sidestr_core/
sighash.rs

1//! The signature hashes a spend on a sidestr chain is judged by, and the
2//! taproot key-path verifier over them.
3//!
4//! On a stock chain a spend signs BIP 341's taproot sighash and nothing
5//! else. Beside a BLAKE2b parent the chain inherits Bitcoin Knots' **unified
6//! opt-in signature hash** (`doc/unified-sighash.md` in Knots
7//! v29.4.1.knots20260508): one message layout for every script type,
8//! selected per signature by bit `0x20` in the hash-type byte, active from
9//! the chain's `unifiedSighashParam` height — which `siding/lib/overlay.mjs`
10//! sets to `blake2bHeight: 0`, so on a sidestr chain beside `xbt` or
11//! `txbt4` it applies from the genesis. Every spend on the live
12//! `sidestr:txbt4-siding` chain carries hash type `0x21`
13//! (`SIGHASH_ALL | SIGHASH_UNIFIED`); the message is ported from the
14//! reference kernel's `codec/interpreter.js sighashUnified` (Melvin
15//! Carvalho, AGPL-3.0) and proven by replaying that chain.
16//!
17//! A signature *without* the bit reads as plain BIP 341 on both families; a
18//! signature *with* it on a stock chain is an invalid hash type, as BIP 341
19//! says. Which reading applies is [`HeaderFamily::sighash_rules`]'s answer.
20//!
21//! [`HeaderFamily::sighash_rules`]: crate::block::HeaderFamily::sighash_rules
22
23use bitcoin::consensus::encode::serialize;
24use bitcoin::hashes::{sha256, Hash, HashEngine};
25use bitcoin::sighash::{Annex, Prevouts, SighashCache, TapSighashType};
26use bitcoin::{Transaction, TxOut};
27
28use crate::block::{annex_of, schnorr_verify};
29use crate::parents::Family;
30
31/// Knots' opt-in bit in the hash-type byte (`SIGHASH_UNIFIED` in the
32/// reference interpreter).
33pub const SIGHASH_UNIFIED: u8 = 0x20;
34
35/// Which signature-hash rules a spend is judged by.
36#[derive(Debug, Clone, Copy, PartialEq, Eq, Default)]
37pub enum SighashRules {
38    /// BIP 341 only: the stock family, and any family before its fork height.
39    #[default]
40    Bip341,
41    /// Knots' unified sighash is in force: a signature whose hash type carries
42    /// [`SIGHASH_UNIFIED`] is verified over the unified message; one without
43    /// it over BIP 341's, as before.
44    KnotsUnified,
45}
46
47/// The taproot half of a unified message: which spend path, and for the
48/// script path the leaf hash and code-separator position.
49#[derive(Debug, Clone, Copy, PartialEq, Eq)]
50pub enum UnifiedTaproot<'a> {
51    /// Script type 2: the key path.
52    KeyPath,
53    /// Script type 3: a tapscript leaf, key version 0.
54    ScriptPath {
55        /// The TapLeaf hash of the leaf being executed.
56        leaf_hash: &'a [u8; 32],
57        /// The position of the last executed `OP_CODESEPARATOR`, `0xffffffff` for none.
58        codesep_pos: u32,
59    },
60}
61
62fn sha(parts: &[&[u8]]) -> [u8; 32] {
63    let mut e = sha256::Hash::engine();
64    for p in parts {
65        e.input(p);
66    }
67    sha256::Hash::from_engine(e).to_byte_array()
68}
69
70fn compact_size(n: usize) -> Vec<u8> {
71    match n {
72        0..=0xfc => vec![n as u8],
73        0xfd..=0xffff => vec![0xfd, (n & 0xff) as u8, (n >> 8) as u8],
74        _ => {
75            let mut v = vec![0xfe];
76            v.extend((n as u32).to_le_bytes());
77            v
78        }
79    }
80}
81
82/// Knots' unified sighash for a taproot spend (`interpreter.js
83/// sighashUnified`, script types 2 and 3): BIP 341's layout with a script-type
84/// byte in place of the spend type, single SHA-256 aggregates, under
85/// `TaggedHash("UnifiedSighash")`. `hash_type` must carry
86/// [`SIGHASH_UNIFIED`], no undefined bits, and an output type of 1 to 3;
87/// `prevouts` is every input's, in order, since the message commits to all
88/// spent amounts and scripts.
89///
90/// ```text
91/// 0x00 ‖ hash_type ‖ version ‖ lock_time ‖ 0x00
92/// [sha_prevouts ‖ sha_amounts ‖ sha_scriptpubkeys ‖ sha_sequences]   unless ANYONECANPAY
93/// [sha_outputs]                                                      unless NONE or SINGLE
94/// script_type
95/// ANYONECANPAY ? outpoint ‖ prevout ‖ sequence : input index
96/// annex present ‖ [sha(compact(annex) ‖ annex)]
97/// [sha(this output)]                                                 SINGLE
98/// [leaf_hash ‖ 0x00 ‖ codesep_pos]                                   script path
99/// ```
100pub fn unified_taproot_sighash(
101    tx: &Transaction,
102    index: usize,
103    prevouts: &[TxOut],
104    hash_type: u8,
105    annex: Option<&[u8]>,
106    path: UnifiedTaproot,
107) -> Result<[u8; 32], &'static str> {
108    if hash_type & SIGHASH_UNIFIED == 0 {
109        return Err("unified sighash without SIGHASH_UNIFIED");
110    }
111    if hash_type & !(0x1f | 0x80 | SIGHASH_UNIFIED) != 0 {
112        return Err("invalid taproot sighash type");
113    }
114    let output_type = hash_type & 0x1f;
115    if !(1..=3).contains(&output_type) {
116        return Err("invalid taproot sighash type");
117    }
118    if prevouts.len() != tx.input.len() {
119        return Err("unified sighash needs every input prevout");
120    }
121    let input = tx.input.get(index).ok_or("no such input")?;
122    let anyone = hash_type & 0x80 != 0;
123    let outpoint = |i: &bitcoin::TxIn| serialize(&i.previous_output);
124    let mut msg: Vec<u8> = vec![0x00, hash_type];
125    msg.extend((tx.version.0 as u32).to_le_bytes());
126    msg.extend(tx.lock_time.to_consensus_u32().to_le_bytes());
127    msg.push(0x00);
128    if !anyone {
129        let prev: Vec<u8> = tx.input.iter().flat_map(outpoint).collect();
130        let amounts: Vec<u8> = prevouts
131            .iter()
132            .flat_map(|p| p.value.to_sat().to_le_bytes())
133            .collect();
134        let spks: Vec<u8> = prevouts
135            .iter()
136            .flat_map(|p| serialize(&p.script_pubkey))
137            .collect();
138        let seqs: Vec<u8> = tx
139            .input
140            .iter()
141            .flat_map(|i| i.sequence.0.to_le_bytes())
142            .collect();
143        msg.extend(sha(&[&prev]));
144        msg.extend(sha(&[&amounts]));
145        msg.extend(sha(&[&spks]));
146        msg.extend(sha(&[&seqs]));
147    }
148    if output_type != 2 && output_type != 3 {
149        let outs: Vec<u8> = tx.output.iter().flat_map(serialize).collect();
150        msg.extend(sha(&[&outs]));
151    }
152    msg.push(match path {
153        UnifiedTaproot::KeyPath => 2,
154        UnifiedTaproot::ScriptPath { .. } => 3,
155    });
156    if anyone {
157        msg.extend(outpoint(input));
158        msg.extend(serialize(&prevouts[index]));
159        msg.extend(input.sequence.0.to_le_bytes());
160    } else {
161        msg.extend((index as u32).to_le_bytes());
162    }
163    match annex {
164        Some(a) => {
165            msg.push(1);
166            msg.extend(sha(&[&compact_size(a.len()), a]));
167        }
168        None => msg.push(0),
169    }
170    if output_type == 3 {
171        let out = tx
172            .output
173            .get(index)
174            .ok_or("sighash single without matching output")?;
175        msg.extend(sha(&[&serialize(out)]));
176    }
177    if let UnifiedTaproot::ScriptPath {
178        leaf_hash,
179        codesep_pos,
180    } = path
181    {
182        msg.extend(leaf_hash);
183        msg.push(0x00);
184        msg.extend(codesep_pos.to_le_bytes());
185    }
186    let tag = sha256::Hash::hash(b"UnifiedSighash").to_byte_array();
187    Ok(sha(&[&tag, &tag, &msg]))
188}
189
190/// The non-taproot half of a unified message: which script type a
191/// signature in a legacy or segwit v0 input commits to (Knots
192/// `doc/unified-sighash.md`, script types 0 and 1).
193#[derive(Debug, Clone, Copy, PartialEq, Eq)]
194pub enum UnifiedLegacy {
195    /// Script type 0: a bare or P2SH script.
196    Base,
197    /// Script type 1: a segwit v0 program (P2WPKH, P2WSH).
198    WitnessV0,
199}
200
201/// Knots' unified sighash for a legacy or segwit v0 input (`interpreter.js
202/// sighashUnified` and fidsigner's `unified.js unifiedSighash`, script types
203/// 0 and 1): the same layout as [`unified_taproot_sighash`] with the
204/// script-type byte 0 or 1 and, where a taproot message has the annex
205/// byte, the script code with its CompactSize length. Beside it rather than
206/// folded into it, so the taproot function's signature and behaviour stay
207/// fixed.
208///
209/// Only the [`SIGHASH_UNIFIED`] bit is required: as in the reference, the
210/// output type is the low five bits, outputs are committed unless it is
211/// `NONE` (2) or `SINGLE` (3), and no other bit is refused. `prevouts` is
212/// every input's, in order. sidestr-core verifies no legacy or segwit v0
213/// spend (see the crate docs); this is the message, held to Knots' 142
214/// non-taproot known answers in `tests/fidsigner.rs`.
215///
216/// ```text
217/// 0x00 ‖ hash_type ‖ version ‖ lock_time ‖ 0x00
218/// [sha_prevouts ‖ sha_amounts ‖ sha_scriptpubkeys ‖ sha_sequences]   unless ANYONECANPAY
219/// [sha_outputs]                                                      unless NONE or SINGLE
220/// script_type (0 or 1)
221/// ANYONECANPAY ? outpoint ‖ prevout ‖ sequence : input index
222/// compact(script_code) ‖ script_code
223/// [sha(this output)]                                                 SINGLE
224/// ```
225pub fn unified_legacy_sighash(
226    tx: &Transaction,
227    index: usize,
228    prevouts: &[TxOut],
229    hash_type: u8,
230    script_type: UnifiedLegacy,
231    script_code: &[u8],
232) -> Result<[u8; 32], &'static str> {
233    if hash_type & SIGHASH_UNIFIED == 0 {
234        return Err("unified sighash without SIGHASH_UNIFIED");
235    }
236    if prevouts.len() != tx.input.len() {
237        return Err("unified sighash needs every input prevout");
238    }
239    let input = tx.input.get(index).ok_or("no such input")?;
240    let output_type = hash_type & 0x1f;
241    let anyone = hash_type & 0x80 != 0;
242    let outpoint = |i: &bitcoin::TxIn| serialize(&i.previous_output);
243    let mut msg: Vec<u8> = vec![0x00, hash_type];
244    msg.extend((tx.version.0 as u32).to_le_bytes());
245    msg.extend(tx.lock_time.to_consensus_u32().to_le_bytes());
246    msg.push(0x00);
247    if !anyone {
248        let prev: Vec<u8> = tx.input.iter().flat_map(outpoint).collect();
249        let amounts: Vec<u8> = prevouts
250            .iter()
251            .flat_map(|p| p.value.to_sat().to_le_bytes())
252            .collect();
253        let spks: Vec<u8> = prevouts
254            .iter()
255            .flat_map(|p| serialize(&p.script_pubkey))
256            .collect();
257        let seqs: Vec<u8> = tx
258            .input
259            .iter()
260            .flat_map(|i| i.sequence.0.to_le_bytes())
261            .collect();
262        msg.extend(sha(&[&prev]));
263        msg.extend(sha(&[&amounts]));
264        msg.extend(sha(&[&spks]));
265        msg.extend(sha(&[&seqs]));
266    }
267    if output_type != 2 && output_type != 3 {
268        let outs: Vec<u8> = tx.output.iter().flat_map(serialize).collect();
269        msg.extend(sha(&[&outs]));
270    }
271    msg.push(match script_type {
272        UnifiedLegacy::Base => 0,
273        UnifiedLegacy::WitnessV0 => 1,
274    });
275    if anyone {
276        msg.extend(outpoint(input));
277        msg.extend(serialize(&prevouts[index]));
278        msg.extend(input.sequence.0.to_le_bytes());
279    } else {
280        msg.extend((index as u32).to_le_bytes());
281    }
282    msg.extend(compact_size(script_code.len()));
283    msg.extend(script_code);
284    if output_type == 3 {
285        let out = tx
286            .output
287            .get(index)
288            .ok_or("sighash single without matching output")?;
289        msg.extend(sha(&[&serialize(out)]));
290    }
291    let tag = sha256::Hash::hash(b"UnifiedSighash").to_byte_array();
292    Ok(sha(&[&tag, &tag, &msg]))
293}
294
295/// Verify one input as a taproot key-path spend under `rules`: one Schnorr
296/// signature, 64 bytes for `SIGHASH_DEFAULT` or 65 with an explicit type, an
297/// annex allowed, over BIP 341's sighash — or, under
298/// [`SighashRules::KnotsUnified`] with the [`SIGHASH_UNIFIED`] bit set,
299/// over the unified message. Any other script type and the script path are
300/// refused, never skipped (`interpreter.js #verifyTaproot`, key path).
301pub fn verify_taproot_key_path(
302    tx: &Transaction,
303    index: usize,
304    prevouts: &[TxOut],
305    rules: SighashRules,
306) -> Result<(), &'static str> {
307    let prevout = prevouts.get(index).ok_or("no prevout for the input")?;
308    let input = tx.input.get(index).ok_or("no such input")?;
309    if !prevout.script_pubkey.is_p2tr() {
310        return Err("unsupported script type: sidestr-core verifies taproot spends only");
311    }
312    if !input.script_sig.is_empty() {
313        return Err("WITNESS_MALLEATED");
314    }
315    let mut items: Vec<&[u8]> = input.witness.iter().collect();
316    if items.is_empty() {
317        return Err("empty taproot witness");
318    }
319    let annex = annex_of(&mut items)?;
320    if items.len() != 1 {
321        return Err("taproot script path: not a key-path spend");
322    }
323    let raw = items[0];
324    let (sig, hash_type) = match raw.len() {
325        64 => (raw, 0u8),
326        65 => {
327            if raw[64] == 0 {
328                return Err("explicit SIGHASH_DEFAULT in 65-byte signature");
329            }
330            (&raw[..64], raw[64])
331        }
332        _ => return Err("bad key-path signature size"),
333    };
334    let msg = if rules == SighashRules::KnotsUnified && hash_type & SIGHASH_UNIFIED != 0 {
335        unified_taproot_sighash(
336            tx,
337            index,
338            prevouts,
339            hash_type,
340            annex.as_ref().map(Annex::as_bytes),
341            UnifiedTaproot::KeyPath,
342        )?
343    } else {
344        let ty = TapSighashType::from_consensus_u8(hash_type)
345            .map_err(|_| "invalid taproot sighash type")?;
346        if prevouts.len() != tx.input.len() {
347            return Err("taproot sighash needs every input prevout");
348        }
349        SighashCache::new(tx)
350            .taproot_signature_hash(index, &Prevouts::All(prevouts), annex, None, ty)
351            .map_err(|_| "sighash failed")?
352            .to_byte_array()
353    };
354    if schnorr_verify(&msg, sig, &prevout.script_pubkey.as_bytes()[2..34]) {
355        Ok(())
356    } else {
357        Err("invalid key-path schnorr signature")
358    }
359}
360
361/// Verify one input under the script templates this crate carries.
362///
363/// Besides taproot key-path spends, the pool and markets rules deliberately
364/// use a bare `OP_TRUE` collateral coin. The reference-generated spend of
365/// that coin has an empty `scriptSig` and witness; that exact form succeeds
366/// here. Other script templates remain unsupported and fail closed.
367pub fn verify_supported_input(
368    tx: &Transaction,
369    index: usize,
370    prevouts: &[TxOut],
371    rules: SighashRules,
372) -> Result<(), String> {
373    let prevout = prevouts.get(index).ok_or("no prevout for the input")?;
374    if prevout.script_pubkey.as_bytes() == [0x51] {
375        let input = tx.input.get(index).ok_or("no input at that index")?;
376        return if input.script_sig.is_empty() && input.witness.is_empty() {
377            Ok(())
378        } else {
379            Err("an OP_TRUE collateral spend has empty scriptSig and witness".into())
380        };
381    }
382    verify_taproot_key_path(tx, index, prevouts, rules).map_err(str::to_owned)
383}
384
385/// The signature-hash rules a chain inherits from its parent's family (SPEC
386/// 3, 0.0.3): Knots' unified sighash beside a BLAKE2b parent, BIP 341
387/// beside stock Bitcoin. The same answer [`HeaderFamily::sighash_rules`]
388/// gives for a sidestr chain of that family, whose fork height is 0, for a
389/// caller — a wallet — that holds a chain document and no family type
390/// (`siding/lib/txsign.mjs usesUnifiedSighash`).
391///
392/// ```
393/// use sidestr_core::parents::{resolve_parent, Family};
394/// use sidestr_core::sighash::{rules_for, SighashRules};
395///
396/// assert_eq!(rules_for(resolve_parent("tbtc4").unwrap().family), SighashRules::Bip341);
397/// assert_eq!(rules_for(Family::Blake2b), SighashRules::KnotsUnified);
398/// ```
399///
400/// [`HeaderFamily::sighash_rules`]: crate::block::HeaderFamily::sighash_rules
401pub fn rules_for(family: Family) -> SighashRules {
402    match family {
403        Family::Stock => SighashRules::Bip341,
404        Family::Blake2b => SighashRules::KnotsUnified,
405    }
406}
407
408/// The hash type a key-path signature carries under `rules`
409/// (`txsign.mjs keyPathSighash`): `0x21` (`SIGHASH_ALL | SIGHASH_UNIFIED`)
410/// where the unified sighash is in force, `0x01` (`SIGHASH_ALL`) under BIP
411/// 341. Always explicit, so every witness is 65 bytes and names its rule.
412pub fn key_path_hash_type(rules: SighashRules) -> u8 {
413    match rules {
414        SighashRules::KnotsUnified => 0x01 | SIGHASH_UNIFIED,
415        SighashRules::Bip341 => 0x01,
416    }
417}
418
419/// The message input `index`'s key-path signature commits to under `rules`,
420/// and the hash-type byte appended to that signature (`txsign.mjs
421/// keyPathSighash`). `prevouts` is every input's, in order. The signer's
422/// witness is the 64-byte BIP 340 signature over the message followed by
423/// the byte: exactly what [`verify_taproot_key_path`] checks under the same
424/// rules, and what the reference producer checks before a transaction enters
425/// its mempool.
426///
427/// ```
428/// use bitcoin::hashes::Hash;
429/// use bitcoin::secp256k1::{Keypair, Message, SecretKey};
430/// use bitcoin::{absolute::LockTime, transaction::Version, Amount, OutPoint, ScriptBuf, Sequence, Transaction, TxIn, TxOut, Txid, Witness};
431/// use sidestr_core::block::{challenge_for, secp};
432/// use sidestr_core::sighash::{key_path_sighash, verify_taproot_key_path, SighashRules};
433///
434/// let kp = Keypair::from_secret_key(secp(), &SecretKey::from_slice(&[0x11; 32]).unwrap());
435/// let me = challenge_for(&kp.x_only_public_key().0);
436/// let prevouts = vec![TxOut { value: Amount::from_sat(50_000), script_pubkey: me.clone() }];
437/// let mut tx = Transaction { version: Version::TWO, lock_time: LockTime::ZERO,
438///     input: vec![TxIn { previous_output: OutPoint { txid: Txid::all_zeros(), vout: 0 }, script_sig: ScriptBuf::new(),
439///                        sequence: Sequence(0xffff_fffd), witness: Witness::new() }],
440///     output: vec![TxOut { value: Amount::from_sat(49_000), script_pubkey: me }] };
441///
442/// // beside a BLAKE2b parent: hash type 0x21, refused beside stock Bitcoin (txsign-test.mjs)
443/// let (msg, ht) = key_path_sighash(&tx, 0, &prevouts, SighashRules::KnotsUnified).unwrap();
444/// let sig = secp().sign_schnorr_with_aux_rand(&Message::from_digest(msg), &kp, &[0; 32]);
445/// tx.input[0].witness = Witness::from_slice(&[[sig.serialize().as_slice(), &[ht]].concat()]);
446/// assert_eq!(ht, 0x21);
447/// assert!(verify_taproot_key_path(&tx, 0, &prevouts, SighashRules::KnotsUnified).is_ok());
448/// assert!(verify_taproot_key_path(&tx, 0, &prevouts, SighashRules::Bip341).is_err());
449/// ```
450pub fn key_path_sighash(
451    tx: &Transaction,
452    index: usize,
453    prevouts: &[TxOut],
454    rules: SighashRules,
455) -> Result<([u8; 32], u8), &'static str> {
456    let hash_type = key_path_hash_type(rules);
457    let msg = match rules {
458        SighashRules::KnotsUnified => unified_taproot_sighash(
459            tx,
460            index,
461            prevouts,
462            hash_type,
463            None,
464            UnifiedTaproot::KeyPath,
465        )?,
466        SighashRules::Bip341 => {
467            if prevouts.len() != tx.input.len() {
468                return Err("taproot sighash needs every input prevout");
469            }
470            if index >= tx.input.len() {
471                return Err("no such input");
472            }
473            SighashCache::new(tx)
474                .taproot_key_spend_signature_hash(
475                    index,
476                    &Prevouts::All(prevouts),
477                    TapSighashType::All,
478                )
479                .map_err(|_| "sighash failed")?
480                .to_byte_array()
481        }
482    };
483    Ok((msg, hash_type))
484}
485
486#[cfg(test)]
487mod tests {
488    use super::*;
489    use bitcoin::secp256k1::{Keypair, Message, SecretKey};
490    use bitcoin::transaction::Version;
491    use bitcoin::{absolute::LockTime, Amount, OutPoint, ScriptBuf, Sequence, TxIn, Witness};
492
493    fn spend(hash_type: u8, rules: SighashRules) -> (Transaction, Vec<TxOut>) {
494        let key = SecretKey::from_slice(&[3u8; 32]).unwrap();
495        let kp = Keypair::from_secret_key(crate::block::secp(), &key);
496        let me = crate::block::challenge_for(&kp.x_only_public_key().0);
497        let prevouts = vec![TxOut {
498            value: Amount::from_sat(10_000),
499            script_pubkey: me.clone(),
500        }];
501        let mut tx = Transaction {
502            version: Version::TWO,
503            lock_time: LockTime::ZERO,
504            input: vec![TxIn {
505                previous_output: OutPoint {
506                    txid: bitcoin::Txid::all_zeros(),
507                    vout: 1,
508                },
509                script_sig: ScriptBuf::new(),
510                sequence: Sequence(0xffff_fffd),
511                witness: Witness::new(),
512            }],
513            output: vec![TxOut {
514                value: Amount::from_sat(9_000),
515                script_pubkey: me,
516            }],
517        };
518        let msg = match rules {
519            SighashRules::KnotsUnified if hash_type & SIGHASH_UNIFIED != 0 => {
520                unified_taproot_sighash(&tx, 0, &prevouts, hash_type, None, UnifiedTaproot::KeyPath)
521                    .unwrap()
522            }
523            _ => SighashCache::new(&tx)
524                .taproot_key_spend_signature_hash(
525                    0,
526                    &Prevouts::All(&prevouts),
527                    TapSighashType::from_consensus_u8(hash_type & !SIGHASH_UNIFIED).unwrap(),
528                )
529                .unwrap()
530                .to_byte_array(),
531        };
532        let sig = crate::block::secp()
533            .sign_schnorr_with_aux_rand(&Message::from_digest(msg), &kp, &[0u8; 32])
534            .serialize()
535            .to_vec();
536        let item = if hash_type == 0 {
537            sig
538        } else {
539            [sig, vec![hash_type]].concat()
540        };
541        tx.input[0].witness = Witness::from_slice(&[item]);
542        (tx, prevouts)
543    }
544
545    #[test]
546    fn unified_bit_is_read_only_where_the_rules_say() {
547        let (tx, p) = spend(0x21, SighashRules::KnotsUnified);
548        assert!(verify_taproot_key_path(&tx, 0, &p, SighashRules::KnotsUnified).is_ok());
549        assert_eq!(
550            verify_taproot_key_path(&tx, 0, &p, SighashRules::Bip341),
551            Err("invalid taproot sighash type")
552        );
553        let (tx, p) = spend(0x00, SighashRules::KnotsUnified);
554        assert!(verify_taproot_key_path(&tx, 0, &p, SighashRules::KnotsUnified).is_ok());
555        assert!(verify_taproot_key_path(&tx, 0, &p, SighashRules::Bip341).is_ok());
556        let (tx, p) = spend(0x01, SighashRules::Bip341);
557        assert!(verify_taproot_key_path(&tx, 0, &p, SighashRules::KnotsUnified).is_ok());
558        // a unified message is not a BIP 341 message
559        let (tx, p) = spend(0x21, SighashRules::Bip341);
560        assert!(verify_taproot_key_path(&tx, 0, &p, SighashRules::KnotsUnified).is_err());
561    }
562
563    #[test]
564    fn unified_message_refuses_undefined_types() {
565        let (tx, p) = spend(0x00, SighashRules::Bip341);
566        for bad in [0x20u8, 0x24, 0x60, 0xa0] {
567            assert!(
568                unified_taproot_sighash(&tx, 0, &p, bad, None, UnifiedTaproot::KeyPath).is_err(),
569                "{bad:#x}"
570            );
571        }
572        assert!(unified_taproot_sighash(&tx, 0, &p, 0x01, None, UnifiedTaproot::KeyPath).is_err());
573        assert!(unified_taproot_sighash(&tx, 0, &[], 0x21, None, UnifiedTaproot::KeyPath).is_err());
574        let a = unified_taproot_sighash(&tx, 0, &p, 0x21, None, UnifiedTaproot::KeyPath).unwrap();
575        let b = unified_taproot_sighash(&tx, 0, &p, 0x21, Some(&[0x50]), UnifiedTaproot::KeyPath)
576            .unwrap();
577        let c = unified_taproot_sighash(
578            &tx,
579            0,
580            &p,
581            0x21,
582            None,
583            UnifiedTaproot::ScriptPath {
584                leaf_hash: &[9u8; 32],
585                codesep_pos: 0xffff_ffff,
586            },
587        )
588        .unwrap();
589        let d = unified_taproot_sighash(&tx, 0, &p, 0xa1, None, UnifiedTaproot::KeyPath).unwrap();
590        assert!(a != b && a != c && a != d && b != c);
591    }
592}
sidestr_core/sighash.rs

sidestr_core/
sighash.rs
