davideandClaude Sonnet 5.5
54dbffb552
A user could bet and then double-spend the 1-conference deposit that funded the bet with a private chain: the bet left the chain but its participant stayed `confirmed`, and the payout failed "insufficient pool UTXOs" for ever with everyone else's money stuck. Coinbase outputs were also credited at 1 confirmation (maturity is 120). Deposits - `round_config.deposit_confirmations` (default 6, 1-100, editable from /admin) is the threshold for a deposit; an output of a platform transaction (any txid of a pending_transactions row, RBF versions included) keeps 1; a coinbase output needs 120, recognised from the raw transaction, which must hash to the txid (`is_coinbase`, cached). `read_deposit_policy` / `classify_new_deposits` run between the read and the write, so no session is open across the lookup. - The quorum must also place the coin deep enough on our own tip (ELC-17). - Confirmed outputs short of their threshold are pending deposits (memory only, replaced at every refresh): shown in `pending_balance_sats` / `has_pending` (also for DEP-13's withdrawal message), never spendable. No scripthash notification announces a maturing deposit, so each new block refreshes only the users that have one, one task per user (DEP-09 now says so). Payout - `_trigger_payout` verifies the round's confirmed participants' bet outputs with the other servers (`verify_pool_outpoints`: strict majority of >= 2 answers per outpoint, a mempool-only coin or a tie gives no verdict) and builds from exactly those outpoints (RND-22), never from whatever else sits at the address. No quorum: `payout_failed`, `pool verification unavailable`, nothing changes. Bets that are gone become `reorged_out`, one `participant_reorged_out` row each, `pool_amount_sats` rewritten (only downward) in the same transaction, and the 70/30 split is computed on what is left. - Winner's own bet gone: nothing is built; `rounds.payout_blocked_at` (Alembic f2c64a8d1e93, with `deposit_confirmations`, plain add_column) is set, `payout_blocked` and the pause with `paused_reason = 'payout_blocked'` are written in one transaction; `POST /admin/resume` clears the mark and the next attempt verifies again. /admin/rounds returns it. - Rounds opened before B-80 (pool = the shared reserve address) keep the old active-server `listunspent` choice, since that address holds no single round's bets. Ambiguities resolved: the winner's row stays `confirmed` while held (AUD-45 says every participant whose bet is gone becomes `reorged_out`, but OPS-30/DAT-68 need the verification to repeat after the resume, which only a `confirmed` row allows); `/`'s deposit hint no longer says "1 confirmation" (7 languages, same keys); guides updated. Tests changed because the spec changed: listener tests that credited height-100 coins at tip 0 now set a tip past every threshold; the payout fixtures seed confirmed participants (the new source of the inputs) instead of an active-server `listunspent`, FakeNetwork answers the verification, and test_round_pool_address asserts the quorum is asked about the round's address. New: thresholds at exactly 6/5, configured value, coinbase at 119/120 and a mismatching or missing raw tx, platform outputs at 1, dust, quorum height, waiting-deposit display and disappearance, block-triggered refresh, resume, verification verdicts, gone bets excluded with the split recomputed, winner gone held and paused, held payouts untouched until the resume, re-verification after it, no quorum, a payout with 1 and with 400 participants against reserve+fee+dust, admin config bounds and migration. Mutation-checked: threshold 1, ignored coinbase, no height bound, no verification and no winner hold each fail tests. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
95 lines
4.1 KiB
Python
95 lines
4.1 KiB
Python
"""Test doubles for what the services ask of the network (B-76 and after)."""
|
|
|
|
from app.electrum.client import ElectrumRpcError
|
|
|
|
|
|
def rpc_error(message: str, code: int = -26) -> ElectrumRpcError:
|
|
"""A server that answered with a JSON-RPC `error` object — an explicit refusal."""
|
|
return ElectrumRpcError({"code": code, "message": message})
|
|
|
|
|
|
class FakeNetwork:
|
|
"""The ElectrumListener surface a broadcast needs: `known` is what
|
|
`transaction_known` answers (True: some server has it, False: every server denies
|
|
it, None: too few answers to tell); fanned-out transactions are recorded."""
|
|
|
|
def __init__(self, known: bool | None = False, proven: bool = True):
|
|
self.known = known
|
|
self.proven = proven # what `confirmation_proven` answers (B-83)
|
|
self.asked: list[str] = []
|
|
self.fanned_out: list[str] = []
|
|
self.proofs_asked: list[tuple[str, int]] = []
|
|
# B-82: what `verify_pool_outpoints` answers. Every bet output is present unless listed
|
|
# in `pool_absent`; `pool_unavailable` models a quorum that could not be reached.
|
|
self.pool_absent: set[tuple[str, int]] = set()
|
|
self.pool_unavailable = False
|
|
self.verified_scripthashes: list[str] = []
|
|
self.verified_outpoints: list[list[tuple[str, int, int]]] = []
|
|
|
|
async def transaction_known(self, txid: str) -> bool | None:
|
|
self.asked.append(txid)
|
|
return self.known
|
|
|
|
def fan_out_transaction(self, raw_tx_hex: str) -> None:
|
|
self.fanned_out.append(raw_tx_hex)
|
|
|
|
async def confirmation_proven(self, txid: str, height: int) -> bool:
|
|
self.proofs_asked.append((txid, height))
|
|
return self.proven
|
|
|
|
async def verify_pool_outpoints(self, scripthash, outpoints):
|
|
self.verified_scripthashes.append(scripthash)
|
|
self.verified_outpoints.append(list(outpoints))
|
|
hook = getattr(self, "on_verify", None)
|
|
if hook is not None:
|
|
await hook()
|
|
if self.pool_unavailable:
|
|
return None
|
|
return {(txid, vout): (txid, vout) not in self.pool_absent for txid, vout, _amount in outpoints}
|
|
|
|
|
|
MISSING_INPUTS = "bad-txns-inputs-missingorspent"
|
|
|
|
|
|
class ScriptedNetwork(FakeNetwork):
|
|
"""What the reconciler asks of the listener (B-78), scripted per test.
|
|
|
|
`active` and `others` are the history answers of the active server and of each other
|
|
server — a list of {"tx_hash", "height"} entries, or None for a server that did not
|
|
answer. `spender` is what `confirmed_spender` returns (the txid of a mined
|
|
transaction spending the row's inputs, or None). `rebroadcast` is the
|
|
(active, others) pair of verdicts `rebroadcast_everywhere` returns: ("accepted", ""),
|
|
("refused", message) or None."""
|
|
|
|
def __init__(self, *, active=(), others=((), ()), spender=None, rebroadcast=None, others_needed=2, proven=True):
|
|
super().__init__(known=False, proven=proven)
|
|
self.active = None if active is None else list(active)
|
|
self.others = tuple(None if o is None else list(o) for o in others)
|
|
self.spender = spender
|
|
self.rebroadcast = rebroadcast
|
|
self.others_needed = others_needed
|
|
self.history_calls = 0
|
|
self.rebroadcast_calls: list[str] = []
|
|
|
|
async def get_histories(self, scripthash):
|
|
from app.electrum.quorum import ServerAnswers
|
|
|
|
self.history_calls += 1
|
|
return ServerAnswers(self.active, self.others, self.others_needed)
|
|
|
|
async def confirmed_spender(self, scripthash, own_txids, outpoints):
|
|
return self.spender
|
|
|
|
async def rebroadcast_everywhere(self, raw_tx_hex):
|
|
from app.electrum.quorum import ServerAnswers
|
|
|
|
self.rebroadcast_calls.append(raw_tx_hex)
|
|
active, others = self.rebroadcast if self.rebroadcast is not None else (None, (None, None))
|
|
return ServerAnswers(active, tuple(others), self.others_needed)
|
|
|
|
@classmethod
|
|
def proof_of_absence(cls, message: str = MISSING_INPUTS, **kwargs):
|
|
"""Nobody of the quorum knows the tx and every server refuses it for missing inputs."""
|
|
refusal = ("refused", message)
|
|
return cls(rebroadcast=(refusal, (refusal, refusal)), **kwargs)
|