypto.Hash
+      var halfN = BN.fromBuffer(Buffer.from('7FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF5D576E7357A4501DDFE92F46681B20A0', 'hex'))
+      var I = bsv.Script.Interpreter
+      // The hardened verify flags enforce low-S.
+      ;(help.flags() & I.SCRIPT_VERIFY_LOW_S).should.not.equal(0)
+
+      var lock = PushTx.authenticator()
+      var spend = spendOf(lock, SATS, [p2pkhOutput(alice, SATS - 500)])
+      var preimage = PushTx.grind(spend, 0, lock, SATS).preimage
+      // The in-script signature s = (HASH256(preimage)+Gx) mod n is provably low-S.
+      var s = BN.fromBuffer(Hash.sha256sha256(preimage)).add(BN.fromBuffer(PushTx.Gx)).mod(PushTx.N)
+      s.gt(halfN).should.equal(false)
+      // And it verifies with LOW_S enforced (a high-S signature would be rejected here).
+      spend.inputs[0].setScript(new Script().add(preimage))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+    })
+  })
+
+  describe('PELS (perpetual covenant)', function () {
+    var FEE = 500
+    it('recreates the same script and chains a second hop', function () {
+      var lock = SC.perpetualCovenant(FEE)
+      var spend = spendOf(lock, SATS, [new Transaction.Output({ script: lock, satoshis: SATS - FEE })])
+      spend.inputs[0].setScript(new Script().add(PushTx.grind(spend, 0, lock, SATS).preimage))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      var inSats = SATS - FEE
+      spend = spendOf(lock, inSats, [new Transaction.Output({ script: lock, satoshis: inSats - FEE })])
+      spend.inputs[0].setScript(new Script().add(PushTx.grind(spend, 0, lock, inSats).preimage))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: inSats }).ok.should.equal(true)
+    })
+
+    it('rejects escaping to a P2PKH', function () {
+      var lock = SC.perpetualCovenant(FEE)
+      var spend = spendOf(lock, SATS, [p2pkhOutput(PrivateKey.fromRandom(), SATS - FEE)])
+      spend.inputs[0].setScript(new Script().add(PushTx.grind(spend, 0, lock, SATS).preimage))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+  })
+
+  describe('Token (stateful NFT)', function () {
+    var FEE = 500
+
+    // Owners are keys, not secrets: ownerId = HASH160(pubkey); transfers are ECDSA-signed.
+    function transfer (currentLock, inSats, ownerKey, nextHash, outputOverride) {
+      var nextLock = Token.ownershipToken(FEE, nextHash)
+      var out = outputOverride || new Transaction.Output({ script: nextLock, satoshis: inSats - FEE })
+      var spend = spendOf(currentLock, inSats, [out])
+      spend.inputs[0].setScript(Token.unlockTransfer(ownerKey, nextHash, spend, inSats, currentLock))
+      return { spend: spend, nextLock: nextLock }
+    }
+
+    it('transfers ownership across a chain and rejects a non-owner', function () {
+      var aliceToken = Token.ownershipToken(FEE, Token.ownerId(alice))
+      var bobHash = Token.ownerId(bob)
+      var carolHash = Token.ownerId(carol)
+
+      var r = transfer(aliceToken, SATS, alice, bobHash)
+      verify(r.spend.inputs[0].script, aliceToken, { tx: r.spend, satoshis: SATS }).ok.should.equal(true)
+
+      var inSats = SATS - FEE
+      var r2 = transfer(r.nextLock, inSats, bob, carolHash)
+      verify(r2.spend.inputs[0].script, r.nextLock, { tx: r2.spend, satoshis: inSats }).ok.should.equal(true)
+
+      var bad = transfer(aliceToken, SATS, carol, bobHash) // carol does not own alice's token
+      verify(bad.spend.inputs[0].script, aliceToken, { tx: bad.spend, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('rejects breaking the token out to a P2PKH', function () {
+      var aliceToken = Token.ownershipToken(FEE, Token.ownerId(alice))
+      var r = transfer(aliceToken, SATS, alice, Token.ownerId(bob),
+        p2pkhOutput(PrivateKey.fromRandom(), SATS - FEE))
+      verify(r.spend.inputs[0].script, aliceToken, { tx: r.spend, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('defeats front-running: a third party cannot redirect a signed transfer', function () {
+      var aliceToken = Token.ownershipToken(FEE, Token.ownerId(alice))
+      var bobHash = Token.ownerId(bob)
+      var mallory = PrivateKey.fromRandom()
+      var malloryHash = Token.ownerId(mallory)
+
+      // Alice signs a valid transfer to Bob.
+      var r = transfer(aliceToken, SATS, alice, bobHash)
+      verify(r.spend.inputs[0].script, aliceToken, { tx: r.spend, satoshis: SATS }).ok.should.equal(true)
+
+      // A mempool watcher lifts Alice's signature + pubkey (chunks 1 and 2 of her
+      // unlock script) and tries to redirect the token to Mallory by recreating
+      // the token output owned by Mallory and reusing Alice's signature.
+      var chunks = r.spend.inputs[0].script.chunks
+      var stolenSig = chunks[1].buf
+      var stolenPub = chunks[2].buf
+
+      var malloryLock = Token.ownershipToken(FEE, malloryHash)
+      var evil = spendOf(aliceToken, SATS, [new Transaction.Output({ script: malloryLock, satoshis: SATS - FEE })])
+      var g = PushTx.grind(evil, 0, aliceToken, SATS) // a valid OP_PUSH_TX preimage for the evil tx
+      evil.inputs[0].setScript(new Script()
+        .add(Buffer.from(malloryHash))
+        .add(stolenSig) // Alice signed the Bob-output spend, not this one
+        .add(stolenPub)
+        .add(Buffer.from(g.preimage)))
+
+      // OP_CHECKSIG recomputes the sighash over the Mallory output => Alice's sig fails.
+      verify(evil.inputs[0].script, aliceToken, { tx: evil, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('grinds the input sequence so a token can coexist with a pinned nLockTime', function () {
+      var aliceToken = Token.ownershipToken(FEE, Token.ownerId(alice))
+      var bobHash = Token.ownerId(bob)
+      var nextLock = Token.ownershipToken(FEE, bobHash)
+      var spend = spendOf(aliceToken, SATS, [new Transaction.Output({ script: nextLock, satoshis: SATS - FEE })])
+      spend.nLockTime = 500000 // caller pins nLockTime; grind must not clobber it
+      spend.inputs[0].setScript(
+        Token.unlockTransfer(alice, bobHash, spend, SATS, aliceToken, { grind: { field: 'sequence' } }))
+      spend.nLockTime.should.equal(500000)
+      verify(spend.inputs[0].script, aliceToken, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+    })
+  })
+})

package/test/smart_contract/dsl_debugger.js

@@ -0,0 +1,103 @@
+'use strict'
+
+/* global describe, it, before, after */
+require('chai').should()
+var bsv = require('../..')
+var SC = bsv.SmartContract
+var Script = bsv.Script
+var PrivateKey = bsv.PrivateKey
+var Opcode = bsv.Opcode
+var H = SC.CovenantHelpers
+var verify = H.verify
+
+var SATS = 100000
+
+describe('SmartContract covenant DSL + debugger (v4.5.0)', function () {
+  this.timeout(20000)
+  var I = bsv.Script.Interpreter
+  var saved
+  before(function () {
+    saved = { el: I.MAX_SCRIPT_ELEMENT_SIZE, num: I.MAXIMUM_ELEMENT_SIZE, ops: I.MAX_OPS_PER_SCRIPT }
+    SC.enableGenesis()
+  })
+  after(function () {
+    I.MAX_SCRIPT_ELEMENT_SIZE = saved.el
+    I.MAXIMUM_ELEMENT_SIZE = saved.num
+    I.MAX_OPS_PER_SCRIPT = saved.ops
+  })
+
+  var alice = PrivateKey.fromRandom()
+  var attacker = PrivateKey.fromRandom()
+  function spendWith (lock, outputs) {
+    return H.fundAndSpend(lock, SATS, { outputs: outputs }).spend
+  }
+
+  describe('policy() DSL', function () {
+    it('payTo: compiles a covenant that pins the output and rejects redirects', function () {
+      var c = SC.policy().payTo(alice.toAddress(), SATS - 500).compile()
+      var spend = spendWith(c.lock, c.outputs)
+      spend.inputs[0].setScript(c.unlock(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      spend = spendWith(c.lock, [H.p2pkhOutput(attacker, SATS - 500)])
+      spend.inputs[0].setScript(c.unlock(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('multi-output: pins the exact ordered set and rejects a tweaked amount', function () {
+      var c = SC.policy().payTo(alice.toAddress(), 60000).payTo(attacker.toAddress(), 39500).compile()
+      var spend = spendWith(c.lock, c.outputs)
+      spend.inputs[0].setScript(c.unlock(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      var bad = spendWith(c.lock, [H.p2pkhOutput(alice, 60001), H.p2pkhOutput(attacker, 39499)])
+      bad.inputs[0].setScript(c.unlock(bad, SATS))
+      verify(bad.inputs[0].script, c.lock, { tx: bad, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('payTo AND lockUntil compose; rejects an early locktime', function () {
+      var height = 800000
+      var c = SC.policy().payTo(alice.toAddress(), SATS - 500).lockUntil(height).compile()
+      var spend = spendWith(c.lock, c.outputs)
+      spend.inputs[0].setScript(c.unlock(spend, SATS))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      spend = spendWith(c.lock, c.outputs)
+      spend.nLockTime = height - 1
+      spend.inputs[0].sequenceNumber = 0xfffffffe
+      spend.inputs[0].setScript(new Script().add(SC.PushTx.grind(spend, 0, c.lock, SATS).preimage))
+      verify(spend.inputs[0].script, c.lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+
+    it('exposes .perpetual()/.token() shortcuts', function () {
+      SC.policy.perpetual(500).toBuffer().length.should.be.above(252)
+      var h = bsv.crypto.Hash.sha256ripemd160(bsv.PrivateKey.fromRandom().toPublicKey().toBuffer())
+      SC.policy.token(500, h).toBuffer().length.should.be.above(252)
+    })
+
+    it('throws on an empty policy', function () {
+      (function () { SC.policy().compile() }).should.throw(/empty policy/)
+    })
+  })
+
+  describe('trace() debugger', function () {
+    it('traces a hash-lock and agrees with the interpreter (true and false)', function () {
+      var secret = Buffer.from('hello')
+      var lock = new Script().add(Opcode.OP_SHA256).add(bsv.crypto.Hash.sha256(secret)).add(Opcode.OP_EQUAL)
+      var r = SC.trace(new Script().add(secret), lock, { satoshis: 1000 })
+      r.ok.should.equal(true)
+      r.steps[r.steps.length - 1].stack.join().should.equal('01')
+      SC.trace(new Script().add(Buffer.from('nope')), lock, { satoshis: 1000 }).ok.should.equal(false)
+    })
+
+    it('traces an OP_PUSH_TX covenant ending in OP_CHECKSIG -> 01', function () {
+      var lock = SC.PushTx.authenticator()
+      var spend = H.fundAndSpend(lock, SATS, { outputs: [H.p2pkhOutput(alice, SATS - 500)] }).spend
+      spend.inputs[0].setScript(new Script().add(SC.PushTx.grind(spend, 0, lock, SATS).preimage))
+      var r = SC.trace(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS })
+      r.ok.should.equal(true)
+      r.steps[r.steps.length - 1].op.should.equal('OP_CHECKSIG')
+      SC.Debugger.format(r).should.contain('VALID')
+    })
+  })
+})

package/test/smart_contract/token_generalized.js

@@ -0,0 +1,187 @@
+'use strict'
+
+/* global describe, it, before, after */
+require('chai').should()
+var bsv = require('../..')
+var SC = bsv.SmartContract
+var PrivateKey = bsv.PrivateKey
+var Script = bsv.Script
+var Transaction = bsv.Transaction
+
+var Token = SC.Token
+var Auth = SC.Authorizers
+var help = SC.CovenantHelpers
+var fundAndSpend = help.fundAndSpend
+var p2pkhOutput = help.p2pkhOutput
+var verify = help.verify
+
+var SATS = 100000
+var FEE = 500
+
+describe('SmartContract generalized token (pluggable auth + multi-output)', function () {
+  this.timeout(20000)
+  var I = bsv.Script.Interpreter
+  var saved
+
+  before(function () {
+    saved = { el: I.MAX_SCRIPT_ELEMENT_SIZE, num: I.MAXIMUM_ELEMENT_SIZE, ops: I.MAX_OPS_PER_SCRIPT }
+    SC.enableGenesis()
+  })
+  after(function () {
+    I.MAX_SCRIPT_ELEMENT_SIZE = saved.el
+    I.MAXIMUM_ELEMENT_SIZE = saved.num
+    I.MAX_OPS_PER_SCRIPT = saved.ops
+  })
+
+  function spendOf (lock, sats, outputs) {
+    return fundAndSpend(lock, sats, { outputs: outputs }).spend
+  }
+
+  describe('single-key authorizer (default)', function () {
+    var alice = PrivateKey.fromRandom()
+    var bob = PrivateKey.fromRandom()
+
+    it('transfers and rejects a non-owner', function () {
+      var lock = Token.ownershipToken(FEE, Token.ownerId(alice))
+      var bobHash = Token.ownerId(bob)
+      var next = Token.ownershipToken(FEE, bobHash)
+      var spend = spendOf(lock, SATS, [new Transaction.Output({ script: next, satoshis: SATS - FEE })])
+      spend.inputs[0].setScript(Token.unlockTransfer(alice, bobHash, spend, SATS, lock))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+
+      var bad = spendOf(lock, SATS, [new Transaction.Output({ script: next, satoshis: SATS - FEE })])
+      bad.inputs[0].setScript(Token.unlockTransfer(bob, bobHash, bad, SATS, lock)) // bob does not own alice's token
+      verify(bad.inputs[0].script, lock, { tx: bad, satoshis: SATS }).ok.should.equal(false)
+    })
+  })
+
+  describe('multisig authorizer (m-of-n)', function () {
+    var a = PrivateKey.fromRandom()
+    var b = PrivateKey.fromRandom()
+    var c = PrivateKey.fromRandom()
+    var keys = [a.toPublicKey(), b.toPublicKey(), c.toPublicKey()]
+    var auth23 = Auth.multisig(2, 3)
+    var commit = auth23.commit(keys)
+    var nextOwner = Token.ownerId(PrivateKey.fromRandom())
+
+    function transfer23 (signWith) {
+      var lock = Token.ownershipToken(FEE, commit, auth23)
+      var next = Token.ownershipToken(FEE, nextOwner, auth23) // covenant recreates the SAME (multisig) code
+      var spend = spendOf(lock, SATS, [new Transaction.Output({ script: next, satoshis: SATS - FEE })])
+      spend.inputs[0].setScript(
+        Token.unlockTransfer({ keys: keys, signWith: signWith }, nextOwner, spend, SATS, lock, { auth: auth23 }))
+      return { spend: spend, lock: lock }
+    }
+
+    it('accepts a valid 2-of-3 (keys a,c)', function () {
+      var r = transfer23([a, c])
+      verify(r.spend.inputs[0].script, r.lock, { tx: r.spend, satoshis: SATS }).ok.should.equal(true)
+    })
+
+    it('accepts a different valid pair (keys b,c)', function () {
+      var r = transfer23([b, c])
+      verify(r.spend.inputs[0].script, r.lock, { tx: r.spend, satoshis: SATS }).ok.should.equal(true)
+    })
+
+    it('rejects a single signature (below threshold)', function () {
+      var run = function () { transfer23([a]) }
+      run.should.throw(/at least 2/)
+    })
+
+    it('rejects a signer outside the committed set', function () {
+      var outsider = PrivateKey.fromRandom()
+      var run = function () { transfer23([a, outsider]) }
+      run.should.throw(/not in the committed key set/)
+    })
+
+    it('rejects a forged set (right threshold, wrong keys)', function () {
+      // Commit to {a,b,c} but try to spend revealing a different key set {a,b,x}.
+      var x = PrivateKey.fromRandom()
+      var wrongKeys = [a.toPublicKey(), b.toPublicKey(), x.toPublicKey()]
+      var lock = Token.ownershipToken(FEE, commit, auth23)
+      var next = Token.ownershipToken(FEE, nextOwner, auth23)
+      var spend = spendOf(lock, SATS, [new Transaction.Output({ script: next, satoshis: SATS - FEE })])
+      spend.inputs[0].setScript(
+        Token.unlockTransfer({ keys: wrongKeys, signWith: [a, b] }, nextOwner, spend, SATS, lock, { auth: auth23 }))
+      // HASH160(forged redeem) != committed redeem hash => fails.
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+  })
+
+  describe('predicate authorizer (custom escape hatch)', function () {
+    // Re-implement single-key through the generic predicate interface to prove
+    // the contract is sufficient for custom schemes.
+    var Opcode = bsv.Opcode
+    var Hash = bsv.crypto.Hash
+    var owner = PrivateKey.fromRandom()
+    var custom = Auth.predicate({
+      name: 'custom-single-key',
+      commit: function (key) { return Hash.sha256ripemd160(key.toPublicKey().toBuffer()) },
+      emit: function (s) {
+        return s.add(Opcode.OP_OVER).add(Opcode.OP_HASH160).add(Opcode.OP_EQUALVERIFY).add(Opcode.OP_CHECKSIGVERIFY)
+      },
+      unlockArgs: function (spend, inputIndex, lock, sats, key) {
+        return [help.signInput(spend, key, inputIndex, lock, sats), key.toPublicKey().toBuffer()]
+      }
+    })
+
+    it('authorizes a transfer via a custom predicate', function () {
+      var lock = Token.ownershipToken(FEE, custom.commit(owner), custom)
+      var nextOwner = Token.ownerId(PrivateKey.fromRandom())
+      var next = Token.ownershipToken(FEE, nextOwner)
+      var spend = spendOf(lock, SATS, [new Transaction.Output({ script: next, satoshis: SATS - FEE })])
+      spend.inputs[0].setScript(Token.unlockTransfer(owner, nextOwner, spend, SATS, lock, { auth: custom }))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+    })
+  })
+
+  describe('multi-output token (N-output)', function () {
+    var alice = PrivateKey.fromRandom()
+    var bob = PrivateKey.fromRandom()
+
+    function serialize (output) { return output.toBufferWriter().toBuffer() }
+    function le8 (v) { return new bsv.crypto.BN(v).toBuffer({ endian: 'little', size: 8 }) }
+
+    it('recreates the token among other outputs and binds them all', function () {
+      var lock = Token.ownershipTokenMulti(Token.ownerId(alice))
+      var bobHash = Token.ownerId(bob)
+      var nextToken = Token.ownershipTokenMulti(bobHash)
+
+      var payment = p2pkhOutput(PrivateKey.fromRandom(), 4000)
+      var tokenValue = 1000
+      var tokenOutput = new Transaction.Output({ script: nextToken, satoshis: tokenValue })
+      var dataOutput = new Transaction.Output({
+        script: new Script().add(bsv.Opcode.OP_FALSE).add(bsv.Opcode.OP_RETURN).add(Buffer.from('hello')),
+        satoshis: 0
+      })
+
+      // tx outputs in order: [payment, token, data]
+      var spend = spendOf(lock, SATS, [payment, tokenOutput, dataOutput])
+      spend.inputs[0].setScript(Token.unlockTransferMulti(alice, bobHash, spend, SATS, lock, {
+        before: serialize(payment),
+        after: serialize(dataOutput),
+        tokenValue: le8(tokenValue)
+      }))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(true)
+    })
+
+    it('rejects a tampered surrounding output', function () {
+      var lock = Token.ownershipTokenMulti(Token.ownerId(alice))
+      var bobHash = Token.ownerId(bob)
+      var nextToken = Token.ownershipTokenMulti(bobHash)
+      var payment = p2pkhOutput(PrivateKey.fromRandom(), 4000)
+      var tokenValue = 1000
+      var tokenOutput = new Transaction.Output({ script: nextToken, satoshis: tokenValue })
+
+      var spend = spendOf(lock, SATS, [payment, tokenOutput])
+      // Claim a DIFFERENT `before` than the real first output => HASH160 mismatch.
+      var lyingPayment = p2pkhOutput(PrivateKey.fromRandom(), 4000)
+      spend.inputs[0].setScript(Token.unlockTransferMulti(alice, bobHash, spend, SATS, lock, {
+        before: serialize(lyingPayment),
+        after: Buffer.alloc(0),
+        tokenValue: le8(tokenValue)
+      }))
+      verify(spend.inputs[0].script, lock, { tx: spend, satoshis: SATS }).ok.should.equal(false)
+    })
+  })
+})

package/test/transaction/deserialize.js

@@ -0,0 +1,33 @@
+'use strict'
+
+var Transaction = require('../../lib/transaction')
+
+var vectorsValid = require('../data/bitcoind/tx_valid.json')
+var vectorsInvalid = require('../data/bitcoind/tx_invalid.json')
+
+describe('Transaction deserialization', function () {
+  describe('valid transaction test case', function () {
+    var index = 0
+    vectorsValid.forEach(function (vector) {
+      it('vector #' + index, function () {
+        if (vector.length > 1) {
+          var hexa = vector[1]
+          Transaction(hexa).serialize(true).should.equal(hexa)
+          index++
+        }
+      })
+    })
+  })
+  describe('invalid transaction test case', function () {
+    var index = 0
+    vectorsInvalid.forEach(function (vector) {
+      it('invalid vector #' + index, function () {
+        if (vector.length > 1) {
+          var hexa = vector[1]
+          Transaction(hexa).serialize(true).should.equal(hexa)
+          index++
+        }
+      })
+    })
+  })
+})