LCOV - code coverage report
Current view: top level - src/test/fuzz - package_eval.cpp (source / functions) Coverage Total Hit
Test: fuzz_coverage.info Lines: 100.0 % 281 281
Test Date: 2025-08-01 04:15:35 Functions: 100.0 % 23 23
Branches: 68.1 % 414 282

             Branch data     Line data    Source code
       1                 :             : // Copyright (c) 2023 The Bitcoin Core developers
       2                 :             : // Distributed under the MIT software license, see the accompanying
       3                 :             : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
       4                 :             : 
       5                 :             : #include <consensus/validation.h>
       6                 :             : #include <node/context.h>
       7                 :             : #include <node/mempool_args.h>
       8                 :             : #include <node/miner.h>
       9                 :             : #include <policy/truc_policy.h>
      10                 :             : #include <test/fuzz/FuzzedDataProvider.h>
      11                 :             : #include <test/fuzz/fuzz.h>
      12                 :             : #include <test/fuzz/util.h>
      13                 :             : #include <test/fuzz/util/mempool.h>
      14                 :             : #include <test/util/mining.h>
      15                 :             : #include <test/util/script.h>
      16                 :             : #include <test/util/setup_common.h>
      17                 :             : #include <test/util/txmempool.h>
      18                 :             : #include <util/check.h>
      19                 :             : #include <util/rbf.h>
      20                 :             : #include <util/translation.h>
      21                 :             : #include <validation.h>
      22                 :             : #include <validationinterface.h>
      23                 :             : 
      24                 :             : using node::BlockAssembler;
      25                 :             : using node::NodeContext;
      26                 :             : 
      27                 :             : namespace {
      28                 :             : 
      29                 :             : const TestingSetup* g_setup;
      30                 :             : std::vector<COutPoint> g_outpoints_coinbase_init_mature;
      31                 :             : 
      32                 :             : struct MockedTxPool : public CTxMemPool {
      33                 :       67860 :     void RollingFeeUpdate() EXCLUSIVE_LOCKS_REQUIRED(!cs)
      34                 :             :     {
      35                 :       67860 :         LOCK(cs);
      36         [ +  - ]:       67860 :         lastRollingFeeUpdate = GetTime();
      37         [ +  - ]:       67860 :         blockSinceLastRollingFeeBump = true;
      38                 :       67860 :     }
      39                 :             : };
      40                 :             : 
      41                 :           2 : void initialize_tx_pool()
      42                 :             : {
      43   [ +  -  +  - ]:           4 :     static const auto testing_setup = MakeNoLogFileContext<const TestingSetup>();
      44                 :           2 :     g_setup = testing_setup.get();
      45   [ +  -  +  - ]:           6 :     SetMockTime(WITH_LOCK(g_setup->m_node.chainman->GetMutex(), return g_setup->m_node.chainman->ActiveTip()->Time()));
      46                 :             : 
      47                 :           2 :     BlockAssembler::Options options;
      48                 :           2 :     options.coinbase_output_script = P2WSH_EMPTY;
      49                 :             : 
      50         [ +  + ]:         402 :     for (int i = 0; i < 2 * COINBASE_MATURITY; ++i) {
      51         [ +  - ]:         400 :         COutPoint prevout{MineBlock(g_setup->m_node, options)};
      52         [ +  + ]:         400 :         if (i < COINBASE_MATURITY) {
      53                 :             :             // Remember the txids to avoid expensive disk access later on
      54         [ +  - ]:         200 :             g_outpoints_coinbase_init_mature.push_back(prevout);
      55                 :             :         }
      56                 :             :     }
      57         [ +  - ]:           2 :     g_setup->m_node.validation_signals->SyncWithValidationInterfaceQueue();
      58         [ +  - ]:           4 : }
      59                 :             : 
      60                 :             : struct OutpointsUpdater final : public CValidationInterface {
      61                 :             :     std::set<COutPoint>& m_mempool_outpoints;
      62                 :             : 
      63                 :        4148 :     explicit OutpointsUpdater(std::set<COutPoint>& r)
      64                 :        4148 :         : m_mempool_outpoints{r} {}
      65                 :             : 
      66                 :       98059 :     void TransactionAddedToMempool(const NewMempoolTransactionInfo& tx, uint64_t /* mempool_sequence */) override
      67                 :             :     {
      68                 :             :         // for coins spent we always want to be able to rbf so they're not removed
      69                 :             : 
      70                 :             :         // outputs from this tx can now be spent
      71         [ +  + ]:      411782 :         for (uint32_t index{0}; index < tx.info.m_tx->vout.size(); ++index) {
      72                 :      313723 :             m_mempool_outpoints.insert(COutPoint{tx.info.m_tx->GetHash(), index});
      73                 :             :         }
      74                 :       98059 :     }
      75                 :             : 
      76                 :       37103 :     void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override
      77                 :             :     {
      78                 :             :         // outpoints spent by this tx are now available
      79         [ +  + ]:       97565 :         for (const auto& input : tx->vin) {
      80                 :             :             // Could already exist if this was a replacement
      81                 :       60462 :             m_mempool_outpoints.insert(input.prevout);
      82                 :             :         }
      83                 :             :         // outpoints created by this tx no longer exist
      84         [ +  + ]:      150193 :         for (uint32_t index{0}; index < tx->vout.size(); ++index) {
      85                 :      113090 :             m_mempool_outpoints.erase(COutPoint{tx->GetHash(), index});
      86                 :             :         }
      87                 :       37103 :     }
      88                 :             : };
      89                 :             : 
      90                 :             : struct TransactionsDelta final : public CValidationInterface {
      91                 :             :     std::set<CTransactionRef>& m_added;
      92                 :             : 
      93                 :      267905 :     explicit TransactionsDelta(std::set<CTransactionRef>& a)
      94                 :      267905 :         : m_added{a} {}
      95                 :             : 
      96                 :       29659 :     void TransactionAddedToMempool(const NewMempoolTransactionInfo& tx, uint64_t /* mempool_sequence */) override
      97                 :             :     {
      98                 :             :         // Transactions may be entered and booted any number of times
      99                 :       29659 :         m_added.insert(tx.info.m_tx);
     100                 :       29659 :     }
     101                 :             : 
     102                 :       22786 :     void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override
     103                 :             :     {
     104                 :             :         // Transactions may be entered and booted any number of times
     105                 :       22786 :          m_added.erase(tx);
     106                 :       22786 :     }
     107                 :             : };
     108                 :             : 
     109                 :       96575 : void MockTime(FuzzedDataProvider& fuzzed_data_provider, const Chainstate& chainstate)
     110                 :             : {
     111                 :       96575 :     const auto time = ConsumeTime(fuzzed_data_provider,
     112         [ +  - ]:      193150 :                                   chainstate.m_chain.Tip()->GetMedianTimePast() + 1,
     113         [ +  - ]:       96575 :                                   std::numeric_limits<decltype(chainstate.m_chain.Tip()->nTime)>::max());
     114                 :       96575 :     SetMockTime(time);
     115                 :       96575 : }
     116                 :             : 
     117                 :        2246 : std::unique_ptr<CTxMemPool> MakeMempool(FuzzedDataProvider& fuzzed_data_provider, const NodeContext& node)
     118                 :             : {
     119                 :             :     // Take the default options for tests...
     120                 :        2246 :     CTxMemPool::Options mempool_opts{MemPoolOptionsForTest(node)};
     121                 :             : 
     122                 :             : 
     123                 :             :     // ...override specific options for this specific fuzz suite
     124                 :        2246 :     mempool_opts.limits.ancestor_count = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 50);
     125                 :        2246 :     mempool_opts.limits.ancestor_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 202) * 1'000;
     126                 :        2246 :     mempool_opts.limits.descendant_count = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 50);
     127                 :        2246 :     mempool_opts.limits.descendant_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 202) * 1'000;
     128                 :        2246 :     mempool_opts.max_size_bytes = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 200) * 1'000'000;
     129                 :        2246 :     mempool_opts.expiry = std::chrono::hours{fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 999)};
     130                 :             :     // Only interested in 2 cases: sigop cost 0 or when single legacy sigop cost is >> 1KvB
     131                 :        2246 :     nBytesPerSigOp = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 1) * 10'000;
     132                 :             : 
     133                 :        2246 :     mempool_opts.check_ratio = 1;
     134                 :        2246 :     mempool_opts.require_standard = fuzzed_data_provider.ConsumeBool();
     135                 :             : 
     136         [ +  - ]:        2246 :     bilingual_str error;
     137                 :             :     // ...and construct a CTxMemPool from it
     138         [ +  - ]:        2246 :     auto mempool{std::make_unique<CTxMemPool>(std::move(mempool_opts), error)};
     139                 :             :     // ... ignore the error since it might be beneficial to fuzz even when the
     140                 :             :     // mempool size is unreasonably small
     141   [ +  +  +  -  :        2548 :     Assert(error.empty() || error.original.starts_with("-maxmempool must be at least "));
                   +  - ]
     142                 :        2246 :     return mempool;
     143                 :        2246 : }
     144                 :             : 
     145                 :        1902 : std::unique_ptr<CTxMemPool> MakeEphemeralMempool(const NodeContext& node)
     146                 :             : {
     147                 :             :     // Take the default options for tests...
     148                 :        1902 :     CTxMemPool::Options mempool_opts{MemPoolOptionsForTest(node)};
     149                 :             : 
     150                 :        1902 :     mempool_opts.check_ratio = 1;
     151                 :             : 
     152                 :             :     // Require standardness rules otherwise ephemeral dust is no-op
     153                 :        1902 :     mempool_opts.require_standard = true;
     154                 :             : 
     155                 :             :     // And set minrelay to 0 to allow ephemeral parent tx even with non-TRUC
     156         [ +  - ]:        1902 :     mempool_opts.min_relay_feerate = CFeeRate(0);
     157                 :             : 
     158         [ +  - ]:        1902 :     bilingual_str error;
     159                 :             :     // ...and construct a CTxMemPool from it
     160         [ +  - ]:        1902 :     auto mempool{std::make_unique<CTxMemPool>(std::move(mempool_opts), error)};
     161         [ +  - ]:        1902 :     Assert(error.empty());
     162                 :        1902 :     return mempool;
     163                 :        1902 : }
     164                 :             : 
     165                 :             : // Scan mempool for a tx that has spent dust and return a
     166                 :             : // prevout of the child that isn't the dusty parent itself.
     167                 :             : // This is used to double-spend the child out of the mempool,
     168                 :             : // leaving the parent childless.
     169                 :             : // This assumes CheckMempoolEphemeralInvariants has passed for tx_pool.
     170                 :      154338 : std::optional<COutPoint> GetChildEvictingPrevout(const CTxMemPool& tx_pool)
     171                 :             : {
     172                 :      154338 :     LOCK(tx_pool.cs);
     173   [ +  -  +  + ]:     3903815 :     for (const auto& tx_info : tx_pool.infoAll()) {
     174   [ +  -  +  - ]:     3761420 :         const auto& entry = *Assert(tx_pool.GetEntry(tx_info.tx->GetHash()));
     175         [ +  - ]:     3761420 :         std::vector<uint32_t> dust_indexes{GetDust(*tx_info.tx, tx_pool.m_opts.dust_relay_feerate)};
     176         [ +  + ]:     3761420 :         if (!dust_indexes.empty()) {
     177         [ +  + ]:       31268 :             const auto& children = entry.GetMemPoolChildrenConst();
     178         [ +  + ]:       31268 :             if (!children.empty()) {
     179         [ +  - ]:       18788 :                 Assert(children.size() == 1);
     180                 :             :                 // Find an input that doesn't spend from parent's txid
     181                 :       18788 :                 const auto& only_child = children.begin()->get().GetTx();
     182         [ +  + ]:       47036 :                 for (const auto& tx_input : only_child.vin) {
     183         [ +  + ]:       40191 :                     if (tx_input.prevout.hash != tx_info.tx->GetHash()) {
     184                 :       11943 :                         return tx_input.prevout;
     185                 :             :                     }
     186                 :             :                 }
     187                 :             :             }
     188                 :             :         }
     189                 :     3903815 :     }
     190                 :             : 
     191                 :      142395 :     return std::nullopt;
     192                 :      154338 : }
     193                 :             : 
     194         [ +  - ]:        2356 : FUZZ_TARGET(ephemeral_package_eval, .init = initialize_tx_pool)
     195                 :             : {
     196                 :        1902 :     SeedRandomStateForTest(SeedRand::ZEROS);
     197                 :        1902 :     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
     198                 :        1902 :     const auto& node = g_setup->m_node;
     199                 :        1902 :     auto& chainstate{static_cast<DummyChainState&>(node.chainman->ActiveChainstate())};
     200                 :             : 
     201                 :        1902 :     MockTime(fuzzed_data_provider, chainstate);
     202                 :             : 
     203                 :             :     // All RBF-spendable outpoints outside of the unsubmitted package
     204         [ +  - ]:        1902 :     std::set<COutPoint> mempool_outpoints;
     205         [ +  - ]:        1902 :     std::unordered_map<COutPoint, CAmount, SaltedOutpointHasher> outpoints_value;
     206         [ +  + ]:      192102 :     for (const auto& outpoint : g_outpoints_coinbase_init_mature) {
     207   [ +  -  +  - ]:      190200 :         Assert(mempool_outpoints.insert(outpoint).second);
     208         [ +  - ]:      190200 :         outpoints_value[outpoint] = 50 * COIN;
     209                 :             :     }
     210                 :             : 
     211         [ +  - ]:        1902 :     auto outpoints_updater = std::make_shared<OutpointsUpdater>(mempool_outpoints);
     212   [ +  -  +  - ]:        3804 :     node.validation_signals->RegisterSharedValidationInterface(outpoints_updater);
     213                 :             : 
     214         [ +  - ]:        1902 :     auto tx_pool_{MakeEphemeralMempool(node)};
     215                 :        1902 :     MockedTxPool& tx_pool = *static_cast<MockedTxPool*>(tx_pool_.get());
     216                 :             : 
     217                 :        1902 :     chainstate.SetMempool(&tx_pool);
     218                 :             : 
     219   [ +  +  +  + ]:      277517 :     LIMITED_WHILE(fuzzed_data_provider.remaining_bytes() > 0, 300)
     220                 :             :     {
     221         [ +  - ]:      275615 :         Assert(!mempool_outpoints.empty());
     222                 :             : 
     223                 :      275615 :         std::vector<CTransactionRef> txs;
     224                 :             : 
     225                 :             :         // Find something we may want to double-spend with two input single tx
     226   [ +  +  +  - ]:      275615 :         std::optional<COutPoint> outpoint_to_rbf{fuzzed_data_provider.ConsumeBool() ? GetChildEvictingPrevout(tx_pool) : std::nullopt};
     227                 :             : 
     228                 :             :         // Make small packages
     229         [ +  + ]:      275615 :         const auto num_txs = outpoint_to_rbf ? 1 : fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 4);
     230                 :             : 
     231                 :      275615 :         std::set<COutPoint> package_outpoints;
     232         [ +  + ]:      870042 :         while (txs.size() < num_txs) {
     233                 :             :             // Create transaction to add to the mempool
     234         [ +  - ]:     1188854 :             txs.emplace_back([&] {
     235                 :      594427 :                 CMutableTransaction tx_mut;
     236                 :      594427 :                 tx_mut.version = CTransaction::CURRENT_VERSION;
     237                 :      594427 :                 tx_mut.nLockTime = 0;
     238                 :             :                 // Last transaction in a package needs to be a child of parents to get further in validation
     239                 :             :                 // so the last transaction to be generated(in a >1 package) must spend all package-made outputs
     240                 :             :                 // Note that this test currently only spends package outputs in last transaction.
     241   [ +  +  +  + ]:      594427 :                 bool last_tx = num_txs > 1 && txs.size() == num_txs - 1;
     242         [ +  + ]:      594427 :                 const auto num_in = outpoint_to_rbf ? 2 :
     243         [ +  + ]:      582484 :                     last_tx ? fuzzed_data_provider.ConsumeIntegralInRange<int>(package_outpoints.size()/2 + 1, package_outpoints.size()) :
     244                 :      408447 :                     fuzzed_data_provider.ConsumeIntegralInRange<int>(1, 4);
     245         [ +  + ]:      594427 :                 const auto num_out = outpoint_to_rbf ? 1 : fuzzed_data_provider.ConsumeIntegralInRange<int>(1, 4);
     246                 :             : 
     247         [ +  + ]:      594427 :                 auto& outpoints = last_tx ? package_outpoints : mempool_outpoints;
     248                 :             : 
     249   [ +  -  -  +  :      594427 :                 Assert((int)outpoints.size() >= num_in && num_in > 0);
                   +  - ]
     250                 :             : 
     251                 :             :                 CAmount amount_in{0};
     252         [ +  + ]:     2272526 :                 for (int i = 0; i < num_in; ++i) {
     253                 :             :                     // Pop random outpoint. We erase them to avoid double-spending
     254                 :             :                     // while in this loop, but later add them back (unless last_tx).
     255                 :     1678099 :                     auto pop = outpoints.begin();
     256                 :     1678099 :                     std::advance(pop, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, outpoints.size() - 1));
     257         [ +  + ]:     1678099 :                     auto outpoint = *pop;
     258                 :             : 
     259   [ +  +  +  + ]:     1678099 :                     if (i == 0 && outpoint_to_rbf) {
     260                 :       11943 :                         outpoint = *outpoint_to_rbf;
     261                 :       11943 :                         outpoints.erase(outpoint);
     262                 :             :                     } else {
     263                 :     1666156 :                         outpoints.erase(pop);
     264                 :             :                     }
     265                 :             :                     // no need to update or erase from outpoints_value
     266         [ +  - ]:     1678099 :                     amount_in += outpoints_value.at(outpoint);
     267                 :             : 
     268                 :             :                     // Create input
     269                 :     1678099 :                     CTxIn in;
     270                 :     1678099 :                     in.prevout = outpoint;
     271         [ +  - ]:     1678099 :                     in.scriptWitness.stack = P2WSH_EMPTY_TRUE_STACK;
     272                 :             : 
     273         [ +  - ]:     1678099 :                     tx_mut.vin.push_back(in);
     274                 :     1678099 :                 }
     275                 :             : 
     276                 :      594427 :                 const auto amount_fee = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, amount_in);
     277                 :      594427 :                 const auto amount_out = (amount_in - amount_fee) / num_out;
     278         [ +  + ]:     1983124 :                 for (int i = 0; i < num_out; ++i) {
     279         [ +  - ]:     1388697 :                     tx_mut.vout.emplace_back(amount_out, P2WSH_EMPTY);
     280                 :             :                 }
     281                 :             : 
     282                 :             :                 // Note output amounts can naturally drop to dust on their own.
     283   [ +  +  +  + ]:      594427 :                 if (!outpoint_to_rbf && fuzzed_data_provider.ConsumeBool()) {
     284                 :      215251 :                     uint32_t dust_index = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, num_out);
     285   [ +  -  +  - ]:      215251 :                     tx_mut.vout.insert(tx_mut.vout.begin() + dust_index, CTxOut(0, P2WSH_EMPTY));
     286                 :             :                 }
     287                 :             : 
     288         [ +  - ]:      594427 :                 auto tx = MakeTransactionRef(tx_mut);
     289                 :             :                 // Restore previously removed outpoints, except in-package outpoints (to allow RBF)
     290         [ +  + ]:      594427 :                 if (!last_tx) {
     291         [ +  + ]:     1386449 :                     for (const auto& in : tx->vin) {
     292   [ +  -  +  - ]:      966059 :                         Assert(outpoints.insert(in.prevout).second);
     293                 :             :                     }
     294                 :             :                     // Cache the in-package outpoints being made
     295         [ +  + ]:     1532574 :                     for (size_t i = 0; i < tx->vout.size(); ++i) {
     296         [ +  - ]:     1112184 :                         package_outpoints.emplace(tx->GetHash(), i);
     297                 :             :                     }
     298                 :             :                 }
     299                 :             :                 // We need newly-created values for the duration of this run
     300         [ +  + ]:     2198375 :                 for (size_t i = 0; i < tx->vout.size(); ++i) {
     301         [ +  - ]:     1603948 :                     outpoints_value[COutPoint(tx->GetHash(), i)] = tx->vout[i].nValue;
     302                 :             :                 }
     303                 :      594427 :                 return tx;
     304         [ +  - ]:     1783281 :             }());
     305                 :             :         }
     306                 :             : 
     307         [ +  + ]:      275615 :         if (fuzzed_data_provider.ConsumeBool()) {
     308         [ +  + ]:      149480 :             const auto& txid = fuzzed_data_provider.ConsumeBool() ?
     309                 :       61650 :                                    txs.back()->GetHash() :
     310                 :       43915 :                                    PickValue(fuzzed_data_provider, mempool_outpoints).hash;
     311                 :      105565 :             const auto delta = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-50 * COIN, +50 * COIN);
     312                 :             :             // We only prioritise out of mempool transactions since PrioritiseTransaction doesn't
     313                 :             :             // filter for ephemeral dust
     314   [ +  -  +  + ]:      105565 :             if (tx_pool.exists(txid)) {
     315         [ +  - ]:       20541 :                 const auto tx_info{tx_pool.info(txid)};
     316   [ +  -  +  + ]:       20541 :                 if (GetDust(*tx_info.tx, tx_pool.m_opts.dust_relay_feerate).empty()) {
     317         [ +  - ]:       19791 :                     tx_pool.PrioritiseTransaction(txid.ToUint256(), delta);
     318                 :             :                 }
     319                 :       20541 :             }
     320                 :             :         }
     321                 :             : 
     322         [ +  - ]:      275615 :         auto single_submit = txs.size() == 1;
     323                 :             : 
     324         [ +  - ]:      826845 :         const auto result_package = WITH_LOCK(::cs_main,
     325                 :             :                                     return ProcessNewPackage(chainstate, tx_pool, txs, /*test_accept=*/single_submit, /*client_maxfeerate=*/{}));
     326                 :             : 
     327   [ +  -  +  - ]:      826845 :         const auto res = WITH_LOCK(::cs_main, return AcceptToMemoryPool(chainstate, txs.back(), GetTime(),
     328                 :             :                                    /*bypass_limits=*/fuzzed_data_provider.ConsumeBool(), /*test_accept=*/!single_submit));
     329                 :             : 
     330   [ +  +  +  + ]:      275615 :         if (!single_submit && result_package.m_state.GetResult() != PackageValidationResult::PCKG_POLICY) {
     331                 :             :             // We don't know anything about the validity since transactions were randomly generated, so
     332                 :             :             // just use result_package.m_state here. This makes the expect_valid check meaningless, but
     333                 :             :             // we can still verify that the contents of m_tx_results are consistent with m_state.
     334         [ +  - ]:      102786 :             const bool expect_valid{result_package.m_state.IsValid()};
     335   [ +  -  +  - ]:      205572 :             Assert(!CheckPackageMempoolAcceptResult(txs, result_package, expect_valid, &tx_pool));
     336                 :             :         }
     337                 :             : 
     338         [ +  - ]:      275615 :         node.validation_signals->SyncWithValidationInterfaceQueue();
     339                 :             : 
     340         [ +  - ]:      275615 :         CheckMempoolEphemeralInvariants(tx_pool);
     341                 :      275615 :     }
     342                 :             : 
     343   [ +  -  +  - ]:        3804 :     node.validation_signals->UnregisterSharedValidationInterface(outpoints_updater);
     344                 :             : 
     345   [ +  -  +  - ]:        5706 :     WITH_LOCK(::cs_main, tx_pool.check(chainstate.CoinsTip(), chainstate.m_chain.Height() + 1));
     346         [ +  - ]:        3804 : }
     347                 :             : 
     348                 :             : 
     349         [ +  - ]:        2700 : FUZZ_TARGET(tx_package_eval, .init = initialize_tx_pool)
     350                 :             : {
     351                 :        2246 :     SeedRandomStateForTest(SeedRand::ZEROS);
     352                 :        2246 :     FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
     353                 :        2246 :     const auto& node = g_setup->m_node;
     354                 :        2246 :     auto& chainstate{static_cast<DummyChainState&>(node.chainman->ActiveChainstate())};
     355                 :             : 
     356                 :        2246 :     MockTime(fuzzed_data_provider, chainstate);
     357                 :             : 
     358                 :             :     // All RBF-spendable outpoints outside of the unsubmitted package
     359         [ +  - ]:        2246 :     std::set<COutPoint> mempool_outpoints;
     360         [ +  - ]:        2246 :     std::unordered_map<COutPoint, CAmount, SaltedOutpointHasher> outpoints_value;
     361         [ +  + ]:      226846 :     for (const auto& outpoint : g_outpoints_coinbase_init_mature) {
     362   [ +  -  +  - ]:      224600 :         Assert(mempool_outpoints.insert(outpoint).second);
     363         [ +  - ]:      224600 :         outpoints_value[outpoint] = 50 * COIN;
     364                 :             :     }
     365                 :             : 
     366         [ +  - ]:        2246 :     auto outpoints_updater = std::make_shared<OutpointsUpdater>(mempool_outpoints);
     367   [ +  -  +  - ]:        4492 :     node.validation_signals->RegisterSharedValidationInterface(outpoints_updater);
     368                 :             : 
     369         [ +  - ]:        2246 :     auto tx_pool_{MakeMempool(fuzzed_data_provider, node)};
     370                 :        2246 :     MockedTxPool& tx_pool = *static_cast<MockedTxPool*>(tx_pool_.get());
     371                 :             : 
     372                 :        2246 :     chainstate.SetMempool(&tx_pool);
     373                 :             : 
     374   [ +  +  +  + ]:      270151 :     LIMITED_WHILE(fuzzed_data_provider.remaining_bytes() > 0, 300)
     375                 :             :     {
     376         [ +  - ]:      267905 :         Assert(!mempool_outpoints.empty());
     377                 :             : 
     378                 :      267905 :         std::vector<CTransactionRef> txs;
     379                 :             : 
     380                 :             :         // Make packages of 1-to-26 transactions
     381                 :      267905 :         const auto num_txs = fuzzed_data_provider.ConsumeIntegralInRange<size_t>(1, 26);
     382                 :      267905 :         std::set<COutPoint> package_outpoints;
     383         [ +  + ]:     1204718 :         while (txs.size() < num_txs) {
     384                 :             :             // Create transaction to add to the mempool
     385         [ +  - ]:     1873626 :             txs.emplace_back([&] {
     386                 :      936813 :                 CMutableTransaction tx_mut;
     387         [ +  + ]:      936813 :                 tx_mut.version = fuzzed_data_provider.ConsumeBool() ? TRUC_VERSION : CTransaction::CURRENT_VERSION;
     388         [ +  + ]:      936813 :                 tx_mut.nLockTime = fuzzed_data_provider.ConsumeBool() ? 0 : fuzzed_data_provider.ConsumeIntegral<uint32_t>();
     389                 :             :                 // Last transaction in a package needs to be a child of parents to get further in validation
     390                 :             :                 // so the last transaction to be generated(in a >1 package) must spend all package-made outputs
     391                 :             :                 // Note that this test currently only spends package outputs in last transaction.
     392   [ +  +  +  + ]:      936813 :                 bool last_tx = num_txs > 1 && txs.size() == num_txs - 1;
     393                 :      936813 :                 const auto num_in = last_tx ? package_outpoints.size()  : fuzzed_data_provider.ConsumeIntegralInRange<int>(1, mempool_outpoints.size());
     394                 :      936813 :                 auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<int>(1, mempool_outpoints.size() * 2);
     395                 :             : 
     396         [ +  + ]:      936813 :                 auto& outpoints = last_tx ? package_outpoints : mempool_outpoints;
     397                 :             : 
     398         [ +  - ]:      936813 :                 Assert(!outpoints.empty());
     399                 :             : 
     400                 :             :                 CAmount amount_in{0};
     401         [ +  + ]:    16362236 :                 for (size_t i = 0; i < num_in; ++i) {
     402                 :             :                     // Pop random outpoint. We erase them to avoid double-spending
     403                 :             :                     // while in this loop, but later add them back (unless last_tx).
     404                 :    15425423 :                     auto pop = outpoints.begin();
     405                 :    15425423 :                     std::advance(pop, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, outpoints.size() - 1));
     406                 :    15425423 :                     const auto outpoint = *pop;
     407                 :    15425423 :                     outpoints.erase(pop);
     408                 :             :                     // no need to update or erase from outpoints_value
     409         [ +  - ]:    15425423 :                     amount_in += outpoints_value.at(outpoint);
     410                 :             : 
     411                 :             :                     // Create input
     412                 :    15425423 :                     const auto sequence = ConsumeSequence(fuzzed_data_provider);
     413                 :    15425423 :                     const auto script_sig = CScript{};
     414   [ +  +  +  - ]:    23260269 :                     const auto script_wit_stack = fuzzed_data_provider.ConsumeBool() ? P2WSH_EMPTY_TRUE_STACK : P2WSH_EMPTY_TWO_STACK;
     415                 :             : 
     416                 :    15425423 :                     CTxIn in;
     417                 :    15425423 :                     in.prevout = outpoint;
     418                 :    15425423 :                     in.nSequence = sequence;
     419                 :    15425423 :                     in.scriptSig = script_sig;
     420         [ +  - ]:    15425423 :                     in.scriptWitness.stack = script_wit_stack;
     421                 :             : 
     422         [ +  - ]:    15425423 :                     tx_mut.vin.push_back(in);
     423                 :    15425423 :                 }
     424                 :             : 
     425                 :             :                 // Duplicate an input
     426                 :      936813 :                 bool dup_input = fuzzed_data_provider.ConsumeBool();
     427         [ +  + ]:      936813 :                 if (dup_input) {
     428         [ +  - ]:      375761 :                     tx_mut.vin.push_back(tx_mut.vin.back());
     429                 :             :                 }
     430                 :             : 
     431                 :             :                 // Refer to a non-existent input
     432         [ +  + ]:      936813 :                 if (fuzzed_data_provider.ConsumeBool()) {
     433         [ +  - ]:      313689 :                     tx_mut.vin.emplace_back();
     434                 :             :                 }
     435                 :             : 
     436                 :             :                 // Make a p2pk output to make sigops adjusted vsize to violate TRUC rules, potentially, which is never spent
     437   [ +  +  +  + ]:      936813 :                 if (last_tx && amount_in > 1000 && fuzzed_data_provider.ConsumeBool()) {
     438   [ +  -  +  -  :      106880 :                     tx_mut.vout.emplace_back(1000, CScript() << std::vector<unsigned char>(33, 0x02) << OP_CHECKSIG);
                   +  - ]
     439                 :             :                     // Don't add any other outputs.
     440                 :       53440 :                     num_out = 1;
     441                 :       53440 :                     amount_in -= 1000;
     442                 :             :                 }
     443                 :             : 
     444                 :      936813 :                 const auto amount_fee = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, amount_in);
     445                 :      936813 :                 const auto amount_out = (amount_in - amount_fee) / num_out;
     446         [ +  + ]:    16659476 :                 for (int i = 0; i < num_out; ++i) {
     447         [ +  - ]:    15722663 :                     tx_mut.vout.emplace_back(amount_out, P2WSH_EMPTY);
     448                 :             :                 }
     449         [ +  - ]:      936813 :                 auto tx = MakeTransactionRef(tx_mut);
     450                 :             :                 // Restore previously removed outpoints, except in-package outpoints
     451         [ +  + ]:      936813 :                 if (!last_tx) {
     452         [ +  + ]:     8915236 :                     for (const auto& in : tx->vin) {
     453                 :             :                         // It's a fake input, or a new input, or a duplicate
     454   [ +  +  +  -  :    16548672 :                         Assert(in == CTxIn() || outpoints.insert(in.prevout).second || dup_input);
          +  +  +  -  +  
                      - ]
     455                 :             :                     }
     456                 :             :                     // Cache the in-package outpoints being made
     457         [ +  + ]:    15092132 :                     for (size_t i = 0; i < tx->vout.size(); ++i) {
     458         [ +  - ]:    14284222 :                         package_outpoints.emplace(tx->GetHash(), i);
     459                 :             :                     }
     460                 :             :                 }
     461                 :             :                 // We need newly-created values for the duration of this run
     462         [ +  + ]:    16712916 :                 for (size_t i = 0; i < tx->vout.size(); ++i) {
     463         [ +  - ]:    15776103 :                     outpoints_value[COutPoint(tx->GetHash(), i)] = tx->vout[i].nValue;
     464                 :             :                 }
     465                 :      936813 :                 return tx;
     466         [ +  - ]:     2810439 :             }());
     467                 :             :         }
     468                 :             : 
     469         [ +  + ]:      267905 :         if (fuzzed_data_provider.ConsumeBool()) {
     470         [ +  - ]:       92427 :             MockTime(fuzzed_data_provider, chainstate);
     471                 :             :         }
     472         [ +  + ]:      267905 :         if (fuzzed_data_provider.ConsumeBool()) {
     473         [ +  - ]:       67860 :             tx_pool.RollingFeeUpdate();
     474                 :             :         }
     475         [ +  + ]:      267905 :         if (fuzzed_data_provider.ConsumeBool()) {
     476         [ +  + ]:      169922 :             const auto& txid = fuzzed_data_provider.ConsumeBool() ?
     477                 :       45106 :                                    txs.back()->GetHash() :
     478                 :       62408 :                                    PickValue(fuzzed_data_provider, mempool_outpoints).hash;
     479                 :      107514 :             const auto delta = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-50 * COIN, +50 * COIN);
     480         [ +  - ]:      107514 :             tx_pool.PrioritiseTransaction(txid.ToUint256(), delta);
     481                 :             :         }
     482                 :             : 
     483                 :             :         // Remember all added transactions
     484         [ +  - ]:      267905 :         std::set<CTransactionRef> added;
     485         [ +  - ]:      267905 :         auto txr = std::make_shared<TransactionsDelta>(added);
     486   [ +  -  +  - ]:      535810 :         node.validation_signals->RegisterSharedValidationInterface(txr);
     487                 :             : 
     488                 :             :         // When there are multiple transactions in the package, we call ProcessNewPackage(txs, test_accept=false)
     489                 :             :         // and AcceptToMemoryPool(txs.back(), test_accept=true). When there is only 1 transaction, we might flip it
     490                 :             :         // (the package is a test accept and ATMP is a submission).
     491   [ +  +  +  + ]:      406907 :         auto single_submit = txs.size() == 1 && fuzzed_data_provider.ConsumeBool();
     492                 :             : 
     493                 :             :         // Exercise client_maxfeerate logic
     494                 :      267905 :         std::optional<CFeeRate> client_maxfeerate{};
     495         [ +  + ]:      267905 :         if (fuzzed_data_provider.ConsumeBool()) {
     496         [ +  - ]:       65213 :             client_maxfeerate = CFeeRate(fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-1, 50 * COIN), 100);
     497                 :             :         }
     498                 :             : 
     499         [ +  - ]:      803715 :         const auto result_package = WITH_LOCK(::cs_main,
     500                 :             :                                     return ProcessNewPackage(chainstate, tx_pool, txs, /*test_accept=*/single_submit, client_maxfeerate));
     501                 :             : 
     502                 :             :         // Always set bypass_limits to false because it is not supported in ProcessNewPackage and
     503                 :             :         // can be a source of divergence.
     504   [ +  -  +  - ]:      803715 :         const auto res = WITH_LOCK(::cs_main, return AcceptToMemoryPool(chainstate, txs.back(), GetTime(),
     505                 :             :                                    /*bypass_limits=*/false, /*test_accept=*/!single_submit));
     506                 :      267905 :         const bool passed = res.m_result_type == MempoolAcceptResult::ResultType::VALID;
     507                 :             : 
     508         [ +  - ]:      267905 :         node.validation_signals->SyncWithValidationInterfaceQueue();
     509   [ +  -  +  - ]:      535810 :         node.validation_signals->UnregisterSharedValidationInterface(txr);
     510                 :             : 
     511                 :             :         // There is only 1 transaction in the package. We did a test-package-accept and a ATMP
     512         [ +  + ]:      267905 :         if (single_submit) {
     513         [ +  - ]:       23083 :             Assert(passed != added.empty());
     514         [ +  - ]:       23083 :             Assert(passed == res.m_state.IsValid());
     515         [ +  + ]:       23083 :             if (passed) {
     516         [ +  - ]:        3121 :                 Assert(added.size() == 1);
     517         [ +  - ]:        3121 :                 Assert(txs.back() == *added.begin());
     518                 :             :             }
     519         [ +  + ]:      244822 :         } else if (result_package.m_state.GetResult() != PackageValidationResult::PCKG_POLICY) {
     520                 :             :             // We don't know anything about the validity since transactions were randomly generated, so
     521                 :             :             // just use result_package.m_state here. This makes the expect_valid check meaningless, but
     522                 :             :             // we can still verify that the contents of m_tx_results are consistent with m_state.
     523         [ +  - ]:      159835 :             const bool expect_valid{result_package.m_state.IsValid()};
     524   [ +  -  +  - ]:      319670 :             Assert(!CheckPackageMempoolAcceptResult(txs, result_package, expect_valid, &tx_pool));
     525                 :             :         } else {
     526                 :             :             // This is empty if it fails early checks, or "full" if transactions are looked at deeper
     527   [ +  +  +  -  :      165293 :             Assert(result_package.m_tx_results.size() == txs.size() || result_package.m_tx_results.empty());
                   +  - ]
     528                 :             :         }
     529                 :             : 
     530         [ +  - ]:      267905 :         CheckMempoolTRUCInvariants(tx_pool);
     531                 :             : 
     532                 :             :         // Dust checks only make sense when dust is enforced
     533         [ +  + ]:      267905 :         if (tx_pool.m_opts.require_standard) {
     534         [ +  - ]:      114497 :             CheckMempoolEphemeralInvariants(tx_pool);
     535                 :             :         }
     536         [ +  - ]:      535810 :     }
     537                 :             : 
     538   [ +  -  +  - ]:        4492 :     node.validation_signals->UnregisterSharedValidationInterface(outpoints_updater);
     539                 :             : 
     540   [ +  -  +  - ]:        6738 :     WITH_LOCK(::cs_main, tx_pool.check(chainstate.CoinsTip(), chainstate.m_chain.Height() + 1));
     541         [ +  - ]:        4492 : }
     542                 :             : } // namespace
        

Generated by: LCOV version 2.0-1