fix(crypto): resolve the invalid witness

build.gradle

@@ -47,7 +47,7 @@ subprojects {
         implementation group: 'org.apache.commons', name: 'commons-math', version: '2.2'
         implementation "org.apache.commons:commons-collections4:4.1"
         implementation group: 'joda-time', name: 'joda-time', version: '2.3'
-        implementation group: 'org.bouncycastle', name: 'bcprov-jdk15on', version: '1.69'
+        implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.79'
 
         compileOnly 'org.projectlombok:lombok:1.18.12'
         annotationProcessor 'org.projectlombok:lombok:1.18.12'

chainbase/src/main/java/org/tron/common/utils/LocalWitnesses.java

@@ -32,6 +32,7 @@ public class LocalWitnesses {
   @Getter
   private List<String> privateKeys = Lists.newArrayList();
 
+  @Getter
   private byte[] witnessAccountAddress;
 
   public LocalWitnesses() {
@@ -45,21 +46,11 @@ public LocalWitnesses(List<String> privateKeys) {
     setPrivateKeys(privateKeys);
   }
 
-  public byte[] getWitnessAccountAddress(boolean isECKeyCryptoEngine) {
-    if (witnessAccountAddress == null) {
-      byte[] privateKey = ByteArray.fromHexString(getPrivateKey());
-      final SignInterface cryptoEngine = SignUtils.fromPrivate(privateKey, isECKeyCryptoEngine);
-      this.witnessAccountAddress = cryptoEngine.getAddress();
-    }
-    return witnessAccountAddress;
-  }
-
-  public void setWitnessAccountAddress(final byte[] localWitnessAccountAddress) {
-    this.witnessAccountAddress = localWitnessAccountAddress;
-  }
-
-  public void initWitnessAccountAddress(boolean isECKeyCryptoEngine) {
-    if (witnessAccountAddress == null) {
+  public void initWitnessAccountAddress(final byte[] witnessAddress,
+      boolean isECKeyCryptoEngine) {
+    if (witnessAddress != null) {
+      this.witnessAccountAddress = witnessAddress;
+    } else if (!CollectionUtils.isEmpty(privateKeys)) {
       byte[] privateKey = ByteArray.fromHexString(getPrivateKey());
       final SignInterface ecKey = SignUtils.fromPrivate(privateKey,
           isECKeyCryptoEngine);
@@ -85,11 +76,15 @@ private void validate(String privateKey) {
       privateKey = privateKey.substring(2);
     }
 
-    if (StringUtils.isNotBlank(privateKey)
-        && privateKey.length() != ChainConstant.PRIVATE_KEY_LENGTH) {
+    if (StringUtils.isBlank(privateKey)
+        || privateKey.length() != ChainConstant.PRIVATE_KEY_LENGTH) {
       throw new IllegalArgumentException(
-          String.format("private key must be %d-bits hex string, actual: %d",
-              ChainConstant.PRIVATE_KEY_LENGTH, privateKey.length()));
+          String.format("private key must be %d hex string, actual: %d",
+              ChainConstant.PRIVATE_KEY_LENGTH,
+              StringUtils.isBlank(privateKey) ? 0 : privateKey.length()));
+    }
+    if (!StringUtil.isHexadecimal(privateKey)) {
+      throw new IllegalArgumentException("private key must be hex string");
     }
   }
 

common/src/main/java/org/tron/common/utils/StringUtil.java

@@ -44,4 +44,21 @@ public static String createReadableString(ByteString string) {
   public static ByteString hexString2ByteString(String hexString) {
     return ByteString.copyFrom(ByteArray.fromHexString(hexString));
   }
+
+  public static boolean isHexadecimal(String str) {
+    if (str == null || str.isEmpty()) {
+      return false;
+    }
+    if (str.length() % 2 != 0) {
+      return false;
+    }
+
+    for (int i = 0; i < str.length(); i++) {
+      char c = str.charAt(i);
+      if (Character.digit(c, 16) == -1) {
+        return false;
+      }
+    }
+    return true;
+  }
 }

crypto/src/main/java/org/tron/common/crypto/ECKey.java

@@ -55,6 +55,7 @@
 import org.tron.common.crypto.jce.ECKeyPairGenerator;
 import org.tron.common.crypto.jce.TronCastleProvider;
 import org.tron.common.utils.BIUtil;
+import org.tron.common.utils.ByteArray;
 import org.tron.common.utils.ByteUtil;
 
 @Slf4j(topic = "crypto")
@@ -285,7 +286,7 @@ public static ECKey fromPrivate(BigInteger privKey) {
    * @return -
    */
   public static ECKey fromPrivate(byte[] privKeyBytes) {
-    if (Objects.isNull(privKeyBytes)) {
+    if (ByteArray.isEmpty(privKeyBytes)) {
       return null;
     }
     return fromPrivate(new BigInteger(1, privKeyBytes));

crypto/src/main/java/org/tron/common/crypto/sm2/SM2.java

@@ -41,6 +41,7 @@
 import org.tron.common.crypto.SignatureInterface;
 import org.tron.common.crypto.jce.ECKeyFactory;
 import org.tron.common.crypto.jce.TronCastleProvider;
+import org.tron.common.utils.ByteArray;
 import org.tron.common.utils.ByteUtil;
 
 /**
@@ -247,7 +248,7 @@ public static SM2 fromPrivate(BigInteger privKey) {
    * @return -
    */
   public static SM2 fromPrivate(byte[] privKeyBytes) {
-    if (Objects.isNull(privKeyBytes)) {
+    if (ByteArray.isEmpty(privKeyBytes)) {
       return null;
     }
     return fromPrivate(new BigInteger(1, privKeyBytes));

framework/src/main/java/org/tron/core/config/args/Args.java

@@ -405,31 +405,33 @@ public static void setParam(final Config config) {
 
     if (StringUtils.isNoneBlank(PARAMETER.privateKey)) {
       localWitnesses = (new LocalWitnesses(PARAMETER.privateKey));
+      byte[] witnessAddress = null;
       if (StringUtils.isNoneBlank(PARAMETER.witnessAddress)) {
-        byte[] bytes = Commons.decodeFromBase58Check(PARAMETER.witnessAddress);
-        if (bytes != null) {
-          localWitnesses.setWitnessAccountAddress(bytes);
+        witnessAddress = Commons.decodeFromBase58Check(PARAMETER.witnessAddress);
+        if (witnessAddress != null) {
           logger.debug("Got localWitnessAccountAddress from cmd");
         } else {
           PARAMETER.witnessAddress = "";
           logger.warn(IGNORE_WRONG_WITNESS_ADDRESS_FORMAT);
         }
       }
-      localWitnesses.initWitnessAccountAddress(PARAMETER.isECKeyCryptoEngine());
+      localWitnesses.initWitnessAccountAddress(witnessAddress, PARAMETER.isECKeyCryptoEngine());
       logger.debug("Got privateKey from cmd");
     } else if (config.hasPath(Constant.LOCAL_WITNESS)) {
       localWitnesses = new LocalWitnesses();
+      byte[] witnessAddress = getWitnessAddress(config);
       List<String> localwitness = config.getStringList(Constant.LOCAL_WITNESS);
-      localWitnesses.setPrivateKeys(localwitness);
-      witnessAddressCheck(config);
-      localWitnesses.initWitnessAccountAddress(PARAMETER.isECKeyCryptoEngine());
-      logger.debug("Got privateKey from config.conf");
+      if (!localwitness.isEmpty()) {
+        localWitnesses.setPrivateKeys(localwitness);
+        logger.debug("Got privateKey from config.conf");
+      }
+      localWitnesses.initWitnessAccountAddress(witnessAddress, PARAMETER.isECKeyCryptoEngine());
     } else if (config.hasPath(Constant.LOCAL_WITNESS_KEYSTORE)) {
       localWitnesses = new LocalWitnesses();
       List<String> privateKeys = new ArrayList<String>();
       if (PARAMETER.isWitness()) {
         List<String> localwitness = config.getStringList(Constant.LOCAL_WITNESS_KEYSTORE);
-        if (localwitness.size() > 0) {
+        if (!localwitness.isEmpty()) {
           String fileName = System.getProperty("user.dir") + "/" + localwitness.get(0);
           String password;
           if (StringUtils.isEmpty(PARAMETER.password)) {
@@ -453,8 +455,8 @@ public static void setParam(final Config config) {
         }
       }
       localWitnesses.setPrivateKeys(privateKeys);
-      witnessAddressCheck(config);
-      localWitnesses.initWitnessAccountAddress(PARAMETER.isECKeyCryptoEngine());
+      byte[] witnessAddress = getWitnessAddress(config);
+      localWitnesses.initWitnessAccountAddress(witnessAddress, PARAMETER.isECKeyCryptoEngine());
       logger.debug("Got privateKey from keystore");
     }
 
@@ -1773,17 +1775,18 @@ public static void setFullNodeAllowShieldedTransaction(boolean fullNodeAllowShie
     PARAMETER.fullNodeAllowShieldedTransactionArgs = fullNodeAllowShieldedTransaction;
   }
 
-  private static void witnessAddressCheck(Config config) {
+  private static byte[] getWitnessAddress(Config config) {
+    byte[] witnessAddress = null;
     if (config.hasPath(Constant.LOCAL_WITNESS_ACCOUNT_ADDRESS)) {
-      byte[] bytes = Commons
+      witnessAddress = Commons
           .decodeFromBase58Check(config.getString(Constant.LOCAL_WITNESS_ACCOUNT_ADDRESS));
-      if (bytes != null) {
-        localWitnesses.setWitnessAccountAddress(bytes);
+      if (witnessAddress != null) {
         logger.debug("Got localWitnessAccountAddress from config.conf");
       } else {
         logger.warn(IGNORE_WRONG_WITNESS_ADDRESS_FORMAT);
       }
     }
+    return witnessAddress;
   }
 
   /**

framework/src/main/java/org/tron/core/consensus/ConsensusService.java

@@ -61,17 +61,18 @@ public void start() {
         logger.info("Add witness: {}, size: {}",
             Hex.toHexString(privateKeyAddress), miners.size());
       }
-    } else {
+    } else if (privateKeys.size() == 1) {
       byte[] privateKey =
           fromHexString(Args.getLocalWitnesses().getPrivateKey());
       byte[] privateKeyAddress = SignUtils.fromPrivate(privateKey,
           Args.getInstance().isECKeyCryptoEngine()).getAddress();
-      byte[] witnessAddress = Args.getLocalWitnesses().getWitnessAccountAddress(
-          Args.getInstance().isECKeyCryptoEngine());
+      byte[] witnessAddress = Args.getLocalWitnesses().getWitnessAccountAddress();
       WitnessCapsule witnessCapsule = witnessStore.get(witnessAddress);
       if (null == witnessCapsule) {
         logger.warn("Witness {} is not in witnessStore.", Hex.toHexString(witnessAddress));
       }
+      // In multi-signature mode, the address derived from the private key may differ from
+      // witnessAddress.
       Miner miner = param.new Miner(privateKey, ByteString.copyFrom(privateKeyAddress),
           ByteString.copyFrom(witnessAddress));
       miners.add(miner);

framework/src/main/java/org/tron/core/metrics/node/NodeMetricManager.java

@@ -5,6 +5,7 @@
 import org.springframework.stereotype.Component;
 import org.tron.common.backup.BackupManager;
 import org.tron.common.parameter.CommonParameter;
+import org.tron.common.utils.ByteUtil;
 import org.tron.core.ChainBaseManager;
 import org.tron.core.config.args.Args;
 import org.tron.program.Version;
@@ -36,8 +37,9 @@ private void setNodeInfo(NodeInfo nodeInfo) {
 
     nodeInfo.setIp(Args.getInstance().getNodeExternalIp());
 
-    ByteString witnessAddress = ByteString.copyFrom(Args.getLocalWitnesses()
-        .getWitnessAccountAddress(CommonParameter.getInstance().isECKeyCryptoEngine()));
+    byte[] witnessAccountAddress = Args.getLocalWitnesses().getWitnessAccountAddress();
+    ByteString witnessAddress = !ByteUtil.isNullOrZeroArray(witnessAccountAddress) ? ByteString
+        .copyFrom(witnessAccountAddress) : null;
     if (chainBaseManager.getWitnessScheduleStore().getActiveWitnesses().contains(witnessAddress)) {
       nodeInfo.setNodeType(1);
     } else {

framework/src/main/java/org/tron/core/net/service/relay/RelayService.java

@@ -66,11 +66,11 @@ public class RelayService {
 
   private List<InetSocketAddress> fastForwardNodes = parameter.getFastForwardNodes();
 
-  private ByteString witnessAddress = ByteString
-      .copyFrom(Args.getLocalWitnesses().getWitnessAccountAddress(CommonParameter.getInstance()
-          .isECKeyCryptoEngine()));
+  private final int keySize = Args.getLocalWitnesses().getPrivateKeys().size();
 
-  private int keySize = Args.getLocalWitnesses().getPrivateKeys().size();
+  private final ByteString witnessAddress =
+      Args.getLocalWitnesses().getWitnessAccountAddress() != null ? ByteString
+          .copyFrom(Args.getLocalWitnesses().getWitnessAccountAddress()) : null;
 
   private int maxFastForwardNum = Args.getInstance().getMaxFastForwardNum();
 

framework/src/test/java/org/tron/core/capsule/BlockCapsuleTest.java

@@ -134,7 +134,7 @@ public void testHasWitnessSignature() {
 
     localWitnesses = new LocalWitnesses();
     localWitnesses.setPrivateKeys(Arrays.asList(privateKey));
-    localWitnesses.initWitnessAccountAddress(true);
+    localWitnesses.initWitnessAccountAddress(null, true);
     Args.setLocalWitnesses(localWitnesses);
 
     Assert.assertFalse(blockCapsule0.hasWitnessSignature());

framework/src/test/java/org/tron/core/config/args/ArgsTest.java

@@ -65,10 +65,10 @@ public void get() {
 
     localWitnesses = new LocalWitnesses();
     localWitnesses.setPrivateKeys(Arrays.asList(privateKey));
-    localWitnesses.initWitnessAccountAddress(true);
+    localWitnesses.initWitnessAccountAddress(null, true);
     Args.setLocalWitnesses(localWitnesses);
     address = ByteArray.toHexString(Args.getLocalWitnesses()
-        .getWitnessAccountAddress(CommonParameter.getInstance().isECKeyCryptoEngine()));
+        .getWitnessAccountAddress());
     Assert.assertEquals(Constant.ADD_PRE_FIX_STRING_TESTNET, DecodeUtil.addressPreFixString);
     Assert.assertEquals(0, parameter.getBackupPriority());
 
@@ -126,7 +126,7 @@ public void get() {
 
     Assert.assertEquals(address,
         ByteArray.toHexString(Args.getLocalWitnesses()
-            .getWitnessAccountAddress(CommonParameter.getInstance().isECKeyCryptoEngine())));
+            .getWitnessAccountAddress()));
   }
 
   @Test