| 2711 | |
| 2712 | template<typename T> |
| 2713 | bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, const T& tx_to, uint32_t in_pos, uint8_t hash_type, SigVersion sigversion, const PrecomputedTransactionData& cache, MissingDataBehavior mdb) |
| 2714 | { |
| 2715 | uint8_t ext_flag, key_version; |
| 2716 | switch (sigversion) { |
| 2717 | case SigVersion::TAPROOT: |
| 2718 | ext_flag = 0; |
| 2719 | // key_version is not used and left uninitialized. |
| 2720 | break; |
| 2721 | case SigVersion::TAPSCRIPT: |
| 2722 | ext_flag = 1; |
| 2723 | // key_version must be 0 for now, representing the current version of |
| 2724 | // 32-byte public keys in the tapscript signature opcode execution. |
| 2725 | // An upgradable public key version (with a size not 32-byte) may |
| 2726 | // request a different key_version with a new sigversion. |
| 2727 | key_version = 0; |
| 2728 | break; |
| 2729 | default: |
| 2730 | assert(false); |
| 2731 | } |
| 2732 | assert(in_pos < tx_to.vin.size()); |
| 2733 | if (!(cache.m_bip341_taproot_ready && cache.m_spent_outputs_ready)) { |
| 2734 | return HandleMissingData(mdb); |
| 2735 | } |
| 2736 | |
| 2737 | CHashWriter ss = cache.m_tapsighash_hasher; |
| 2738 | |
| 2739 | // no epoch in elements taphash |
| 2740 | // static constexpr uint8_t EPOCH = 0; |
| 2741 | // ss << EPOCH; |
| 2742 | |
| 2743 | // Hash type |
| 2744 | const uint8_t output_type = (hash_type == SIGHASH_DEFAULT) ? SIGHASH_ALL : (hash_type & SIGHASH_OUTPUT_MASK); // Default (no sighash byte) is equivalent to SIGHASH_ALL |
| 2745 | const uint8_t input_type = hash_type & SIGHASH_INPUT_MASK; |
| 2746 | if (!(hash_type <= 0x03 || (hash_type >= 0x81 && hash_type <= 0x83))) return false; |
| 2747 | ss << hash_type; |
| 2748 | |
| 2749 | // Transaction level data |
| 2750 | ss << tx_to.nVersion; |
| 2751 | ss << tx_to.nLockTime; |
| 2752 | if (input_type != SIGHASH_ANYONECANPAY) { |
| 2753 | ss << cache.m_outpoints_flag_single_hash; |
| 2754 | ss << cache.m_prevouts_single_hash; |
| 2755 | ss << cache.m_spent_asset_amounts_single_hash; |
| 2756 | // Why is nNonce not included in sighash?(both in ACP and non ACP case) |
| 2757 | // |
| 2758 | // Nonces are not serialized into utxo database. As a consequence, after restarting the node, |
| 2759 | // all nonces in the utxoset are cleared which results in a inconsistent view for nonces for |
| 2760 | // nodes that did not restart. See https://github.com/ElementsProject/elements/issues/1004 for details |
| 2761 | ss << cache.m_spent_scripts_single_hash; |
| 2762 | ss << cache.m_sequences_single_hash; |
| 2763 | ss << cache.m_issuances_single_hash; |
| 2764 | ss << cache.m_issuance_rangeproofs_single_hash; |
| 2765 | } |
| 2766 | if (output_type == SIGHASH_ALL) { |
| 2767 | ss << cache.m_outputs_single_hash; |
| 2768 | ss << cache.m_output_witnesses_single_hash; |
| 2769 | } |
| 2770 | // Data about the input/prevout being spent |