@smartledger/bsv 9.14.0 → 9.16.0

package/lib/script/interpreter.js

@@ -98,11 +98,34 @@ Interpreter.prototype._verifyCore = function (scriptSig, scriptPubkey, tx, nin,
   })
   var stackCopy
 
-  if ((flags & Interpreter.SCRIPT_VERIFY_SIGPUSHONLY) !== 0 && !scriptSig.isPushOnly()) {
-    this.errstr = 'SCRIPT_ERR_SIG_PUSHONLY'
+  // A UTXO cannot be post-Chronicle without being post-Genesis. The node refuses the
+  // combination outright (valid_flags, interpreter.cpp) rather than picking an era.
+  if ((flags & Interpreter.SCRIPT_UTXO_AFTER_CHRONICLE) !== 0 &&
+      (flags & Interpreter.SCRIPT_UTXO_AFTER_GENESIS) === 0) {
+    this.errstr = 'SCRIPT_ERR_INVALID_FLAGS'
     return false
   }
 
+  // SIGPUSHONLY is a rule of an era, not of the flag alone:
+  //
+  //   if((IsGenesis(flags) && !IsChronicle(flags)) ||
+  //      (IsChronicle(flags) && !IsMalleableTxnVersion(checker.Version())))
+  //
+  // Before Genesis this branch refused nothing — a non-push scriptSig was caught only where
+  // P2SH demanded it, below — and the node never sets the flag there anyway
+  // (InputScriptVerifyFlags adds it only once the block era is post-Genesis). Under
+  // Chronicle it survives as a non-malleability rule, so a malleable version is exempt,
+  // and that case DOES arise on today's mainnet flags.
+  if ((flags & Interpreter.SCRIPT_VERIFY_SIGPUSHONLY) !== 0) {
+    var chronicleBlock = (flags & Interpreter.SCRIPT_CHRONICLE) !== 0
+    var pushOnlyRequired = (((flags & Interpreter.SCRIPT_GENESIS) !== 0) && !chronicleBlock) ||
+      (chronicleBlock && enforcesNonMalleability(flags, tx))
+    if (pushOnlyRequired && !scriptSig.isPushOnly()) {
+      this.errstr = 'SCRIPT_ERR_SIG_PUSHONLY'
+      return false
+    }
+  }
+
   // evaluate scriptSig
   if (!this.evaluate()) {
     return false
@@ -197,18 +220,25 @@ Interpreter.prototype._verifyCore = function (scriptSig, scriptPubkey, tx, nin,
     // Disallow CLEANSTACK without P2SH, as otherwise a switch
     // CLEANSTACK->P2SH+CLEANSTACK would be possible, which is not a
     // softfork (and P2SH should be one).
-    // Genesis removed P2SH, so post-Genesis the pairing no longer applies and
-    // CLEANSTACK stands on its own.
-    if ((flags & Interpreter.SCRIPT_VERIFY_P2SH) === 0 &&
-        (flags & Interpreter.SCRIPT_UTXO_AFTER_GENESIS) === 0) {
-      throw new Error('internal error - CLEANSTACK without P2SH')
+    // The flags come from a caller, so this is a bad request rather than a broken
+    // invariant. The node names it (SCRIPT_ERR_INVALID_FLAGS); throwing turned a verdict
+    // into a crash. It requires the P2SH flag in every era, including after Genesis removed
+    // P2SH, and its own corpus never reaches this branch because the harness adds the flag
+    // (`if(flags & SCRIPT_VERIFY_CLEANSTACK) flags |= SCRIPT_VERIFY_P2SH;` in DoTest,
+    // src/test/script_tests.cpp) — which is why this used to carry a post-Genesis carve-out
+    // that let the pair through. That was ours, not the node's.
+    if ((flags & Interpreter.SCRIPT_VERIFY_P2SH) === 0) {
+      this.errstr = 'SCRIPT_ERR_INVALID_FLAGS'
+      return false
     }
 
     // The final stack. After a P2SH evaluation that is stackCopy itself, since
     // the redeem script was evaluated over it, but reading stackCopy directly
     // is wrong once P2SH no longer applies: it is then either the stack as it
     // stood after the scriptSig, or never assigned at all.
-    if (this.stack.length !== 1) {
+    // Clean stack was only ever a policy rule, never consensus, so Chronicle ties it to
+    // the transaction version rather than to the age of the output being spent.
+    if (this.enforceNonMalleability() && this.stack.length !== 1) {
       this.errstr = 'SCRIPT_ERR_CLEANSTACK'
       return false
     }
@@ -841,6 +871,37 @@ Interpreter.castToBool = function (buf) {
 /**
  * Translated from bitcoind's CheckSignatureEncoding
  */
+/**
+ * Chronicle lets a transaction opt into malleability by using a version above 1, and the
+ * rules that exist only to stop a signed transaction being rewritten in flight then stop
+ * applying to it. The node's EnforceNonMalleability(flags, checker.Version()):
+ *
+ *   return !(IsChronicle(flags) && IsMalleableTxnVersion(txnVersion));   // version > 1
+ *
+ * It gates LOW_S, MINIMALDATA, MINIMALIF, NULLFAIL, NULLDUMMY, SIGPUSHONLY and CLEANSTACK.
+ * Note which era flag it reads: SCRIPT_CHRONICLE, the era of the block being built, not
+ * SCRIPT_UTXO_AFTER_CHRONICLE, the era of the output being spent.
+ *
+ * Every version at or below 1 is non-malleable, so the rules apply; a missing transaction
+ * is treated the same way, which is the enforcing answer.
+ */
+function enforcesNonMalleability (flags, tx) {
+  if ((flags & Interpreter.SCRIPT_CHRONICLE) === 0) {
+    return true
+  }
+  // int32, as CTransaction::nVersion is and as checker.Version() returns it. Comparing the
+  // JS number would read a version of 0xffffffff as 4294967295 and call the transaction
+  // malleable, where the node reads -1 and enforces. Such a version cannot arrive from the
+  // network — writeInt32LE refuses it and readInt32LE has already signed anything parsed —
+  // but a caller can set it in code, and the fail-open reading is the wrong one to have.
+  // With no transaction at all the rules apply: BaseSignatureChecker::Version() returns 0.
+  return !(tx && ((tx.version | 0) > 1))
+}
+
+Interpreter.prototype.enforceNonMalleability = function () {
+  return enforcesNonMalleability(this.flags, this.tx)
+}
+
 Interpreter.prototype.checkSignatureEncoding = function (buf) {
   var sig
 
@@ -850,16 +911,26 @@ Interpreter.prototype.checkSignatureEncoding = function (buf) {
     return true
   }
 
+  // Three independent checks, as CheckSignatureEncoding has them. They used to be chained
+  // with else-if, so LOW_S — which mainnetFlags() and currentConsensusFlags() both set —
+  // returned early and the whole STRICTENC block below never ran. On the library's own
+  // default flags that silently accepted a signature with an undefined hash type, one
+  // without FORKID where FORKID is required, and one asking for the Chronicle digest
+  // outside Chronicle: three things the node refuses by name.
   if ((this.flags & (Interpreter.SCRIPT_VERIFY_DERSIG | Interpreter.SCRIPT_VERIFY_LOW_S | Interpreter.SCRIPT_VERIFY_STRICTENC)) !== 0 && !Signature.isTxDER(buf)) {
     this.errstr = 'SCRIPT_ERR_SIG_DER_INVALID_FORMAT'
     return false
-  } else if ((this.flags & Interpreter.SCRIPT_VERIFY_LOW_S) !== 0) {
+  }
+
+  if ((this.flags & Interpreter.SCRIPT_VERIFY_LOW_S) !== 0) {
     sig = Signature.fromTxFormat(buf)
-    if (!sig.hasLowS()) {
+    if (!sig.hasLowS() && this.enforceNonMalleability()) {
       this.errstr = 'SCRIPT_ERR_SIG_DER_HIGH_S'
       return false
     }
-  } else if ((this.flags & Interpreter.SCRIPT_VERIFY_STRICTENC) !== 0) {
+  }
+
+  if ((this.flags & Interpreter.SCRIPT_VERIFY_STRICTENC) !== 0) {
     sig = Signature.fromTxFormat(buf)
     if (!sig.hasDefinedHashtype()) {
       this.errstr = 'SCRIPT_ERR_SIG_HASHTYPE'
@@ -1344,27 +1415,40 @@ Interpreter.prototype.step = function () {
     switch (opcode) {
       case Opcode.OP_2MUL:
       case Opcode.OP_2DIV:
-        // Chronicle restores both. Until it is enabled they stay disabled, and
-        // "disabled" is stronger than "unimplemented": a disabled opcode fails the
-        // script even in an UNEXECUTED branch, which is why this lives in
-        // isOpcodeDisabled rather than in the evaluation switch.
+        // Chronicle restores both; until the UTXO is post-Chronicle they stay disabled.
+        //
+        // "Disabled" is stronger than "unimplemented", but only before Genesis. The node reads
+        //
+        //   if(IsOpcodeDisabled(opcode, utxoEra) && (!utxo_after_genesis || fExec))
+        //     return SCRIPT_ERR_DISABLED_OPCODE;
+        //
+        // so a disabled opcode in an UNEXECUTED branch fails a pre-Genesis spend and is harmless
+        // in a post-Genesis one. That is why this lives in isOpcodeDisabled, which the caller
+        // consults before testing fExec — the era decides, not the branch alone. An earlier
+        // version of this comment said it fails unexecuted in every era, which is half the rule.
         if (!self.isAfterChronicle()) {
           return true
         }
         break
 
+      // Restored on BSV and never gated by the node. Monolith came back in May 2018 and
+      // Magnetic in November 2018, and IsOpcodeDisabled (src/script/interpreter.cpp) disables
+      // OP_2MUL and OP_2DIV and nothing else — so every opcode below executes in every era the
+      // node can validate, with no flag to enable.
+      //
+      // The four Magnetic ones used to be refused here unless SCRIPT_ENABLE_MAGNETIC_OPCODES
+      // was set, "for backwards compatibility". That refused 77 rows of the node's own corpus
+      // as DISABLED_OPCODE. Fail-closed, so nothing was at risk of being accepted wrongly, but
+      // they were spends the network accepts. The Monolith group beside them had already made
+      // the opposite call on identical reasoning, so the two halves of one 2018 upgrade
+      // disagreed with each other.
+      //
+      // SCRIPT_ENABLE_MAGNETIC_OPCODES and SCRIPT_ENABLE_MONOLITH_OPCODES remain exported and
+      // accepted — they are public API — and setting either is now simply redundant.
       case Opcode.OP_INVERT:
       case Opcode.OP_MUL:
       case Opcode.OP_LSHIFT:
       case Opcode.OP_RSHIFT:
-        // Magnetic opcodes - still require flag for backwards compatibility
-        if ((self.flags & Interpreter.SCRIPT_ENABLE_MAGNETIC_OPCODES) === 0) {
-          return true
-        }
-        break
-
-      // Monolith opcodes are now enabled by default in SmartLedger BSV
-      // These were activated in May 2018 and are part of standard BSV consensus
       case Opcode.OP_DIV:
       case Opcode.OP_MOD:
       case Opcode.OP_SPLIT:
@@ -1374,7 +1458,6 @@ Interpreter.prototype.step = function () {
       case Opcode.OP_XOR:
       case Opcode.OP_BIN2NUM:
       case Opcode.OP_NUM2BIN:
-        // These opcodes are now always enabled - no flag required
         return false
 
       default:
@@ -1384,7 +1467,8 @@ Interpreter.prototype.step = function () {
     return false
   }
 
-  var fRequireMinimal = (this.flags & Interpreter.SCRIPT_VERIFY_MINIMALDATA) !== 0
+  var fRequireMinimal = (this.flags & Interpreter.SCRIPT_VERIFY_MINIMALDATA) !== 0 &&
+    this.enforceNonMalleability()
 
   var buf, buf1, buf2, spliced, n, x1, x2, bn, bn1, bn2, bufSig, bufPubkey, subscript
   var sig, pubkey
@@ -1770,15 +1854,11 @@ Interpreter.prototype.step = function () {
           }
           buf = stacktop(-1)
 
-          if (this.flags & Interpreter.SCRIPT_VERIFY_MINIMALIF) {
-            if (buf.length > 1) {
-              this.errstr = 'SCRIPT_ERR_MINIMALIF'
-              return false
-            }
-            if (buf.length === 1 && buf[0] !== 1) {
-              this.errstr = 'SCRIPT_ERR_MINIMALIF'
-              return false
-            }
+          if ((this.flags & Interpreter.SCRIPT_VERIFY_MINIMALIF) &&
+              (buf.length > 1 || (buf.length === 1 && buf[0] !== 1)) &&
+              this.enforceNonMalleability()) {
+            this.errstr = 'SCRIPT_ERR_MINIMALIF'
+            return false
           }
           fValue = Interpreter.castToBool(buf)
           if (opcodenum === Opcode.OP_NOTIF) {
@@ -2457,7 +2537,7 @@ Interpreter.prototype.step = function () {
         }
 
         if (!fSuccess && (this.flags & Interpreter.SCRIPT_VERIFY_NULLFAIL) &&
-          bufSig.length) {
+          bufSig.length && this.enforceNonMalleability()) {
           this.errstr = 'SCRIPT_ERR_NULLFAIL'
           return false
         }
@@ -2487,7 +2567,17 @@ Interpreter.prototype.step = function () {
           return false
         }
 
-        var nKeysCount = BN.fromScriptNumBuffer(stacktop(-i), fRequireMinimal, this.maxScriptNumLength()).toNumber()
+        // FOUR bytes, not the era's length. The node hardcodes it and says why:
+        //
+        //   // initialize to max size of CScriptNum::MAXIMUM_ELEMENT_SIZE (4 bytes)
+        //   // because only 4 byte integers are supported by OP_CHECKMULTISIG / OP_CHECKMULTISIGVERIFY
+        //   nKeysCountSigned = CScriptNum(stack.stacktop(-i).GetElement(), requireMinimal,
+        //                                 CScriptNum::MAXIMUM_ELEMENT_SIZE).getint();
+        //
+        // So it is era-independent, unlike every other operand decode in this file. Passing
+        // maxScriptNumLength() here accepted a 5-byte count that the node refuses as
+        // SCRIPTNUM_OVERFLOW in every era — a false accept, the direction that costs money.
+        var nKeysCount = BN.fromScriptNumBuffer(stacktop(-i), fRequireMinimal, 4).toNumber()
         // TODO: Keys and opcount are parameterized in client. No magic numbers!
         // Genesis raised this to UINT32_MAX rather than removing it.
         if (nKeysCount < 0 || nKeysCount > this.maxPubKeysPerMultisig()) {
@@ -2521,7 +2611,8 @@ Interpreter.prototype.step = function () {
           return false
         }
 
-        var nSigsCount = BN.fromScriptNumBuffer(stacktop(-i), fRequireMinimal, this.maxScriptNumLength()).toNumber()
+        // Four bytes, for the same reason as nKeysCount above.
+        var nSigsCount = BN.fromScriptNumBuffer(stacktop(-i), fRequireMinimal, 4).toNumber()
         if (nSigsCount < 0 || nSigsCount > nKeysCount) {
           this.errstr = 'SCRIPT_ERR_SIG_COUNT'
           return false
@@ -2583,7 +2674,7 @@ Interpreter.prototype.step = function () {
         // Clean up stack of actual arguments
         while (i-- > 1) {
           if (!fSuccess && (this.flags & Interpreter.SCRIPT_VERIFY_NULLFAIL) &&
-            !ikey2 && stacktop(-1).length) {
+            !ikey2 && stacktop(-1).length && this.enforceNonMalleability()) {
             this.errstr = 'SCRIPT_ERR_NULLFAIL'
             return false
           }
@@ -2605,7 +2696,8 @@ Interpreter.prototype.step = function () {
           this.errstr = 'SCRIPT_ERR_INVALID_STACK_OPERATION'
           return false
         }
-        if ((this.flags & Interpreter.SCRIPT_VERIFY_NULLDUMMY) && stacktop(-1).length) {
+        if ((this.flags & Interpreter.SCRIPT_VERIFY_NULLDUMMY) && stacktop(-1).length &&
+            this.enforceNonMalleability()) {
           this.errstr = 'SCRIPT_ERR_SIG_NULLDUMMY'
           return false
         }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@smartledger/bsv",
-  "version": "9.14.0",
+  "version": "9.16.0",
   "description": "Bitcoin SV library with an interpreter-verified script engine: OP_PUSH_TX covenants, BIP-143 preimage tooling, and consensus flags that match what miners actually enforce. Also ships DID:web / W3C VC-JWT credentials and the Legal Token Protocol.",
   "author": "SmartLedger Technology <hello@smartledger.technology> (https://smartledger.technology)",
   "homepage": "https://github.com/codenlighten/smartledger-bsv#readme",
@@ -145,7 +145,8 @@
     "check:dts": "node scripts/check-dts-coverage.js",
     "check:audit-scope": "node scripts/check-audit-scope.js",
     "check:audit-scope:fix": "node scripts/check-audit-scope.js --fix",
-    "check:dts:update": "node scripts/check-dts-coverage.js --update"
+    "check:dts:update": "node scripts/check-dts-coverage.js --update",
+    "vectors:sv-coverage": "node tools/sv-vector-coverage.js"
   },
   "unpkg": "bsv.min.js",
   "jsdelivr": "bsv.min.js",
@@ -243,13 +244,16 @@
     "vm-browserify": "^1.1.2"
   },
   "overrides": {
-    "js-yaml@^3": "^3.15.1",
-    "js-yaml@^4": "^4.3.1",
+    "js-yaml@^3": "^3.15.2",
+    "js-yaml@^4": "^4.3.2",
     "serialize-javascript": "^7.0.5",
     "tmp": "^0.2.7",
     "mocha": {
       "diff": "^8.0.3"
-    }
+    },
+    "brace-expansion": "^2.0.2",
+    "browserslist": "^4.28.7",
+    "baseline-browser-mapping": "^2.11.0"
   },
   "license": "MIT",
   "standard": {