@smartledger/bsv 7.13.0 → 8.0.0

package/lib/script/interpreter.js

@@ -75,7 +75,8 @@ Interpreter.prototype.verify = function (scriptSig, scriptPubkey, tx, nin, flags
     nin = 0
   }
   if (_.isUndefined(flags)) {
-    flags = 0
+    flags = Interpreter.currentConsensusFlags()
+    if (!satoshisBN) flags &= ~Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID
   }
 
   // If FORKID is enabled, we also ensure strict encoding.
@@ -107,7 +108,12 @@ Interpreter.prototype.verify = function (scriptSig, scriptPubkey, tx, nin, flags
     return false
   }
 
-  if (flags & Interpreter.SCRIPT_VERIFY_P2SH) {
+  // Genesis removed P2SH: an output created after it that happens to match the
+  // pattern is evaluated literally, with no redeem-script pass.
+  var p2sh = (flags & Interpreter.SCRIPT_VERIFY_P2SH) !== 0 &&
+    (flags & Interpreter.SCRIPT_UTXO_AFTER_GENESIS) === 0
+
+  if (p2sh) {
     stackCopy = this.stack.slice()
   }
 
@@ -139,7 +145,7 @@ Interpreter.prototype.verify = function (scriptSig, scriptPubkey, tx, nin, flags
   }
 
   // Additional validation for spend-to-script-hash transactions:
-  if ((flags & Interpreter.SCRIPT_VERIFY_P2SH) && scriptPubkey.isScriptHashOut()) {
+  if (p2sh && scriptPubkey.isScriptHashOut()) {
     // scriptSig must be literals-only or validation fails
     if (!scriptSig.isPushOnly()) {
       this.errstr = 'SCRIPT_ERR_SIG_PUSHONLY'
@@ -191,11 +197,18 @@ Interpreter.prototype.verify = function (scriptSig, scriptPubkey, tx, nin, flags
     // Disallow CLEANSTACK without P2SH, as otherwise a switch
     // CLEANSTACK->P2SH+CLEANSTACK would be possible, which is not a
     // softfork (and P2SH should be one).
-    if ((flags & Interpreter.SCRIPT_VERIFY_P2SH) === 0) {
+    // Genesis removed P2SH, so post-Genesis the pairing no longer applies and
+    // CLEANSTACK stands on its own.
+    if ((flags & Interpreter.SCRIPT_VERIFY_P2SH) === 0 &&
+        (flags & Interpreter.SCRIPT_UTXO_AFTER_GENESIS) === 0) {
       throw new Error('internal error - CLEANSTACK without P2SH')
     }
 
-    if (stackCopy.length !== 1) {
+    // The final stack. After a P2SH evaluation that is stackCopy itself, since
+    // the redeem script was evaluated over it, but reading stackCopy directly
+    // is wrong once P2SH no longer applies: it is then either the stack as it
+    // stood after the scriptSig, or never assigned at all.
+    if (this.stack.length !== 1) {
       this.errstr = 'SCRIPT_ERR_CLEANSTACK'
       return false
     }
@@ -212,7 +225,15 @@ Interpreter.prototype.initialize = function (obj) {
   this.pc = 0
   this.pbegincodehash = 0
   this.nOpCount = 0
+  this.returned = false
+  // Set when an OP_RETURN is reached inside a conditional after Genesis: the
+  // rest of the script stops executing while the conditional grammar is still
+  // checked to the end.
+  this.nonTopLevelReturnAfterGenesis = false
   this.vfExec = []
+  // Whether the conditional at each depth has already seen an OP_ELSE.
+  // Genesis allows only one per OP_IF, which needs remembering per level.
+  this.vfElse = []
   this.errstr = ''
   this.flags = 0
 }
@@ -227,7 +248,13 @@ Interpreter.prototype.set = function (obj) {
   this.pc = typeof obj.pc !== 'undefined' ? obj.pc : this.pc
   this.pbegincodehash = typeof obj.pbegincodehash !== 'undefined' ? obj.pbegincodehash : this.pbegincodehash
   this.nOpCount = typeof obj.nOpCount !== 'undefined' ? obj.nOpCount : this.nOpCount
+  this.returned = typeof obj.returned !== 'undefined' ? obj.returned : this.returned
+  this.nonTopLevelReturnAfterGenesis =
+    typeof obj.nonTopLevelReturnAfterGenesis !== 'undefined'
+      ? obj.nonTopLevelReturnAfterGenesis
+      : this.nonTopLevelReturnAfterGenesis
   this.vfExec = obj.vfExec || this.vfExec
+  this.vfElse = obj.vfElse || this.vfElse
   this.errstr = obj.errstr || this.errstr
   this.flags = typeof obj.flags !== 'undefined' ? obj.flags : this.flags
 }
@@ -236,12 +263,24 @@ Interpreter.true = Buffer.from([1])
 Interpreter.false = Buffer.from([])
 
 Interpreter.MAX_SCRIPT_ELEMENT_SIZE = 520
+// CScriptNum's `max_length`: the widest a script NUMBER may be, in bytes. Distinct from
+// MAX_SCRIPT_ELEMENT_SIZE, which caps a pushed data element. Arithmetic opcodes read
+// operands through it, and Chronicle's shift bounds its result against it.
 Interpreter.MAXIMUM_ELEMENT_SIZE = 4
+
+// The script-number bound `useMainnetConsensus()` applies. Held separately from the
+// pre-Genesis default above so the two can diverge once the post-Genesis value is pinned
+// against the node source; see the note in useMainnetConsensus for why it is not simply
+// raised with the other caps.
+Interpreter.DEFAULT_SCRIPT_NUM_LENGTH = 4
 // Maximum number of non-push opcodes per script. Pre-Genesis consensus is 201;
 // post-Genesis BSV removed this limit. Exposed as a constant (instead of a magic
 // number) so applications can opt into post-Genesis rules — e.g. OP_PUSH_TX
 // covenants, which need a few hundred opcodes — without forking the interpreter.
-Interpreter.MAX_OPS_PER_SCRIPT = 201
+// BSV's pre-Genesis figure is 500, not Bitcoin Core's 201: the limit was
+// raised before Genesis removed it altogether. Carrying Core's number rejected
+// scripts the network accepted.
+Interpreter.MAX_OPS_PER_SCRIPT = 500
 // Maximum total serialized script size. Pre-Genesis consensus is 10,000 bytes;
 // post-Genesis BSV removed this limit too. It was previously a literal inside
 // evaluate(), so `useGenesisLimits()` could not lift it and any script over 10 KB —
@@ -249,6 +288,16 @@ Interpreter.MAX_OPS_PER_SCRIPT = 201
 // no matter what the caller asked for.
 Interpreter.MAX_SCRIPT_SIZE = 10000
 
+// Genesis and Chronicle limits, from the node's src/consensus/consensus.h.
+// These are the values the WIP note above asked to be pinned against the node
+// source: Genesis raised the script-number bound to 750,000 bytes and
+// Chronicle to 32,000,000, and removed the element, script size and operation
+// caps outright.
+Interpreter.UNLIMITED = Number.MAX_SAFE_INTEGER
+Interpreter.MAX_SCRIPT_NUM_LENGTH_AFTER_GENESIS = 750000
+Interpreter.MAX_SCRIPT_NUM_LENGTH_AFTER_CHRONICLE = 32000000
+Interpreter.MAX_PUBKEYS_PER_MULTISIG_AFTER_GENESIS = 4294967295
+
 Interpreter.LOCKTIME_THRESHOLD = 500000000
 Interpreter.LOCKTIME_THRESHOLD_BN = new BN(Interpreter.LOCKTIME_THRESHOLD)
 
@@ -398,17 +447,41 @@ Interpreter.SCRIPT_ENABLE_REPLAY_PROTECTION = (1 << 17)
 
 // Enable new opcodes.
 //
-Interpreter.SCRIPT_ENABLE_MONOLITH_OPCODES = (1 << 18)
+// Moved off 1<<18 and 1<<19, which the reference node assigns to
+// SCRIPT_GENESIS and SCRIPT_UTXO_AFTER_GENESIS. Sharing those bits meant that
+// node-derived flags passed into this library were silently read as something
+// else. These two are BCH-era flags the node does not define at all, so their
+// positions carry no consensus meaning and are free to move.
+Interpreter.SCRIPT_ENABLE_MONOLITH_OPCODES = (1 << 11)
 
 // Are the Magnetic upgrade opcodes enabled?
 //
-Interpreter.SCRIPT_ENABLE_MAGNETIC_OPCODES = (1 << 19)
+Interpreter.SCRIPT_ENABLE_MAGNETIC_OPCODES = (1 << 12)
+
+// The era flags, at the bit positions src/script/script_flags.h assigns them.
+// Keep them in sync: they are consensus-relevant and are passed across the
+// boundary with node-derived test vectors.
+//
+// The distinction between the pairs matters. SCRIPT_UTXO_AFTER_* describes the
+// output being spent and governs almost every rule, because an output made
+// before an upgrade is spent under the old rules forever. SCRIPT_GENESIS and
+// SCRIPT_CHRONICLE describe the block the spending transaction is in.
+Interpreter.SCRIPT_GENESIS = (1 << 18)
+Interpreter.SCRIPT_UTXO_AFTER_GENESIS = (1 << 19)
 
 // Chronicle restores OP_2MUL/OP_2DIV and gives OP_VER/OP_VERIF/OP_VERNOTIF meaning.
 // Off by default: enabling it changes script evaluation, so it is an explicit opt-in
 // exactly like the Monolith and Magnetic flags above.
 Interpreter.SCRIPT_ENABLE_CHRONICLE = (1 << 20)
 
+// The node's name for the same bit: Chronicle rules apply to the block the
+// spending transaction is in.
+Interpreter.SCRIPT_CHRONICLE = Interpreter.SCRIPT_ENABLE_CHRONICLE
+
+// Was the output being spent created after Chronicle activated? This is what
+// the node gates the restored opcodes on.
+Interpreter.SCRIPT_UTXO_AFTER_CHRONICLE = (1 << 21)
+
 /**
  * Block height at which Chronicle activated on BSV mainnet (2026-04-07).
  *
@@ -432,9 +505,21 @@ Interpreter.CHRONICLE_ACTIVATION_HEIGHT = 943816
  * every output created since is subject to it. Pass `false` to validate the spend of a
  * pre-activation UTXO, which is exactly the distinction the node makes.
  *
+ * CLTV and CSV are deliberately ABSENT. Genesis reverted both opcodes to OP_NOP2/OP_NOP3,
+ * and the node ignores their flags entirely once the UTXO is post-Genesis:
+ *
+ *   if (!(flags & SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY) || utxo_after_genesis) {
+ *       // not enabled; treat as a NOP2
+ *
+ * Including them made this function reject `<n> OP_CHECKLOCKTIMEVERIFY OP_DROP OP_1`,
+ * which mainnet accepts — a validator STRICTER than consensus, which is as wrong as one
+ * that is looser and harder to notice, because nothing that tests this library against
+ * itself can see it. The flags still exist for callers deliberately emulating
+ * pre-Genesis rules; they are simply not mainnet.
+ *
  * NOTE: script-number and element-size limits are NOT flags — they are process-wide
- * statics raised by `useGenesisLimits()`. A post-Genesis validator needs both this flag
- * set and that call.
+ * statics. This function cannot set them, which is why `useMainnetConsensus()` exists;
+ * prefer it unless you are managing the limits yourself.
  *
  * @param {object} [opts]
  * @param {boolean} [opts.afterChronicle=true] is the UTXO being spent post-activation
@@ -448,8 +533,6 @@ Interpreter.mainnetFlags = function (opts) {
     Interpreter.SCRIPT_VERIFY_LOW_S |
     Interpreter.SCRIPT_VERIFY_NULLFAIL |
     Interpreter.SCRIPT_VERIFY_MINIMALDATA |
-    Interpreter.SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY |
-    Interpreter.SCRIPT_VERIFY_CHECKSEQUENCEVERIFY |
     Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID |
     Interpreter.SCRIPT_ENABLE_MAGNETIC_OPCODES |
     Interpreter.SCRIPT_ENABLE_MONOLITH_OPCODES
@@ -459,6 +542,88 @@ Interpreter.mainnetFlags = function (opts) {
   return flags
 }
 
+/**
+ * Configure this process for BSV mainnet consensus and return the matching flags.
+ *
+ * Flags and limits are separate mechanisms here — flags are an argument to `verify()`,
+ * limits are process-wide statics — and that split is what made `mainnetFlags()` alone
+ * insufficient: it returns mainnet flags while the interpreter still holds the
+ * PRE-Genesis 520 / 201 / 10,000 caps, so a 12,801-byte script valid on mainnet was
+ * rejected with SCRIPT_ERR_SCRIPT_SIZE.
+ *
+ * This is the single call that makes both agree. It MUTATES process-wide state, which is
+ * why it is named `use*` like `useGenesisLimits()` rather than reading like a getter.
+ *
+ * @param {object} [opts]
+ * @param {boolean} [opts.afterChronicle=true] is the UTXO being spent post-activation
+ * @param {number} [opts.max] element-size ceiling to pass through to useGenesisLimits()
+ * @returns {number} the flags to hand to verify()
+ */
+/**
+ * The flags describing BSV mainnet as it is today, and the default for `verify()`.
+ *
+ * Until 8.0.0 `verify()` defaulted to `0` — no rules at all. A BSV library whose
+ * out-of-the-box answer described Bitcoin in 2015 is wrong in the direction that is
+ * hardest to notice: it accepts scripts the network rejects, and nothing that tests this
+ * library against itself can see it. The era now has to be stated to get anything else.
+ *
+ * The set is derived from what the node applies, not assembled by judgement:
+ *
+ *   MONOLITH / MAGNETIC   BSV restored these opcodes in 2018 and the node does not gate
+ *                         them. This library still does, so omitting them here would be
+ *                         STRICTER than consensus. tools/sv-vector-harness.js sets the
+ *                         same pair as its baseline for every vector, for this reason.
+ *   GENESIS               rules keyed to the era of the spending transaction
+ *   UTXO_AFTER_GENESIS    rules keyed to the era of the output being spent (2020)
+ *   CHRONICLE             the spending transaction's era (2026)
+ *   UTXO_AFTER_CHRONICLE  the spent output's era
+ *
+ * Spending a pre-activation output is the explicit case, because that is the input the
+ * caller knows and the library cannot: `mainnetFlags({ afterChronicle: false })`, or a
+ * hand-assembled set for older eras.
+ *
+ * FORKID is deliberately absent here and added by `verify()` only when the input amount
+ * is available, since the digest cannot be computed without it.
+ *
+ * @returns {number}
+ */
+Interpreter.currentConsensusFlags = function () {
+  return Interpreter.SCRIPT_ENABLE_MONOLITH_OPCODES |
+    Interpreter.SCRIPT_ENABLE_MAGNETIC_OPCODES |
+    Interpreter.SCRIPT_GENESIS |
+    Interpreter.SCRIPT_UTXO_AFTER_GENESIS |
+    Interpreter.SCRIPT_ENABLE_CHRONICLE |
+    Interpreter.SCRIPT_UTXO_AFTER_CHRONICLE |
+    Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID
+}
+
+Interpreter.useMainnetConsensus = function (opts) {
+  opts = opts || {}
+  Interpreter.useGenesisLimits(opts.max)
+
+  // Restore a FINITE script-number bound. `useGenesisLimits()` raises all four caps to
+  // the same ceiling, and for MAXIMUM_ELEMENT_SIZE — which is CScriptNum's `max_length`,
+  // not a push-size cap — a ceiling of 0x7fffffff makes Chronicle's shift overflow check
+  // unreachable, because it tests `current_size + shift_bytes > max_length`. Measured:
+  //
+  //   default limits:              SCRIPT_ERR_SCRIPTNUM_OVERFLOW  (correct)
+  //   after useGenesisLimits():    valid, grows without bound     (WRONG)
+  //
+  // A validator looser than consensus accepts what the network rejects, so the ceiling
+  // cannot be right whatever the true post-Genesis value turns out to be.
+  //
+  // The true value is NOT settled here. Genesis raised this bound above the pre-Genesis
+  // 4 bytes, so the conservative default below is stricter than mainnet for wide
+  // arithmetic — the same class of error #112 fixed, in the opposite direction. It is
+  // chosen deliberately: given a choice between rejecting a valid script and accepting
+  // an invalid one, this library fails closed. Callers who know the bound their workload
+  // needs should pass `maxScriptNumLength` explicitly, and the value should be pinned
+  // against the SV Node source before this default changes.
+  Interpreter.MAXIMUM_ELEMENT_SIZE = opts.maxScriptNumLength || Interpreter.DEFAULT_SCRIPT_NUM_LENGTH
+
+  return Interpreter.mainnetFlags(opts)
+}
+
 /* Below flags apply in the context of BIP 68 */
 /**
  * If this flag set, CTxIn::nSequence is NOT interpreted as a relative
@@ -526,6 +691,20 @@ Interpreter.prototype.checkSignatureEncoding = function (buf) {
       return false
     }
 
+    // A signature may only ask for the original digest where Chronicle
+    // applies. This is where the node stops a pre-Chronicle signature whose
+    // type byte happens to set 0x20 from being read as one asking for OTDA:
+    //
+    //   if(!chronicleEnabled && usesChronicle) return SCRIPT_ERR_ILLEGAL_CHRONICLE;
+    //
+    // It rejects such a signature outright rather than reinterpreting it,
+    // which is why SignatureHash() itself can route on the bit alone.
+    if (!(this.flags & Interpreter.SCRIPT_CHRONICLE) &&
+        (sig.nhashtype & Signature.SIGHASH_CHRONICLE)) {
+      this.errstr = 'SCRIPT_ERR_ILLEGAL_CHRONICLE'
+      return false
+    }
+
     if ((this.flags & Interpreter.SCRIPT_ENABLE_SIGHASH_FORKID) &&
         !(sig.nhashtype & Signature.SIGHASH_FORKID)) {
       this.errstr = 'SCRIPT_ERR_MUST_USE_FORKID'
@@ -554,6 +733,67 @@ Interpreter.prototype.checkPubkeyEncoding = function (buf) {
   *
   */
 
+/**
+ * Which era's rules apply.
+ *
+ * The node decides almost everything by the era of the output being spent, so
+ * these read the SCRIPT_UTXO_AFTER_* flags rather than a process-wide setting.
+ * A caller that sets no era flag gets the previous behaviour exactly: the
+ * limit methods below fall back to the mutable statics, so useGenesisLimits()
+ * and setLimits() keep working as they did.
+ */
+Interpreter.prototype.isAfterGenesis = function () {
+  return (this.flags & Interpreter.SCRIPT_UTXO_AFTER_GENESIS) !== 0
+}
+
+/**
+ * SCRIPT_ENABLE_CHRONICLE is accepted alongside SCRIPT_UTXO_AFTER_CHRONICLE.
+ * The former is this library's existing opt-in and sits on the node's
+ * SCRIPT_CHRONICLE bit; the latter is what the node actually gates the
+ * restored opcodes on. Either enables them, so existing callers are unaffected.
+ */
+Interpreter.prototype.isAfterChronicle = function () {
+  return (this.flags &
+    (Interpreter.SCRIPT_UTXO_AFTER_CHRONICLE | Interpreter.SCRIPT_ENABLE_CHRONICLE)) !== 0
+}
+
+/** Genesis removed this limit; before it, whatever the statics say. */
+Interpreter.prototype.maxScriptElementSize = function () {
+  return this.isAfterGenesis() ? Interpreter.UNLIMITED : Interpreter.MAX_SCRIPT_ELEMENT_SIZE
+}
+
+/** Genesis removed this limit too. */
+Interpreter.prototype.maxScriptSize = function () {
+  return this.isAfterGenesis() ? Interpreter.UNLIMITED : Interpreter.MAX_SCRIPT_SIZE
+}
+
+/** And this one. Note the pre-Genesis figure on BSV is 500, not Core's 201. */
+Interpreter.prototype.maxOpsPerScript = function () {
+  return this.isAfterGenesis() ? Interpreter.UNLIMITED : Interpreter.MAX_OPS_PER_SCRIPT
+}
+
+/**
+ * The widest a script number may be. Four bytes before Genesis, which is why
+ * pre-Genesis contracts cannot do arithmetic on satoshi amounts; Genesis
+ * raised it to 750KB and Chronicle to 32MB.
+ */
+Interpreter.prototype.maxScriptNumLength = function () {
+  if (this.isAfterChronicle()) {
+    return Interpreter.MAX_SCRIPT_NUM_LENGTH_AFTER_CHRONICLE
+  }
+  if (this.isAfterGenesis()) {
+    return Interpreter.MAX_SCRIPT_NUM_LENGTH_AFTER_GENESIS
+  }
+  return Interpreter.MAXIMUM_ELEMENT_SIZE
+}
+
+/** Genesis raised this rather than removing it: the node caps at UINT32_MAX. */
+Interpreter.prototype.maxPubKeysPerMultisig = function () {
+  return this.isAfterGenesis()
+    ? Interpreter.MAX_PUBKEYS_PER_MULTISIG_AFTER_GENESIS
+    : 20
+}
+
 Interpreter._isMinimallyEncoded = function (buf, nMaxNumSize) {
   nMaxNumSize = nMaxNumSize || Interpreter.MAXIMUM_ELEMENT_SIZE
   if (buf.length > nMaxNumSize) {
@@ -636,7 +876,7 @@ Interpreter._minimallyEncode = function (buf) {
  * bitcoind commit: b5d1b1092998bc95313856d535c632ea5a8f9104
  */
 Interpreter.prototype.evaluate = function () {
-  if (this.script.toBuffer().length > Interpreter.MAX_SCRIPT_SIZE) {
+  if (this.script.toBuffer().length > this.maxScriptSize()) {
     this.errstr = 'SCRIPT_ERR_SCRIPT_SIZE'
     return false
   }
@@ -649,6 +889,12 @@ Interpreter.prototype.evaluate = function () {
         return false
       }
       this._callbackStep(thisStep)
+      if (this.returned) {
+        // A top-level OP_RETURN after Genesis: the script is over and the top
+        // stack item decides. Nothing after it is read, so an unbalanced
+        // conditional or an invalid opcode beyond this point is not an error.
+        return true
+      }
     }
 
     // Size limits
@@ -657,7 +903,12 @@ Interpreter.prototype.evaluate = function () {
       return false
     }
   } catch (e) {
-    this.errstr = 'SCRIPT_ERR_UNKNOWN_ERROR: ' + e
+    // An error that knows the node's result code reports it. Script number
+    // decoding is the case that matters: 78 of the corpus's rejected vectors
+    // expect SCRIPTNUM_MINENCODE or SCRIPTNUM_OVERFLOW, and every one of them
+    // used to arrive here and be flattened into UNKNOWN_ERROR. The script
+    // failed either way, so the accept/reject vectors could not see it.
+    this.errstr = e.scriptErr || ('SCRIPT_ERR_UNKNOWN_ERROR: ' + e)
     return false
   }
 
@@ -718,7 +969,11 @@ Interpreter.prototype.checkLockTime = function (nLockTime) {
   // prevent this condition. Alternatively we could test all
   // inputs, but testing just this input minimizes the data
   // required to prove correct CHECKLOCKTIMEVERIFY execution.
-  if (this.tx.inputs[this.nin].isFinal()) {
+  // Same guard as checkSequence: no input at `nin` means the locktime cannot be
+  // satisfied. Reached only when the comparisons above pass, which is why this one
+  // never surfaced as a TypeError — the ordering hid it, not a check.
+  var input = this.tx.inputs[this.nin]
+  if (!input || input.isFinal()) {
     return false
   }
 
@@ -732,9 +987,19 @@ Interpreter.prototype.checkLockTime = function (nLockTime) {
  *                   the transaction's sequence
  */
 Interpreter.prototype.checkSequence = function (nSequence) {
+  // No input at `nin` means the relative locktime cannot be satisfied, so fail the
+  // script rather than dereferencing undefined. This used to throw a TypeError that the
+  // evaluator's try/catch converted into SCRIPT_ERR_UNKNOWN_ERROR — a misleading error
+  // that pointed at the script instead of at the caller's index. The same shape as the
+  // `new BN(...)` note below, and as the CHECKLOCKTIMEVERIFY guard.
+  var input = this.tx.inputs[this.nin]
+  if (!input) {
+    return false
+  }
+
   // Relative lock times are supported by comparing the passed in operand to
   // the sequence number of the input.
-  var txToSequence = this.tx.inputs[this.nin].sequenceNumber
+  var txToSequence = input.sequenceNumber
 
   // Fail if the transaction's version number is not set high enough to
   // trigger BIP 68 rules.
@@ -819,7 +1084,7 @@ Interpreter.prototype.step = function () {
         // "disabled" is stronger than "unimplemented": a disabled opcode fails the
         // script even in an UNEXECUTED branch, which is why this lives in
         // isOpcodeDisabled rather than in the evaluation switch.
-        if ((self.flags & Interpreter.SCRIPT_ENABLE_CHRONICLE) === 0) {
+        if (!self.isAfterChronicle()) {
           return true
         }
         break
@@ -857,8 +1122,6 @@ Interpreter.prototype.step = function () {
 
   var fRequireMinimal = (this.flags & Interpreter.SCRIPT_VERIFY_MINIMALDATA) !== 0
 
-  // bool fExec = !count(vfExec.begin(), vfExec.end(), false);
-  var fExec = (this.vfExec.indexOf(false) === -1)
   var buf, buf1, buf2, spliced, n, x1, x2, bn, bn1, bn2, bufSig, bufPubkey, subscript
   var sig, pubkey
   var fValue, fSuccess
@@ -867,22 +1130,35 @@ Interpreter.prototype.step = function () {
   var chunk = this.script.chunks[this.pc]
   this.pc++
   var opcodenum = chunk.opcodenum
+
+  // bool fExec = !count(vfExec.begin(), vfExec.end(), false);
+  //
+  // Computed after the opcode is read, because it depends on it: once an
+  // OP_RETURN has been seen inside a conditional after Genesis, nothing but a
+  // further OP_RETURN executes, while the conditional grammar is still checked
+  // through to the end of the script.
+  var fExec = (this.vfExec.indexOf(false) === -1) &&
+    (!this.nonTopLevelReturnAfterGenesis || opcodenum === Opcode.OP_RETURN)
   if (_.isUndefined(opcodenum)) {
     this.errstr = 'SCRIPT_ERR_UNDEFINED_OPCODE'
     return false
   }
-  if (chunk.buf && chunk.buf.length > Interpreter.MAX_SCRIPT_ELEMENT_SIZE) {
+  if (chunk.buf && chunk.buf.length > this.maxScriptElementSize()) {
     this.errstr = 'SCRIPT_ERR_PUSH_SIZE'
     return false
   }
 
   // Note how Opcode.OP_RESERVED does not count towards the opcode limit.
-  if (opcodenum > Opcode.OP_16 && ++(this.nOpCount) > Interpreter.MAX_OPS_PER_SCRIPT) {
+  if (opcodenum > Opcode.OP_16 && ++(this.nOpCount) > this.maxOpsPerScript()) {
     this.errstr = 'SCRIPT_ERR_OP_COUNT'
     return false
   }
 
-  if (isOpcodeDisabled(opcodenum)) {
+  // Before Genesis the mere presence of a disabled opcode invalidates the
+  // script, even in a branch that never runs. After it, only executing one
+  // fails — the node states it as `IsOpcodeDisabled(...) && (!utxo_after_genesis
+  // || fExec)`.
+  if (isOpcodeDisabled(opcodenum) && (!this.isAfterGenesis() || fExec)) {
     this.errstr = 'SCRIPT_ERR_DISABLED_OPCODE'
     return false
   }
@@ -895,7 +1171,13 @@ Interpreter.prototype.step = function () {
     if (!chunk.buf) {
       this.stack.push(Interpreter.false)
     } else if (chunk.len !== chunk.buf.length) {
-      throw new Error(`Length of push value not equal to length of data (${chunk.len},${chunk.buf.length})`)
+      // A push that declares more bytes than the script carries — "PUSHDATA1
+      // with not enough bytes" and its PUSHDATA2/4 counterparts. The node
+      // fails these as SCRIPT_ERR_BAD_OPCODE. Throwing reached the evaluator's
+      // catch and became UNKNOWN_ERROR; this is inside step(), which can
+      // simply fail.
+      this.errstr = 'SCRIPT_ERR_BAD_OPCODE'
+      return false
     } else {
       this.stack.push(chunk.buf)
     }
@@ -937,7 +1219,14 @@ Interpreter.prototype.step = function () {
       case Opcode.OP_NOP2:
       case Opcode.OP_CHECKLOCKTIMEVERIFY:
 
-        if (!(this.flags & Interpreter.SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY)) {
+        // Genesis reverted this to an upgradable NOP for outputs created
+        // after it, so a post-Genesis script containing it enforces no
+        // locktime at all. The node reads
+        //   !(flags & SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY) || utxo_after_genesis
+        // and without the second half a transaction the network accepts is
+        // rejected here.
+        if (!(this.flags & Interpreter.SCRIPT_VERIFY_CHECKLOCKTIMEVERIFY) ||
+            this.isAfterGenesis()) {
           // not enabled; treat as a NOP2
           if (this.flags & Interpreter.SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS) {
             this.errstr = 'SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS'
@@ -985,7 +1274,14 @@ Interpreter.prototype.step = function () {
       case Opcode.OP_NOP3:
       case Opcode.OP_CHECKSEQUENCEVERIFY:
 
-        if (!(this.flags & Interpreter.SCRIPT_VERIFY_CHECKSEQUENCEVERIFY)) {
+        // Genesis reverted this to an upgradable NOP for outputs created
+        // after it, so a post-Genesis script containing it enforces no
+        // locktime at all. The node reads
+        //   !(flags & SCRIPT_VERIFY_CHECKSEQUENCEVERIFY) || utxo_after_genesis
+        // and without the second half a transaction the network accepts is
+        // rejected here.
+        if (!(this.flags & Interpreter.SCRIPT_VERIFY_CHECKSEQUENCEVERIFY) ||
+            this.isAfterGenesis()) {
           // not enabled; treat as a NOP3
           if (this.flags & Interpreter.SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS) {
             this.errstr = 'SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS'
@@ -1056,7 +1352,7 @@ Interpreter.prototype.step = function () {
         //
         // Rejecting them outright would make this library refuse scripts the network
         // accepts, which is the mirror of the bug that made them silently succeed.
-        if ((this.flags & Interpreter.SCRIPT_ENABLE_CHRONICLE) === 0) {
+        if (!this.isAfterChronicle()) {
           if (this.flags & Interpreter.SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS) {
             this.errstr = 'SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS'
             return false
@@ -1069,7 +1365,7 @@ Interpreter.prototype.step = function () {
           this.errstr = 'SCRIPT_ERR_INVALID_STACK_OPERATION'
           return false
         }
-        var maxNumSize = Interpreter.MAXIMUM_ELEMENT_SIZE
+        var maxNumSize = this.maxScriptNumLength()
         var shiftBn = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, maxNumSize)
         if (shiftBn.isNeg()) {
           this.errstr = 'SCRIPT_ERR_INVALID_NUMBER_RANGE'
@@ -1133,7 +1429,7 @@ Interpreter.prototype.step = function () {
         //
         // Unlike the string opcodes, BAD_OPCODE pre-Chronicle IS correct here —
         // the node returns it unconditionally.
-        if ((this.flags & Interpreter.SCRIPT_ENABLE_CHRONICLE) === 0) {
+        if (!this.isAfterChronicle()) {
           this.errstr = 'SCRIPT_ERR_BAD_OPCODE'
           return false
         }
@@ -1157,8 +1453,13 @@ Interpreter.prototype.step = function () {
         // So pre-Chronicle they are an error only in an EXECUTED branch. BSV is
         // post-Genesis, which is the whole condition. Returning BAD_OPCODE
         // unconditionally rejected scripts the network accepts.
-        if ((this.flags & Interpreter.SCRIPT_ENABLE_CHRONICLE) === 0) {
-          if (!fExec) {
+        if (!this.isAfterChronicle()) {
+          // Genesis is part of the condition, not an assumption: before it
+          // these are illegal everywhere, including in a branch that never
+          // runs, and only from Genesis does an unexecuted one become
+          // harmless. The era is carried in the flags now, so a pre-Genesis
+          // output is validated as one.
+          if (this.isAfterGenesis() && !fExec) {
             break
           }
           this.errstr = 'SCRIPT_ERR_BAD_OPCODE'
@@ -1190,6 +1491,7 @@ Interpreter.prototype.step = function () {
           this.stack.pop()
         }
         this.vfExec.push(fValue)
+        this.vfElse.push(false)
         break
 
       case Opcode.OP_IF:
@@ -1221,14 +1523,21 @@ Interpreter.prototype.step = function () {
           this.stack.pop()
         }
         this.vfExec.push(fValue)
+        this.vfElse.push(false)
         break
 
       case Opcode.OP_ELSE:
-        if (this.vfExec.length === 0) {
+        // Genesis allows only one OP_ELSE per OP_IF. A second one is
+        // unbalanced, and accepting it means accepting scripts the network
+        // rejects — the node states it as
+        //   if (vfExec.empty() || (vfElse.back() && utxo_after_genesis))
+        if (this.vfExec.length === 0 ||
+            (this.vfElse[this.vfElse.length - 1] && this.isAfterGenesis())) {
           this.errstr = 'SCRIPT_ERR_UNBALANCED_CONDITIONAL'
           return false
         }
         this.vfExec[this.vfExec.length - 1] = !this.vfExec[this.vfExec.length - 1]
+        this.vfElse[this.vfElse.length - 1] = true
         break
 
       case Opcode.OP_ENDIF:
@@ -1237,6 +1546,7 @@ Interpreter.prototype.step = function () {
           return false
         }
         this.vfExec.pop()
+        this.vfElse.pop()
         break
 
       case Opcode.OP_VERIFY:
@@ -1257,6 +1567,21 @@ Interpreter.prototype.step = function () {
         break
 
       case Opcode.OP_RETURN:
+        if (this.isAfterGenesis()) {
+          if (this.vfExec.length === 0) {
+            // Genesis restored OP_RETURN's original meaning: it terminates the
+            // script and the top stack item decides validity. The remainder
+            // cannot affect the outcome, even if it holds unbalanced
+            // conditionals or invalid opcodes, which is what makes
+            // OP_FALSE OP_RETURN <data> outputs safe to carry anything.
+            this.returned = true
+            break
+          }
+          // Inside a conditional, suppress the rest but keep checking grammar.
+          this.nonTopLevelReturnAfterGenesis = true
+          break
+        }
+        // Before Genesis, an OP_RETURN alone invalidates the script.
         this.errstr = 'SCRIPT_ERR_OP_RETURN'
         return false
         // break // unreachable
@@ -1414,7 +1739,7 @@ Interpreter.prototype.step = function () {
           return false
         }
         buf = stacktop(-1)
-        bn = BN.fromScriptNumBuffer(buf, fRequireMinimal)
+        bn = BN.fromScriptNumBuffer(buf, fRequireMinimal, this.maxScriptNumLength())
         n = bn.toNumber()
         this.stack.pop()
         if (n < 0 || n >= this.stack.length) {
@@ -1524,6 +1849,10 @@ Interpreter.prototype.step = function () {
         // (x -- out)
         if (this.stack.length < 1) {
           this.errstr = 'SCRIPT_ERR_INVALID_STACK_OPERATION'
+          // The missing return here let evaluation continue and crash on the
+          // absent operand, reporting an internal TypeError rather than the
+          // stack error it had already decided on.
+          return false
         }
         buf = stacktop(-1)
         for (let i = 0; i < buf.length; i++) {
@@ -1543,7 +1872,7 @@ Interpreter.prototype.step = function () {
           this.stack.pop()
         } else {
           bn1 = new BN(buf1)
-          bn2 = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal)
+          bn2 = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength())
           n = bn2.toNumber()
           if (n < 0) {
             this.errstr = 'SCRIPT_ERR_INVALID_NUMBER_RANGE'
@@ -1608,7 +1937,7 @@ Interpreter.prototype.step = function () {
           return false
         }
         buf = stacktop(-1)
-        bn = BN.fromScriptNumBuffer(buf, fRequireMinimal)
+        bn = BN.fromScriptNumBuffer(buf, fRequireMinimal, this.maxScriptNumLength())
         switch (opcodenum) {
           case Opcode.OP_2MUL:
             bn = bn.mul(new BN(2))
@@ -1667,8 +1996,8 @@ Interpreter.prototype.step = function () {
           this.errstr = 'SCRIPT_ERR_INVALID_STACK_OPERATION'
           return false
         }
-        bn1 = BN.fromScriptNumBuffer(stacktop(-2), fRequireMinimal, Interpreter.MAXIMUM_ELEMENT_SIZE)
-        bn2 = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, Interpreter.MAXIMUM_ELEMENT_SIZE)
+        bn1 = BN.fromScriptNumBuffer(stacktop(-2), fRequireMinimal, this.maxScriptNumLength())
+        bn2 = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength())
         bn = new BN(0)
 
         switch (opcodenum) {
@@ -1685,8 +2014,12 @@ Interpreter.prototype.step = function () {
             break
 
           case Opcode.OP_DIV:
-            // denominator must not be 0
-            if (bn2 === 0) {
+            // denominator must not be 0. bn2 is a BN, so `bn2 === 0` was never
+            // true and this guard never fired — bn.js asserted instead, and
+            // the evaluator's catch reported SCRIPT_ERR_UNKNOWN_ERROR. The
+            // script still failed, which is why the accept/reject vectors
+            // stayed green while the reason was wrong.
+            if (bn2.cmp(BN.Zero) === 0) {
               this.errstr = 'SCRIPT_ERR_DIV_BY_ZERO'
               return false
             }
@@ -1694,9 +2027,9 @@ Interpreter.prototype.step = function () {
             break
 
           case Opcode.OP_MOD:
-            // divisor must not be 0
-            if (bn2 === 0) {
-              this.errstr = 'SCRIPT_ERR_DIV_BY_ZERO'
+            // divisor must not be 0. The node reports this one separately.
+            if (bn2.cmp(BN.Zero) === 0) {
+              this.errstr = 'SCRIPT_ERR_MOD_BY_ZERO'
               return false
             }
             bn = bn1.mod(bn2)
@@ -1766,9 +2099,9 @@ Interpreter.prototype.step = function () {
           this.errstr = 'SCRIPT_ERR_INVALID_STACK_OPERATION'
           return false
         }
-        bn1 = BN.fromScriptNumBuffer(stacktop(-3), fRequireMinimal, Interpreter.MAXIMUM_ELEMENT_SIZE)
-        bn2 = BN.fromScriptNumBuffer(stacktop(-2), fRequireMinimal, Interpreter.MAXIMUM_ELEMENT_SIZE)
-        var bn3 = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, Interpreter.MAXIMUM_ELEMENT_SIZE)
+        bn1 = BN.fromScriptNumBuffer(stacktop(-3), fRequireMinimal, this.maxScriptNumLength())
+        bn2 = BN.fromScriptNumBuffer(stacktop(-2), fRequireMinimal, this.maxScriptNumLength())
+        var bn3 = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength())
         // bool fValue = (bn2 <= bn1 && bn1 < bn3);
         fValue = (bn2.cmp(bn1) <= 0) && (bn1.cmp(bn3) < 0)
         this.stack.pop()
@@ -1880,9 +2213,10 @@ Interpreter.prototype.step = function () {
           return false
         }
 
-        var nKeysCount = BN.fromScriptNumBuffer(stacktop(-i), fRequireMinimal).toNumber()
+        var nKeysCount = BN.fromScriptNumBuffer(stacktop(-i), fRequireMinimal, this.maxScriptNumLength()).toNumber()
         // TODO: Keys and opcount are parameterized in client. No magic numbers!
-        if (nKeysCount < 0 || nKeysCount > 20) {
+        // Genesis raised this to UINT32_MAX rather than removing it.
+        if (nKeysCount < 0 || nKeysCount > this.maxPubKeysPerMultisig()) {
           this.errstr = 'SCRIPT_ERR_PUBKEY_COUNT'
           return false
         }
@@ -1906,7 +2240,7 @@ Interpreter.prototype.step = function () {
           return false
         }
 
-        var nSigsCount = BN.fromScriptNumBuffer(stacktop(-i), fRequireMinimal).toNumber()
+        var nSigsCount = BN.fromScriptNumBuffer(stacktop(-i), fRequireMinimal, this.maxScriptNumLength()).toNumber()
         if (nSigsCount < 0 || nSigsCount > nKeysCount) {
           this.errstr = 'SCRIPT_ERR_SIG_COUNT'
           return false
@@ -2019,7 +2353,12 @@ Interpreter.prototype.step = function () {
 
         buf1 = stacktop(-2)
         buf2 = stacktop(-1)
-        if (buf1.length + buf2.length > Interpreter.MAX_SCRIPT_ELEMENT_SIZE) {
+        // Era-derived, like every other element size check. Genesis lifted the
+        // 520-byte cap, and reading the static here meant OP_CAT kept
+        // enforcing it after Genesis — rejecting a concatenation the network
+        // accepts. No vector in the corpus covers this, so it is held by
+        // test/script/genesis_limits.js instead.
+        if (buf1.length + buf2.length > this.maxScriptElementSize()) {
           this.errstr = 'SCRIPT_ERR_PUSH_SIZE'
           return false
         }
@@ -2035,7 +2374,7 @@ Interpreter.prototype.step = function () {
         buf1 = stacktop(-2)
 
         // Make sure the split point is apropriate.
-        var position = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal).toNumber()
+        var position = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength()).toNumber()
         if (position < 0 || position > buf1.length) {
           this.errstr = 'SCRIPT_ERR_INVALID_SPLIT_RANGE'
           return false
@@ -2065,7 +2404,7 @@ Interpreter.prototype.step = function () {
         //
         // Running them unconditionally consumed stack where the network does
         // nothing, which is a wrong answer rather than an error.
-        if ((this.flags & Interpreter.SCRIPT_ENABLE_CHRONICLE) === 0) {
+        if (!this.isAfterChronicle()) {
           if (this.flags & Interpreter.SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS) {
             this.errstr = 'SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS'
             return false
@@ -2078,7 +2417,7 @@ Interpreter.prototype.step = function () {
           return false
         }
         buf1 = stacktop(-2)
-        n = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, Interpreter.MAXIMUM_ELEMENT_SIZE).toNumber()
+        n = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength()).toNumber()
         // ERRORS on out of range; it does not clamp. The node is
         // `if(len < 0 || len > size) return SCRIPT_ERR_INVALID_NUMBER_RANGE`.
         // Clamping made scripts the node rejects succeed here.
@@ -2107,7 +2446,7 @@ Interpreter.prototype.step = function () {
         //
         // Running them unconditionally consumed stack where the network does
         // nothing, which is a wrong answer rather than an error.
-        if ((this.flags & Interpreter.SCRIPT_ENABLE_CHRONICLE) === 0) {
+        if (!this.isAfterChronicle()) {
           if (this.flags & Interpreter.SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_NOPS) {
             this.errstr = 'SCRIPT_ERR_DISCOURAGE_UPGRADABLE_NOPS'
             return false
@@ -2120,8 +2459,8 @@ Interpreter.prototype.step = function () {
           return false
         }
         buf1 = stacktop(-3)
-        var subSize = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, Interpreter.MAXIMUM_ELEMENT_SIZE).toNumber()
-        var subBegin = BN.fromScriptNumBuffer(stacktop(-2), fRequireMinimal, Interpreter.MAXIMUM_ELEMENT_SIZE).toNumber()
+        var subSize = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength()).toNumber()
+        var subBegin = BN.fromScriptNumBuffer(stacktop(-2), fRequireMinimal, this.maxScriptNumLength()).toNumber()
         // ERRORS on out of range, matching
         //   offset < 0 || offset >= size || len < 0 || len > size - offset
         // Note `offset >= size` is strict: a begin index AT the end is an
@@ -2145,8 +2484,12 @@ Interpreter.prototype.step = function () {
           return false
         }
 
-        var size = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal).toNumber()
-        if (size > Interpreter.MAX_SCRIPT_ELEMENT_SIZE) {
+        var size = BN.fromScriptNumBuffer(stacktop(-1), fRequireMinimal, this.maxScriptNumLength()).toNumber()
+        // A negative size is a push size failure, not an encoding one. Without
+        // the lower bound it fell through to the rawnum.length > size test,
+        // which any number passes when size is negative, and reported
+        // IMPOSSIBLE_ENCODING instead.
+        if (size < 0 || size > this.maxScriptElementSize()) {
           this.errstr = 'SCRIPT_ERR_PUSH_SIZE'
           return false
         }