main: cap signature operations per block (#20)

MAX_SIZE bounds a block's bytes, not what it costs to check. Every
OP_CHECKSIG is an elliptic-curve verification, and blocks may be 32 MB
here, so one packed with signature operations takes every node minutes of
CPU to reject -- while at this chain's difficulty it stays cheap to mine.
There was no counter at all.

CheckBlock now sums signature operations across the block and rejects
past 20000, the figure Bitcoin settled on. OP_CHECKMULTISIG counts as 20
since it may verify that many.

Consensus change. Real blocks here carry one or two operations each --
coinbase pay-to-pubkey and standard pay-to-pubkey-hash spends -- so the
ceiling is four orders of magnitude above anything in the chain, but it
still needs verifying against the full history before merge.

3 files changed, 48 insertions, 0 deletions

diff --git a/src/main.cpp b/src/main.cpp
index 17e446e..a75bf54 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -1261,6 +1261,16 @@ bool CBlock::CheckBlock() const
         if (!tx.CheckTransaction())
             return error("CheckBlock() : CheckTransaction failed");
 
+    // Cap the work a block can demand. MAX_SIZE bounds the bytes, not the cost:
+    // every signature operation is an elliptic-curve verification, and at this
+    // chain's difficulty a block packed with them is affordable to mine and
+    // expensive for everyone else to reject.
+    unsigned int nSigOps = 0;
+    foreach(const CTransaction& tx, vtx)
+        nSigOps += tx.GetSigOpCount();
+    if (nSigOps > MAX_BLOCK_SIGOPS)
+        return error("CheckBlock() : out-of-bounds signature operation count");
+
     // Reject blocks carrying the same transaction twice (CVE-2012-2459).
     //
     // BuildMerkleTree duplicates the last hash when a level has an odd width,
diff --git a/src/main.h b/src/main.h
index 40f8d45..fde3a4e 100644
--- a/src/main.h
+++ b/src/main.h
@@ -18,6 +18,11 @@ static const unsigned int MAX_SIZE = 0x02000000;
 // Ceiling on transactions held waiting for a parent that has not arrived.
 // They cost a peer nothing to send and are never validated, only stored.
 static const unsigned int MAX_ORPHAN_TRANSACTIONS = 100;
+// Signature operations allowed in one block. Size alone does not bound what a
+// block costs to validate: every OP_CHECKSIG is an elliptic-curve verification,
+// so a block within the size limit could still hold millions of them and take
+// the network minutes of CPU to reject. Same value Bitcoin settled on.
+static const unsigned int MAX_BLOCK_SIGOPS = 20000;
 static const int64 COIN = 100000000;
 // Total Bitflash emission: identical to Bitcoin (21 million).
 // MAX_MONEY guards against the value overflow bug (CVE-2010-5139), which in
@@ -503,6 +508,16 @@ public:
         return (vin.size() == 1 && vin[0].prevout.IsNull());
     }
 
+    unsigned int GetSigOpCount() const
+    {
+        unsigned int n = 0;
+        foreach(const CTxIn& txin, vin)
+            n += txin.scriptSig.GetSigOpCount();
+        foreach(const CTxOut& txout, vout)
+            n += txout.scriptPubKey.GetSigOpCount();
+        return n;
+    }
+
     bool CheckTransaction() const
     {
         // Basic checks that don't depend on any context
diff --git a/src/script.h b/src/script.h
index 27c1b13..26bb65a 100644
--- a/src/script.h
+++ b/src/script.h
@@ -536,6 +536,29 @@ public:
     }
 
 
+    // Signature operations in this script. Each one costs every validating
+    // node an elliptic-curve verification, so blocks are capped on this count
+    // and not only on their size -- a byte of OP_CHECKSIG is far more
+    // expensive to check than a byte of anything else.
+    unsigned int GetSigOpCount() const
+    {
+        unsigned int n = 0;
+        const_iterator pc = begin();
+        opcodetype opcode;
+        vector<unsigned char> vchPushValue;
+        while (pc < end())
+        {
+            if (!GetOp(pc, opcode, vchPushValue))
+                break;
+            if (opcode == OP_CHECKSIG || opcode == OP_CHECKSIGVERIFY)
+                n++;
+            else if (opcode == OP_CHECKMULTISIG || opcode == OP_CHECKMULTISIGVERIFY)
+                n += 20;
+        }
+        return n;
+    }
+
+
     void FindAndDelete(const CScript& b)
     {
         iterator pc = begin();