Bitcoin-abc: Fix Transaction Malleability

[SergioDemianLerner]

Apply the following modifications:

• Exclude scriptsigs when computing transaction hashes in GetHash() (optionally rename to GetId() as zCash did).
• Create a new CTransaction method getTransactionFullHash() that includes scriptSigs, similar to the GetHash() method prior this change.
• Modify the leaves of the transaction Merkle-Tree to contain two fields {txHash,fullTxhash} instead of only the txHash.
• When verifying a block, check that the fullTxHash corresponds to the txHash.
• Allow scriptSigs to be padded by trailing NOPs and consider them standard scripts, and standard transactions.
• Before signing a transaction, first estimate the amount of bytes required for each scriptSig
• When signing and computing the transaction hash (SignatureHash), also hash the (estimated/actual) length of the scriptSig of the input being signed, to prevent on-the-wire transaction malleability.
  e.g.
  CHashWriter ss(SER_GETHASH, 0);
  // Version
  ss << txTo.nVersion;
  ss << hashPrevouts;
  ss << hashSequence;
  ss << txTo.vin[nIn].prevout;
  ss << static_cast ss << originalScriptSigLength
  ss << amount;
  ss << txTo.vin[nIn].nSequence;
  ss << hashOutputs;
  ss << txTo.nLockTime;
  ss << nHashType;
• When packing signatures in a scriptSig, add trailing NOPs afterwards to make the actual length reach the estimated length.

[zander]

Sergio; I suggest joining the bitcoin-ml list where changes to the protocol can be discussed between all stakeholders.
https://lists.linuxfoundation.org/mailman/listinfo/bitcoin-ml