mirror of
https://github.com/serai-dex/serai.git
synced 2024-12-22 19:49:22 +00:00
Monero: support for legacy transactions (#308)
* add mlsag * fix last commit * fix miner v1 txs * fix non-miner v1 txs * add borromean + fix mlsag * add block hash calculations * fix for the jokester that added unreduced scalars to the borromean signature of 2368d846e671bf79a1f84c6d3af9f0bfe296f043f50cf17ae5e485384a53707b * Add Borromean range proof verifying functionality * Add MLSAG verifying functionality * fmt & clippy :) * update MLSAG, ss2_elements will always be 2 * Add MgSig proving * Tidy block.rs * Tidy Borromean, fix bugs in last commit, replace todo! with unreachable! * Mark legacy EcdhInfo amount decryption as experimental * Correct comments * Write a new impl of the merkle algorithm This one tries to be understandable. * Only pull in things only needed for experimental when experimental * Stop caching the Monero block hash now in processor that we have Block::hash * Corrections for recent processor commit * Use a clearer algorithm for the merkle Should also be more efficient due to not shifting as often. * Tidy Mlsag * Remove verify_rct_* from Mlsag Both methods were ports from Monero, overtly specific without clear documentation. They need to be added back in, with documentation, or included in a node which provides the necessary further context for them to be naturally understandable. * Move mlsag/mod.rs to mlsag.rs This should only be a folder if it has multiple files. * Replace EcdhInfo terminology The ECDH encrypted the amount, yet this struct contained the encrypted amount, not some ECDH. Also corrects the types on the original EcdhInfo struct. * Correct handling of commitment masks when scanning * Route read_array through read_raw_vec * Misc lint * Make a proper RctType enum No longer caches RctType in the RctSignatures as well. * Replace Vec<Bulletproofs> with Bulletproofs Monero uses aggregated range proofs, so there's only ever one Bulletproof. This is enforced with a consensus rule as well, making this safe. As for why Monero uses a vec, it's probably due to the lack of variadic typing used. Its effectively an Option for them, yet we don't need an Option since we do have variadic typing (enums). * Add necessary checks to Eventuality re: supported protocols * Fix for block 202612 and fix merkel root calculations * MLSAG (de)serialisation fix ss_2_elements will not always be 2 as rct type 1 transactions are not enforced to have one input * Revert "MLSAG (de)serialisation fix" This reverts commit5e710e0c96. here it checks number of MGs == number of inputs:0a1eaf26f9/src/cryptonote_core/tx_verification_utils.cpp (L60-59)and here it checks for RctTypeFull number of MGs == 1:0a1eaf26f9/src/ringct/rctSigs.cpp (L1325)so number of inputs == 1 so ss_2_elements == 2 * update `MlsagAggregate` comment * cargo update Resolves a yanked crate * Move location of serai-client in Cargo.toml --------- Co-authored-by: Luke Parker <lukeparker5132@gmail.com>
This commit is contained in:
Boog900
GitHub
parent
0f80f6ec7d
commit
89eef95fb3
16 changed files with 702 additions and 117 deletions
|
|
@ -46,6 +46,7 @@ monero-generators = { path = "generators", version = "0.3", default-features = f
|
|||
|
||||
futures = { version = "0.3", default-features = false, features = ["alloc"], optional = true }
|
||||
|
||||
hex-literal = "0.4"
|
||||
hex = { version = "0.4", default-features = false, features = ["alloc"] }
|
||||
serde = { version = "1", default-features = false, features = ["derive"] }
|
||||
serde_json = { version = "1", default-features = false, features = ["alloc"] }
|
||||
|
|
@ -61,8 +62,6 @@ dalek-ff-group = { path = "../../crypto/dalek-ff-group", version = "0.3", defaul
|
|||
monero-generators = { path = "generators", version = "0.3", default-features = false }
|
||||
|
||||
[dev-dependencies]
|
||||
hex-literal = "0.4"
|
||||
|
||||
tokio = { version = "1", features = ["full"] }
|
||||
monero-rpc = "0.3"
|
||||
|
||||
|
|
@ -96,6 +95,9 @@ std = [
|
|||
"serde/std",
|
||||
"serde_json/std",
|
||||
]
|
||||
|
||||
http_rpc = ["digest_auth", "reqwest"]
|
||||
multisig = ["transcript", "frost", "dleq", "std"]
|
||||
experimental = []
|
||||
|
||||
default = ["std", "http_rpc"]
|
||||
|
|
|
|||
|
|
@ -5,8 +5,7 @@
|
|||
|
||||
#![cfg_attr(not(feature = "std"), no_std)]
|
||||
|
||||
use core::cell::OnceCell;
|
||||
use std_shims::sync::Mutex;
|
||||
use std_shims::sync::OnceLock;
|
||||
|
||||
use sha3::{Digest, Keccak256};
|
||||
|
||||
|
|
@ -25,11 +24,11 @@ fn hash(data: &[u8]) -> [u8; 32] {
|
|||
Keccak256::digest(data).into()
|
||||
}
|
||||
|
||||
/// Monero alternate generator `H`, used for amounts in Pedersen commitments.
|
||||
static H_CELL: Mutex<OnceCell<DalekPoint>> = Mutex::new(OnceCell::new());
|
||||
static H_CELL: OnceLock<DalekPoint> = OnceLock::new();
|
||||
/// Monero's alternate generator `H`, used for amounts in Pedersen commitments.
|
||||
#[allow(non_snake_case)]
|
||||
pub fn H() -> DalekPoint {
|
||||
*H_CELL.lock().get_or_init(|| {
|
||||
*H_CELL.get_or_init(|| {
|
||||
CompressedEdwardsY(hash(&EdwardsPoint::generator().to_bytes()))
|
||||
.decompress()
|
||||
.unwrap()
|
||||
|
|
@ -37,6 +36,19 @@ pub fn H() -> DalekPoint {
|
|||
})
|
||||
}
|
||||
|
||||
static H_POW_2_CELL: OnceLock<[DalekPoint; 64]> = OnceLock::new();
|
||||
/// Monero's alternate generator `H`, multiplied by 2**i for i in 1 ..= 64.
|
||||
#[allow(non_snake_case)]
|
||||
pub fn H_pow_2() -> &'static [DalekPoint; 64] {
|
||||
H_POW_2_CELL.get_or_init(|| {
|
||||
let mut res = [H(); 64];
|
||||
for i in 1 .. 64 {
|
||||
res[i] = res[i - 1] + res[i - 1];
|
||||
}
|
||||
res
|
||||
})
|
||||
}
|
||||
|
||||
const MAX_M: usize = 16;
|
||||
const N: usize = 64;
|
||||
const MAX_MN: usize = MAX_M * N;
|
||||
|
|
|
|||
|
|
@ -4,10 +4,17 @@ use std_shims::{
|
|||
};
|
||||
|
||||
use crate::{
|
||||
hash,
|
||||
merkle::merkle_root,
|
||||
serialize::*,
|
||||
transaction::{Input, Transaction},
|
||||
};
|
||||
|
||||
const CORRECT_BLOCK_HASH_202612: [u8; 32] =
|
||||
hex_literal::hex!("426d16cff04c71f8b16340b722dc4010a2dd3831c22041431f772547ba6e331a");
|
||||
const EXISTING_BLOCK_HASH_202612: [u8; 32] =
|
||||
hex_literal::hex!("bbd604d2ba11ba27935e006ed39c9bfdd99b76bf4a50654bc1e1e61217962698");
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct BlockHeader {
|
||||
pub major_version: u64,
|
||||
|
|
@ -68,6 +75,31 @@ impl Block {
|
|||
Ok(())
|
||||
}
|
||||
|
||||
fn tx_merkle_root(&self) -> [u8; 32] {
|
||||
merkle_root(self.miner_tx.hash(), &self.txs)
|
||||
}
|
||||
|
||||
fn serialize_hashable(&self) -> Vec<u8> {
|
||||
let mut blob = self.header.serialize();
|
||||
blob.extend_from_slice(&self.tx_merkle_root());
|
||||
write_varint(&(1 + u64::try_from(self.txs.len()).unwrap()), &mut blob).unwrap();
|
||||
|
||||
let mut out = Vec::with_capacity(8 + blob.len());
|
||||
write_varint(&u64::try_from(blob.len()).unwrap(), &mut out).unwrap();
|
||||
out.append(&mut blob);
|
||||
|
||||
out
|
||||
}
|
||||
|
||||
pub fn hash(&self) -> [u8; 32] {
|
||||
let hash = hash(&self.serialize_hashable());
|
||||
if hash == CORRECT_BLOCK_HASH_202612 {
|
||||
return EXISTING_BLOCK_HASH_202612;
|
||||
};
|
||||
|
||||
hash
|
||||
}
|
||||
|
||||
pub fn serialize(&self) -> Vec<u8> {
|
||||
let mut serialized = vec![];
|
||||
self.write(&mut serialized).unwrap();
|
||||
|
|
|
|||
|
|
@ -18,11 +18,14 @@ use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar, edwar
|
|||
|
||||
pub use monero_generators::H;
|
||||
|
||||
mod merkle;
|
||||
|
||||
mod serialize;
|
||||
use serialize::{read_byte, read_u16};
|
||||
|
||||
/// RingCT structs and functionality.
|
||||
pub mod ringct;
|
||||
use ringct::RctType;
|
||||
|
||||
/// Transaction structs.
|
||||
pub mod transaction;
|
||||
|
|
@ -43,14 +46,16 @@ pub(crate) fn INV_EIGHT() -> Scalar {
|
|||
*INV_EIGHT_CELL.get_or_init(|| Scalar::from(8u8).invert())
|
||||
}
|
||||
|
||||
/// Monero protocol version. v15 is omitted as v15 was simply v14 and v16 being active at the same
|
||||
/// time, with regards to the transactions supported. Accordingly, v16 should be used during v15.
|
||||
/// Monero protocol version.
|
||||
///
|
||||
/// v15 is omitted as v15 was simply v14 and v16 being active at the same time, with regards to the
|
||||
/// transactions supported. Accordingly, v16 should be used during v15.
|
||||
#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
|
||||
#[allow(non_camel_case_types)]
|
||||
pub enum Protocol {
|
||||
v14,
|
||||
v16,
|
||||
Custom { ring_len: usize, bp_plus: bool },
|
||||
Custom { ring_len: usize, bp_plus: bool, optimal_rct_type: RctType },
|
||||
}
|
||||
|
||||
impl Protocol {
|
||||
|
|
@ -64,6 +69,7 @@ impl Protocol {
|
|||
}
|
||||
|
||||
/// Whether or not the specified version uses Bulletproofs or Bulletproofs+.
|
||||
///
|
||||
/// This method will likely be reworked when versions not using Bulletproofs at all are added.
|
||||
pub fn bp_plus(&self) -> bool {
|
||||
match self {
|
||||
|
|
@ -73,15 +79,25 @@ impl Protocol {
|
|||
}
|
||||
}
|
||||
|
||||
// TODO: Make this an Option when we support pre-RCT protocols
|
||||
pub fn optimal_rct_type(&self) -> RctType {
|
||||
match self {
|
||||
Protocol::v14 => RctType::Clsag,
|
||||
Protocol::v16 => RctType::BulletproofsPlus,
|
||||
Protocol::Custom { optimal_rct_type, .. } => *optimal_rct_type,
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn write<W: io::Write>(&self, w: &mut W) -> io::Result<()> {
|
||||
match self {
|
||||
Protocol::v14 => w.write_all(&[0, 14]),
|
||||
Protocol::v16 => w.write_all(&[0, 16]),
|
||||
Protocol::Custom { ring_len, bp_plus } => {
|
||||
Protocol::Custom { ring_len, bp_plus, optimal_rct_type } => {
|
||||
// Custom, version 0
|
||||
w.write_all(&[1, 0])?;
|
||||
w.write_all(&u16::try_from(*ring_len).unwrap().to_le_bytes())?;
|
||||
w.write_all(&[u8::from(*bp_plus)])
|
||||
w.write_all(&[u8::from(*bp_plus)])?;
|
||||
w.write_all(&[optimal_rct_type.to_byte()])
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -103,6 +119,8 @@ impl Protocol {
|
|||
1 => true,
|
||||
_ => Err(io::Error::new(io::ErrorKind::Other, "invalid bool serialization"))?,
|
||||
},
|
||||
optimal_rct_type: RctType::from_byte(read_byte(r)?)
|
||||
.ok_or_else(|| io::Error::new(io::ErrorKind::Other, "invalid RctType serialization"))?,
|
||||
},
|
||||
_ => {
|
||||
Err(io::Error::new(io::ErrorKind::Other, "unrecognized custom protocol serialization"))?
|
||||
|
|
|
|||
55
coins/monero/src/merkle.rs
Normal file
55
coins/monero/src/merkle.rs
Normal file
|
|
@ -0,0 +1,55 @@
|
|||
use std_shims::vec::Vec;
|
||||
|
||||
use crate::hash;
|
||||
|
||||
pub fn merkle_root(root: [u8; 32], leafs: &[[u8; 32]]) -> [u8; 32] {
|
||||
match leafs.len() {
|
||||
0 => root,
|
||||
1 => hash(&[root, leafs[0]].concat()),
|
||||
_ => {
|
||||
let mut hashes = Vec::with_capacity(1 + leafs.len());
|
||||
hashes.push(root);
|
||||
hashes.extend(leafs);
|
||||
|
||||
// Monero preprocess this so the length is a power of 2
|
||||
let mut high_pow_2 = 4; // 4 is the lowest value this can be
|
||||
while high_pow_2 < hashes.len() {
|
||||
high_pow_2 *= 2;
|
||||
}
|
||||
let low_pow_2 = high_pow_2 / 2;
|
||||
|
||||
// Merge right-most hashes until we're at the low_pow_2
|
||||
{
|
||||
let overage = hashes.len() - low_pow_2;
|
||||
let mut rightmost = hashes.drain((low_pow_2 - overage) ..);
|
||||
// This is true since we took overage from beneath and above low_pow_2, taking twice as
|
||||
// many elements as overage
|
||||
debug_assert_eq!(rightmost.len() % 2, 0);
|
||||
|
||||
let mut paired_hashes = Vec::with_capacity(overage);
|
||||
while let Some(left) = rightmost.next() {
|
||||
let right = rightmost.next().unwrap();
|
||||
paired_hashes.push(hash(&[left.as_ref(), &right].concat()));
|
||||
}
|
||||
drop(rightmost);
|
||||
|
||||
hashes.extend(paired_hashes);
|
||||
assert_eq!(hashes.len(), low_pow_2);
|
||||
}
|
||||
|
||||
// Do a traditional pairing off
|
||||
let mut new_hashes = Vec::with_capacity(hashes.len() / 2);
|
||||
while hashes.len() > 1 {
|
||||
let mut i = 0;
|
||||
while i < hashes.len() {
|
||||
new_hashes.push(hash(&[hashes[i], hashes[i + 1]].concat()));
|
||||
i += 2;
|
||||
}
|
||||
|
||||
hashes = new_hashes;
|
||||
new_hashes = Vec::with_capacity(hashes.len() / 2);
|
||||
}
|
||||
hashes[0]
|
||||
}
|
||||
}
|
||||
}
|
||||
108
coins/monero/src/ringct/borromean.rs
Normal file
108
coins/monero/src/ringct/borromean.rs
Normal file
|
|
@ -0,0 +1,108 @@
|
|||
use core::fmt::Debug;
|
||||
use std_shims::io::{self, Read, Write};
|
||||
|
||||
use curve25519_dalek::edwards::EdwardsPoint;
|
||||
#[cfg(feature = "experimental")]
|
||||
use curve25519_dalek::{traits::Identity, scalar::Scalar};
|
||||
|
||||
#[cfg(feature = "experimental")]
|
||||
use monero_generators::H_pow_2;
|
||||
#[cfg(feature = "experimental")]
|
||||
use crate::hash_to_scalar;
|
||||
use crate::serialize::*;
|
||||
|
||||
/// 64 Borromean ring signatures.
|
||||
///
|
||||
/// This type keeps the data as raw bytes as Monero has some transactions with unreduced scalars in
|
||||
/// this field. While we could use `from_bytes_mod_order`, we'd then not be able to encode this
|
||||
/// back into it's original form.
|
||||
///
|
||||
/// Those scalars also have a custom reduction algorithm...
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct BorromeanSignatures {
|
||||
pub s0: [[u8; 32]; 64],
|
||||
pub s1: [[u8; 32]; 64],
|
||||
pub ee: [u8; 32],
|
||||
}
|
||||
|
||||
impl BorromeanSignatures {
|
||||
pub fn read<R: Read>(r: &mut R) -> io::Result<BorromeanSignatures> {
|
||||
Ok(BorromeanSignatures {
|
||||
s0: read_array(read_bytes, r)?,
|
||||
s1: read_array(read_bytes, r)?,
|
||||
ee: read_bytes(r)?,
|
||||
})
|
||||
}
|
||||
|
||||
pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
|
||||
for s0 in self.s0.iter() {
|
||||
w.write_all(s0)?;
|
||||
}
|
||||
for s1 in self.s1.iter() {
|
||||
w.write_all(s1)?;
|
||||
}
|
||||
w.write_all(&self.ee)
|
||||
}
|
||||
|
||||
#[cfg(feature = "experimental")]
|
||||
fn verify(&self, keys_a: &[EdwardsPoint], keys_b: &[EdwardsPoint]) -> bool {
|
||||
let mut transcript = [0; 2048];
|
||||
for i in 0 .. 64 {
|
||||
// TODO: These aren't the correct reduction
|
||||
// TODO: Can either of these be tightened?
|
||||
#[allow(non_snake_case)]
|
||||
let LL = EdwardsPoint::vartime_double_scalar_mul_basepoint(
|
||||
&Scalar::from_bytes_mod_order(self.ee),
|
||||
&keys_a[i],
|
||||
&Scalar::from_bytes_mod_order(self.s0[i]),
|
||||
);
|
||||
#[allow(non_snake_case)]
|
||||
let LV = EdwardsPoint::vartime_double_scalar_mul_basepoint(
|
||||
&hash_to_scalar(LL.compress().as_bytes()),
|
||||
&keys_b[i],
|
||||
&Scalar::from_bytes_mod_order(self.s1[i]),
|
||||
);
|
||||
transcript[i .. ((i + 1) * 32)].copy_from_slice(LV.compress().as_bytes());
|
||||
}
|
||||
|
||||
// TODO: This isn't the correct reduction
|
||||
// TODO: Can this be tightened to from_canonical_bytes?
|
||||
hash_to_scalar(&transcript) == Scalar::from_bytes_mod_order(self.ee)
|
||||
}
|
||||
}
|
||||
|
||||
/// A range proof premised on Borromean ring signatures.
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct BorromeanRange {
|
||||
pub sigs: BorromeanSignatures,
|
||||
pub bit_commitments: [EdwardsPoint; 64],
|
||||
}
|
||||
|
||||
impl BorromeanRange {
|
||||
pub fn read<R: Read>(r: &mut R) -> io::Result<BorromeanRange> {
|
||||
Ok(BorromeanRange {
|
||||
sigs: BorromeanSignatures::read(r)?,
|
||||
bit_commitments: read_array(read_point, r)?,
|
||||
})
|
||||
}
|
||||
pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
|
||||
self.sigs.write(w)?;
|
||||
write_raw_vec(write_point, &self.bit_commitments, w)
|
||||
}
|
||||
|
||||
#[cfg(feature = "experimental")]
|
||||
pub fn verify(&self, commitment: &EdwardsPoint) -> bool {
|
||||
if &self.bit_commitments.iter().sum::<EdwardsPoint>() != commitment {
|
||||
return false;
|
||||
}
|
||||
|
||||
#[allow(non_snake_case)]
|
||||
let H_pow_2 = H_pow_2();
|
||||
let mut commitments_sub_one = [EdwardsPoint::identity(); 64];
|
||||
for i in 0 .. 64 {
|
||||
commitments_sub_one[i] = self.bit_commitments[i] - H_pow_2[i];
|
||||
}
|
||||
|
||||
self.sigs.verify(&self.bit_commitments, &commitments_sub_one)
|
||||
}
|
||||
}
|
||||
71
coins/monero/src/ringct/mlsag.rs
Normal file
71
coins/monero/src/ringct/mlsag.rs
Normal file
|
|
@ -0,0 +1,71 @@
|
|||
use std_shims::{
|
||||
vec::Vec,
|
||||
io::{self, Read, Write},
|
||||
};
|
||||
|
||||
use curve25519_dalek::scalar::Scalar;
|
||||
#[cfg(feature = "experimental")]
|
||||
use curve25519_dalek::edwards::EdwardsPoint;
|
||||
|
||||
use crate::serialize::*;
|
||||
#[cfg(feature = "experimental")]
|
||||
use crate::{hash_to_scalar, ringct::hash_to_point};
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct Mlsag {
|
||||
pub ss: Vec<[Scalar; 2]>,
|
||||
pub cc: Scalar,
|
||||
}
|
||||
|
||||
impl Mlsag {
|
||||
pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
|
||||
for ss in self.ss.iter() {
|
||||
write_raw_vec(write_scalar, ss, w)?;
|
||||
}
|
||||
write_scalar(&self.cc, w)
|
||||
}
|
||||
|
||||
pub fn read<R: Read>(mixins: usize, r: &mut R) -> io::Result<Mlsag> {
|
||||
Ok(Mlsag {
|
||||
ss: (0 .. mixins).map(|_| read_array(read_scalar, r)).collect::<Result<_, _>>()?,
|
||||
cc: read_scalar(r)?,
|
||||
})
|
||||
}
|
||||
|
||||
#[cfg(feature = "experimental")]
|
||||
pub fn verify(
|
||||
&self,
|
||||
msg: &[u8; 32],
|
||||
ring: &[[EdwardsPoint; 2]],
|
||||
key_image: &EdwardsPoint,
|
||||
) -> bool {
|
||||
if ring.is_empty() {
|
||||
return false;
|
||||
}
|
||||
|
||||
let mut buf = Vec::with_capacity(6 * 32);
|
||||
let mut ci = self.cc;
|
||||
for (i, ring_member) in ring.iter().enumerate() {
|
||||
buf.extend_from_slice(msg);
|
||||
|
||||
#[allow(non_snake_case)]
|
||||
let L =
|
||||
|r| EdwardsPoint::vartime_double_scalar_mul_basepoint(&ci, &ring_member[r], &self.ss[i][r]);
|
||||
|
||||
buf.extend_from_slice(ring_member[0].compress().as_bytes());
|
||||
buf.extend_from_slice(L(0).compress().as_bytes());
|
||||
|
||||
#[allow(non_snake_case)]
|
||||
let R = (self.ss[i][0] * hash_to_point(ring_member[0])) + (ci * key_image);
|
||||
buf.extend_from_slice(R.compress().as_bytes());
|
||||
|
||||
buf.extend_from_slice(ring_member[1].compress().as_bytes());
|
||||
buf.extend_from_slice(L(1).compress().as_bytes());
|
||||
|
||||
ci = hash_to_scalar(&buf);
|
||||
buf.clear();
|
||||
}
|
||||
|
||||
ci == self.cc
|
||||
}
|
||||
}
|
||||
|
|
@ -4,22 +4,26 @@ use std_shims::{
|
|||
io::{self, Read, Write},
|
||||
};
|
||||
|
||||
use zeroize::Zeroizing;
|
||||
use zeroize::{Zeroize, Zeroizing};
|
||||
|
||||
use curve25519_dalek::{constants::ED25519_BASEPOINT_TABLE, scalar::Scalar, edwards::EdwardsPoint};
|
||||
|
||||
pub(crate) mod hash_to_point;
|
||||
pub use hash_to_point::{raw_hash_to_point, hash_to_point};
|
||||
|
||||
/// MLSAG struct, along with verifying functionality.
|
||||
pub mod mlsag;
|
||||
/// CLSAG struct, along with signing and verifying functionality.
|
||||
pub mod clsag;
|
||||
/// BorromeanRange struct, along with verifying functionality.
|
||||
pub mod borromean;
|
||||
/// Bulletproofs(+) structs, along with proving and verifying functionality.
|
||||
pub mod bulletproofs;
|
||||
|
||||
use crate::{
|
||||
Protocol,
|
||||
serialize::*,
|
||||
ringct::{clsag::Clsag, bulletproofs::Bulletproofs},
|
||||
ringct::{mlsag::Mlsag, clsag::Clsag, borromean::BorromeanRange, bulletproofs::Bulletproofs},
|
||||
};
|
||||
|
||||
/// Generate a key image for a given key. Defined as `x * hash_to_point(xG)`.
|
||||
|
|
@ -27,10 +31,95 @@ pub fn generate_key_image(secret: &Zeroizing<Scalar>) -> EdwardsPoint {
|
|||
hash_to_point(&ED25519_BASEPOINT_TABLE * secret.deref()) * secret.deref()
|
||||
}
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub enum EncryptedAmount {
|
||||
Original { mask: [u8; 32], amount: [u8; 32] },
|
||||
Compact { amount: [u8; 8] },
|
||||
}
|
||||
|
||||
impl EncryptedAmount {
|
||||
pub fn read<R: Read>(compact: bool, r: &mut R) -> io::Result<EncryptedAmount> {
|
||||
Ok(if !compact {
|
||||
EncryptedAmount::Original { mask: read_bytes(r)?, amount: read_bytes(r)? }
|
||||
} else {
|
||||
EncryptedAmount::Compact { amount: read_bytes(r)? }
|
||||
})
|
||||
}
|
||||
|
||||
pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
|
||||
match self {
|
||||
EncryptedAmount::Original { mask, amount } => {
|
||||
w.write_all(mask)?;
|
||||
w.write_all(amount)
|
||||
}
|
||||
EncryptedAmount::Compact { amount } => w.write_all(amount),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, Copy, PartialEq, Eq, Debug, Zeroize)]
|
||||
pub enum RctType {
|
||||
/// No RCT proofs.
|
||||
Null,
|
||||
/// One MLSAG for a single input and a Borromean range proof (RCTTypeFull).
|
||||
MlsagAggregate,
|
||||
// One MLSAG for each input and a Borromean range proof (RCTTypeSimple).
|
||||
MlsagIndividual,
|
||||
// One MLSAG for each input and a Bulletproof (RCTTypeBulletproof).
|
||||
Bulletproofs,
|
||||
/// One MLSAG for each input and a Bulletproof, yet starting to use EncryptedAmount::Compact
|
||||
/// (RCTTypeBulletproof2).
|
||||
BulletproofsCompactAmount,
|
||||
/// One CLSAG for each input and a Bulletproof (RCTTypeCLSAG).
|
||||
Clsag,
|
||||
/// One CLSAG for each input and a Bulletproof+ (RCTTypeBulletproofPlus).
|
||||
BulletproofsPlus,
|
||||
}
|
||||
|
||||
impl RctType {
|
||||
pub fn to_byte(self) -> u8 {
|
||||
match self {
|
||||
RctType::Null => 0,
|
||||
RctType::MlsagAggregate => 1,
|
||||
RctType::MlsagIndividual => 2,
|
||||
RctType::Bulletproofs => 3,
|
||||
RctType::BulletproofsCompactAmount => 4,
|
||||
RctType::Clsag => 5,
|
||||
RctType::BulletproofsPlus => 6,
|
||||
}
|
||||
}
|
||||
|
||||
pub fn from_byte(byte: u8) -> Option<Self> {
|
||||
Some(match byte {
|
||||
0 => RctType::Null,
|
||||
1 => RctType::MlsagAggregate,
|
||||
2 => RctType::MlsagIndividual,
|
||||
3 => RctType::Bulletproofs,
|
||||
4 => RctType::BulletproofsCompactAmount,
|
||||
5 => RctType::Clsag,
|
||||
6 => RctType::BulletproofsPlus,
|
||||
_ => None?,
|
||||
})
|
||||
}
|
||||
|
||||
pub fn compact_encrypted_amounts(&self) -> bool {
|
||||
match self {
|
||||
RctType::Null => false,
|
||||
RctType::MlsagAggregate => false,
|
||||
RctType::MlsagIndividual => false,
|
||||
RctType::Bulletproofs => false,
|
||||
RctType::BulletproofsCompactAmount => true,
|
||||
RctType::Clsag => true,
|
||||
RctType::BulletproofsPlus => true,
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct RctBase {
|
||||
pub fee: u64,
|
||||
pub ecdh_info: Vec<[u8; 8]>,
|
||||
pub pseudo_outs: Vec<EdwardsPoint>,
|
||||
pub encrypted_amounts: Vec<EncryptedAmount>,
|
||||
pub commitments: Vec<EdwardsPoint>,
|
||||
}
|
||||
|
||||
|
|
@ -39,30 +128,60 @@ impl RctBase {
|
|||
1 + 8 + (outputs * (8 + 32))
|
||||
}
|
||||
|
||||
pub fn write<W: Write>(&self, w: &mut W, rct_type: u8) -> io::Result<()> {
|
||||
w.write_all(&[rct_type])?;
|
||||
pub fn write<W: Write>(&self, w: &mut W, rct_type: RctType) -> io::Result<()> {
|
||||
w.write_all(&[rct_type.to_byte()])?;
|
||||
match rct_type {
|
||||
0 => Ok(()),
|
||||
5 | 6 => {
|
||||
RctType::Null => Ok(()),
|
||||
_ => {
|
||||
write_varint(&self.fee, w)?;
|
||||
for ecdh in &self.ecdh_info {
|
||||
w.write_all(ecdh)?;
|
||||
if rct_type == RctType::MlsagIndividual {
|
||||
write_raw_vec(write_point, &self.pseudo_outs, w)?;
|
||||
}
|
||||
for encrypted_amount in &self.encrypted_amounts {
|
||||
encrypted_amount.write(w)?;
|
||||
}
|
||||
write_raw_vec(write_point, &self.commitments, w)
|
||||
}
|
||||
_ => panic!("Serializing unknown RctType's Base"),
|
||||
}
|
||||
}
|
||||
|
||||
pub fn read<R: Read>(outputs: usize, r: &mut R) -> io::Result<(RctBase, u8)> {
|
||||
let rct_type = read_byte(r)?;
|
||||
pub fn read<R: Read>(inputs: usize, outputs: usize, r: &mut R) -> io::Result<(RctBase, RctType)> {
|
||||
let rct_type = RctType::from_byte(read_byte(r)?)
|
||||
.ok_or_else(|| io::Error::new(io::ErrorKind::Other, "invalid RCT type"))?;
|
||||
|
||||
match rct_type {
|
||||
RctType::Null => {}
|
||||
RctType::MlsagAggregate => {}
|
||||
RctType::MlsagIndividual => {}
|
||||
RctType::Bulletproofs |
|
||||
RctType::BulletproofsCompactAmount |
|
||||
RctType::Clsag |
|
||||
RctType::BulletproofsPlus => {
|
||||
if outputs == 0 {
|
||||
// Because the Bulletproofs(+) layout must be canonical, there must be 1 Bulletproof if
|
||||
// Bulletproofs are in use
|
||||
// If there are Bulletproofs, there must be a matching amount of outputs, implicitly
|
||||
// banning 0 outputs
|
||||
// Since HF 12 (CLSAG being 13), a 2-output minimum has also been enforced
|
||||
Err(io::Error::new(io::ErrorKind::Other, "RCT with Bulletproofs(+) had 0 outputs"))?;
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
Ok((
|
||||
if rct_type == 0 {
|
||||
RctBase { fee: 0, ecdh_info: vec![], commitments: vec![] }
|
||||
if rct_type == RctType::Null {
|
||||
RctBase { fee: 0, pseudo_outs: vec![], encrypted_amounts: vec![], commitments: vec![] }
|
||||
} else {
|
||||
RctBase {
|
||||
fee: read_varint(r)?,
|
||||
ecdh_info: (0 .. outputs).map(|_| read_bytes(r)).collect::<Result<_, _>>()?,
|
||||
pseudo_outs: if rct_type == RctType::MlsagIndividual {
|
||||
read_raw_vec(read_point, inputs, r)?
|
||||
} else {
|
||||
vec![]
|
||||
},
|
||||
encrypted_amounts: (0 .. outputs)
|
||||
.map(|_| EncryptedAmount::read(rct_type.compact_encrypted_amounts(), r))
|
||||
.collect::<Result<_, _>>()?,
|
||||
commitments: read_raw_vec(read_point, outputs, r)?,
|
||||
}
|
||||
},
|
||||
|
|
@ -74,67 +193,114 @@ impl RctBase {
|
|||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub enum RctPrunable {
|
||||
Null,
|
||||
Clsag { bulletproofs: Vec<Bulletproofs>, clsags: Vec<Clsag>, pseudo_outs: Vec<EdwardsPoint> },
|
||||
MlsagBorromean {
|
||||
borromean: Vec<BorromeanRange>,
|
||||
mlsags: Vec<Mlsag>,
|
||||
},
|
||||
MlsagBulletproofs {
|
||||
bulletproofs: Bulletproofs,
|
||||
mlsags: Vec<Mlsag>,
|
||||
pseudo_outs: Vec<EdwardsPoint>,
|
||||
},
|
||||
Clsag {
|
||||
bulletproofs: Bulletproofs,
|
||||
clsags: Vec<Clsag>,
|
||||
pseudo_outs: Vec<EdwardsPoint>,
|
||||
},
|
||||
}
|
||||
|
||||
impl RctPrunable {
|
||||
/// RCT Type byte for a given RctPrunable struct.
|
||||
pub fn rct_type(&self) -> u8 {
|
||||
match self {
|
||||
RctPrunable::Null => 0,
|
||||
RctPrunable::Clsag { bulletproofs, .. } => {
|
||||
if matches!(bulletproofs[0], Bulletproofs::Original { .. }) {
|
||||
5
|
||||
} else {
|
||||
6
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn fee_weight(protocol: Protocol, inputs: usize, outputs: usize) -> usize {
|
||||
1 + Bulletproofs::fee_weight(protocol.bp_plus(), outputs) +
|
||||
(inputs * (Clsag::fee_weight(protocol.ring_len()) + 32))
|
||||
}
|
||||
|
||||
pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
|
||||
pub fn write<W: Write>(&self, w: &mut W, rct_type: RctType) -> io::Result<()> {
|
||||
match self {
|
||||
RctPrunable::Null => Ok(()),
|
||||
RctPrunable::Clsag { bulletproofs, clsags, pseudo_outs, .. } => {
|
||||
write_vec(Bulletproofs::write, bulletproofs, w)?;
|
||||
RctPrunable::MlsagBorromean { borromean, mlsags } => {
|
||||
write_raw_vec(BorromeanRange::write, borromean, w)?;
|
||||
write_raw_vec(Mlsag::write, mlsags, w)
|
||||
}
|
||||
RctPrunable::MlsagBulletproofs { bulletproofs, mlsags, pseudo_outs } => {
|
||||
if rct_type == RctType::Bulletproofs {
|
||||
w.write_all(&1u32.to_le_bytes())?;
|
||||
} else {
|
||||
w.write_all(&[1])?;
|
||||
}
|
||||
bulletproofs.write(w)?;
|
||||
|
||||
write_raw_vec(Mlsag::write, mlsags, w)?;
|
||||
write_raw_vec(write_point, pseudo_outs, w)
|
||||
}
|
||||
RctPrunable::Clsag { bulletproofs, clsags, pseudo_outs } => {
|
||||
w.write_all(&[1])?;
|
||||
bulletproofs.write(w)?;
|
||||
|
||||
write_raw_vec(Clsag::write, clsags, w)?;
|
||||
write_raw_vec(write_point, pseudo_outs, w)
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub fn serialize(&self) -> Vec<u8> {
|
||||
pub fn serialize(&self, rct_type: RctType) -> Vec<u8> {
|
||||
let mut serialized = vec![];
|
||||
self.write(&mut serialized).unwrap();
|
||||
self.write(&mut serialized, rct_type).unwrap();
|
||||
serialized
|
||||
}
|
||||
|
||||
pub fn read<R: Read>(rct_type: u8, decoys: &[usize], r: &mut R) -> io::Result<RctPrunable> {
|
||||
pub fn read<R: Read>(
|
||||
rct_type: RctType,
|
||||
decoys: &[usize],
|
||||
outputs: usize,
|
||||
r: &mut R,
|
||||
) -> io::Result<RctPrunable> {
|
||||
Ok(match rct_type {
|
||||
0 => RctPrunable::Null,
|
||||
5 | 6 => RctPrunable::Clsag {
|
||||
bulletproofs: read_vec(
|
||||
if rct_type == 5 { Bulletproofs::read } else { Bulletproofs::read_plus },
|
||||
RctType::Null => RctPrunable::Null,
|
||||
RctType::MlsagAggregate | RctType::MlsagIndividual => RctPrunable::MlsagBorromean {
|
||||
borromean: read_raw_vec(BorromeanRange::read, outputs, r)?,
|
||||
mlsags: decoys.iter().map(|d| Mlsag::read(*d, r)).collect::<Result<_, _>>()?,
|
||||
},
|
||||
RctType::Bulletproofs | RctType::BulletproofsCompactAmount => {
|
||||
RctPrunable::MlsagBulletproofs {
|
||||
bulletproofs: {
|
||||
if (if rct_type == RctType::Bulletproofs {
|
||||
u64::from(read_u32(r)?)
|
||||
} else {
|
||||
read_varint(r)?
|
||||
}) != 1
|
||||
{
|
||||
Err(io::Error::new(io::ErrorKind::Other, "n bulletproofs instead of one"))?;
|
||||
}
|
||||
Bulletproofs::read(r)?
|
||||
},
|
||||
mlsags: decoys.iter().map(|d| Mlsag::read(*d, r)).collect::<Result<_, _>>()?,
|
||||
pseudo_outs: read_raw_vec(read_point, decoys.len(), r)?,
|
||||
}
|
||||
}
|
||||
RctType::Clsag | RctType::BulletproofsPlus => RctPrunable::Clsag {
|
||||
bulletproofs: {
|
||||
if read_varint(r)? != 1 {
|
||||
Err(io::Error::new(io::ErrorKind::Other, "n bulletproofs instead of one"))?;
|
||||
}
|
||||
(if rct_type == RctType::Clsag { Bulletproofs::read } else { Bulletproofs::read_plus })(
|
||||
r,
|
||||
)?,
|
||||
)?
|
||||
},
|
||||
clsags: (0 .. decoys.len()).map(|o| Clsag::read(decoys[o], r)).collect::<Result<_, _>>()?,
|
||||
pseudo_outs: read_raw_vec(read_point, decoys.len(), r)?,
|
||||
},
|
||||
_ => Err(io::Error::new(io::ErrorKind::Other, "Tried to deserialize unknown RCT type"))?,
|
||||
})
|
||||
}
|
||||
|
||||
pub(crate) fn signature_write<W: Write>(&self, w: &mut W) -> io::Result<()> {
|
||||
match self {
|
||||
RctPrunable::Null => panic!("Serializing RctPrunable::Null for a signature"),
|
||||
RctPrunable::Clsag { bulletproofs, .. } => {
|
||||
bulletproofs.iter().try_for_each(|bp| bp.signature_write(w))
|
||||
RctPrunable::MlsagBorromean { borromean, .. } => {
|
||||
borromean.iter().try_for_each(|rs| rs.write(w))
|
||||
}
|
||||
RctPrunable::MlsagBulletproofs { bulletproofs, .. } => bulletproofs.signature_write(w),
|
||||
RctPrunable::Clsag { bulletproofs, .. } => bulletproofs.signature_write(w),
|
||||
}
|
||||
}
|
||||
}
|
||||
|
|
@ -146,13 +312,68 @@ pub struct RctSignatures {
|
|||
}
|
||||
|
||||
impl RctSignatures {
|
||||
/// RctType for a given RctSignatures struct.
|
||||
pub fn rct_type(&self) -> RctType {
|
||||
match &self.prunable {
|
||||
RctPrunable::Null => RctType::Null,
|
||||
RctPrunable::MlsagBorromean { .. } => {
|
||||
/*
|
||||
This type of RctPrunable may have no outputs, yet pseudo_outs are per input
|
||||
This will only be a valid RctSignatures if it's for a TX with inputs
|
||||
That makes this valid for any valid RctSignatures
|
||||
|
||||
While it will be invalid for any invalid RctSignatures, potentially letting an invalid
|
||||
MlsagAggregate be interpreted as a valid MlsagIndividual (or vice versa), they have
|
||||
incompatible deserializations
|
||||
|
||||
This means it's impossible to receive a MlsagAggregate over the wire and interpret it
|
||||
as a MlsagIndividual (or vice versa)
|
||||
|
||||
That only makes manual manipulation unsafe, which will always be true since these fields
|
||||
are all pub
|
||||
|
||||
TODO: Consider making them private with read-only accessors?
|
||||
*/
|
||||
if self.base.pseudo_outs.is_empty() {
|
||||
RctType::MlsagAggregate
|
||||
} else {
|
||||
RctType::MlsagIndividual
|
||||
}
|
||||
}
|
||||
// RctBase ensures there's at least one output, making the following
|
||||
// inferences guaranteed/expects impossible on any valid RctSignatures
|
||||
RctPrunable::MlsagBulletproofs { .. } => {
|
||||
if matches!(
|
||||
self
|
||||
.base
|
||||
.encrypted_amounts
|
||||
.get(0)
|
||||
.expect("MLSAG with Bulletproofs didn't have any outputs"),
|
||||
EncryptedAmount::Original { .. }
|
||||
) {
|
||||
RctType::Bulletproofs
|
||||
} else {
|
||||
RctType::BulletproofsCompactAmount
|
||||
}
|
||||
}
|
||||
RctPrunable::Clsag { bulletproofs, .. } => {
|
||||
if matches!(bulletproofs, Bulletproofs::Original { .. }) {
|
||||
RctType::Clsag
|
||||
} else {
|
||||
RctType::BulletproofsPlus
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
pub(crate) fn fee_weight(protocol: Protocol, inputs: usize, outputs: usize) -> usize {
|
||||
RctBase::fee_weight(outputs) + RctPrunable::fee_weight(protocol, inputs, outputs)
|
||||
}
|
||||
|
||||
pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
|
||||
self.base.write(w, self.prunable.rct_type())?;
|
||||
self.prunable.write(w)
|
||||
let rct_type = self.rct_type();
|
||||
self.base.write(w, rct_type)?;
|
||||
self.prunable.write(w, rct_type)
|
||||
}
|
||||
|
||||
pub fn serialize(&self) -> Vec<u8> {
|
||||
|
|
@ -162,7 +383,7 @@ impl RctSignatures {
|
|||
}
|
||||
|
||||
pub fn read<R: Read>(decoys: Vec<usize>, outputs: usize, r: &mut R) -> io::Result<RctSignatures> {
|
||||
let base = RctBase::read(outputs, r)?;
|
||||
Ok(RctSignatures { base: base.0, prunable: RctPrunable::read(base.1, &decoys, r)? })
|
||||
let base = RctBase::read(decoys.len(), outputs, r)?;
|
||||
Ok(RctSignatures { base: base.0, prunable: RctPrunable::read(base.1, &decoys, outputs, r)? })
|
||||
}
|
||||
}
|
||||
|
|
|
|||
|
|
@ -278,8 +278,12 @@ impl<R: RpcConnection> Rpc<R> {
|
|||
let res: BlockResponse =
|
||||
self.json_rpc_call("get_block", Some(json!({ "hash": hex::encode(hash) }))).await?;
|
||||
|
||||
// TODO: Verify the TXs included are actually committed to by the header
|
||||
Block::read::<&[u8]>(&mut rpc_hex(&res.blob)?.as_ref()).map_err(|_| RpcError::InvalidNode)
|
||||
let block =
|
||||
Block::read::<&[u8]>(&mut rpc_hex(&res.blob)?.as_ref()).map_err(|_| RpcError::InvalidNode)?;
|
||||
if block.hash() != hash {
|
||||
Err(RpcError::InvalidNode)?;
|
||||
}
|
||||
Ok(block)
|
||||
}
|
||||
|
||||
pub async fn get_block_by_number(&self, number: usize) -> Result<Block, RpcError> {
|
||||
|
|
|
|||
|
|
@ -1,3 +1,4 @@
|
|||
use core::fmt::Debug;
|
||||
use std_shims::{
|
||||
vec::Vec,
|
||||
io::{self, Read, Write},
|
||||
|
|
@ -140,6 +141,13 @@ pub(crate) fn read_raw_vec<R: Read, T, F: Fn(&mut R) -> io::Result<T>>(
|
|||
Ok(res)
|
||||
}
|
||||
|
||||
pub(crate) fn read_array<R: Read, T: Debug, F: Fn(&mut R) -> io::Result<T>, const N: usize>(
|
||||
f: F,
|
||||
r: &mut R,
|
||||
) -> io::Result<[T; N]> {
|
||||
read_raw_vec(f, N, r).map(|vec| vec.try_into().unwrap())
|
||||
}
|
||||
|
||||
pub(crate) fn read_vec<R: Read, T, F: Fn(&mut R) -> io::Result<T>>(
|
||||
f: F,
|
||||
r: &mut R,
|
||||
|
|
|
|||
|
|
@ -231,13 +231,17 @@ impl TransactionPrefix {
|
|||
prefix.extra = read_vec(read_byte, r)?;
|
||||
Ok(prefix)
|
||||
}
|
||||
|
||||
pub fn hash(&self) -> [u8; 32] {
|
||||
hash(&self.serialize())
|
||||
}
|
||||
}
|
||||
|
||||
/// Monero transaction. For version 1, rct_signatures still contains an accurate fee value.
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct Transaction {
|
||||
pub prefix: TransactionPrefix,
|
||||
pub signatures: Vec<(Scalar, Scalar)>,
|
||||
pub signatures: Vec<Vec<(Scalar, Scalar)>>,
|
||||
pub rct_signatures: RctSignatures,
|
||||
}
|
||||
|
||||
|
|
@ -255,10 +259,12 @@ impl Transaction {
|
|||
pub fn write<W: Write>(&self, w: &mut W) -> io::Result<()> {
|
||||
self.prefix.write(w)?;
|
||||
if self.prefix.version == 1 {
|
||||
for sig in &self.signatures {
|
||||
for sigs in &self.signatures {
|
||||
for sig in sigs {
|
||||
write_scalar(&sig.0, w)?;
|
||||
write_scalar(&sig.1, w)?;
|
||||
}
|
||||
}
|
||||
Ok(())
|
||||
} else if self.prefix.version == 2 {
|
||||
self.rct_signatures.write(w)
|
||||
|
|
@ -277,14 +283,25 @@ impl Transaction {
|
|||
let prefix = TransactionPrefix::read(r)?;
|
||||
let mut signatures = vec![];
|
||||
let mut rct_signatures = RctSignatures {
|
||||
base: RctBase { fee: 0, ecdh_info: vec![], commitments: vec![] },
|
||||
base: RctBase { fee: 0, encrypted_amounts: vec![], pseudo_outs: vec![], commitments: vec![] },
|
||||
prunable: RctPrunable::Null,
|
||||
};
|
||||
|
||||
if prefix.version == 1 {
|
||||
for _ in 0 .. prefix.inputs.len() {
|
||||
signatures.push((read_scalar(r)?, read_scalar(r)?));
|
||||
}
|
||||
signatures = prefix
|
||||
.inputs
|
||||
.iter()
|
||||
.filter_map(|input| match input {
|
||||
Input::ToKey { key_offsets, .. } => Some(
|
||||
key_offsets
|
||||
.iter()
|
||||
.map(|_| Ok((read_scalar(r)?, read_scalar(r)?)))
|
||||
.collect::<Result<_, io::Error>>(),
|
||||
),
|
||||
_ => None,
|
||||
})
|
||||
.collect::<Result<_, _>>()?;
|
||||
|
||||
rct_signatures.base.fee = prefix
|
||||
.inputs
|
||||
.iter()
|
||||
|
|
@ -322,18 +339,16 @@ impl Transaction {
|
|||
} else {
|
||||
let mut hashes = Vec::with_capacity(96);
|
||||
|
||||
self.prefix.write(&mut buf).unwrap();
|
||||
hashes.extend(hash(&buf));
|
||||
buf.clear();
|
||||
hashes.extend(self.prefix.hash());
|
||||
|
||||
self.rct_signatures.base.write(&mut buf, self.rct_signatures.prunable.rct_type()).unwrap();
|
||||
self.rct_signatures.base.write(&mut buf, self.rct_signatures.rct_type()).unwrap();
|
||||
hashes.extend(hash(&buf));
|
||||
buf.clear();
|
||||
|
||||
match self.rct_signatures.prunable {
|
||||
RctPrunable::Null => buf.resize(32, 0),
|
||||
_ => {
|
||||
self.rct_signatures.prunable.write(&mut buf).unwrap();
|
||||
self.rct_signatures.prunable.write(&mut buf, self.rct_signatures.rct_type()).unwrap();
|
||||
buf = hash(&buf).to_vec();
|
||||
}
|
||||
}
|
||||
|
|
@ -348,11 +363,9 @@ impl Transaction {
|
|||
let mut buf = Vec::with_capacity(2048);
|
||||
let mut sig_hash = Vec::with_capacity(96);
|
||||
|
||||
self.prefix.write(&mut buf).unwrap();
|
||||
sig_hash.extend(hash(&buf));
|
||||
buf.clear();
|
||||
sig_hash.extend(self.prefix.hash());
|
||||
|
||||
self.rct_signatures.base.write(&mut buf, self.rct_signatures.prunable.rct_type()).unwrap();
|
||||
self.rct_signatures.base.write(&mut buf, self.rct_signatures.rct_type()).unwrap();
|
||||
sig_hash.extend(hash(&buf));
|
||||
buf.clear();
|
||||
|
||||
|
|
|
|||
|
|
@ -9,7 +9,9 @@ use curve25519_dalek::{
|
|||
edwards::{EdwardsPoint, CompressedEdwardsY},
|
||||
};
|
||||
|
||||
use crate::{hash, hash_to_scalar, serialize::write_varint, transaction::Input};
|
||||
use crate::{
|
||||
hash, hash_to_scalar, serialize::write_varint, ringct::EncryptedAmount, transaction::Input,
|
||||
};
|
||||
|
||||
pub mod extra;
|
||||
pub(crate) use extra::{PaymentId, ExtraField, Extra};
|
||||
|
|
@ -86,20 +88,49 @@ pub(crate) fn shared_key(
|
|||
(view_tag, hash_to_scalar(&shared_key), payment_id_xor)
|
||||
}
|
||||
|
||||
pub(crate) fn commitment_mask(shared_key: Scalar) -> Scalar {
|
||||
let mut mask = b"commitment_mask".to_vec();
|
||||
mask.extend(shared_key.to_bytes());
|
||||
hash_to_scalar(&mask)
|
||||
}
|
||||
|
||||
pub(crate) fn amount_encryption(amount: u64, key: Scalar) -> [u8; 8] {
|
||||
let mut amount_mask = b"amount".to_vec();
|
||||
amount_mask.extend(key.to_bytes());
|
||||
(amount ^ u64::from_le_bytes(hash(&amount_mask)[.. 8].try_into().unwrap())).to_le_bytes()
|
||||
}
|
||||
|
||||
fn amount_decryption(amount: [u8; 8], key: Scalar) -> u64 {
|
||||
u64::from_le_bytes(amount_encryption(u64::from_le_bytes(amount), key))
|
||||
// TODO: Move this under EncryptedAmount?
|
||||
fn amount_decryption(amount: &EncryptedAmount, key: Scalar) -> (Scalar, u64) {
|
||||
match amount {
|
||||
EncryptedAmount::Original { mask, amount } => {
|
||||
#[cfg(feature = "experimental")]
|
||||
{
|
||||
let mask_shared_sec = hash(key.as_bytes());
|
||||
let mask =
|
||||
Scalar::from_bytes_mod_order(*mask) - Scalar::from_bytes_mod_order(mask_shared_sec);
|
||||
|
||||
let amount_shared_sec = hash(&mask_shared_sec);
|
||||
let amount_scalar =
|
||||
Scalar::from_bytes_mod_order(*amount) - Scalar::from_bytes_mod_order(amount_shared_sec);
|
||||
// d2b from rctTypes.cpp
|
||||
let amount = u64::from_le_bytes(amount_scalar.to_bytes()[0 .. 8].try_into().unwrap());
|
||||
|
||||
(mask, amount)
|
||||
}
|
||||
|
||||
pub(crate) fn commitment_mask(shared_key: Scalar) -> Scalar {
|
||||
let mut mask = b"commitment_mask".to_vec();
|
||||
mask.extend(shared_key.to_bytes());
|
||||
hash_to_scalar(&mask)
|
||||
#[cfg(not(feature = "experimental"))]
|
||||
{
|
||||
let _ = mask;
|
||||
let _ = amount;
|
||||
todo!("decrypting a legacy monero transaction's amount")
|
||||
}
|
||||
}
|
||||
EncryptedAmount::Compact { amount } => (
|
||||
commitment_mask(key),
|
||||
u64::from_le_bytes(amount_encryption(u64::from_le_bytes(*amount), key)),
|
||||
),
|
||||
}
|
||||
}
|
||||
|
||||
/// The private view key and public spend key, enabling scanning transactions.
|
||||
|
|
|
|||
|
|
@ -16,7 +16,6 @@ use crate::{
|
|||
rpc::{RpcError, RpcConnection, Rpc},
|
||||
wallet::{
|
||||
PaymentId, Extra, address::SubaddressIndex, Scanner, uniqueness, shared_key, amount_decryption,
|
||||
commitment_mask,
|
||||
},
|
||||
};
|
||||
|
||||
|
|
@ -379,15 +378,15 @@ impl Scanner {
|
|||
commitment.amount = amount;
|
||||
// Regular transaction
|
||||
} else {
|
||||
let amount = match tx.rct_signatures.base.ecdh_info.get(o) {
|
||||
Some(amount) => amount_decryption(*amount, shared_key),
|
||||
let (mask, amount) = match tx.rct_signatures.base.encrypted_amounts.get(o) {
|
||||
Some(amount) => amount_decryption(amount, shared_key),
|
||||
// This should never happen, yet it may be possible with miner transactions?
|
||||
// Using get just decreases the possibility of a panic and lets us move on in that case
|
||||
None => break,
|
||||
};
|
||||
|
||||
// Rebuild the commitment to verify it
|
||||
commitment = Commitment::new(commitment_mask(shared_key), amount);
|
||||
commitment = Commitment::new(mask, amount);
|
||||
// If this is a malicious commitment, move to the next output
|
||||
// Any other R value will calculate to a different spend key and are therefore ignorable
|
||||
if Some(&commitment.calculate()) != tx.rct_signatures.base.commitments.get(o) {
|
||||
|
|
|
|||
|
|
@ -53,6 +53,7 @@ pub use builder::SignableTransactionBuilder;
|
|||
mod multisig;
|
||||
#[cfg(feature = "multisig")]
|
||||
pub use multisig::TransactionMachine;
|
||||
use crate::ringct::EncryptedAmount;
|
||||
|
||||
#[allow(non_snake_case)]
|
||||
#[derive(Clone, PartialEq, Eq, Debug, Zeroize, ZeroizeOnDrop)]
|
||||
|
|
@ -629,7 +630,7 @@ impl SignableTransaction {
|
|||
|
||||
let mut fee = self.inputs.iter().map(|input| input.commitment().amount).sum::<u64>();
|
||||
let mut tx_outputs = Vec::with_capacity(outputs.len());
|
||||
let mut ecdh_info = Vec::with_capacity(outputs.len());
|
||||
let mut encrypted_amounts = Vec::with_capacity(outputs.len());
|
||||
for output in &outputs {
|
||||
fee -= output.commitment.amount;
|
||||
tx_outputs.push(Output {
|
||||
|
|
@ -637,7 +638,7 @@ impl SignableTransaction {
|
|||
key: output.dest.compress(),
|
||||
view_tag: Some(output.view_tag).filter(|_| matches!(self.protocol, Protocol::v16)),
|
||||
});
|
||||
ecdh_info.push(output.amount);
|
||||
encrypted_amounts.push(EncryptedAmount::Compact { amount: output.amount });
|
||||
}
|
||||
|
||||
(
|
||||
|
|
@ -653,14 +654,11 @@ impl SignableTransaction {
|
|||
rct_signatures: RctSignatures {
|
||||
base: RctBase {
|
||||
fee,
|
||||
ecdh_info,
|
||||
encrypted_amounts,
|
||||
pseudo_outs: vec![],
|
||||
commitments: commitments.iter().map(|commitment| commitment.calculate()).collect(),
|
||||
},
|
||||
prunable: RctPrunable::Clsag {
|
||||
bulletproofs: vec![bp],
|
||||
clsags: vec![],
|
||||
pseudo_outs: vec![],
|
||||
},
|
||||
prunable: RctPrunable::Clsag { bulletproofs: bp, clsags: vec![], pseudo_outs: vec![] },
|
||||
},
|
||||
},
|
||||
sum,
|
||||
|
|
@ -706,6 +704,7 @@ impl SignableTransaction {
|
|||
clsags.append(&mut clsag_pairs.iter().map(|clsag| clsag.0.clone()).collect::<Vec<_>>());
|
||||
pseudo_outs.append(&mut clsag_pairs.iter().map(|clsag| clsag.1).collect::<Vec<_>>());
|
||||
}
|
||||
_ => unreachable!("attempted to sign a TX which wasn't CLSAG"),
|
||||
}
|
||||
Ok(tx)
|
||||
}
|
||||
|
|
@ -747,6 +746,16 @@ impl Eventuality {
|
|||
uniqueness(&tx.prefix.inputs),
|
||||
);
|
||||
|
||||
let rct_type = tx.rct_signatures.rct_type();
|
||||
if rct_type != self.protocol.optimal_rct_type() {
|
||||
return false;
|
||||
}
|
||||
|
||||
// TODO: Remove this when the following for loop is updated
|
||||
if !rct_type.compact_encrypted_amounts() {
|
||||
panic!("created an Eventuality for a very old RctType we don't support proving for");
|
||||
}
|
||||
|
||||
for (o, (expected, actual)) in outputs.iter().zip(tx.prefix.outputs.iter()).enumerate() {
|
||||
// Verify the output, commitment, and encrypted amount.
|
||||
if (&Output {
|
||||
|
|
@ -755,7 +764,8 @@ impl Eventuality {
|
|||
view_tag: Some(expected.view_tag).filter(|_| matches!(self.protocol, Protocol::v16)),
|
||||
} != actual) ||
|
||||
(Some(&expected.commitment.calculate()) != tx.rct_signatures.base.commitments.get(o)) ||
|
||||
(Some(&expected.amount) != tx.rct_signatures.base.ecdh_info.get(o))
|
||||
(Some(&EncryptedAmount::Compact { amount: expected.amount }) !=
|
||||
tx.rct_signatures.base.encrypted_amounts.get(o))
|
||||
{
|
||||
return false;
|
||||
}
|
||||
|
|
|
|||
|
|
@ -430,6 +430,7 @@ impl SignatureMachine<Transaction> for TransactionSignatureMachine {
|
|||
pseudo_outs.push(pseudo_out);
|
||||
}
|
||||
}
|
||||
_ => unreachable!("attempted to sign a multisig TX which wasn't CLSAG"),
|
||||
}
|
||||
Ok(tx)
|
||||
}
|
||||
|
|
|
|||
|
|
@ -13,7 +13,7 @@ use frost::{curve::Ed25519, ThresholdKeys};
|
|||
use monero_serai::{
|
||||
Protocol,
|
||||
transaction::Transaction,
|
||||
block::Block as MBlock,
|
||||
block::Block,
|
||||
rpc::{RpcError, HttpRpc, Rpc},
|
||||
wallet::{
|
||||
ViewPair, Scanner,
|
||||
|
|
@ -134,20 +134,18 @@ pub struct SignableTransaction {
|
|||
actual: MSignableTransaction,
|
||||
}
|
||||
|
||||
#[derive(Clone, PartialEq, Eq, Debug)]
|
||||
pub struct Block([u8; 32], MBlock);
|
||||
impl BlockTrait<Monero> for Block {
|
||||
type Id = [u8; 32];
|
||||
fn id(&self) -> Self::Id {
|
||||
self.0
|
||||
self.hash()
|
||||
}
|
||||
|
||||
fn parent(&self) -> Self::Id {
|
||||
self.1.header.previous
|
||||
self.header.previous
|
||||
}
|
||||
|
||||
fn time(&self) -> u64 {
|
||||
self.1.header.timestamp
|
||||
self.header.timestamp
|
||||
}
|
||||
|
||||
fn median_fee(&self) -> Fee {
|
||||
|
|
@ -256,18 +254,22 @@ impl Coin for Monero {
|
|||
}
|
||||
|
||||
async fn get_block(&self, number: usize) -> Result<Self::Block, CoinError> {
|
||||
let hash = self.rpc.get_block_hash(number).await.map_err(|_| CoinError::ConnectionError)?;
|
||||
let block = self.rpc.get_block(hash).await.map_err(|_| CoinError::ConnectionError)?;
|
||||
Ok(Block(hash, block))
|
||||
Ok(
|
||||
self
|
||||
.rpc
|
||||
.get_block(self.rpc.get_block_hash(number).await.map_err(|_| CoinError::ConnectionError)?)
|
||||
.await
|
||||
.map_err(|_| CoinError::ConnectionError)?,
|
||||
)
|
||||
}
|
||||
|
||||
async fn get_outputs(
|
||||
&self,
|
||||
block: &Self::Block,
|
||||
block: &Block,
|
||||
key: EdwardsPoint,
|
||||
) -> Result<Vec<Self::Output>, CoinError> {
|
||||
let mut txs = Self::scanner(key)
|
||||
.scan(&self.rpc, &block.1)
|
||||
.scan(&self.rpc, block)
|
||||
.await
|
||||
.map_err(|_| CoinError::ConnectionError)?
|
||||
.iter()
|
||||
|
|
@ -305,10 +307,8 @@ impl Coin for Monero {
|
|||
async fn get_eventuality_completions(
|
||||
&self,
|
||||
eventualities: &mut EventualitiesTracker<Eventuality>,
|
||||
block: &Self::Block,
|
||||
block: &Block,
|
||||
) -> HashMap<[u8; 32], [u8; 32]> {
|
||||
let block = &block.1;
|
||||
|
||||
let mut res = HashMap::new();
|
||||
if eventualities.map.is_empty() {
|
||||
return res;
|
||||
|
|
@ -317,7 +317,7 @@ impl Coin for Monero {
|
|||
async fn check_block(
|
||||
coin: &Monero,
|
||||
eventualities: &mut EventualitiesTracker<Eventuality>,
|
||||
block: &MBlock,
|
||||
block: &Block,
|
||||
res: &mut HashMap<[u8; 32], [u8; 32]>,
|
||||
) {
|
||||
for hash in &block.txs {
|
||||
|
|
@ -357,7 +357,7 @@ impl Coin for Monero {
|
|||
block.unwrap()
|
||||
};
|
||||
|
||||
check_block(self, eventualities, &block.1, &mut res).await;
|
||||
check_block(self, eventualities, &block, &mut res).await;
|
||||
}
|
||||
|
||||
// Also check the current block
|
||||
|
|
|
|||
Loading…
Reference in a new issue