starius / btcd / 37412945756

54%

master: 55%

Build Type

push

github

Committed by starius

Commit Message

txscript: reject SIGHASH_SINGLE signing without a matching output

When SIGHASH_SINGLE has no output corresponding to the input being
signed, legacy signing uses the constant hash one and segwit v0 signing
commits to no outputs. These signatures can allow funds to be
redirected.

Reject this case in RawTxInSignature and RawTxInWitnessSignature with
ErrInvalidSigHashSingleIndex, including when ANYONECANPAY is set.
Their callers inherit the protection; multisig signing omits refused
signatures through its existing error handling, as SignTxOutput now
documents.

The check masks the hash type with sigHashMask (0x1f) like the sighash
code, where Core masks with 3; the two agree for the standard hash
types. When the matching output is absent, Core also refuses
non-standard types such as 0x07, 0x0b and 0x13. btcd's sighash treats
those like SIGHASH_ALL, committing to every output, so they are still
signed. This divergence is intentional.

Leave sighash calculation unchanged to preserve consensus verification.
Taproot signing already rejects this case.

Add regression coverage for P2PKH, bare multisig, P2SH-P2PKH,
P2SH-multisig, P2WPKH and P2TR across the six standard explicit sighash
types, checking both missing-output rejection and successful signing of
supported combinations. Also cover the raw ECDSA signers with
non-standard hash types: without a matching output, 0x23, 0x43 and 0xc3
are refused, while 0x07, 0x0b and 0x13 are still signed.

Port of Bitcoin Core PR bitcoin/bitcoin#35984:
https://github.com/bitcoin/bitcoin/pull/35984

Coverage Stats

14 of 14 new or added lines in 1 file covered. (100.0%)

72 existing lines in 3 files now uncovered.

38174 of 70418 relevant lines covered (54.21%)

355767.19 hits per line