Branch data Line data Source code
1 : : // Copyright (c) 2023 The Bitcoin Core developers
2 : : // Distributed under the MIT software license, see the accompanying
3 : : // file COPYING or http://www.opensource.org/licenses/mit-license.php.
4 : :
5 : : #include <consensus/validation.h>
6 : : #include <node/context.h>
7 : : #include <node/mempool_args.h>
8 : : #include <node/miner.h>
9 : : #include <policy/truc_policy.h>
10 : : #include <test/fuzz/FuzzedDataProvider.h>
11 : : #include <test/fuzz/fuzz.h>
12 : : #include <test/fuzz/util.h>
13 : : #include <test/fuzz/util/mempool.h>
14 : : #include <test/util/mining.h>
15 : : #include <test/util/script.h>
16 : : #include <test/util/setup_common.h>
17 : : #include <test/util/txmempool.h>
18 : : #include <util/check.h>
19 : : #include <util/rbf.h>
20 : : #include <util/translation.h>
21 : : #include <validation.h>
22 : : #include <validationinterface.h>
23 : :
24 : : using node::NodeContext;
25 : :
26 : : namespace {
27 : :
28 : : const TestingSetup* g_setup;
29 : : std::vector<COutPoint> g_outpoints_coinbase_init_mature;
30 : :
31 : : struct MockedTxPool : public CTxMemPool {
32 : 0 : void RollingFeeUpdate() EXCLUSIVE_LOCKS_REQUIRED(!cs)
33 : : {
34 : 0 : LOCK(cs);
35 [ # # ]: 0 : lastRollingFeeUpdate = GetTime();
36 [ # # ]: 0 : blockSinceLastRollingFeeBump = true;
37 : 0 : }
38 : : };
39 : :
40 : 0 : void initialize_tx_pool()
41 : : {
42 [ # # # # ]: 0 : static const auto testing_setup = MakeNoLogFileContext<const TestingSetup>();
43 : 0 : g_setup = testing_setup.get();
44 : :
45 [ # # ]: 0 : for (int i = 0; i < 2 * COINBASE_MATURITY; ++i) {
46 : 0 : COutPoint prevout{MineBlock(g_setup->m_node, P2WSH_EMPTY)};
47 [ # # ]: 0 : if (i < COINBASE_MATURITY) {
48 : : // Remember the txids to avoid expensive disk access later on
49 : 0 : g_outpoints_coinbase_init_mature.push_back(prevout);
50 : : }
51 : : }
52 : 0 : g_setup->m_node.validation_signals->SyncWithValidationInterfaceQueue();
53 [ # # ]: 0 : }
54 : :
55 : : struct OutpointsUpdater final : public CValidationInterface {
56 : : std::set<COutPoint>& m_mempool_outpoints;
57 : :
58 : 0 : explicit OutpointsUpdater(std::set<COutPoint>& r)
59 : 0 : : m_mempool_outpoints{r} {}
60 : :
61 : 0 : void TransactionAddedToMempool(const NewMempoolTransactionInfo& tx, uint64_t /* mempool_sequence */) override
62 : : {
63 : : // for coins spent we always want to be able to rbf so they're not removed
64 : :
65 : : // outputs from this tx can now be spent
66 [ # # ]: 0 : for (uint32_t index{0}; index < tx.info.m_tx->vout.size(); ++index) {
67 : 0 : m_mempool_outpoints.insert(COutPoint{tx.info.m_tx->GetHash(), index});
68 : : }
69 : 0 : }
70 : :
71 : 0 : void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override
72 : : {
73 : : // outpoints spent by this tx are now available
74 [ # # ]: 0 : for (const auto& input : tx->vin) {
75 : : // Could already exist if this was a replacement
76 : 0 : m_mempool_outpoints.insert(input.prevout);
77 : : }
78 : : // outpoints created by this tx no longer exist
79 [ # # ]: 0 : for (uint32_t index{0}; index < tx->vout.size(); ++index) {
80 : 0 : m_mempool_outpoints.erase(COutPoint{tx->GetHash(), index});
81 : : }
82 : 0 : }
83 : : };
84 : :
85 : : struct TransactionsDelta final : public CValidationInterface {
86 : : std::set<CTransactionRef>& m_added;
87 : :
88 : 0 : explicit TransactionsDelta(std::set<CTransactionRef>& a)
89 : 0 : : m_added{a} {}
90 : :
91 : 0 : void TransactionAddedToMempool(const NewMempoolTransactionInfo& tx, uint64_t /* mempool_sequence */) override
92 : : {
93 : : // Transactions may be entered and booted any number of times
94 : 0 : m_added.insert(tx.info.m_tx);
95 : 0 : }
96 : :
97 : 0 : void TransactionRemovedFromMempool(const CTransactionRef& tx, MemPoolRemovalReason reason, uint64_t /* mempool_sequence */) override
98 : : {
99 : : // Transactions may be entered and booted any number of times
100 : 0 : m_added.erase(tx);
101 : 0 : }
102 : : };
103 : :
104 : 0 : void MockTime(FuzzedDataProvider& fuzzed_data_provider, const Chainstate& chainstate)
105 : : {
106 : 0 : const auto time = ConsumeTime(fuzzed_data_provider,
107 [ # # ]: 0 : chainstate.m_chain.Tip()->GetMedianTimePast() + 1,
108 [ # # ]: 0 : std::numeric_limits<decltype(chainstate.m_chain.Tip()->nTime)>::max());
109 : 0 : SetMockTime(time);
110 : 0 : }
111 : :
112 : 0 : std::unique_ptr<CTxMemPool> MakeMempool(FuzzedDataProvider& fuzzed_data_provider, const NodeContext& node)
113 : : {
114 : : // Take the default options for tests...
115 : 0 : CTxMemPool::Options mempool_opts{MemPoolOptionsForTest(node)};
116 : :
117 : :
118 : : // ...override specific options for this specific fuzz suite
119 : 0 : mempool_opts.limits.ancestor_count = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 50);
120 : 0 : mempool_opts.limits.ancestor_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 202) * 1'000;
121 : 0 : mempool_opts.limits.descendant_count = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 50);
122 : 0 : mempool_opts.limits.descendant_size_vbytes = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 202) * 1'000;
123 : 0 : mempool_opts.max_size_bytes = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 200) * 1'000'000;
124 : 0 : mempool_opts.expiry = std::chrono::hours{fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 999)};
125 : : // Only interested in 2 cases: sigop cost 0 or when single legacy sigop cost is >> 1KvB
126 : 0 : nBytesPerSigOp = fuzzed_data_provider.ConsumeIntegralInRange<unsigned>(0, 1) * 10'000;
127 : :
128 : 0 : mempool_opts.check_ratio = 1;
129 : 0 : mempool_opts.require_standard = fuzzed_data_provider.ConsumeBool();
130 : :
131 [ # # ]: 0 : bilingual_str error;
132 : : // ...and construct a CTxMemPool from it
133 [ # # ]: 0 : auto mempool{std::make_unique<CTxMemPool>(std::move(mempool_opts), error)};
134 : : // ... ignore the error since it might be beneficial to fuzz even when the
135 : : // mempool size is unreasonably small
136 [ # # # # : 0 : Assert(error.empty() || error.original.starts_with("-maxmempool must be at least "));
# # ]
137 : 0 : return mempool;
138 : 0 : }
139 : :
140 [ # # ]: 0 : FUZZ_TARGET(tx_package_eval, .init = initialize_tx_pool)
141 : : {
142 : 0 : FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
143 : 0 : const auto& node = g_setup->m_node;
144 : 0 : auto& chainstate{static_cast<DummyChainState&>(node.chainman->ActiveChainstate())};
145 : :
146 : 0 : MockTime(fuzzed_data_provider, chainstate);
147 : :
148 : : // All RBF-spendable outpoints outside of the unsubmitted package
149 : 0 : std::set<COutPoint> mempool_outpoints;
150 : 0 : std::map<COutPoint, CAmount> outpoints_value;
151 [ # # ]: 0 : for (const auto& outpoint : g_outpoints_coinbase_init_mature) {
152 [ # # # # ]: 0 : Assert(mempool_outpoints.insert(outpoint).second);
153 [ # # ]: 0 : outpoints_value[outpoint] = 50 * COIN;
154 : : }
155 : :
156 [ # # ]: 0 : auto outpoints_updater = std::make_shared<OutpointsUpdater>(mempool_outpoints);
157 [ # # # # ]: 0 : node.validation_signals->RegisterSharedValidationInterface(outpoints_updater);
158 : :
159 [ # # ]: 0 : auto tx_pool_{MakeMempool(fuzzed_data_provider, node)};
160 : 0 : MockedTxPool& tx_pool = *static_cast<MockedTxPool*>(tx_pool_.get());
161 : :
162 : 0 : chainstate.SetMempool(&tx_pool);
163 : :
164 [ # # # # ]: 0 : LIMITED_WHILE(fuzzed_data_provider.ConsumeBool(), 300)
165 : : {
166 [ # # ]: 0 : Assert(!mempool_outpoints.empty());
167 : :
168 : 0 : std::vector<CTransactionRef> txs;
169 : :
170 : : // Make packages of 1-to-26 transactions
171 : 0 : const auto num_txs = (size_t) fuzzed_data_provider.ConsumeIntegralInRange<int>(1, 26);
172 : 0 : std::set<COutPoint> package_outpoints;
173 [ # # ]: 0 : while (txs.size() < num_txs) {
174 : :
175 : : // Last transaction in a package needs to be a child of parents to get further in validation
176 : : // so the last transaction to be generated(in a >1 package) must spend all package-made outputs
177 : : // Note that this test currently only spends package outputs in last transaction.
178 [ # # # # ]: 0 : bool last_tx = num_txs > 1 && txs.size() == num_txs - 1;
179 : :
180 : : // Create transaction to add to the mempool
181 : 0 : const CTransactionRef tx = [&] {
182 : 0 : CMutableTransaction tx_mut;
183 [ # # ]: 0 : tx_mut.version = fuzzed_data_provider.ConsumeBool() ? TRUC_VERSION : CTransaction::CURRENT_VERSION;
184 [ # # ]: 0 : tx_mut.nLockTime = fuzzed_data_provider.ConsumeBool() ? 0 : fuzzed_data_provider.ConsumeIntegral<uint32_t>();
185 : : // Last tx will sweep all outpoints in package
186 [ # # ]: 0 : const auto num_in = last_tx ? package_outpoints.size() : fuzzed_data_provider.ConsumeIntegralInRange<int>(1, mempool_outpoints.size());
187 : 0 : auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<int>(1, mempool_outpoints.size() * 2);
188 : :
189 [ # # ]: 0 : auto& outpoints = last_tx ? package_outpoints : mempool_outpoints;
190 : :
191 [ # # ]: 0 : Assert(!outpoints.empty());
192 : :
193 : : CAmount amount_in{0};
194 [ # # ]: 0 : for (size_t i = 0; i < num_in; ++i) {
195 : : // Pop random outpoint
196 : 0 : auto pop = outpoints.begin();
197 : 0 : std::advance(pop, fuzzed_data_provider.ConsumeIntegralInRange<size_t>(0, outpoints.size() - 1));
198 : 0 : const auto outpoint = *pop;
199 : 0 : outpoints.erase(pop);
200 : : // no need to update or erase from outpoints_value
201 [ # # ]: 0 : amount_in += outpoints_value.at(outpoint);
202 : :
203 : : // Create input
204 : 0 : const auto sequence = ConsumeSequence(fuzzed_data_provider);
205 : 0 : const auto script_sig = CScript{};
206 [ # # # # ]: 0 : const auto script_wit_stack = fuzzed_data_provider.ConsumeBool() ? P2WSH_EMPTY_TRUE_STACK : P2WSH_EMPTY_TWO_STACK;
207 : :
208 : 0 : CTxIn in;
209 : 0 : in.prevout = outpoint;
210 : 0 : in.nSequence = sequence;
211 : 0 : in.scriptSig = script_sig;
212 [ # # ]: 0 : in.scriptWitness.stack = script_wit_stack;
213 : :
214 [ # # ]: 0 : tx_mut.vin.push_back(in);
215 : 0 : }
216 : :
217 : : // Duplicate an input
218 : 0 : bool dup_input = fuzzed_data_provider.ConsumeBool();
219 [ # # ]: 0 : if (dup_input) {
220 [ # # ]: 0 : tx_mut.vin.push_back(tx_mut.vin.back());
221 : : }
222 : :
223 : : // Refer to a non-existent input
224 [ # # ]: 0 : if (fuzzed_data_provider.ConsumeBool()) {
225 [ # # ]: 0 : tx_mut.vin.emplace_back();
226 : : }
227 : :
228 : : // Make a p2pk output to make sigops adjusted vsize to violate TRUC rules, potentially, which is never spent
229 [ # # # # : 0 : if (last_tx && amount_in > 1000 && fuzzed_data_provider.ConsumeBool()) {
# # ]
230 [ # # # # : 0 : tx_mut.vout.emplace_back(1000, CScript() << std::vector<unsigned char>(33, 0x02) << OP_CHECKSIG);
# # ]
231 : : // Don't add any other outputs.
232 : 0 : num_out = 1;
233 : 0 : amount_in -= 1000;
234 : : }
235 : :
236 : 0 : const auto amount_fee = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(0, amount_in);
237 : 0 : const auto amount_out = (amount_in - amount_fee) / num_out;
238 [ # # ]: 0 : for (int i = 0; i < num_out; ++i) {
239 [ # # ]: 0 : tx_mut.vout.emplace_back(amount_out, P2WSH_EMPTY);
240 : : }
241 [ # # ]: 0 : auto tx = MakeTransactionRef(tx_mut);
242 : : // Restore previously removed outpoints, except in-package outpoints
243 [ # # ]: 0 : if (!last_tx) {
244 [ # # ]: 0 : for (const auto& in : tx->vin) {
245 : : // It's a fake input, or a new input, or a duplicate
246 [ # # # # : 0 : Assert(in == CTxIn() || outpoints.insert(in.prevout).second || dup_input);
# # # # #
# ]
247 : : }
248 : : // Cache the in-package outpoints being made
249 [ # # ]: 0 : for (size_t i = 0; i < tx->vout.size(); ++i) {
250 [ # # ]: 0 : package_outpoints.emplace(tx->GetHash(), i);
251 : : }
252 : : }
253 : : // We need newly-created values for the duration of this run
254 [ # # ]: 0 : for (size_t i = 0; i < tx->vout.size(); ++i) {
255 [ # # ]: 0 : outpoints_value[COutPoint(tx->GetHash(), i)] = tx->vout[i].nValue;
256 : : }
257 : 0 : return tx;
258 [ # # ]: 0 : }();
259 [ # # ]: 0 : txs.push_back(tx);
260 : 0 : }
261 : :
262 [ # # ]: 0 : if (fuzzed_data_provider.ConsumeBool()) {
263 [ # # ]: 0 : MockTime(fuzzed_data_provider, chainstate);
264 : : }
265 [ # # ]: 0 : if (fuzzed_data_provider.ConsumeBool()) {
266 [ # # ]: 0 : tx_pool.RollingFeeUpdate();
267 : : }
268 [ # # ]: 0 : if (fuzzed_data_provider.ConsumeBool()) {
269 [ # # ]: 0 : const auto& txid = fuzzed_data_provider.ConsumeBool() ?
270 : 0 : txs.back()->GetHash() :
271 : 0 : PickValue(fuzzed_data_provider, mempool_outpoints).hash;
272 : 0 : const auto delta = fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-50 * COIN, +50 * COIN);
273 [ # # ]: 0 : tx_pool.PrioritiseTransaction(txid.ToUint256(), delta);
274 : : }
275 : :
276 : : // Remember all added transactions
277 [ # # ]: 0 : std::set<CTransactionRef> added;
278 [ # # ]: 0 : auto txr = std::make_shared<TransactionsDelta>(added);
279 [ # # # # ]: 0 : node.validation_signals->RegisterSharedValidationInterface(txr);
280 : :
281 : : // When there are multiple transactions in the package, we call ProcessNewPackage(txs, test_accept=false)
282 : : // and AcceptToMemoryPool(txs.back(), test_accept=true). When there is only 1 transaction, we might flip it
283 : : // (the package is a test accept and ATMP is a submission).
284 [ # # # # ]: 0 : auto single_submit = txs.size() == 1 && fuzzed_data_provider.ConsumeBool();
285 : :
286 : : // Exercise client_maxfeerate logic
287 : 0 : std::optional<CFeeRate> client_maxfeerate{};
288 [ # # ]: 0 : if (fuzzed_data_provider.ConsumeBool()) {
289 [ # # ]: 0 : client_maxfeerate = CFeeRate(fuzzed_data_provider.ConsumeIntegralInRange<CAmount>(-1, 50 * COIN), 100);
290 : : }
291 : :
292 [ # # ]: 0 : const auto result_package = WITH_LOCK(::cs_main,
293 : : return ProcessNewPackage(chainstate, tx_pool, txs, /*test_accept=*/single_submit, client_maxfeerate));
294 : :
295 : : // Always set bypass_limits to false because it is not supported in ProcessNewPackage and
296 : : // can be a source of divergence.
297 [ # # # # ]: 0 : const auto res = WITH_LOCK(::cs_main, return AcceptToMemoryPool(chainstate, txs.back(), GetTime(),
298 : : /*bypass_limits=*/false, /*test_accept=*/!single_submit));
299 : 0 : const bool passed = res.m_result_type == MempoolAcceptResult::ResultType::VALID;
300 : :
301 [ # # ]: 0 : node.validation_signals->SyncWithValidationInterfaceQueue();
302 [ # # # # ]: 0 : node.validation_signals->UnregisterSharedValidationInterface(txr);
303 : :
304 : : // There is only 1 transaction in the package. We did a test-package-accept and a ATMP
305 [ # # ]: 0 : if (single_submit) {
306 [ # # ]: 0 : Assert(passed != added.empty());
307 [ # # ]: 0 : Assert(passed == res.m_state.IsValid());
308 [ # # ]: 0 : if (passed) {
309 [ # # ]: 0 : Assert(added.size() == 1);
310 [ # # ]: 0 : Assert(txs.back() == *added.begin());
311 : : }
312 [ # # ]: 0 : } else if (result_package.m_state.GetResult() != PackageValidationResult::PCKG_POLICY) {
313 : : // We don't know anything about the validity since transactions were randomly generated, so
314 : : // just use result_package.m_state here. This makes the expect_valid check meaningless, but
315 : : // we can still verify that the contents of m_tx_results are consistent with m_state.
316 [ # # ]: 0 : const bool expect_valid{result_package.m_state.IsValid()};
317 [ # # # # ]: 0 : Assert(!CheckPackageMempoolAcceptResult(txs, result_package, expect_valid, &tx_pool));
318 : : } else {
319 : : // This is empty if it fails early checks, or "full" if transactions are looked at deeper
320 [ # # # # : 0 : Assert(result_package.m_tx_results.size() == txs.size() || result_package.m_tx_results.empty());
# # ]
321 : : }
322 : :
323 [ # # ]: 0 : CheckMempoolTRUCInvariants(tx_pool);
324 [ # # ]: 0 : }
325 : :
326 [ # # # # ]: 0 : node.validation_signals->UnregisterSharedValidationInterface(outpoints_updater);
327 : :
328 [ # # # # ]: 0 : WITH_LOCK(::cs_main, tx_pool.check(chainstate.CoinsTip(), chainstate.m_chain.Height() + 1));
329 [ # # ]: 0 : }
330 : : } // namespace
|
