test/functional/p2p-fullblocktest.py

   1 #!/usr/bin/env python3
   2 # Copyright (c) 2015-2017 The Bitcoin Core developers
   3 # Distributed under the MIT software license, see the accompanying
   4 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
   5 """Test block processing.
   6
   7 This reimplements tests from the bitcoinj/FullBlockTestGenerator used
   8 by the pull-tester.
   9
  10 We use the testing framework in which we expect a particular answer from
  11 each test.
  12 """
  13
  14 from test_framework.test_framework import ComparisonTestFramework
  15 from test_framework.util import *
  16 from test_framework.comptool import TestManager, TestInstance, RejectResult
  17 from test_framework.blocktools import *
  18 import time
  19 from test_framework.key import CECKey
  20 from test_framework.script import *
  21 from test_framework.mininode import network_thread_start
  22 import struct
  23
  24 class PreviousSpendableOutput():
  25     def __init__(self, tx = CTransaction(), n = -1):
  26         self.tx = tx
  27         self.n = n  # the output we're spending
  28
  29 #  Use this class for tests that require behavior other than normal "mininode" behavior.
  30 #  For now, it is used to serialize a bloated varint (b64).
  31 class CBrokenBlock(CBlock):
  32     def __init__(self, header=None):
  33         super(CBrokenBlock, self).__init__(header)
  34
  35     def initialize(self, base_block):
  36         self.vtx = copy.deepcopy(base_block.vtx)
  37         self.hashMerkleRoot = self.calc_merkle_root()
  38
  39     def serialize(self):
  40         r = b""
  41         r += super(CBlock, self).serialize()
  42         r += struct.pack("<BQ", 255, len(self.vtx))
  43         for tx in self.vtx:
  44             r += tx.serialize()
  45         return r
  46
  47     def normal_serialize(self):
  48         r = b""
  49         r += super(CBrokenBlock, self).serialize()
  50         return r
  51
  52 class FullBlockTest(ComparisonTestFramework):
  53     # Can either run this test as 1 node with expected answers, or two and compare them.
  54     # Change the "outcome" variable from each TestInstance object to only do the comparison.
  55     def set_test_params(self):
  56         self.num_nodes = 1
  57         self.setup_clean_chain = True
  58         self.block_heights = {}
  59         self.coinbase_key = CECKey()
  60         self.coinbase_key.set_secretbytes(b"horsebattery")
  61         self.coinbase_pubkey = self.coinbase_key.get_pubkey()
  62         self.tip = None
  63         self.blocks = {}
  64
  65     def add_options(self, parser):
  66         super().add_options(parser)
  67         parser.add_option("--runbarelyexpensive", dest="runbarelyexpensive", default=True)
  68
  69     def run_test(self):
  70         self.test = TestManager(self, self.options.tmpdir)
  71         self.test.add_all_connections(self.nodes)
  72         network_thread_start()
  73         self.test.run()
  74
  75     def add_transactions_to_block(self, block, tx_list):
  76         [ tx.rehash() for tx in tx_list ]
  77         block.vtx.extend(tx_list)
  78
  79     # this is a little handier to use than the version in blocktools.py
  80     def create_tx(self, spend_tx, n, value, script=CScript([OP_TRUE])):
  81         tx = create_transaction(spend_tx, n, b"", value, script)
  82         return tx
  83
  84     # sign a transaction, using the key we know about
  85     # this signs input 0 in tx, which is assumed to be spending output n in spend_tx
  86     def sign_tx(self, tx, spend_tx, n):
  87         scriptPubKey = bytearray(spend_tx.vout[n].scriptPubKey)
  88         if (scriptPubKey[0] == OP_TRUE):  # an anyone-can-spend
  89             tx.vin[0].scriptSig = CScript()
  90             return
  91         (sighash, err) = SignatureHash(spend_tx.vout[n].scriptPubKey, tx, 0, SIGHASH_ALL)
  92         tx.vin[0].scriptSig = CScript([self.coinbase_key.sign(sighash) + bytes(bytearray([SIGHASH_ALL]))])
  93
  94     def create_and_sign_transaction(self, spend_tx, n, value, script=CScript([OP_TRUE])):
  95         tx = self.create_tx(spend_tx, n, value, script)
  96         self.sign_tx(tx, spend_tx, n)
  97         tx.rehash()
  98         return tx
  99
 100     def next_block(self, number, spend=None, additional_coinbase_value=0, script=CScript([OP_TRUE]), solve=True):
 101         if self.tip == None:
 102             base_block_hash = self.genesis_hash
 103             block_time = int(time.time())+1
 104         else:
 105             base_block_hash = self.tip.sha256
 106             block_time = self.tip.nTime + 1
 107         # First create the coinbase
 108         height = self.block_heights[base_block_hash] + 1
 109         coinbase = create_coinbase(height, self.coinbase_pubkey)
 110         coinbase.vout[0].nValue += additional_coinbase_value
 111         coinbase.rehash()
 112         if spend == None:
 113             block = create_block(base_block_hash, coinbase, block_time)
 114         else:
 115             coinbase.vout[0].nValue += spend.tx.vout[spend.n].nValue - 1 # all but one satoshi to fees
 116             coinbase.rehash()
 117             block = create_block(base_block_hash, coinbase, block_time)
 118             tx = create_transaction(spend.tx, spend.n, b"", 1, script)  # spend 1 satoshi
 119             self.sign_tx(tx, spend.tx, spend.n)
 120             self.add_transactions_to_block(block, [tx])
 121             block.hashMerkleRoot = block.calc_merkle_root()
 122         if solve:
 123             block.solve()
 124         self.tip = block
 125         self.block_heights[block.sha256] = height
 126         assert number not in self.blocks
 127         self.blocks[number] = block
 128         return block
 129
 130     def get_tests(self):
 131         self.genesis_hash = int(self.nodes[0].getbestblockhash(), 16)
 132         self.block_heights[self.genesis_hash] = 0
 133         spendable_outputs = []
 134
 135         # save the current tip so it can be spent by a later block
 136         def save_spendable_output():
 137             spendable_outputs.append(self.tip)
 138
 139         # get an output that we previously marked as spendable
 140         def get_spendable_output():
 141             return PreviousSpendableOutput(spendable_outputs.pop(0).vtx[0], 0)
 142
 143         # returns a test case that asserts that the current tip was accepted
 144         def accepted():
 145             return TestInstance([[self.tip, True]])
 146
 147         # returns a test case that asserts that the current tip was rejected
 148         def rejected(reject = None):
 149             if reject is None:
 150                 return TestInstance([[self.tip, False]])
 151             else:
 152                 return TestInstance([[self.tip, reject]])
 153
 154         # move the tip back to a previous block
 155         def tip(number):
 156             self.tip = self.blocks[number]
 157
 158         # adds transactions to the block and updates state
 159         def update_block(block_number, new_transactions):
 160             block = self.blocks[block_number]
 161             self.add_transactions_to_block(block, new_transactions)
 162             old_sha256 = block.sha256
 163             block.hashMerkleRoot = block.calc_merkle_root()
 164             block.solve()
 165             # Update the internal state just like in next_block
 166             self.tip = block
 167             if block.sha256 != old_sha256:
 168                 self.block_heights[block.sha256] = self.block_heights[old_sha256]
 169                 del self.block_heights[old_sha256]
 170             self.blocks[block_number] = block
 171             return block
 172
 173         # shorthand for functions
 174         block = self.next_block
 175         create_tx = self.create_tx
 176         create_and_sign_tx = self.create_and_sign_transaction
 177
 178         # these must be updated if consensus changes
 179         MAX_BLOCK_SIGOPS = 20000
 180
 181
 182         # Create a new block
 183         block(0)
 184         save_spendable_output()
 185         yield accepted()
 186
 187
 188         # Now we need that block to mature so we can spend the coinbase.
 189         test = TestInstance(sync_every_block=False)
 190         for i in range(99):
 191             block(5000 + i)
 192             test.blocks_and_transactions.append([self.tip, True])
 193             save_spendable_output()
 194         yield test
 195
 196         # collect spendable outputs now to avoid cluttering the code later on
 197         out = []
 198         for i in range(33):
 199             out.append(get_spendable_output())
 200
 201         # Start by building a couple of blocks on top (which output is spent is
 202         # in parentheses):
 203         #     genesis -> b1 (0) -> b2 (1)
 204         block(1, spend=out[0])
 205         save_spendable_output()
 206         yield accepted()
 207
 208         block(2, spend=out[1])
 209         yield accepted()
 210         save_spendable_output()
 211
 212         # so fork like this:
 213         #
 214         #     genesis -> b1 (0) -> b2 (1)
 215         #                      \-> b3 (1)
 216         #
 217         # Nothing should happen at this point. We saw b2 first so it takes priority.
 218         tip(1)
 219         b3 = block(3, spend=out[1])
 220         txout_b3 = PreviousSpendableOutput(b3.vtx[1], 0)
 221         yield rejected()
 222
 223
 224         # Now we add another block to make the alternative chain longer.
 225         #
 226         #     genesis -> b1 (0) -> b2 (1)
 227         #                      \-> b3 (1) -> b4 (2)
 228         block(4, spend=out[2])
 229         yield accepted()
 230
 231
 232         # ... and back to the first chain.
 233         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6 (3)
 234         #                      \-> b3 (1) -> b4 (2)
 235         tip(2)
 236         block(5, spend=out[2])
 237         save_spendable_output()
 238         yield rejected()
 239
 240         block(6, spend=out[3])
 241         yield accepted()
 242
 243         # Try to create a fork that double-spends
 244         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6 (3)
 245         #                                          \-> b7 (2) -> b8 (4)
 246         #                      \-> b3 (1) -> b4 (2)
 247         tip(5)
 248         block(7, spend=out[2])
 249         yield rejected()
 250
 251         block(8, spend=out[4])
 252         yield rejected()
 253
 254         # Try to create a block that has too much fee
 255         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6 (3)
 256         #                                                    \-> b9 (4)
 257         #                      \-> b3 (1) -> b4 (2)
 258         tip(6)
 259         block(9, spend=out[4], additional_coinbase_value=1)
 260         yield rejected(RejectResult(16, b'bad-cb-amount'))
 261
 262         # Create a fork that ends in a block with too much fee (the one that causes the reorg)
 263         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6  (3)
 264         #                                          \-> b10 (3) -> b11 (4)
 265         #                      \-> b3 (1) -> b4 (2)
 266         tip(5)
 267         block(10, spend=out[3])
 268         yield rejected()
 269
 270         block(11, spend=out[4], additional_coinbase_value=1)
 271         yield rejected(RejectResult(16, b'bad-cb-amount'))
 272
 273
 274         # Try again, but with a valid fork first
 275         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6  (3)
 276         #                                          \-> b12 (3) -> b13 (4) -> b14 (5)
 277         #                                              (b12 added last)
 278         #                      \-> b3 (1) -> b4 (2)
 279         tip(5)
 280         b12 = block(12, spend=out[3])
 281         save_spendable_output()
 282         b13 = block(13, spend=out[4])
 283         # Deliver the block header for b12, and the block b13.
 284         # b13 should be accepted but the tip won't advance until b12 is delivered.
 285         yield TestInstance([[CBlockHeader(b12), None], [b13, False]])
 286
 287         save_spendable_output()
 288         # b14 is invalid, but the node won't know that until it tries to connect
 289         # Tip still can't advance because b12 is missing
 290         block(14, spend=out[5], additional_coinbase_value=1)
 291         yield rejected()
 292
 293         yield TestInstance([[b12, True, b13.sha256]]) # New tip should be b13.
 294
 295         # Add a block with MAX_BLOCK_SIGOPS and one with one more sigop
 296         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6  (3)
 297         #                                          \-> b12 (3) -> b13 (4) -> b15 (5) -> b16 (6)
 298         #                      \-> b3 (1) -> b4 (2)
 299
 300         # Test that a block with a lot of checksigs is okay
 301         lots_of_checksigs = CScript([OP_CHECKSIG] * (MAX_BLOCK_SIGOPS - 1))
 302         tip(13)
 303         block(15, spend=out[5], script=lots_of_checksigs)
 304         yield accepted()
 305         save_spendable_output()
 306
 307
 308         # Test that a block with too many checksigs is rejected
 309         too_many_checksigs = CScript([OP_CHECKSIG] * (MAX_BLOCK_SIGOPS))
 310         block(16, spend=out[6], script=too_many_checksigs)
 311         yield rejected(RejectResult(16, b'bad-blk-sigops'))
 312
 313
 314         # Attempt to spend a transaction created on a different fork
 315         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6  (3)
 316         #                                          \-> b12 (3) -> b13 (4) -> b15 (5) -> b17 (b3.vtx[1])
 317         #                      \-> b3 (1) -> b4 (2)
 318         tip(15)
 319         block(17, spend=txout_b3)
 320         yield rejected(RejectResult(16, b'bad-txns-inputs-missingorspent'))
 321
 322         # Attempt to spend a transaction created on a different fork (on a fork this time)
 323         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6  (3)
 324         #                                          \-> b12 (3) -> b13 (4) -> b15 (5)
 325         #                                                                \-> b18 (b3.vtx[1]) -> b19 (6)
 326         #                      \-> b3 (1) -> b4 (2)
 327         tip(13)
 328         block(18, spend=txout_b3)
 329         yield rejected()
 330
 331         block(19, spend=out[6])
 332         yield rejected()
 333
 334         # Attempt to spend a coinbase at depth too low
 335         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6  (3)
 336         #                                          \-> b12 (3) -> b13 (4) -> b15 (5) -> b20 (7)
 337         #                      \-> b3 (1) -> b4 (2)
 338         tip(15)
 339         block(20, spend=out[7])
 340         yield rejected(RejectResult(16, b'bad-txns-premature-spend-of-coinbase'))
 341
 342         # Attempt to spend a coinbase at depth too low (on a fork this time)
 343         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6  (3)
 344         #                                          \-> b12 (3) -> b13 (4) -> b15 (5)
 345         #                                                                \-> b21 (6) -> b22 (5)
 346         #                      \-> b3 (1) -> b4 (2)
 347         tip(13)
 348         block(21, spend=out[6])
 349         yield rejected()
 350
 351         block(22, spend=out[5])
 352         yield rejected()
 353
 354         # Create a block on either side of MAX_BLOCK_BASE_SIZE and make sure its accepted/rejected
 355         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6  (3)
 356         #                                          \-> b12 (3) -> b13 (4) -> b15 (5) -> b23 (6)
 357         #                                                                           \-> b24 (6) -> b25 (7)
 358         #                      \-> b3 (1) -> b4 (2)
 359         tip(15)
 360         b23 = block(23, spend=out[6])
 361         tx = CTransaction()
 362         script_length = MAX_BLOCK_BASE_SIZE - len(b23.serialize()) - 69
 363         script_output = CScript([b'\x00' * script_length])
 364         tx.vout.append(CTxOut(0, script_output))
 365         tx.vin.append(CTxIn(COutPoint(b23.vtx[1].sha256, 0)))
 366         b23 = update_block(23, [tx])
 367         # Make sure the math above worked out to produce a max-sized block
 368         assert_equal(len(b23.serialize()), MAX_BLOCK_BASE_SIZE)
 369         yield accepted()
 370         save_spendable_output()
 371
 372         # Make the next block one byte bigger and check that it fails
 373         tip(15)
 374         b24 = block(24, spend=out[6])
 375         script_length = MAX_BLOCK_BASE_SIZE - len(b24.serialize()) - 69
 376         script_output = CScript([b'\x00' * (script_length+1)])
 377         tx.vout = [CTxOut(0, script_output)]
 378         b24 = update_block(24, [tx])
 379         assert_equal(len(b24.serialize()), MAX_BLOCK_BASE_SIZE+1)
 380         yield rejected(RejectResult(16, b'bad-blk-length'))
 381
 382         block(25, spend=out[7])
 383         yield rejected()
 384
 385         # Create blocks with a coinbase input script size out of range
 386         #     genesis -> b1 (0) -> b2 (1) -> b5 (2) -> b6  (3)
 387         #                                          \-> b12 (3) -> b13 (4) -> b15 (5) -> b23 (6) -> b30 (7)
 388         #                                                                           \-> ... (6) -> ... (7)
 389         #                      \-> b3 (1) -> b4 (2)
 390         tip(15)
 391         b26 = block(26, spend=out[6])
 392         b26.vtx[0].vin[0].scriptSig = b'\x00'
 393         b26.vtx[0].rehash()
 394         # update_block causes the merkle root to get updated, even with no new
 395         # transactions, and updates the required state.
 396         b26 = update_block(26, [])
 397         yield rejected(RejectResult(16, b'bad-cb-length'))
 398
 399         # Extend the b26 chain to make sure bitcoind isn't accepting b26
 400         block(27, spend=out[7])
 401         yield rejected(False)
 402
 403         # Now try a too-large-coinbase script
 404         tip(15)
 405         b28 = block(28, spend=out[6])
 406         b28.vtx[0].vin[0].scriptSig = b'\x00' * 101
 407         b28.vtx[0].rehash()
 408         b28 = update_block(28, [])
 409         yield rejected(RejectResult(16, b'bad-cb-length'))
 410
 411         # Extend the b28 chain to make sure bitcoind isn't accepting b28
 412         block(29, spend=out[7])
 413         yield rejected(False)
 414
 415         # b30 has a max-sized coinbase scriptSig.
 416         tip(23)
 417         b30 = block(30)
 418         b30.vtx[0].vin[0].scriptSig = b'\x00' * 100
 419         b30.vtx[0].rehash()
 420         b30 = update_block(30, [])
 421         yield accepted()
 422         save_spendable_output()
 423
 424         # b31 - b35 - check sigops of OP_CHECKMULTISIG / OP_CHECKMULTISIGVERIFY / OP_CHECKSIGVERIFY
 425         #
 426         #     genesis -> ... -> b30 (7) -> b31 (8) -> b33 (9) -> b35 (10)
 427         #                                                                \-> b36 (11)
 428         #                                                    \-> b34 (10)
 429         #                                         \-> b32 (9)
 430         #
 431
 432         # MULTISIG: each op code counts as 20 sigops.  To create the edge case, pack another 19 sigops at the end.
 433         lots_of_multisigs = CScript([OP_CHECKMULTISIG] * ((MAX_BLOCK_SIGOPS-1) // 20) + [OP_CHECKSIG] * 19)
 434         b31 = block(31, spend=out[8], script=lots_of_multisigs)
 435         assert_equal(get_legacy_sigopcount_block(b31), MAX_BLOCK_SIGOPS)
 436         yield accepted()
 437         save_spendable_output()
 438
 439         # this goes over the limit because the coinbase has one sigop
 440         too_many_multisigs = CScript([OP_CHECKMULTISIG] * (MAX_BLOCK_SIGOPS // 20))
 441         b32 = block(32, spend=out[9], script=too_many_multisigs)
 442         assert_equal(get_legacy_sigopcount_block(b32), MAX_BLOCK_SIGOPS + 1)
 443         yield rejected(RejectResult(16, b'bad-blk-sigops'))
 444
 445
 446         # CHECKMULTISIGVERIFY
 447         tip(31)
 448         lots_of_multisigs = CScript([OP_CHECKMULTISIGVERIFY] * ((MAX_BLOCK_SIGOPS-1) // 20) + [OP_CHECKSIG] * 19)
 449         block(33, spend=out[9], script=lots_of_multisigs)
 450         yield accepted()
 451         save_spendable_output()
 452
 453         too_many_multisigs = CScript([OP_CHECKMULTISIGVERIFY] * (MAX_BLOCK_SIGOPS // 20))
 454         block(34, spend=out[10], script=too_many_multisigs)
 455         yield rejected(RejectResult(16, b'bad-blk-sigops'))
 456
 457
 458         # CHECKSIGVERIFY
 459         tip(33)
 460         lots_of_checksigs = CScript([OP_CHECKSIGVERIFY] * (MAX_BLOCK_SIGOPS - 1))
 461         b35 = block(35, spend=out[10], script=lots_of_checksigs)
 462         yield accepted()
 463         save_spendable_output()
 464
 465         too_many_checksigs = CScript([OP_CHECKSIGVERIFY] * (MAX_BLOCK_SIGOPS))
 466         block(36, spend=out[11], script=too_many_checksigs)
 467         yield rejected(RejectResult(16, b'bad-blk-sigops'))
 468
 469
 470         # Check spending of a transaction in a block which failed to connect
 471         #
 472         # b6  (3)
 473         # b12 (3) -> b13 (4) -> b15 (5) -> b23 (6) -> b30 (7) -> b31 (8) -> b33 (9) -> b35 (10)
 474         #                                                                                     \-> b37 (11)
 475         #                                                                                     \-> b38 (11/37)
 476         #
 477
 478         # save 37's spendable output, but then double-spend out11 to invalidate the block
 479         tip(35)
 480         b37 = block(37, spend=out[11])
 481         txout_b37 = PreviousSpendableOutput(b37.vtx[1], 0)
 482         tx = create_and_sign_tx(out[11].tx, out[11].n, 0)
 483         b37 = update_block(37, [tx])
 484         yield rejected(RejectResult(16, b'bad-txns-inputs-missingorspent'))
 485
 486         # attempt to spend b37's first non-coinbase tx, at which point b37 was still considered valid
 487         tip(35)
 488         block(38, spend=txout_b37)
 489         yield rejected(RejectResult(16, b'bad-txns-inputs-missingorspent'))
 490
 491         # Check P2SH SigOp counting
 492         #
 493         #
 494         #   13 (4) -> b15 (5) -> b23 (6) -> b30 (7) -> b31 (8) -> b33 (9) -> b35 (10) -> b39 (11) -> b41 (12)
 495         #                                                                                        \-> b40 (12)
 496         #
 497         # b39 - create some P2SH outputs that will require 6 sigops to spend:
 498         #
 499         #           redeem_script = COINBASE_PUBKEY, (OP_2DUP+OP_CHECKSIGVERIFY) * 5, OP_CHECKSIG
 500         #           p2sh_script = OP_HASH160, ripemd160(sha256(script)), OP_EQUAL
 501         #
 502         tip(35)
 503         b39 = block(39)
 504         b39_outputs = 0
 505         b39_sigops_per_output = 6
 506
 507         # Build the redeem script, hash it, use hash to create the p2sh script
 508         redeem_script = CScript([self.coinbase_pubkey] + [OP_2DUP, OP_CHECKSIGVERIFY]*5 + [OP_CHECKSIG])
 509         redeem_script_hash = hash160(redeem_script)
 510         p2sh_script = CScript([OP_HASH160, redeem_script_hash, OP_EQUAL])
 511
 512         # Create a transaction that spends one satoshi to the p2sh_script, the rest to OP_TRUE
 513         # This must be signed because it is spending a coinbase
 514         spend = out[11]
 515         tx = create_tx(spend.tx, spend.n, 1, p2sh_script)
 516         tx.vout.append(CTxOut(spend.tx.vout[spend.n].nValue - 1, CScript([OP_TRUE])))
 517         self.sign_tx(tx, spend.tx, spend.n)
 518         tx.rehash()
 519         b39 = update_block(39, [tx])
 520         b39_outputs += 1
 521
 522         # Until block is full, add tx's with 1 satoshi to p2sh_script, the rest to OP_TRUE
 523         tx_new = None
 524         tx_last = tx
 525         total_size=len(b39.serialize())
 526         while(total_size < MAX_BLOCK_BASE_SIZE):
 527             tx_new = create_tx(tx_last, 1, 1, p2sh_script)
 528             tx_new.vout.append(CTxOut(tx_last.vout[1].nValue - 1, CScript([OP_TRUE])))
 529             tx_new.rehash()
 530             total_size += len(tx_new.serialize())
 531             if total_size >= MAX_BLOCK_BASE_SIZE:
 532                 break
 533             b39.vtx.append(tx_new) # add tx to block
 534             tx_last = tx_new
 535             b39_outputs += 1
 536
 537         b39 = update_block(39, [])
 538         yield accepted()
 539         save_spendable_output()
 540
 541
 542         # Test sigops in P2SH redeem scripts
 543         #
 544         # b40 creates 3333 tx's spending the 6-sigop P2SH outputs from b39 for a total of 19998 sigops.
 545         # The first tx has one sigop and then at the end we add 2 more to put us just over the max.
 546         #
 547         # b41 does the same, less one, so it has the maximum sigops permitted.
 548         #
 549         tip(39)
 550         b40 = block(40, spend=out[12])
 551         sigops = get_legacy_sigopcount_block(b40)
 552         numTxes = (MAX_BLOCK_SIGOPS - sigops) // b39_sigops_per_output
 553         assert_equal(numTxes <= b39_outputs, True)
 554
 555         lastOutpoint = COutPoint(b40.vtx[1].sha256, 0)
 556         new_txs = []
 557         for i in range(1, numTxes+1):
 558             tx = CTransaction()
 559             tx.vout.append(CTxOut(1, CScript([OP_TRUE])))
 560             tx.vin.append(CTxIn(lastOutpoint, b''))
 561             # second input is corresponding P2SH output from b39
 562             tx.vin.append(CTxIn(COutPoint(b39.vtx[i].sha256, 0), b''))
 563             # Note: must pass the redeem_script (not p2sh_script) to the signature hash function
 564             (sighash, err) = SignatureHash(redeem_script, tx, 1, SIGHASH_ALL)
 565             sig = self.coinbase_key.sign(sighash) + bytes(bytearray([SIGHASH_ALL]))
 566             scriptSig = CScript([sig, redeem_script])
 567
 568             tx.vin[1].scriptSig = scriptSig
 569             tx.rehash()
 570             new_txs.append(tx)
 571             lastOutpoint = COutPoint(tx.sha256, 0)
 572
 573         b40_sigops_to_fill = MAX_BLOCK_SIGOPS - (numTxes * b39_sigops_per_output + sigops) + 1
 574         tx = CTransaction()
 575         tx.vin.append(CTxIn(lastOutpoint, b''))
 576         tx.vout.append(CTxOut(1, CScript([OP_CHECKSIG] * b40_sigops_to_fill)))
 577         tx.rehash()
 578         new_txs.append(tx)
 579         update_block(40, new_txs)
 580         yield rejected(RejectResult(16, b'bad-blk-sigops'))
 581
 582         # same as b40, but one less sigop
 583         tip(39)
 584         block(41, spend=None)
 585         update_block(41, b40.vtx[1:-1])
 586         b41_sigops_to_fill = b40_sigops_to_fill - 1
 587         tx = CTransaction()
 588         tx.vin.append(CTxIn(lastOutpoint, b''))
 589         tx.vout.append(CTxOut(1, CScript([OP_CHECKSIG] * b41_sigops_to_fill)))
 590         tx.rehash()
 591         update_block(41, [tx])
 592         yield accepted()
 593
 594         # Fork off of b39 to create a constant base again
 595         #
 596         # b23 (6) -> b30 (7) -> b31 (8) -> b33 (9) -> b35 (10) -> b39 (11) -> b42 (12) -> b43 (13)
 597         #                                                                  \-> b41 (12)
 598         #
 599         tip(39)
 600         block(42, spend=out[12])
 601         yield rejected()
 602         save_spendable_output()
 603
 604         block(43, spend=out[13])
 605         yield accepted()
 606         save_spendable_output()
 607
 608
 609         # Test a number of really invalid scenarios
 610         #
 611         #  -> b31 (8) -> b33 (9) -> b35 (10) -> b39 (11) -> b42 (12) -> b43 (13) -> b44 (14)
 612         #                                                                                   \-> ??? (15)
 613
 614         # The next few blocks are going to be created "by hand" since they'll do funky things, such as having
 615         # the first transaction be non-coinbase, etc.  The purpose of b44 is to make sure this works.
 616         height = self.block_heights[self.tip.sha256] + 1
 617         coinbase = create_coinbase(height, self.coinbase_pubkey)
 618         b44 = CBlock()
 619         b44.nTime = self.tip.nTime + 1
 620         b44.hashPrevBlock = self.tip.sha256
 621         b44.nBits = 0x207fffff
 622         b44.vtx.append(coinbase)
 623         b44.hashMerkleRoot = b44.calc_merkle_root()
 624         b44.solve()
 625         self.tip = b44
 626         self.block_heights[b44.sha256] = height
 627         self.blocks[44] = b44
 628         yield accepted()
 629
 630         # A block with a non-coinbase as the first tx
 631         non_coinbase = create_tx(out[15].tx, out[15].n, 1)
 632         b45 = CBlock()
 633         b45.nTime = self.tip.nTime + 1
 634         b45.hashPrevBlock = self.tip.sha256
 635         b45.nBits = 0x207fffff
 636         b45.vtx.append(non_coinbase)
 637         b45.hashMerkleRoot = b45.calc_merkle_root()
 638         b45.calc_sha256()
 639         b45.solve()
 640         self.block_heights[b45.sha256] = self.block_heights[self.tip.sha256]+1
 641         self.tip = b45
 642         self.blocks[45] = b45
 643         yield rejected(RejectResult(16, b'bad-cb-missing'))
 644
 645         # A block with no txns
 646         tip(44)
 647         b46 = CBlock()
 648         b46.nTime = b44.nTime+1
 649         b46.hashPrevBlock = b44.sha256
 650         b46.nBits = 0x207fffff
 651         b46.vtx = []
 652         b46.hashMerkleRoot = 0
 653         b46.solve()
 654         self.block_heights[b46.sha256] = self.block_heights[b44.sha256]+1
 655         self.tip = b46
 656         assert 46 not in self.blocks
 657         self.blocks[46] = b46
 658         s = ser_uint256(b46.hashMerkleRoot)
 659         yield rejected(RejectResult(16, b'bad-blk-length'))
 660
 661         # A block with invalid work
 662         tip(44)
 663         b47 = block(47, solve=False)
 664         target = uint256_from_compact(b47.nBits)
 665         while b47.sha256 < target: #changed > to <
 666             b47.nNonce += 1
 667             b47.rehash()
 668         yield rejected(RejectResult(16, b'high-hash'))
 669
 670         # A block with timestamp > 2 hrs in the future
 671         tip(44)
 672         b48 = block(48, solve=False)
 673         b48.nTime = int(time.time()) + 60 * 60 * 3
 674         b48.solve()
 675         yield rejected(RejectResult(16, b'time-too-new'))
 676
 677         # A block with an invalid merkle hash
 678         tip(44)
 679         b49 = block(49)
 680         b49.hashMerkleRoot += 1
 681         b49.solve()
 682         yield rejected(RejectResult(16, b'bad-txnmrklroot'))
 683
 684         # A block with an incorrect POW limit
 685         tip(44)
 686         b50 = block(50)
 687         b50.nBits = b50.nBits - 1
 688         b50.solve()
 689         yield rejected(RejectResult(16, b'bad-diffbits'))
 690
 691         # A block with two coinbase txns
 692         tip(44)
 693         b51 = block(51)
 694         cb2 = create_coinbase(51, self.coinbase_pubkey)
 695         b51 = update_block(51, [cb2])
 696         yield rejected(RejectResult(16, b'bad-cb-multiple'))
 697
 698         # A block w/ duplicate txns
 699         # Note: txns have to be in the right position in the merkle tree to trigger this error
 700         tip(44)
 701         b52 = block(52, spend=out[15])
 702         tx = create_tx(b52.vtx[1], 0, 1)
 703         b52 = update_block(52, [tx, tx])
 704         yield rejected(RejectResult(16, b'bad-txns-duplicate'))
 705
 706         # Test block timestamps
 707         #  -> b31 (8) -> b33 (9) -> b35 (10) -> b39 (11) -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15)
 708         #                                                                                   \-> b54 (15)
 709         #
 710         tip(43)
 711         block(53, spend=out[14])
 712         yield rejected() # rejected since b44 is at same height
 713         save_spendable_output()
 714
 715         # invalid timestamp (b35 is 5 blocks back, so its time is MedianTimePast)
 716         b54 = block(54, spend=out[15])
 717         b54.nTime = b35.nTime - 1
 718         b54.solve()
 719         yield rejected(RejectResult(16, b'time-too-old'))
 720
 721         # valid timestamp
 722         tip(53)
 723         b55 = block(55, spend=out[15])
 724         b55.nTime = b35.nTime
 725         update_block(55, [])
 726         yield accepted()
 727         save_spendable_output()
 728
 729
 730         # Test CVE-2012-2459
 731         #
 732         # -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15) -> b57p2 (16)
 733         #                                                \-> b57   (16)
 734         #                                                \-> b56p2 (16)
 735         #                                                \-> b56   (16)
 736         #
 737         # Merkle tree malleability (CVE-2012-2459): repeating sequences of transactions in a block without
 738         #                           affecting the merkle root of a block, while still invalidating it.
 739         #                           See:  src/consensus/merkle.h
 740         #
 741         #  b57 has three txns:  coinbase, tx, tx1.  The merkle root computation will duplicate tx.
 742         #  Result:  OK
 743         #
 744         #  b56 copies b57 but duplicates tx1 and does not recalculate the block hash.  So it has a valid merkle
 745         #  root but duplicate transactions.
 746         #  Result:  Fails
 747         #
 748         #  b57p2 has six transactions in its merkle tree:
 749         #       - coinbase, tx, tx1, tx2, tx3, tx4
 750         #  Merkle root calculation will duplicate as necessary.
 751         #  Result:  OK.
 752         #
 753         #  b56p2 copies b57p2 but adds both tx3 and tx4.  The purpose of the test is to make sure the code catches
 754         #  duplicate txns that are not next to one another with the "bad-txns-duplicate" error (which indicates
 755         #  that the error was caught early, avoiding a DOS vulnerability.)
 756
 757         # b57 - a good block with 2 txs, don't submit until end
 758         tip(55)
 759         b57 = block(57)
 760         tx = create_and_sign_tx(out[16].tx, out[16].n, 1)
 761         tx1 = create_tx(tx, 0, 1)
 762         b57 = update_block(57, [tx, tx1])
 763
 764         # b56 - copy b57, add a duplicate tx
 765         tip(55)
 766         b56 = copy.deepcopy(b57)
 767         self.blocks[56] = b56
 768         assert_equal(len(b56.vtx),3)
 769         b56 = update_block(56, [tx1])
 770         assert_equal(b56.hash, b57.hash)
 771         yield rejected(RejectResult(16, b'bad-txns-duplicate'))
 772
 773         # b57p2 - a good block with 6 tx'es, don't submit until end
 774         tip(55)
 775         b57p2 = block("57p2")
 776         tx = create_and_sign_tx(out[16].tx, out[16].n, 1)
 777         tx1 = create_tx(tx, 0, 1)
 778         tx2 = create_tx(tx1, 0, 1)
 779         tx3 = create_tx(tx2, 0, 1)
 780         tx4 = create_tx(tx3, 0, 1)
 781         b57p2 = update_block("57p2", [tx, tx1, tx2, tx3, tx4])
 782
 783         # b56p2 - copy b57p2, duplicate two non-consecutive tx's
 784         tip(55)
 785         b56p2 = copy.deepcopy(b57p2)
 786         self.blocks["b56p2"] = b56p2
 787         assert_equal(b56p2.hash, b57p2.hash)
 788         assert_equal(len(b56p2.vtx),6)
 789         b56p2 = update_block("b56p2", [tx3, tx4])
 790         yield rejected(RejectResult(16, b'bad-txns-duplicate'))
 791
 792         tip("57p2")
 793         yield accepted()
 794
 795         tip(57)
 796         yield rejected()  #rejected because 57p2 seen first
 797         save_spendable_output()
 798
 799         # Test a few invalid tx types
 800         #
 801         # -> b35 (10) -> b39 (11) -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17)
 802         #                                                                                    \-> ??? (17)
 803         #
 804
 805         # tx with prevout.n out of range
 806         tip(57)
 807         b58 = block(58, spend=out[17])
 808         tx = CTransaction()
 809         assert(len(out[17].tx.vout) < 42)
 810         tx.vin.append(CTxIn(COutPoint(out[17].tx.sha256, 42), CScript([OP_TRUE]), 0xffffffff))
 811         tx.vout.append(CTxOut(0, b""))
 812         tx.calc_sha256()
 813         b58 = update_block(58, [tx])
 814         yield rejected(RejectResult(16, b'bad-txns-inputs-missingorspent'))
 815
 816         # tx with output value > input value out of range
 817         tip(57)
 818         b59 = block(59)
 819         tx = create_and_sign_tx(out[17].tx, out[17].n, 51*COIN)
 820         b59 = update_block(59, [tx])
 821         yield rejected(RejectResult(16, b'bad-txns-in-belowout'))
 822
 823         # reset to good chain
 824         tip(57)
 825         b60 = block(60, spend=out[17])
 826         yield accepted()
 827         save_spendable_output()
 828
 829         # Test BIP30
 830         #
 831         # -> b39 (11) -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17)
 832         #                                                                                    \-> b61 (18)
 833         #
 834         # Blocks are not allowed to contain a transaction whose id matches that of an earlier,
 835         # not-fully-spent transaction in the same chain. To test, make identical coinbases;
 836         # the second one should be rejected.
 837         #
 838         tip(60)
 839         b61 = block(61, spend=out[18])
 840         b61.vtx[0].vin[0].scriptSig = b60.vtx[0].vin[0].scriptSig  #equalize the coinbases
 841         b61.vtx[0].rehash()
 842         b61 = update_block(61, [])
 843         assert_equal(b60.vtx[0].serialize(), b61.vtx[0].serialize())
 844         yield rejected(RejectResult(16, b'bad-txns-BIP30'))
 845
 846
 847         # Test tx.isFinal is properly rejected (not an exhaustive tx.isFinal test, that should be in data-driven transaction tests)
 848         #
 849         #   -> b39 (11) -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17)
 850         #                                                                                     \-> b62 (18)
 851         #
 852         tip(60)
 853         b62 = block(62)
 854         tx = CTransaction()
 855         tx.nLockTime = 0xffffffff  #this locktime is non-final
 856         assert(out[18].n < len(out[18].tx.vout))
 857         tx.vin.append(CTxIn(COutPoint(out[18].tx.sha256, out[18].n))) # don't set nSequence
 858         tx.vout.append(CTxOut(0, CScript([OP_TRUE])))
 859         assert(tx.vin[0].nSequence < 0xffffffff)
 860         tx.calc_sha256()
 861         b62 = update_block(62, [tx])
 862         yield rejected(RejectResult(16, b'bad-txns-nonfinal'))
 863
 864
 865         # Test a non-final coinbase is also rejected
 866         #
 867         #   -> b39 (11) -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17)
 868         #                                                                                     \-> b63 (-)
 869         #
 870         tip(60)
 871         b63 = block(63)
 872         b63.vtx[0].nLockTime = 0xffffffff
 873         b63.vtx[0].vin[0].nSequence = 0xDEADBEEF
 874         b63.vtx[0].rehash()
 875         b63 = update_block(63, [])
 876         yield rejected(RejectResult(16, b'bad-txns-nonfinal'))
 877
 878
 879         #  This checks that a block with a bloated VARINT between the block_header and the array of tx such that
 880         #  the block is > MAX_BLOCK_BASE_SIZE with the bloated varint, but <= MAX_BLOCK_BASE_SIZE without the bloated varint,
 881         #  does not cause a subsequent, identical block with canonical encoding to be rejected.  The test does not
 882         #  care whether the bloated block is accepted or rejected; it only cares that the second block is accepted.
 883         #
 884         #  What matters is that the receiving node should not reject the bloated block, and then reject the canonical
 885         #  block on the basis that it's the same as an already-rejected block (which would be a consensus failure.)
 886         #
 887         #  -> b39 (11) -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17) -> b64 (18)
 888         #                                                                                        \
 889         #                                                                                         b64a (18)
 890         #  b64a is a bloated block (non-canonical varint)
 891         #  b64 is a good block (same as b64 but w/ canonical varint)
 892         #
 893         tip(60)
 894         regular_block = block("64a", spend=out[18])
 895
 896         # make it a "broken_block," with non-canonical serialization
 897         b64a = CBrokenBlock(regular_block)
 898         b64a.initialize(regular_block)
 899         self.blocks["64a"] = b64a
 900         self.tip = b64a
 901         tx = CTransaction()
 902
 903         # use canonical serialization to calculate size
 904         script_length = MAX_BLOCK_BASE_SIZE - len(b64a.normal_serialize()) - 69
 905         script_output = CScript([b'\x00' * script_length])
 906         tx.vout.append(CTxOut(0, script_output))
 907         tx.vin.append(CTxIn(COutPoint(b64a.vtx[1].sha256, 0)))
 908         b64a = update_block("64a", [tx])
 909         assert_equal(len(b64a.serialize()), MAX_BLOCK_BASE_SIZE + 8)
 910         yield TestInstance([[self.tip, None]])
 911
 912         # comptool workaround: to make sure b64 is delivered, manually erase b64a from blockstore
 913         self.test.block_store.erase(b64a.sha256)
 914
 915         tip(60)
 916         b64 = CBlock(b64a)
 917         b64.vtx = copy.deepcopy(b64a.vtx)
 918         assert_equal(b64.hash, b64a.hash)
 919         assert_equal(len(b64.serialize()), MAX_BLOCK_BASE_SIZE)
 920         self.blocks[64] = b64
 921         update_block(64, [])
 922         yield accepted()
 923         save_spendable_output()
 924
 925         # Spend an output created in the block itself
 926         #
 927         # -> b42 (12) -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17) -> b64 (18) -> b65 (19)
 928         #
 929         tip(64)
 930         block(65)
 931         tx1 = create_and_sign_tx(out[19].tx, out[19].n, out[19].tx.vout[0].nValue)
 932         tx2 = create_and_sign_tx(tx1, 0, 0)
 933         update_block(65, [tx1, tx2])
 934         yield accepted()
 935         save_spendable_output()
 936
 937         # Attempt to spend an output created later in the same block
 938         #
 939         # -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17) -> b64 (18) -> b65 (19)
 940         #                                                                                    \-> b66 (20)
 941         tip(65)
 942         block(66)
 943         tx1 = create_and_sign_tx(out[20].tx, out[20].n, out[20].tx.vout[0].nValue)
 944         tx2 = create_and_sign_tx(tx1, 0, 1)
 945         update_block(66, [tx2, tx1])
 946         yield rejected(RejectResult(16, b'bad-txns-inputs-missingorspent'))
 947
 948         # Attempt to double-spend a transaction created in a block
 949         #
 950         # -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17) -> b64 (18) -> b65 (19)
 951         #                                                                                    \-> b67 (20)
 952         #
 953         #
 954         tip(65)
 955         block(67)
 956         tx1 = create_and_sign_tx(out[20].tx, out[20].n, out[20].tx.vout[0].nValue)
 957         tx2 = create_and_sign_tx(tx1, 0, 1)
 958         tx3 = create_and_sign_tx(tx1, 0, 2)
 959         update_block(67, [tx1, tx2, tx3])
 960         yield rejected(RejectResult(16, b'bad-txns-inputs-missingorspent'))
 961
 962         # More tests of block subsidy
 963         #
 964         # -> b43 (13) -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17) -> b64 (18) -> b65 (19) -> b69 (20)
 965         #                                                                                    \-> b68 (20)
 966         #
 967         # b68 - coinbase with an extra 10 satoshis,
 968         #       creates a tx that has 9 satoshis from out[20] go to fees
 969         #       this fails because the coinbase is trying to claim 1 satoshi too much in fees
 970         #
 971         # b69 - coinbase with extra 10 satoshis, and a tx that gives a 10 satoshi fee
 972         #       this succeeds
 973         #
 974         tip(65)
 975         block(68, additional_coinbase_value=10)
 976         tx = create_and_sign_tx(out[20].tx, out[20].n, out[20].tx.vout[0].nValue-9)
 977         update_block(68, [tx])
 978         yield rejected(RejectResult(16, b'bad-cb-amount'))
 979
 980         tip(65)
 981         b69 = block(69, additional_coinbase_value=10)
 982         tx = create_and_sign_tx(out[20].tx, out[20].n, out[20].tx.vout[0].nValue-10)
 983         update_block(69, [tx])
 984         yield accepted()
 985         save_spendable_output()
 986
 987         # Test spending the outpoint of a non-existent transaction
 988         #
 989         # -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17) -> b64 (18) -> b65 (19) -> b69 (20)
 990         #                                                                                    \-> b70 (21)
 991         #
 992         tip(69)
 993         block(70, spend=out[21])
 994         bogus_tx = CTransaction()
 995         bogus_tx.sha256 = uint256_from_str(b"23c70ed7c0506e9178fc1a987f40a33946d4ad4c962b5ae3a52546da53af0c5c")
 996         tx = CTransaction()
 997         tx.vin.append(CTxIn(COutPoint(bogus_tx.sha256, 0), b"", 0xffffffff))
 998         tx.vout.append(CTxOut(1, b""))
 999         update_block(70, [tx])
1000         yield rejected(RejectResult(16, b'bad-txns-inputs-missingorspent'))
1001
1002
1003         # Test accepting an invalid block which has the same hash as a valid one (via merkle tree tricks)
1004         #
1005         #  -> b53 (14) -> b55 (15) -> b57 (16) -> b60 (17) -> b64 (18) -> b65 (19) -> b69 (20) -> b72 (21)
1006         #                                                                                      \-> b71 (21)
1007         #
1008         # b72 is a good block.
1009         # b71 is a copy of 72, but re-adds one of its transactions.  However, it has the same hash as b71.
1010         #
1011         tip(69)
1012         b72 = block(72)
1013         tx1 = create_and_sign_tx(out[21].tx, out[21].n, 2)
1014         tx2 = create_and_sign_tx(tx1, 0, 1)
1015         b72 = update_block(72, [tx1, tx2])  # now tip is 72
1016         b71 = copy.deepcopy(b72)
1017         b71.vtx.append(tx2)   # add duplicate tx2
1018         self.block_heights[b71.sha256] = self.block_heights[b69.sha256] + 1  # b71 builds off b69
1019         self.blocks[71] = b71
1020
1021         assert_equal(len(b71.vtx), 4)
1022         assert_equal(len(b72.vtx), 3)
1023         assert_equal(b72.sha256, b71.sha256)
1024
1025         tip(71)
1026         yield rejected(RejectResult(16, b'bad-txns-duplicate'))
1027         tip(72)
1028         yield accepted()
1029         save_spendable_output()
1030
1031
1032         # Test some invalid scripts and MAX_BLOCK_SIGOPS
1033         #
1034         # -> b55 (15) -> b57 (16) -> b60 (17) -> b64 (18) -> b65 (19) -> b69 (20) -> b72 (21)
1035         #                                                                                    \-> b** (22)
1036         #
1037
1038         # b73 - tx with excessive sigops that are placed after an excessively large script element.
1039         #       The purpose of the test is to make sure those sigops are counted.
1040         #
1041         #       script is a bytearray of size 20,526
1042         #
1043         #       bytearray[0-19,998]     : OP_CHECKSIG
1044         #       bytearray[19,999]       : OP_PUSHDATA4
1045         #       bytearray[20,000-20,003]: 521  (max_script_element_size+1, in little-endian format)
1046         #       bytearray[20,004-20,525]: unread data (script_element)
1047         #       bytearray[20,526]       : OP_CHECKSIG (this puts us over the limit)
1048         #
1049         tip(72)
1050         b73 = block(73)
1051         size = MAX_BLOCK_SIGOPS - 1 + MAX_SCRIPT_ELEMENT_SIZE + 1 + 5 + 1
1052         a = bytearray([OP_CHECKSIG] * size)
1053         a[MAX_BLOCK_SIGOPS - 1] = int("4e",16) # OP_PUSHDATA4
1054
1055         element_size = MAX_SCRIPT_ELEMENT_SIZE + 1
1056         a[MAX_BLOCK_SIGOPS] = element_size % 256
1057         a[MAX_BLOCK_SIGOPS+1] = element_size // 256
1058         a[MAX_BLOCK_SIGOPS+2] = 0
1059         a[MAX_BLOCK_SIGOPS+3] = 0
1060
1061         tx = create_and_sign_tx(out[22].tx, 0, 1, CScript(a))
1062         b73 = update_block(73, [tx])
1063         assert_equal(get_legacy_sigopcount_block(b73), MAX_BLOCK_SIGOPS+1)
1064         yield rejected(RejectResult(16, b'bad-blk-sigops'))
1065
1066         # b74/75 - if we push an invalid script element, all prevous sigops are counted,
1067         #          but sigops after the element are not counted.
1068         #
1069         #       The invalid script element is that the push_data indicates that
1070         #       there will be a large amount of data (0xffffff bytes), but we only
1071         #       provide a much smaller number.  These bytes are CHECKSIGS so they would
1072         #       cause b75 to fail for excessive sigops, if those bytes were counted.
1073         #
1074         #       b74 fails because we put MAX_BLOCK_SIGOPS+1 before the element
1075         #       b75 succeeds because we put MAX_BLOCK_SIGOPS before the element
1076         #
1077         #
1078         tip(72)
1079         b74 = block(74)
1080         size = MAX_BLOCK_SIGOPS - 1 + MAX_SCRIPT_ELEMENT_SIZE + 42 # total = 20,561
1081         a = bytearray([OP_CHECKSIG] * size)
1082         a[MAX_BLOCK_SIGOPS] = 0x4e
1083         a[MAX_BLOCK_SIGOPS+1] = 0xfe
1084         a[MAX_BLOCK_SIGOPS+2] = 0xff
1085         a[MAX_BLOCK_SIGOPS+3] = 0xff
1086         a[MAX_BLOCK_SIGOPS+4] = 0xff
1087         tx = create_and_sign_tx(out[22].tx, 0, 1, CScript(a))
1088         b74 = update_block(74, [tx])
1089         yield rejected(RejectResult(16, b'bad-blk-sigops'))
1090
1091         tip(72)
1092         b75 = block(75)
1093         size = MAX_BLOCK_SIGOPS - 1 + MAX_SCRIPT_ELEMENT_SIZE + 42
1094         a = bytearray([OP_CHECKSIG] * size)
1095         a[MAX_BLOCK_SIGOPS-1] = 0x4e
1096         a[MAX_BLOCK_SIGOPS] = 0xff
1097         a[MAX_BLOCK_SIGOPS+1] = 0xff
1098         a[MAX_BLOCK_SIGOPS+2] = 0xff
1099         a[MAX_BLOCK_SIGOPS+3] = 0xff
1100         tx = create_and_sign_tx(out[22].tx, 0, 1, CScript(a))
1101         b75 = update_block(75, [tx])
1102         yield accepted()
1103         save_spendable_output()
1104
1105         # Check that if we push an element filled with CHECKSIGs, they are not counted
1106         tip(75)
1107         b76 = block(76)
1108         size = MAX_BLOCK_SIGOPS - 1 + MAX_SCRIPT_ELEMENT_SIZE + 1 + 5
1109         a = bytearray([OP_CHECKSIG] * size)
1110         a[MAX_BLOCK_SIGOPS-1] = 0x4e # PUSHDATA4, but leave the following bytes as just checksigs
1111         tx = create_and_sign_tx(out[23].tx, 0, 1, CScript(a))
1112         b76 = update_block(76, [tx])
1113         yield accepted()
1114         save_spendable_output()
1115
1116         # Test transaction resurrection
1117         #
1118         # -> b77 (24) -> b78 (25) -> b79 (26)
1119         #            \-> b80 (25) -> b81 (26) -> b82 (27)
1120         #
1121         #    b78 creates a tx, which is spent in b79. After b82, both should be in mempool
1122         #
1123         #    The tx'es must be unsigned and pass the node's mempool policy.  It is unsigned for the
1124         #    rather obscure reason that the Python signature code does not distinguish between
1125         #    Low-S and High-S values (whereas the bitcoin code has custom code which does so);
1126         #    as a result of which, the odds are 50% that the python code will use the right
1127         #    value and the transaction will be accepted into the mempool. Until we modify the
1128         #    test framework to support low-S signing, we are out of luck.
1129         #
1130         #    To get around this issue, we construct transactions which are not signed and which
1131         #    spend to OP_TRUE.  If the standard-ness rules change, this test would need to be
1132         #    updated.  (Perhaps to spend to a P2SH OP_TRUE script)
1133         #
1134         tip(76)
1135         block(77)
1136         tx77 = create_and_sign_tx(out[24].tx, out[24].n, 10*COIN)
1137         update_block(77, [tx77])
1138         yield accepted()
1139         save_spendable_output()
1140
1141         block(78)
1142         tx78 = create_tx(tx77, 0, 9*COIN)
1143         update_block(78, [tx78])
1144         yield accepted()
1145
1146         block(79)
1147         tx79 = create_tx(tx78, 0, 8*COIN)
1148         update_block(79, [tx79])
1149         yield accepted()
1150
1151         # mempool should be empty
1152         assert_equal(len(self.nodes[0].getrawmempool()), 0)
1153
1154         tip(77)
1155         block(80, spend=out[25])
1156         yield rejected()
1157         save_spendable_output()
1158
1159         block(81, spend=out[26])
1160         yield rejected() # other chain is same length
1161         save_spendable_output()
1162
1163         block(82, spend=out[27])
1164         yield accepted()  # now this chain is longer, triggers re-org
1165         save_spendable_output()
1166
1167         # now check that tx78 and tx79 have been put back into the peer's mempool
1168         mempool = self.nodes[0].getrawmempool()
1169         assert_equal(len(mempool), 2)
1170         assert(tx78.hash in mempool)
1171         assert(tx79.hash in mempool)
1172
1173
1174         # Test invalid opcodes in dead execution paths.
1175         #
1176         #  -> b81 (26) -> b82 (27) -> b83 (28)
1177         #
1178         block(83)
1179         op_codes = [OP_IF, OP_INVALIDOPCODE, OP_ELSE, OP_TRUE, OP_ENDIF]
1180         script = CScript(op_codes)
1181         tx1 = create_and_sign_tx(out[28].tx, out[28].n, out[28].tx.vout[0].nValue, script)
1182
1183         tx2 = create_and_sign_tx(tx1, 0, 0, CScript([OP_TRUE]))
1184         tx2.vin[0].scriptSig = CScript([OP_FALSE])
1185         tx2.rehash()
1186
1187         update_block(83, [tx1, tx2])
1188         yield accepted()
1189         save_spendable_output()
1190
1191
1192         # Reorg on/off blocks that have OP_RETURN in them (and try to spend them)
1193         #
1194         #  -> b81 (26) -> b82 (27) -> b83 (28) -> b84 (29) -> b87 (30) -> b88 (31)
1195         #                                    \-> b85 (29) -> b86 (30)            \-> b89a (32)
1196         #
1197         #
1198         block(84)
1199         tx1 = create_tx(out[29].tx, out[29].n, 0, CScript([OP_RETURN]))
1200         tx1.vout.append(CTxOut(0, CScript([OP_TRUE])))
1201         tx1.vout.append(CTxOut(0, CScript([OP_TRUE])))
1202         tx1.vout.append(CTxOut(0, CScript([OP_TRUE])))
1203         tx1.vout.append(CTxOut(0, CScript([OP_TRUE])))
1204         tx1.calc_sha256()
1205         self.sign_tx(tx1, out[29].tx, out[29].n)
1206         tx1.rehash()
1207         tx2 = create_tx(tx1, 1, 0, CScript([OP_RETURN]))
1208         tx2.vout.append(CTxOut(0, CScript([OP_RETURN])))
1209         tx3 = create_tx(tx1, 2, 0, CScript([OP_RETURN]))
1210         tx3.vout.append(CTxOut(0, CScript([OP_TRUE])))
1211         tx4 = create_tx(tx1, 3, 0, CScript([OP_TRUE]))
1212         tx4.vout.append(CTxOut(0, CScript([OP_RETURN])))
1213         tx5 = create_tx(tx1, 4, 0, CScript([OP_RETURN]))
1214
1215         update_block(84, [tx1,tx2,tx3,tx4,tx5])
1216         yield accepted()
1217         save_spendable_output()
1218
1219         tip(83)
1220         block(85, spend=out[29])
1221         yield rejected()
1222
1223         block(86, spend=out[30])
1224         yield accepted()
1225
1226         tip(84)
1227         block(87, spend=out[30])
1228         yield rejected()
1229         save_spendable_output()
1230
1231         block(88, spend=out[31])
1232         yield accepted()
1233         save_spendable_output()
1234
1235         # trying to spend the OP_RETURN output is rejected
1236         block("89a", spend=out[32])
1237         tx = create_tx(tx1, 0, 0, CScript([OP_TRUE]))
1238         update_block("89a", [tx])
1239         yield rejected()
1240
1241
1242         #  Test re-org of a week's worth of blocks (1088 blocks)
1243         #  This test takes a minute or two and can be accomplished in memory
1244         #
1245         if self.options.runbarelyexpensive:
1246             tip(88)
1247             LARGE_REORG_SIZE = 1088
1248             test1 = TestInstance(sync_every_block=False)
1249             spend=out[32]
1250             for i in range(89, LARGE_REORG_SIZE + 89):
1251                 b = block(i, spend)
1252                 tx = CTransaction()
1253                 script_length = MAX_BLOCK_BASE_SIZE - len(b.serialize()) - 69
1254                 script_output = CScript([b'\x00' * script_length])
1255                 tx.vout.append(CTxOut(0, script_output))
1256                 tx.vin.append(CTxIn(COutPoint(b.vtx[1].sha256, 0)))
1257                 b = update_block(i, [tx])
1258                 assert_equal(len(b.serialize()), MAX_BLOCK_BASE_SIZE)
1259                 test1.blocks_and_transactions.append([self.tip, True])
1260                 save_spendable_output()
1261                 spend = get_spendable_output()
1262
1263             yield test1
1264             chain1_tip = i
1265
1266             # now create alt chain of same length
1267             tip(88)
1268             test2 = TestInstance(sync_every_block=False)
1269             for i in range(89, LARGE_REORG_SIZE + 89):
1270                 block("alt"+str(i))
1271                 test2.blocks_and_transactions.append([self.tip, False])
1272             yield test2
1273
1274             # extend alt chain to trigger re-org
1275             block("alt" + str(chain1_tip + 1))
1276             yield accepted()
1277
1278             # ... and re-org back to the first chain
1279             tip(chain1_tip)
1280             block(chain1_tip + 1)
1281             yield rejected()
1282             block(chain1_tip + 2)
1283             yield accepted()
1284
1285             chain1_tip += 2
1286
1287
1288
1289 if __name__ == '__main__':
1290     FullBlockTest().main()