Add support for standard P2A scripts (#164)

In order to support v3 commitments in lightning, we need to use P2A
(pay-to-anchor) outputs, which are currently rejected by our script
interpreter.

See bitcoin/bitcoin#30352 where this output
type was introduced to `bitcoind`. Their amount can be set to dust
with bitcoin/bitcoin#30239.

Both of those changes are available in Bitcoin Core v29.

Author: t-bast

build.gradle.kts

@@ -13,7 +13,7 @@ plugins {
 val currentOs = org.gradle.internal.os.OperatingSystem.current()
 
 group = "fr.acinq.bitcoin"
-version = "0.27.0"
+version = "0.27.1-SNAPSHOT"
 
 repositories {
     google()

src/commonMain/kotlin/fr/acinq/bitcoin/Script.kt

@@ -524,6 +524,14 @@ public object Script {
         return ScriptWitness(witness.stack + script.script + controlBlock)
     }
 
+    /** Standard P2A (pay-to-anchor) output. */
+    @JvmStatic
+    public val pay2anchor: List<ScriptElt> = listOf(OP_1, OP_PUSHDATA(ByteVector("4e73")))
+
+    /** An empty witness script is used to spend [pay2anchor] outputs. */
+    @JvmStatic
+    public val witnessPay2anchor: ScriptWitness = ScriptWitness.empty
+
     public fun removeSignature(script: List<ScriptElt>, signature: ByteVector): List<ScriptElt> {
         val toRemove = OP_PUSHDATA(signature)
         return script.filterNot { it == toRemove }
@@ -1488,12 +1496,11 @@ public object Script {
                         }
                     }
                 }
-
+                // Standard P2A script (see github.com/bitcoin/bitcoin/pull/30352).
+                witnessVersion == 1L && program.contentEquals(byteArrayOf(0x4e, 0x73)) -> require(witness == witnessPay2anchor) { "P2A output must be spent with an empty witness" }
                 (scriptFlag and ScriptFlags.SCRIPT_VERIFY_DISCOURAGE_UPGRADABLE_WITNESS_PROGRAM) != 0 -> throw IllegalArgumentException("Witness version $witnessVersion reserved for soft-fork upgrades")
-                else -> {
-                    // Higher version witness scripts return true for future softfork compatibility
-                    return
-                }
+                // Higher version witness scripts return true for future softfork compatibility
+                else -> {}
             }
         }
 

src/commonTest/kotlin/fr/acinq/bitcoin/reference/TransactionTestsCommon.kt

@@ -20,6 +20,7 @@ import fr.acinq.bitcoin.*
 import kotlinx.serialization.json.*
 import kotlin.test.Test
 import kotlin.test.assertEquals
+import kotlin.test.assertFails
 import kotlin.test.fail
 
 class TransactionTestsCommon {
@@ -91,7 +92,7 @@ class TransactionTestsCommon {
                             }
                         }
                         true
-                    } catch (t: Throwable) {
+                    } catch (_: Throwable) {
                         false
                     }
                     assertEquals(valid, result, "failed valid=$valid test $testCase")
@@ -117,6 +118,75 @@ class TransactionTestsCommon {
         assertEquals(93, count)
     }
 
+    @Test
+    fun `TRUC transaction with p2a -- no external input`() {
+        val priv = PrivateKey.fromHex("de1fa92dc352791cb83646513bda82bc2d44b80b42d6efceca6789a2b1b34bb8")
+        // The parent transaction usually doesn't pay any fees.
+        val parentTx = Transaction(
+            version = 3,
+            txIn = listOf(TxIn(OutPoint(TxId("007ef4c2f775ae04b67f942cd1e1dc4eb950f857401315e2aaad45eac1f355fa"), 1), 0)),
+            txOut = listOf(
+                TxOut(100_000.sat(), Script.pay2wpkh(priv.publicKey())),
+                TxOut(0.sat(), Script.pay2anchor),
+            ),
+            lockTime = 0
+        )
+        // The child transaction is used to pay fees (CPFP using P2A).
+        // In this example, we also spend the p2wpkh output to pay the fees.
+        val unsignedChildTx = Transaction(
+            version = 3,
+            txIn = listOf(
+                TxIn(OutPoint(parentTx.txid, 0), 0),
+                TxIn(OutPoint(parentTx.txid, 1), 0),
+            ),
+            txOut = listOf(TxOut(95_000.sat(), Script.pay2wpkh(priv.publicKey()))),
+            lockTime = 0
+        )
+        val sig0 = unsignedChildTx.signInput(0, Script.pay2pkh(priv.publicKey()), SigHash.SIGHASH_ALL, 100_000.sat(), SigVersion.SIGVERSION_WITNESS_V0, priv)
+        val childTx = unsignedChildTx
+            .updateWitness(0, Script.witnessPay2wpkh(priv.publicKey(), sig0.byteVector()))
+            .updateWitness(1, Script.witnessPay2anchor)
+        Transaction.correctlySpends(childTx, listOf(parentTx), ScriptFlags.STANDARD_SCRIPT_VERIFY_FLAGS)
+        // The anchor output MUST have an empty witness to be valid.
+        assertFails { Transaction.correctlySpends(childTx.updateWitness(1, ScriptWitness(listOf(ByteVector("deadbeef")))), listOf(parentTx), ScriptFlags.STANDARD_SCRIPT_VERIFY_FLAGS) }
+    }
+
+    @Test
+    fun `TRUC transaction with p2a -- external input`() {
+        val priv = PrivateKey.fromHex("de1fa92dc352791cb83646513bda82bc2d44b80b42d6efceca6789a2b1b34bb8")
+        // The parent transaction usually doesn't pay any fees.
+        val parentTx = Transaction(
+            version = 3,
+            txIn = listOf(TxIn(OutPoint(TxId("cf637c92da728399142665f03ed7451ed5c4e501015189f593b6e5c878e40d72"), 0), 0)),
+            txOut = listOf(
+                TxOut(50_000.sat(), Script.pay2wsh(ByteVector("deadbeef"))),
+                TxOut(0.sat(), Script.pay2anchor),
+            ),
+            lockTime = 0
+        )
+        // The following transaction has been confirmed: its output will be used to pay fees for the parent transaction.
+        val walletTx = Transaction(
+            version = 2,
+            txIn = listOf(TxIn(OutPoint(TxId("72d59754a65ac76c75d51484279f083862cdd8d067efb1ab07e1bf9185e8436d"), 0), 0)),
+            txOut = listOf(TxOut(100_000.sat(), Script.pay2wpkh(priv.publicKey()))),
+            lockTime = 0
+        )
+        val unsignedChildTx = Transaction(
+            version = 3,
+            txIn = listOf(
+                TxIn(OutPoint(walletTx, 0), 0),
+                TxIn(OutPoint(parentTx, 1), 0),
+            ),
+            txOut = listOf(TxOut(95_000.sat(), Script.pay2wpkh(priv.publicKey()))),
+            lockTime = 0
+        )
+        val sig0 = unsignedChildTx.signInput(0, Script.pay2pkh(priv.publicKey()), SigHash.SIGHASH_ALL, 100_000.sat(), SigVersion.SIGVERSION_WITNESS_V0, priv)
+        val childTx = unsignedChildTx
+            .updateWitness(0, Script.witnessPay2wpkh(priv.publicKey(), sig0.byteVector()))
+            .updateWitness(1, Script.witnessPay2anchor)
+        Transaction.correctlySpends(childTx, listOf(walletTx, parentTx), ScriptFlags.STANDARD_SCRIPT_VERIFY_FLAGS)
+    }
+
     @Test
     fun `input and output weights`() {
         val publicKey1 = PublicKey.fromHex("03949633a194a43a310c5a593aada2f2d4a4e3c181880e2b396facfb2130a7f0b5")