random.html: real per-tx script+signature verification with the engine

Clicking a transaction now also fetches its raw hex (one more fetch, still
only-on-click), decodes it with the engine, and runs every input through
be.interpreter.verifyInput using the prevout scriptPubKey+value that esplora
already inlines. Shows a green 'N / N inputs verified' banner with the
in-browser timing, plus a per-input ✓/✗/○ tick. Coinbase and unconfirmed
handled. This is real phase-2 consensus verification, one tx at a time.

Also refresh engine/codec to the fixed schema trunk (#60/#61/#62/#63/#67) so
verification is correct on inscriptions and large taproot spends, not just
standard scripts.

Author: melvincarvalho

engine/codec/blocks.js

@@ -192,7 +192,14 @@ export class BlockEngine {
   // coinbase scriptSig. Returns null if unparseable.
   bip34Height(coinbaseTx) {
     const script = hexToBytes(coinbaseTx.inputs[0].scriptSig);
-    const len = script[0];
+    const op = script[0];
+    if (op === undefined) return null;
+    // Heights 1-16 use the minimal push OP_1..OP_16 (0x51..0x60), a single
+    // opcode byte rather than a length-prefixed push. Core's `CScript() << height`
+    // encodes them this way, so BIP34 requires exactly this on those blocks.
+    if (op >= 0x51 && op <= 0x60) return op - 0x50;
+    // Otherwise a length-prefixed little-endian scriptnum push (1..5 data bytes).
+    const len = op;
     if (len < 1 || len > 5 || script.length < 1 + len) return null;
     let n = 0;
     for (let i = len; i >= 1; i--) n = n * 256 + script[i];

engine/codec/hash.js

@@ -14,7 +14,16 @@ const K = new Uint32Array([
 
 const rotr = (x, n) => (x >>> n) | (x << (32 - n));
 
+// Optional SHA-256 backend (e.g. native node:crypto / WebCrypto / WASM) injected
+// by performance-sensitive callers; null = the pure-JS path below. Keeps this
+// module zero-dependency: the engine never imports an accelerated hasher, the
+// caller supplies one. Must return a 32-byte Uint8Array byte-identical to the
+// pure-JS implementation (callers gate on a consensus-equivalence proof).
+let __sha256Backend = null;
+export function setSha256Backend(fn) { __sha256Backend = fn; }
+
 export function sha256(data) {
+  if (__sha256Backend) return __sha256Backend(data);
   const len = data.length;
   const bitLen = len * 8;
   const padded = new Uint8Array((((len + 8) >> 6) + 1) << 6);

engine/codec/interpreter.js

@@ -53,6 +53,16 @@ const truthy = (bytes) => {
 const boolBytes = (b) => (b ? Uint8Array.of(1) : new Uint8Array(0));
 const eq = (a, b) => a.length === b.length && a.every((v, i) => v === b[i]);
 
+// Bitcoin CompactSize (1/3/5/9 bytes), matching the codec's varint writer.
+// Used for the script-length prefix in the BIP341 TapLeaf hash; tapscripts can
+// exceed 65,535 bytes (large inscriptions), so the 0xfe 4-byte case is required.
+export function compactSize(n) {
+  if (n < 0xfd) return Uint8Array.of(n);
+  if (n <= 0xffff) return Uint8Array.of(0xfd, n & 0xff, (n >>> 8) & 0xff);
+  if (n <= 0xffffffff) return Uint8Array.of(0xfe, n & 0xff, (n >>> 8) & 0xff, (n >>> 16) & 0xff, (n >>> 24) & 0xff);
+  const b = new Uint8Array(9); b[0] = 0xff; new DataView(b.buffer).setBigUint64(1, BigInt(n), true); return b;
+}
+
 const DEFAULT_LIMITS = {
   maxScriptSize: 10000, maxScriptElementSize: 520,
   maxOpsPerScript: 201, maxStackSize: 1000, maxMultisigKeys: 20,
@@ -114,6 +124,18 @@ export class ScriptInterpreter {
     this.scriptEngine = scriptEngine;
     this.limits = limits;
     this.handlers = this.#buildHandlers();
+    // Per-transaction sighash midstate cache (BIP143/BIP341 hashPrevouts,
+    // hashSequence, hashOutputs, etc. depend only on the whole tx, not the input
+    // being signed). Without this, a tx with n segwit/taproot inputs recomputes
+    // these O(n)-sized hashes n times = O(n^2); a 1,400-input consolidation then
+    // takes ~minutes. Keyed by the tx object (WeakMap) so it clears itself.
+    this._sigCache = new WeakMap();
+  }
+
+  #txCache(tx) {
+    let c = this._sigCache.get(tx);
+    if (!c) { c = {}; this._sigCache.set(tx, c); }
+    return c;
   }
 
   // ---- sighash ----
@@ -162,11 +184,13 @@ export class ScriptInterpreter {
       let p = 0; for (const a of arrs) { out.set(a, p); p += a.length; }
       return out;
     };
-    const hashPrevouts = anyone ? zero : dsha256(cat(tx.inputs.map(outpoint)));
-    const hashSequence = (anyone || base === 2 || base === 3) ? zero
-      : dsha256(cat(tx.inputs.map((i) => u32(i.sequence))));
     const serOut = (o) => this.codec.encode('TransactionOutput', o);
-    const hashOutputs = (base !== 2 && base !== 3) ? dsha256(cat(tx.outputs.map(serOut)))
+    // These three depend only on the whole tx — memoize per tx (see #txCache).
+    const C = this.#txCache(tx);
+    const hashPrevouts = anyone ? zero : (C.wPrevouts ??= dsha256(cat(tx.inputs.map(outpoint))));
+    const hashSequence = (anyone || base === 2 || base === 3) ? zero
+      : (C.wSequence ??= dsha256(cat(tx.inputs.map((i) => u32(i.sequence)))));
+    const hashOutputs = (base !== 2 && base !== 3) ? (C.wOutputs ??= dsha256(cat(tx.outputs.map(serOut))))
       : (base === 3 && inIndex < tx.outputs.length) ? dsha256(serOut(tx.outputs[inIndex]))
       : zero;
     const script = hexToBytes(scriptCodeHex);
@@ -204,15 +228,18 @@ export class ScriptInterpreter {
     };
     const outpoint = (inp) => cat([hexToBytes(inp.prevout.txid).reverse(), u32(inp.prevout.vout)]);
 
+    // sha_prevouts/amounts/scriptpubkeys/sequences/outputs depend only on the
+    // whole tx (+ its prevout set, identical across inputs) — memoize per tx.
+    const C = this.#txCache(tx);
     const parts = [u8(0x00), u8(hashType), u32(tx.version), u32(tx.lockTime)];
     if (!anyone) {
-      parts.push(sha256(cat(tx.inputs.map(outpoint))));
-      parts.push(sha256(cat(prevouts.map((p) => i64(p.value)))));
-      parts.push(sha256(cat(prevouts.map((p) => varbytes(hexToBytes(p.scriptPubKey))))));
-      parts.push(sha256(cat(tx.inputs.map((i) => u32(i.sequence)))));
+      parts.push(C.tPrevouts ??= sha256(cat(tx.inputs.map(outpoint))));
+      parts.push(C.tAmounts ??= sha256(cat(prevouts.map((p) => i64(p.value)))));
+      parts.push(C.tScriptpubkeys ??= sha256(cat(prevouts.map((p) => varbytes(hexToBytes(p.scriptPubKey))))));
+      parts.push(C.tSequences ??= sha256(cat(tx.inputs.map((i) => u32(i.sequence)))));
     }
     if (base !== 2 && base !== 3) {
-      parts.push(sha256(cat(tx.outputs.map((o) => this.codec.encode('TransactionOutput', o)))));
+      parts.push(C.tOutputs ??= sha256(cat(tx.outputs.map((o) => this.codec.encode('TransactionOutput', o)))));
     }
     parts.push(u8((leafHash ? 2 : 0) + (annex ? 1 : 0))); // spend_type
     if (anyone) {
@@ -466,7 +493,10 @@ export class ScriptInterpreter {
   // amount, sigVersion, alt}. Returns {ok, error?}; stack is mutated.
   execute(scriptHex, stack, ctx = {}) {
     try {
-      if (scriptHex.length / 2 > this.limits.maxScriptSize) fail('script too large');
+      // BIP342: tapscript has no per-script size limit. The legacy 10kB
+      // MAX_SCRIPT_SIZE does not apply; a tapscript's size is bounded only by the
+      // transaction/block weight limit (it has to fit in a block).
+      if (ctx.sigVersion !== 'tapscript' && scriptHex.length / 2 > this.limits.maxScriptSize) fail('script too large');
       ctx.alt = ctx.alt ?? [];
       ctx.scriptCode = ctx.scriptCode ?? scriptHex;
       this.requireMinimalNum = !!ctx.flags?.has('MINIMALDATA'); // for the shared num() helper
@@ -492,7 +522,10 @@ export class ScriptInterpreter {
           }
           continue;
         }
-        if (op.code > 0x60 && ++opCount > this.limits.maxOpsPerScript) fail('op count');
+        // BIP342: tapscript removes the 201-non-push-opcode-per-script limit
+        // entirely (there is no opcode-count cap). Signature-checking cost is
+        // instead bounded separately by the per-input sigops budget.
+        if (ctx.sigVersion !== 'tapscript' && op.code > 0x60 && ++opCount > this.limits.maxOpsPerScript) fail('op count');
         if (this.#isDisabled(op.name)) fail(`disabled opcode ${op.name}`);
         const isBranch = ['OP_IF', 'OP_NOTIF', 'OP_ELSE', 'OP_ENDIF'].includes(op.name);
         if (!executing && !isBranch) continue;
@@ -610,10 +643,7 @@ export class ScriptInterpreter {
     const leafVersion = control[0] & 0xfe;
     const parity = control[0] & 0x01;
     const internalKey = control.subarray(1, 33);
-    const sizePrefix = script.length < 0xfd
-      ? Uint8Array.of(script.length)
-      : Uint8Array.of(0xfd, script.length & 0xff, script.length >> 8);
-    const leafHash = taggedHash('TapLeaf', Uint8Array.of(leafVersion), sizePrefix, script);
+    const leafHash = taggedHash('TapLeaf', Uint8Array.of(leafVersion), compactSize(script.length), script);
     let k = leafHash;
     for (let i = 33; i < control.length; i += 32) {
       const e = control.subarray(i, i + 32);

engine/codec/script.js

@@ -75,12 +75,18 @@ export class ScriptEngine {
       if (code >= 0x01 && code <= 0x4b) len = code;
       else if (code === 0x4c) { len = bytes[i]; i += 1; }
       else if (code === 0x4d) { len = bytes[i] | (bytes[i + 1] << 8); i += 2; }
-      else if (code === 0x4e) { len = bytes[i] | (bytes[i + 1] << 8) | (bytes[i + 2] << 16) | (bytes[i + 3] << 24); i += 4; }
+      // >>> 0: the 4-byte length is unsigned. Without it, JS's `<< 24` makes a
+      // high-bit length negative, which slips past the bounds check below and
+      // sends `i` negative, looping into undefined bytes (crashes on malformed
+      // coinbase scriptSig data). See bitcoin-desktop/schema#62.
+      else if (code === 0x4e) { len = (bytes[i] | (bytes[i + 1] << 8) | (bytes[i + 2] << 16) | (bytes[i + 3] << 24)) >>> 0; i += 4; }
       if (len === null) {
         ops.push({ code, name: this.byCode.get(code) ?? `OP_UNKNOWN_0x${code.toString(16).padStart(2, '0')}` });
         continue;
       }
-      if (Number.isNaN(len) || i + len > bytes.length) {
+      // Truncated if the length prefix itself overran the end (i > length, len
+      // undefined/0), the declared push runs past the end, or len isn't finite.
+      if (len == null || Number.isNaN(len) || i > bytes.length || i + len > bytes.length) {
         ops.push({ code, name: 'OP_PUSH', error: 'truncated push' });
         break;
       }

engine/codec/secp256k1.js

@@ -109,9 +109,16 @@ export function parseDerSignature(bytes) {
   }
 }
 
+// Optional verify backend (e.g. WASM libsecp256k1) injected by performance-
+// sensitive callers; null = the pure-JS path. Keeps this module zero-dependency:
+// the engine never imports a WASM lib, the caller supplies one.
+let __verifyBackend = null;
+export function setVerifyBackend(b) { __verifyBackend = b; }
+
 // ECDSA verify: signature (parsed r,s) over a 32-byte message hash with an
 // affine public key point.
 export function verifyEcdsa(msgHash, sig, pubkey) {
+  if (__verifyBackend) return __verifyBackend.ecdsa(msgHash, sig, pubkey);
   const { r, s } = sig;
   if (r <= 0n || r >= N || s <= 0n || s >= N) return false;
   const e = mod(bytesToBig(msgHash), N);
@@ -146,6 +153,7 @@ export function liftX(xBytes) {
 }
 
 export function verifySchnorr(msg32, sig64, pubkey32) {
+  if (__verifyBackend) return __verifyBackend.schnorr(msg32, sig64, pubkey32);
   if (sig64.length !== 64 || pubkey32.length !== 32) return false;
   const Ppoint = liftX(pubkey32);
   if (!Ppoint) return false;

random.html

@@ -108,7 +108,7 @@ <h1>Verify a Bitcoin block.</h1>
   </div>
   <p id="err"></p>
   <div id="card"></div>
-  <p class="note"><b>Phase 1:</b> proof of work, merkle root, witness commitment and block structure all live inside the block itself, so they verify with no extra data. Script execution and signature checks need the spending history (the prevouts), which is phase 2. A pass here means structurally sound, not that every signature was checked.</p>
+  <p class="note"><b>Two layers.</b> A block's proof of work, merkle root, witness commitment and structure all live inside the block itself, so they verify with no extra data. Scripts and signatures need the spending history (the prevouts), which isn't in the block &mdash; so <b>click any transaction</b> to fetch it and run its scripts and signatures through the engine for real, right here in your browser. That is the full check, one transaction at a time.</p>
 </div>
 
 <footer>An independent JavaScript implementation. Block data from <span id="prov">mempool.space</span>. <a href="./index.html">bitcoin-kernel</a></footer>
@@ -297,7 +297,7 @@ <h1>Verify a Bitcoin block.</h1>
   } catch (e) { $('live').classList.remove('on'); $('err').textContent = 'Error: ' + e.message; $('rand').disabled = $('go').disabled = false; }
 }
 
-// --- transaction detail: one fetch, only on click ---
+// --- transaction detail + real engine verification (fetches only on click) ---
 async function showTx(txid, push = true) {
   $('rand').disabled = $('go').disabled = true;
   $('card').classList.remove('show'); $('card').style.display = 'none';
@@ -306,8 +306,24 @@ <h1>Verify a Bitcoin block.</h1>
   step('fetching transaction');
   try {
     const tx = await (await api(`/api/tx/${txid}`)).json();
+    let ver = null;
+    try {
+      step('verifying scripts & signatures with the engine');
+      const hex = (await (await api(`/api/tx/${txid}/hex`)).text()).trim();
+      const etx = codec.decode('Transaction', hex);
+      // esplora inlines each prevout's scriptpubkey + value -> exactly what the interpreter needs
+      const prevouts = tx.vin.map((v) => v.is_coinbase ? null : { value: v.prevout.value, scriptPubKey: v.prevout.scriptpubkey });
+      const all = prevouts.every(Boolean) ? prevouts : null; // taproot sighash needs every prevout
+      const t0 = performance.now();
+      const res = tx.vin.map((v, i) => v.is_coinbase ? { coinbase: true } : be.interpreter.verifyInput(etx, i, prevouts[i], all));
+      const ms = performance.now() - t0;
+      const total = res.filter((r) => !r.coinbase).length;
+      const ok = res.filter((r) => r.ok === true).length;
+      const skipped = res.filter((r) => r.ok === null).length;
+      ver = { res, ms, total, ok, skipped, allOk: total > 0 && ok === total };
+    } catch (e) { ver = { error: e.message }; }
     $('live').classList.remove('on');
-    renderTx(tx);
+    renderTx(tx, ver);
     if (push) history.pushState({ tx: txid }, '', `?tx=${txid}`);
   } catch (e) {
     $('live').classList.remove('on');
@@ -317,29 +333,50 @@ <h1>Verify a Bitcoin block.</h1>
   }
 }
 
-function renderTx(tx) {
+function renderTx(tx, ver) {
   const st = tx.status || {};
   const inT = tx.vin.reduce((s, v) => s + (v.prevout ? v.prevout.value : 0), 0);
   const outT = tx.vout.reduce((s, v) => s + v.value, 0);
-  const vins = tx.vin.map((v) => {
+  const mark = (i) => {
+    const r = ver && ver.res ? ver.res[i] : null;
+    if (!r || r.coinbase) return '';
+    if (r.ok === true) return '<span class="ic g">✓</span> ';
+    if (r.ok === false) return '<span class="ic b">✗</span> ';
+    return '<span class="ic s">○</span> ';
+  };
+  const vins = tx.vin.map((v, i) => {
     if (v.is_coinbase) return `<div class="ior"><div class="top"><span class="amt">newly issued coins</span><span class="typ">coinbase</span></div></div>`;
     const p = v.prevout || {};
-    return `<div class="ior"><div class="top"><span class="amt">${btc(p.value || 0)} BTC</span><span class="typ">${esc(p.scriptpubkey_type || '')}</span></div>`
+    return `<div class="ior"><div class="top"><span class="amt">${mark(i)}${btc(p.value || 0)} BTC</span><span class="typ">${esc(p.scriptpubkey_type || '')}</span></div>`
       + `<div class="sub">from <a href="?tx=${v.txid}" data-tx="${v.txid}">${esc(v.txid.slice(0, 22))}…:${v.vout}</a>${p.scriptpubkey_address ? ' &middot; ' + esc(p.scriptpubkey_address) : ''}</div></div>`;
   }).join('');
   const vouts = tx.vout.map((o) => `<div class="ior"><div class="top"><span class="amt">${btc(o.value)} BTC</span><span class="typ">${esc(o.scriptpubkey_type || '')}</span></div>${o.scriptpubkey_address ? `<div class="sub">${esc(o.scriptpubkey_address)}</div>` : ''}</div>`).join('');
+  let vhero = '';
+  if (ver && ver.total > 0) {
+    vhero = `<div class="vhero ${ver.allOk ? '' : 'bad'}" style="padding:1.4rem 1.4rem 1.2rem">
+      <div class="vc" style="font-size:2.2rem"><span class="cu" data-c="${ver.ok}">0</span> <span style="font-size:1.2rem;letter-spacing:-1px">/ ${ver.total}</span></div>
+      <div class="sl">${ver.allOk ? 'inputs verified' : ver.ok + ' of ' + ver.total + ' inputs verified'}${ver.skipped ? ` &middot; ${ver.skipped} skipped` : ''}</div>
+      <div class="pct">${ver.allOk ? 'scripts &amp; signatures checked' : 'verification failed'}<span class="t"> &middot; in <b style="color:var(--good);font-weight:800">${ver.ms.toFixed(1)} ms</b> by the engine, in your browser</span></div>
+    </div>`;
+  } else if (ver && ver.error) {
+    vhero = `<div class="note" style="margin:0;border-radius:0;border-left:0;border-right:0;border-top:0">Could not run verification (${esc(ver.error)}); detail shown from the explorer.</div>`;
+  } else if (ver && ver.total === 0) {
+    vhero = `<div class="note" style="margin:0;border-radius:0;border-left:0;border-right:0;border-top:0">Coinbase transaction &mdash; newly issued coins, no inputs to verify.</div>`;
+  }
   $('card').innerHTML = `
     <div class="backlink">${st.block_height != null ? `&larr; <a href="?height=${st.block_height}" data-h="${st.block_height}">Block ${fmt(st.block_height)}</a>` : 'unconfirmed (in the mempool)'}</div>
     <div class="chead">
       <div class="h" style="font-size:1rem">Transaction</div>
       <div class="hash">${esc(tx.txid)}</div>
       <div class="meta">${tx.vin.length} in &middot; ${tx.vout.length} out &middot; ${fmt(tx.size)} bytes &middot; weight ${fmt(tx.weight)}${tx.fee != null ? ` &middot; fee ${fmt(tx.fee)} sat` : ''}</div>
     </div>
+    ${vhero}
     <div class="seclab">Inputs (${tx.vin.length})${inT ? ` &middot; ${btc(inT)} BTC` : ''}</div>
     <div class="io">${vins}</div>
     <div class="seclab">Outputs (${tx.vout.length}) &middot; ${btc(outT)} BTC</div>
     <div class="io">${vouts}</div>`;
   $('card').style.display = 'block'; $('card').classList.add('show');
+  $('card').querySelectorAll('.cu[data-c]').forEach((el) => countUp(el, +el.dataset.c));
 }
 
 // every click inside the card stays client-side: tx links fetch one tx, block links re-verify