Bitcoin in contracts

/// A contract reads BTC headers at least this far below the anchor: 6 on every network.
const BTC_QUERY_DEPTH: u32 = 6;

/// The header of BTC block `height`, or a revert when it is not yet deep enough to read.
pub fn header_at(height: u32) -> Result<btc::BlockHeader, Vec<u8>> {
    // btc_header traps when the block is too shallow, so check first and revert with a reason
    let deepest = sdk::btc_anchor_height().checked_sub(BTC_QUERY_DEPTH);
    if deepest.is_none_or(|deepest| height > deepest) {
        return Err(b"the block is not deep enough yet".to_vec());
    }
    btc::BlockHeader::parse(&sdk::btc_header(height)).ok_or(b"malformed header".to_vec())
}

/// A transaction and the Merkle proofs that place it in a BTC block.
pub struct Proof<'a> {
    /// Height of the BTC block.
    pub height: u32,
    /// The transaction, serialized without witness data.
    pub raw_tx: &'a [u8],
    /// Its position in the block.
    pub index: u32,
    /// Its Merkle branch, from the leaf up.
    pub branch: &'a [[u8; 32]],
    /// The block's coinbase transaction, without witness data.
    pub coinbase_tx: &'a [u8],
    /// The coinbase's Merkle branch: as long as `branch`.
    pub coinbase_branch: &'a [[u8; 32]],
}

/// Checks that output `vout` of a proven transaction pays `script`; returns the txid and the sats.
pub fn proven_payment(
    proof: &Proof<'_>,
    vout: u32,
    script: &[u8],
) -> Result<([u8; 32], u64), Vec<u8>> {
    let header = header_at(proof.height)?;
    let txid = btc::verify_tx_inclusion(
        &header,
        proof.raw_tx,
        proof.index,
        proof.branch,
        proof.coinbase_tx,
        proof.coinbase_branch,
    )
    .ok_or(b"the transaction is not in that block".to_vec())?;
    let outputs = btc::parse_outputs(proof.raw_tx).ok_or(b"malformed transaction".to_vec())?;
    let output = usize::try_from(vout)
        .ok()
        .and_then(|i| outputs.get(i))
        .ok_or(b"no such output".to_vec())?;
    if output.script_pubkey != script {
        return Err(b"the output pays another script".to_vec());
    }
    Ok((txid, output.value))
}

/// Marks output (txid, vout) as used; a second claim of the same output reverts.
pub fn use_once(txid: &[u8; 32], vout: u32) -> Result<(), Vec<u8>> {
    let key = [b"used".as_slice(), txid, &vout.to_le_bytes()].concat();
    if storage::get(&key).is_some() {
        return Err(b"already claimed".to_vec());
    }
    storage::set(&key, &[1]);
    Ok(())
}

[dependencies]
bitcoin = "0.32"
borsh = "1"
hex = "0.4"

//! Builds the proofs that `btc::verify_tx_inclusion` checks, from a block read from bitcoind.
use bitcoin::consensus::serialize;
use bitcoin::hashes::{sha256d, Hash};
use bitcoin::{Block, Transaction};

/// The parts of a proof that place a transaction in its block.
pub struct InclusionProof {
    /// The transaction, without witness data.
    pub raw_tx: Vec<u8>,
    /// Its Merkle branch, from the leaf up.
    pub branch: Vec<[u8; 32]>,
    /// The block's coinbase transaction, without witness data.
    pub coinbase_tx: Vec<u8>,
    /// The coinbase's Merkle branch.
    pub coinbase_branch: Vec<[u8; 32]>,
}

/// The transaction without witness data: the bytes its txid hashes.
pub fn without_witness(tx: &Transaction) -> Vec<u8> {
    let mut stripped = tx.clone();
    for input in &mut stripped.input {
        input.witness.clear();
    }
    serialize(&stripped)
}

/// The Merkle branch of transaction `index`, from the leaf up, in internal byte order.
pub fn merkle_branch(txids: &[[u8; 32]], mut index: usize) -> Vec<[u8; 32]> {
    let mut level = txids.to_vec();
    let mut branch = Vec::new();
    while level.len() > 1 {
        if level.len() % 2 == 1 {
            level.push(level[level.len() - 1]); // an odd level pairs its last node with itself
        }
        branch.push(level[index ^ 1]);
        level = level
            .chunks(2)
            .map(|pair| sha256d::Hash::hash(&[pair[0], pair[1]].concat()).to_byte_array())
            .collect();
        index /= 2;
    }
    branch
}

/// The proof of transaction `index` of `block`.
pub fn inclusion_proof(block: &Block, index: usize) -> InclusionProof {
    let txids: Vec<[u8; 32]> = block
        .txdata
        .iter()
        .map(|tx| tx.compute_txid().to_byte_array())
        .collect();
    InclusionProof {
        raw_tx: without_witness(&block.txdata[index]),
        branch: merkle_branch(&txids, index),
        coinbase_tx: without_witness(&block.txdata[0]),
        coinbase_branch: merkle_branch(&txids, 0),
    }
}

/// The Borsh arguments of `claim` in the btc-payment-trigger example, in hex for `--args`.
pub fn claim_args(
    block: &Block,
    height: u32,
    index: usize,
    vout: u32,
    beneficiary: [u8; 32],
) -> String {
    let p = inclusion_proof(block, index);
    let index = u32::try_from(index).expect("a block holds fewer than 2^32 transactions");
    let args = (
        height,
        p.raw_tx,
        index,
        p.branch,
        p.coinbase_tx,
        p.coinbase_branch,
        vout,
        beneficiary,
    );
    hex::encode(borsh::to_vec(&args).expect("encoding plain values cannot fail"))
}

/// What the BTC transaction carrying this op pays to `script`, in sats, and its txid.
pub fn paid_by_this_op(script: &[u8]) -> Result<([u8; 32], u64), Vec<u8>> {
    let tx = sdk::native_tx().ok_or(b"send this op through path C".to_vec())?;
    let mut paid = 0u64;
    for output in tx.outputs.iter().filter(|o| o.script == script) {
        paid = paid.checked_add(output.value).ok_or(b"overflow".to_vec())?;
    }
    Ok((tx.txid, paid))
}

//! Native tests of the path C payment check, against the mock host.
#![cfg(not(target_arch = "wasm32"))]

use ksana_contract_sdk::{mock, NativeOutput, NativeTx};

const ALICE: [u8; 32] = [0xa1; 32];
const CONTRACT: [u8; 32] = [0xc0; 32];

#[test]
fn counts_what_the_carrying_transaction_pays() {
    mock::reset();
    let script = [&[0x51, 0x20][..], &[7; 32]].concat(); // a P2TR output script
    let pay = |value| NativeOutput {
        value,
        script: script.clone(),
    };
    let outputs = vec![pay(700), pay(300)];
    mock::set_native_tx(Some(NativeTx {
        txid: [3; 32],
        outputs,
    }));
    let paid = mock::with_context(ALICE, CONTRACT, || snippets::paid_by_this_op(&script));
    assert_eq!(paid, Ok(([3; 32], 1_000)));
    mock::set_native_tx(None); // a path B op from here on
    let paid = mock::with_context(ALICE, CONTRACT, || snippets::paid_by_this_op(&script));
    assert_eq!(paid, Err(b"send this op through path C".to_vec()));
}