Reject BitName registrations without a matching reservation

Author: 1440000bytes

lib/state/bitnames.rs

@@ -505,21 +505,24 @@ impl Dbs {
         bitname_data: &crate::types::MutableBitNameData,
         height: u32,
     ) -> Result<(), Error> {
-        // Find the reservation to burn
-        let implied_commitment =
-            filled_tx.implied_reservation_commitment().expect(
-                "A BitName registration tx should have an implied commitment",
-            );
-        let burned_reservation_txid =
-            filled_tx.spent_reservations().find_map(|(_, filled_output)| {
-                let (txid, commitment) = filled_output.reservation_data()
-                    .expect("A spent reservation should correspond to a commitment");
+        // Find the reservation to burn: the spent reservation whose commitment
+        // equals keyed_hash(revealed_nonce, name_hash). This is enforced by
+        // `validate_bitnames`; returning an error here rather than panicking
+        // guards against any unvalidated connection path.
+        let implied_commitment = filled_tx
+            .implied_reservation_commitment()
+            .ok_or(Error::NoReservationForRegistration { bitname })?;
+        let burned_reservation_txid = filled_tx
+            .spent_reservations()
+            .find_map(|(_, filled_output)| {
+                let (txid, commitment) = filled_output.reservation_data()?;
                 if *commitment == implied_commitment {
                     Some(txid)
                 } else {
                     None
                 }
-            }).expect("A BitName registration tx should correspond to a burned reservation");
+            })
+            .ok_or(Error::NoReservationForRegistration { bitname })?;
         if !self.reservations.delete(rwtxn, burned_reservation_txid)? {
             return Err(Error::MissingReservation {
                 txid: *burned_reservation_txid,

lib/state/error.rs

@@ -37,6 +37,11 @@ pub enum BitName {
     MissingReservation { txid: Txid },
     #[error("no BitNames to update")]
     NoBitNamesToUpdate,
+    #[error(
+        "no spent BitName reservation matches the commitment for the \
+         registration of {bitname}"
+    )]
+    NoReservationForRegistration { bitname: BitNameId },
 }
 
 impl From<db::Error> for BitName {

lib/state/mod.rs

@@ -407,6 +407,26 @@ impl State {
             if self.bitnames.try_get_bitname(rotxn, &name_hash)?.is_some() {
                 return Err(Error::BitNameAlreadyRegistered { name_hash });
             }
+            // A registration must burn the reservation that commits to it,
+            // i.e. a spent reservation whose commitment equals
+            // keyed_hash(revealed_nonce, name_hash). Without this check,
+            // `apply_registration` would later fail to find the reservation
+            // to burn.
+            if let Some(implied_commitment) =
+                tx.implied_reservation_commitment()
+            {
+                let burns_matching_reservation =
+                    tx.spent_reservations().any(|(_, filled_output)| {
+                        filled_output.reservation_commitment()
+                            == Some(&implied_commitment)
+                    });
+                if !burns_matching_reservation {
+                    return Err(error::BitName::NoReservationForRegistration {
+                        bitname: name_hash,
+                    }
+                    .into());
+                }
+            }
             if n_bitname_outputs == n_bitname_inputs + 1 {
                 return Ok(());
             };