ddk: verify a signed contract from its three messages - #231

Summary

Item 2 of #225. apply_funding_signatures copied the offering party's funding witnesses without checking them, and finalize_sign trusted them. advanced::verify_cet_adaptor_signatures rebuilds under the default fee rule, so a contract signed under OwnPayoutOnly couldn't be verified through the public API. Lygos wrote its own verify_sign to cover all of this.

API

• ddk::contract::verify_signed_contract(offer, accept, sign) -> VerifiedContract picks the fee rule from the sign message's contract id, the same way create_signed_dlc_transactions does. It then checks:
  • both parties' refund signatures and CET adaptor signatures;
  • each ordinary offer funding witness against the output it spends: P2WPKH, P2SH-P2WPKH or Taproot key path, with SIGHASH_ALL and the correct script_sig;
  • each offer splice half against the previous contract's offer key. A half is [half] or [half, key]; anything else is rejected.
• A success means everything the three messages carry was verified. An offer funding witness DDK can't check fails, and so does one longer than its input's declared max_witness_len:
  • an input of any other script type, such as P2WSH multisig from an external signer, fails with ContractError::UnverifiableFundingWitness;
  • a witness over max_witness_len fails with ContractError::FundingWitnessTooLong. The funding fee was paid on the declared length, so a longer witness pays less than the agreed rate.
• VerifiedContract exposes contract_id(), transactions() and into_transactions().
  • The accepting party's funding witnesses and splice halves never travel in the messages, so they can't be checked here.
• ddk-dlc:
  • verify_funding_witness(secp, fund_tx, index, &TxInputInfo, prevouts, &Witness), plus new Error::UnsupportedScriptType and Error::WitnessTooLong.
  • A 65-byte Taproot signature with hash type 0x00 is rejected. BIP-341 allows the default type only in the 64-byte form; bitcoin's Signature::from_slice accepts it, and such a witness can't confirm.
  • util::multisig_witness(script, (pk, sig), (pk, sig)). sign_multi_sig_input and combine_dlc_input_signatures both use it, so there is one 2-of-2 witness builder.

Lifecycle

• finalize_sign, finalize_sign_spliced and the advanced::finalize_sign_*_with_funding_signatures variants run verify_signed_contract first, so they now refuse an offer funded from a script type DDK can't check, and an offer witness over its declared length. That replaces the separate offer-half check in complete_dlc_input_witnesses, so there is one verification path. Finalize also picks the fee rule from the sign message now, instead of always using the current rule.
• The signature checks in context.rs are split into verify_refund_signature and verify_adaptor_signatures. sign.rs, advanced.rs and settle.rs use them instead of their own copies.
• advanced::verify_cet_adaptor_signatures runs before a sign message exists, so it has no contract id to pick a fee rule. It is documented as such and points to verify_signed_contract.

Breaking changes

• Behaviour: finalize_sign and its variants refuse a contract whose offer is funded from a P2WSH multisig (or any script other than P2WPKH, P2SH-P2WPKH or Taproot key path). An external signer that funded offers that way finalized before this PR and doesn't now.
• Behaviour: an offer funding witness longer than its input's max_witness_len is refused. A P2WPKH witness with a low-S signature is at most 108 bytes (1 + 1 + 72 + 1 + 33), so the standard declared 108 holds without low-R grinding.
• ddk: ContractError gains UnverifiableFundingWitness and FundingWitnessTooLong.
• ddk-dlc: combine_dlc_input_signatures takes &[u8] and returns Result<Witness, Error>. Add ? at call sites.
• ddk-dlc: verify_dlc_funding_input_signature requires DER plus SIGHASH_ALL; it used to accept a compact signature. Callers holding a raw signature pass util::finalize_sig(&sig, EcdsaSighashType::All).
• ddk-dlc: Error gains UnsupportedScriptType and WitnessTooLong.

Not changed / follow-ups

• Settlement and splice construction still rebuild with signed_context rather than consuming VerifiedContract. A refund should only need the counterparty's refund signature, and the keyless-settlement PR (ddk: settle a contract from its messages without a key #228) restructures settle.rs. Settlement entry points on VerifiedContract should follow once both land.
• A manager splice offered by the previous contract's accepting party signs with remote_fund_pubkey. The stateless API checks local_fund_pubkey, as master already did.
• ddk-ffi (ffi/src/lib.rs:470) passes pre-sorted keys to combine_dlc_input_signatures while the signatures stay in local/remote order. When local_pk > remote_pk that builds an invalid witness. This bug predates this PR; it needs a fix in ddk-ffi, along with the new ?.

Testing

• New in ddk-dlc:
  • funding_witnesses_verify_for_each_supported_coin: all three coin types verify. Taproot SIGHASH_NONE, a P2WSH coin, and a missing, wrong or unexpected script_sig are each rejected.
  • multisig_witness_orders_signatures_by_public_key.
• New in ddk/tests/stateless.rs:
  • a valid contract verifies, and so does the pre-rc.4 OwnPayoutOnly fixture;
  • these are rejected: a tampered offer witness, a wrong-key witness, a SIGHASH_NONE witness, a tampered refund signature (each side), a tampered adaptor signature (each side), and a non-ALL splice half;
  • a splice half may carry its key but nothing else;
  • an offer funded from a script DDK can't check is refused, and so is an offer witness longer than its declared max_witness_len;
  • finalize_sign rejects a bad funding witness.
• Unit suites: ddk-dlc 25, ddk contract:: 29, stateless 63, ddk-manager lib 62, all passing.
• stateless_execution --ignored on regtest: single-funded, splice in/out, alternating splice chain, accept-party splice, numeric, disjoint and the DDK wallet signer all pass.
• cargo fmt --check, cargo clippy -- -D warnings, cargo check -p ddk --no-default-features and cargo check -p ddk-dlc --no-default-features --features no-std pass.
• Reviewed by GPT-6 Astra. Fixed from the review:
  • script_sig was unchecked;
  • unsupported script types were rejected at finalize, which broke external funding;
  • extra trailing elements after a splice half were accepted;
  • migration notes were missing.
    The remaining points are listed above.
• Checked against Orange Grove's DLCs:
  • all 180 signed staging contracts, made under ddk 1.x (OwnPayoutOnly) and 2.0, pass verify_signed_contract, and each rebuilds the funding txid on chain;
  • Orange Grove's test suite passes with its verify_sign replaced by verify_signed_contract.