| 1491 | |
| 1492 | template<typename T> |
| 1493 | bool SignatureHashSchnorr(uint256& hash_out, ScriptExecutionData& execdata, const T& tx_to, uint32_t in_pos, uint8_t hash_type, SigVersion sigversion, const PrecomputedTransactionData& cache, MissingDataBehavior mdb) |
| 1494 | { |
| 1495 | uint8_t ext_flag, key_version; |
| 1496 | switch (sigversion) { |
| 1497 | case SigVersion::TAPROOT: |
| 1498 | ext_flag = 0; |
| 1499 | // key_version is not used and left uninitialized. |
| 1500 | break; |
| 1501 | case SigVersion::TAPSCRIPT: |
| 1502 | ext_flag = 1; |
| 1503 | // key_version must be 0 for now, representing the current version of |
| 1504 | // 32-byte public keys in the tapscript signature opcode execution. |
| 1505 | // An upgradable public key version (with a size not 32-byte) may |
| 1506 | // request a different key_version with a new sigversion. |
| 1507 | key_version = 0; |
| 1508 | break; |
| 1509 | default: |
| 1510 | assert(false); |
| 1511 | } |
| 1512 | assert(in_pos < tx_to.vin.size()); |
| 1513 | if (!(cache.m_bip341_taproot_ready && cache.m_spent_outputs_ready)) { |
| 1514 | return HandleMissingData(mdb); |
| 1515 | } |
| 1516 | |
| 1517 | HashWriter ss{HASHER_TAPSIGHASH}; |
| 1518 | |
| 1519 | // Epoch |
| 1520 | static constexpr uint8_t EPOCH = 0; |
| 1521 | ss << EPOCH; |
| 1522 | |
| 1523 | // Hash type |
| 1524 | const uint8_t output_type = (hash_type == SIGHASH_DEFAULT) ? SIGHASH_ALL : (hash_type & SIGHASH_OUTPUT_MASK); // Default (no sighash byte) is equivalent to SIGHASH_ALL |
| 1525 | const uint8_t input_type = hash_type & SIGHASH_INPUT_MASK; |
| 1526 | if (!(hash_type <= 0x03 || (hash_type >= 0x81 && hash_type <= 0x83))) return false; |
| 1527 | ss << hash_type; |
| 1528 | |
| 1529 | // Transaction level data |
| 1530 | ss << tx_to.version; |
| 1531 | ss << tx_to.nLockTime; |
| 1532 | if (input_type != SIGHASH_ANYONECANPAY) { |
| 1533 | ss << cache.m_prevouts_single_hash; |
| 1534 | ss << cache.m_spent_amounts_single_hash; |
| 1535 | ss << cache.m_spent_scripts_single_hash; |
| 1536 | ss << cache.m_sequences_single_hash; |
| 1537 | } |
| 1538 | if (output_type == SIGHASH_ALL) { |
| 1539 | ss << cache.m_outputs_single_hash; |
| 1540 | } |
| 1541 | |
| 1542 | // Data about the input/prevout being spent |
| 1543 | assert(execdata.m_annex_init); |
| 1544 | const bool have_annex = execdata.m_annex_present; |
| 1545 | const uint8_t spend_type = (ext_flag << 1) + (have_annex ? 1 : 0); // The low bit indicates whether an annex is present. |
| 1546 | ss << spend_type; |
| 1547 | if (input_type == SIGHASH_ANYONECANPAY) { |
| 1548 | ss << tx_to.vin[in_pos].prevout; |
| 1549 | ss << cache.m_spent_outputs[in_pos]; |
| 1550 | ss << tx_to.vin[in_pos].nSequence; |