Merge pull request #2218 from zcash/zcb-improve-warning

zcash_client_backend: Improve `store_decrypted_tx` unsupported `TxOut` warning

Author: nuttycom

Cargo.lock

@@ -78,7 +78,7 @@ crypto-common = { version = "=0.2.0-rc.1" } # later RCs require edition2024
 ripemd = { version = "0.1", default-features = false }
 secp256k1 = { version = "0.29", default-features = false, features = ["alloc"] }
 transparent = { package = "zcash_transparent", version = "0.6.2", path = "zcash_transparent", default-features = false }
-zcash_script = { version = "0.4.2", default-features = false }
+zcash_script = { version = "0.4.3", default-features = false }
 zeroize = { version = "1.7", default-features = false }
 
 # Boilerplate & missing stdlib

Cargo.toml

@@ -1870,6 +1870,11 @@ criteria = "safe-to-deploy"
 delta = "0.15.0 -> 0.16.0"
 notes = "This release involves only updates of previously-vetted dependencies."
 
+[[audits.zcash_script]]
+who = "Jack Grigg <thestr4d@gmail.com>"
+criteria = "safe-to-deploy"
+delta = "0.4.2 -> 0.4.3"
+
 [[audits.zerocopy]]
 who = "Daira-Emma Hopwood <daira@jacaranda.org>"
 criteria = "safe-to-deploy"

supply-chain/audits.toml

@@ -579,10 +579,6 @@ criteria = "safe-to-deploy"
 version = "0.2.11"
 criteria = "safe-to-deploy"
 
-[[exemptions.getrandom]]
-version = "0.3.4"
-criteria = "safe-to-deploy"
-
 [[exemptions.getset]]
 version = "0.1.6"
 criteria = "safe-to-deploy"

supply-chain/config.toml

@@ -2228,6 +2228,11 @@ who = "David Cook <dcook@divviup.org>"
 criteria = "safe-to-deploy"
 delta = "0.2.14 -> 0.2.15"
 
+[[audits.isrg.audits.getrandom]]
+who = "David Cook <dcook@divviup.org>"
+criteria = "safe-to-deploy"
+delta = "0.3.3 -> 0.3.4"
+
 [[audits.isrg.audits.hmac]]
 who = "David Cook <dcook@divviup.org>"
 criteria = "safe-to-deploy"
@@ -2751,6 +2756,31 @@ criteria = "safe-to-deploy"
 delta = "0.3.27 -> 0.3.28"
 aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
 
+[[audits.mozilla.audits.getrandom]]
+who = "Chris Martin <cmartin@mozilla.com>"
+criteria = "safe-to-deploy"
+delta = "0.2.15 -> 0.3.1"
+notes = """
+I've looked over all unsafe code, and it appears to be safe, fully initializing the rng buffers.
+In addition, I've checked Linux, Windows, Mac, and Android more thoroughly against API
+documentation.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
+[[audits.mozilla.audits.getrandom]]
+who = "Emilio Cobos Álvarez <emilio@crisal.io>"
+criteria = "safe-to-deploy"
+delta = "0.3.1 -> 0.3.3"
+notes = """
+Biggest non-trivial change is a new UEFI back-end, which looks reasonable to
+the best of my ability: There's some trickiness on initialization but doesn't
+look unsafe, at worse it leaks, and it might not if the relevant pointers are
+static/non-owning. Other changes also look reasonable too: some tweaks to
+inlining and a syscall-based linux back-end, whose relevant unsafe code looks
+reasonable.
+"""
+aggregated-from = "https://hg.mozilla.org/mozilla-central/raw-file/tip/supply-chain/audits.toml"
+
 [[audits.mozilla.audits.hashbrown]]
 who = "Mike Hommey <mh+mozilla@glandium.org>"
 criteria = "safe-to-deploy"

supply-chain/imports.lock

@@ -8,6 +8,7 @@ use tracing::{debug, info, trace, warn};
 
 use incrementalmerkletree::{Marking, Position, Retention};
 use shardtree::error::ShardTreeError;
+use transparent::address::TransparentAddress;
 use zcash_keys::{address::Receiver, encoding::AddressCodec as _};
 use zcash_primitives::transaction::Transaction;
 use zcash_protocol::{
@@ -983,7 +984,11 @@ where
             .flat_map(|b| b.vout.iter())
             .enumerate()
         {
-            if let Some(address) = txout.recipient_address() {
+            let script_kind = txout.script_kind();
+            if let Some(address) = script_kind
+                .as_ref()
+                .and_then(TransparentAddress::from_script_kind)
+            {
                 debug!(
                     "{:?} output {} has recipient {}",
                     d_tx.tx().txid(),
@@ -1046,6 +1051,13 @@ where
                         value: txout.value(),
                     });
                 }
+            } else if let Some(script_kind) = script_kind {
+                warn!(
+                    "Ignoring unsupported script kind '{}' for tx {} output {}",
+                    script_kind.as_str(),
+                    d_tx.tx().txid(),
+                    output_index
+                );
             } else {
                 warn!(
                     "Unable to determine recipient address for tx {} output {}",

zcash_client_backend/src/data_api/ll/wallet.rs

@@ -11,6 +11,8 @@ workspace.
 ## [0.7.0] - PENDING
 
 ### Added
+- `zcash_transparent::address::TransparentAddress::from_script_kind`
+- `zcash_transparent::bundle::TxOut::script_kind`
 - `zcash_transparent::pczt`:
   - `Input::with_signable_input`
   - `Input::append_signature`

zcash_transparent/CHANGELOG.md

@@ -150,13 +150,20 @@ impl TransparentAddress {
 
     /// Returns the address that this Script contains, if any.
     pub fn from_script_pubkey(script_pubkey: &script::PubKey) -> Option<Self> {
-        solver::standard(script_pubkey).and_then(|script_kind| match script_kind {
+        solver::standard(script_pubkey)
+            .as_ref()
+            .and_then(Self::from_script_kind)
+    }
+
+    /// Returns the address that this `ScriptKind` contains, if any.
+    pub fn from_script_kind(script_kind: &solver::ScriptKind) -> Option<Self> {
+        match script_kind {
             solver::ScriptKind::PubKeyHash { hash } => {
-                Some(TransparentAddress::PublicKeyHash(hash))
+                Some(TransparentAddress::PublicKeyHash(*hash))
             }
-            solver::ScriptKind::ScriptHash { hash } => Some(TransparentAddress::ScriptHash(hash)),
+            solver::ScriptKind::ScriptHash { hash } => Some(TransparentAddress::ScriptHash(*hash)),
             _ => None,
-        })
+        }
     }
 
     /// Generate the `scriptPubKey` corresponding to this address.

zcash_transparent/src/address.rs

@@ -8,6 +8,7 @@ use zcash_script::{
     pattern::push_num,
     pv,
     script::{self, Evaluable as _},
+    solver,
 };
 
 use zcash_protocol::{
@@ -397,10 +398,9 @@ impl TxOut {
 
     /// Returns the address to which the TxOut was sent, if this is a valid P2SH or P2PKH output.
     pub fn recipient_address(&self) -> Option<TransparentAddress> {
-        script::PubKey::parse(&self.script_pubkey.0)
-            .ok()
+        self.script_kind()
             .as_ref()
-            .and_then(TransparentAddress::from_script_pubkey)
+            .and_then(TransparentAddress::from_script_kind)
     }
 
     pub fn value(&self) -> Zatoshis {
@@ -410,6 +410,14 @@ impl TxOut {
     pub fn script_pubkey(&self) -> &Script {
         &self.script_pubkey
     }
+
+    /// Returns the kind of script to which the TxOut was sent, if this is a valid output.
+    pub fn script_kind(&self) -> Option<solver::ScriptKind> {
+        script::PubKey::parse(&self.script_pubkey.0)
+            .ok()
+            .as_ref()
+            .and_then(solver::standard)
+    }
 }
 
 #[cfg(any(test, feature = "test-dependencies"))]