fix(crypto): resolve the invalid witness

build.gradle

@@ -47,7 +47,7 @@ subprojects {
         implementation group: 'org.apache.commons', name: 'commons-math', version: '2.2'
         implementation "org.apache.commons:commons-collections4:4.1"
         implementation group: 'joda-time', name: 'joda-time', version: '2.3'
-        implementation group: 'org.bouncycastle', name: 'bcprov-jdk15on', version: '1.69'
+        implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.79'
 
         compileOnly 'org.projectlombok:lombok:1.18.12'
         annotationProcessor 'org.projectlombok:lombok:1.18.12'

chainbase/src/main/java/org/tron/common/utils/LocalWitnesses.java

@@ -46,7 +46,7 @@ public LocalWitnesses(List<String> privateKeys) {
   }
 
   public byte[] getWitnessAccountAddress(boolean isECKeyCryptoEngine) {
-    if (witnessAccountAddress == null) {
+    if (witnessAccountAddress == null && !CollectionUtils.isEmpty(privateKeys)) {
       byte[] privateKey = ByteArray.fromHexString(getPrivateKey());
       final SignInterface cryptoEngine = SignUtils.fromPrivate(privateKey, isECKeyCryptoEngine);
       this.witnessAccountAddress = cryptoEngine.getAddress();
@@ -59,7 +59,7 @@ public void setWitnessAccountAddress(final byte[] localWitnessAccountAddress) {
   }
 
   public void initWitnessAccountAddress(boolean isECKeyCryptoEngine) {
-    if (witnessAccountAddress == null) {
+    if (witnessAccountAddress == null && !CollectionUtils.isEmpty(privateKeys)) {
       byte[] privateKey = ByteArray.fromHexString(getPrivateKey());
       final SignInterface ecKey = SignUtils.fromPrivate(privateKey,
           isECKeyCryptoEngine);
@@ -85,8 +85,8 @@ private void validate(String privateKey) {
       privateKey = privateKey.substring(2);
     }
 
-    if (StringUtils.isNotBlank(privateKey)
-        && privateKey.length() != ChainConstant.PRIVATE_KEY_LENGTH) {
+    if (StringUtils.isBlank(privateKey) || (StringUtils.isNotBlank(privateKey)
+        && privateKey.length() != ChainConstant.PRIVATE_KEY_LENGTH)) {
       throw new IllegalArgumentException(
           String.format("private key must be %d-bits hex string, actual: %d",
               ChainConstant.PRIVATE_KEY_LENGTH, privateKey.length()));

crypto/src/main/java/org/tron/common/crypto/ECKey.java

@@ -285,7 +285,7 @@ public static ECKey fromPrivate(BigInteger privKey) {
    * @return -
    */
   public static ECKey fromPrivate(byte[] privKeyBytes) {
-    if (Objects.isNull(privKeyBytes)) {
+    if (ByteUtil.isNullOrZeroArray(privKeyBytes)) {
       return null;
     }
     return fromPrivate(new BigInteger(1, privKeyBytes));

crypto/src/main/java/org/tron/common/crypto/sm2/SM2.java

@@ -247,7 +247,7 @@ public static SM2 fromPrivate(BigInteger privKey) {
    * @return -
    */
   public static SM2 fromPrivate(byte[] privKeyBytes) {
-    if (Objects.isNull(privKeyBytes)) {
+    if (ByteUtil.isNullOrZeroArray(privKeyBytes)) {
       return null;
     }
     return fromPrivate(new BigInteger(1, privKeyBytes));

framework/src/main/java/org/tron/core/config/args/Args.java

@@ -420,10 +420,12 @@ public static void setParam(final Config config) {
     } else if (config.hasPath(Constant.LOCAL_WITNESS)) {
       localWitnesses = new LocalWitnesses();
       List<String> localwitness = config.getStringList(Constant.LOCAL_WITNESS);
-      localWitnesses.setPrivateKeys(localwitness);
-      witnessAddressCheck(config);
-      localWitnesses.initWitnessAccountAddress(PARAMETER.isECKeyCryptoEngine());
-      logger.debug("Got privateKey from config.conf");
+      if (localwitness.size() > 0) {
+        localWitnesses.setPrivateKeys(localwitness);
+        witnessAddressCheck(config);
+        localWitnesses.initWitnessAccountAddress(PARAMETER.isECKeyCryptoEngine());
+        logger.debug("Got privateKey from config.conf");
+      }
     } else if (config.hasPath(Constant.LOCAL_WITNESS_KEYSTORE)) {
       localWitnesses = new LocalWitnesses();
       List<String> privateKeys = new ArrayList<String>();

framework/src/main/java/org/tron/core/consensus/ConsensusService.java

@@ -61,7 +61,7 @@ public void start() {
         logger.info("Add witness: {}, size: {}",
             Hex.toHexString(privateKeyAddress), miners.size());
       }
-    } else {
+    } else if (privateKeys.size() == 1) {
       byte[] privateKey =
           fromHexString(Args.getLocalWitnesses().getPrivateKey());
       byte[] privateKeyAddress = SignUtils.fromPrivate(privateKey,
@@ -72,6 +72,8 @@ public void start() {
       if (null == witnessCapsule) {
         logger.warn("Witness {} is not in witnessStore.", Hex.toHexString(witnessAddress));
       }
+      // In multi-signature mode, the address derived from the private key may differ from
+      // witnessAddress.
       Miner miner = param.new Miner(privateKey, ByteString.copyFrom(privateKeyAddress),
           ByteString.copyFrom(witnessAddress));
       miners.add(miner);

framework/src/main/java/org/tron/core/metrics/node/NodeMetricManager.java

@@ -5,6 +5,7 @@
 import org.springframework.stereotype.Component;
 import org.tron.common.backup.BackupManager;
 import org.tron.common.parameter.CommonParameter;
+import org.tron.common.utils.ByteUtil;
 import org.tron.core.ChainBaseManager;
 import org.tron.core.config.args.Args;
 import org.tron.program.Version;
@@ -36,8 +37,10 @@ private void setNodeInfo(NodeInfo nodeInfo) {
 
     nodeInfo.setIp(Args.getInstance().getNodeExternalIp());
 
-    ByteString witnessAddress = ByteString.copyFrom(Args.getLocalWitnesses()
-        .getWitnessAccountAddress(CommonParameter.getInstance().isECKeyCryptoEngine()));
+    byte[] witnessAccountAddress = Args.getLocalWitnesses()
+        .getWitnessAccountAddress(CommonParameter.getInstance().isECKeyCryptoEngine());
+    ByteString witnessAddress = !ByteUtil.isNullOrZeroArray(witnessAccountAddress) ? ByteString
+        .copyFrom(witnessAccountAddress) : null;
     if (chainBaseManager.getWitnessScheduleStore().getActiveWitnesses().contains(witnessAddress)) {
       nodeInfo.setNodeType(1);
     } else {

framework/src/main/java/org/tron/core/net/service/relay/RelayService.java

@@ -66,12 +66,12 @@ public class RelayService {
 
   private List<InetSocketAddress> fastForwardNodes = parameter.getFastForwardNodes();
 
-  private ByteString witnessAddress = ByteString
-      .copyFrom(Args.getLocalWitnesses().getWitnessAccountAddress(CommonParameter.getInstance()
-          .isECKeyCryptoEngine()));
-
   private int keySize = Args.getLocalWitnesses().getPrivateKeys().size();
 
+  private ByteString witnessAddress = keySize > 0 ? ByteString
+      .copyFrom(Args.getLocalWitnesses().getWitnessAccountAddress(CommonParameter.getInstance()
+          .isECKeyCryptoEngine())) : null;
+
   private int maxFastForwardNum = Args.getInstance().getMaxFastForwardNum();
 
   public void init() {

framework/src/test/java/org/tron/core/config/args/LocalWitnessTest.java

@@ -15,18 +15,27 @@
 
 package org.tron.core.config.args;
 
+import static org.junit.Assert.fail;
+
 import com.google.common.collect.Lists;
+import java.io.IOException;
 import org.junit.Assert;
 import org.junit.Before;
+import org.junit.Rule;
 import org.junit.Test;
+import org.junit.rules.TemporaryFolder;
 import org.tron.common.utils.LocalWitnesses;
 import org.tron.common.utils.PublicMethod;
+import org.tron.core.Constant;
 
 public class LocalWitnessTest {
 
   private final LocalWitnesses localWitness = new LocalWitnesses();
   private static final String PRIVATE_KEY = PublicMethod.getRandomPrivateKey();
 
+  @Rule
+  public final TemporaryFolder temporaryFolder = new TemporaryFolder();
+
   @Before
   public void setLocalWitness() {
     localWitness
@@ -42,16 +51,16 @@ public void whenSetNullPrivateKey() {
     Assert.assertNotNull(localWitness.getPublicKey());
   }
 
-  @Test
+  @Test(expected = IllegalArgumentException.class)
   public void whenSetEmptyPrivateKey() {
     localWitness.setPrivateKeys(Lists.newArrayList(""));
-    Assert.assertNotNull(localWitness.getPrivateKey());
-    Assert.assertNotNull(localWitness.getPublicKey());
+    fail("private key must be 64-bits hex string");
   }
 
   @Test(expected = IllegalArgumentException.class)
   public void whenSetBadFormatPrivateKey() {
     localWitness.setPrivateKeys(Lists.newArrayList("a111"));
+    fail("private key must be 64-bits hex string");
   }
 
   @Test
@@ -85,6 +94,26 @@ public void testConstructor() {
     Assert.assertNull(localWitnesses2.getPublicKey());
     localWitnesses2.initWitnessAccountAddress(true);
     LocalWitnesses localWitnesses3 = new LocalWitnesses();
-    Assert.assertNotNull(localWitnesses3.getWitnessAccountAddress(true));
+    Assert.assertNull(localWitnesses3.getWitnessAccountAddress(true));
+  }
+
+  @Test
+  public void testLocalWitnessConfig() throws IOException {
+    Args.setParam(
+        new String[]{"--output-directory", temporaryFolder.newFolder().toString(), "--debug"},
+        "config-localtest.conf");
+    LocalWitnesses witness = Args.getLocalWitnesses();
+    Assert.assertNotNull(witness.getPrivateKey());
+    Assert.assertNotNull(witness.getWitnessAccountAddress(true));
+  }
+
+  @Test
+  public void testNullLocalWitnessConfig() throws IOException {
+    Args.setParam(
+        new String[]{"--output-directory", temporaryFolder.newFolder().toString(), "--debug"},
+        Constant.TEST_CONF);
+    LocalWitnesses witness = Args.getLocalWitnesses();
+    Assert.assertNull(witness.getPrivateKey());
+    Assert.assertNull(witness.getWitnessAccountAddress(true));
   }
 }

framework/src/test/java/org/tron/core/net/services/RelayServiceTest.java

@@ -5,6 +5,7 @@
 import com.google.common.collect.Lists;
 import com.google.protobuf.ByteString;
 import java.lang.reflect.Field;
+import java.lang.reflect.InvocationTargetException;
 import java.lang.reflect.Method;
 import java.net.InetSocketAddress;
 import java.util.ArrayList;
@@ -168,4 +169,28 @@ private void testCheckHelloMessage() {
       logger.info("{}", e.getMessage());
     }
   }
-}
+
+  @Test
+  public void testNullWitnessAddress() {
+    try {
+      Class<?> clazz = service.getClass();
+
+      Field keySizeField = clazz.getDeclaredField("keySize");
+      keySizeField.setAccessible(true);
+      keySizeField.set(service, 0);
+
+      Field witnessAddressField = clazz.getDeclaredField("witnessAddress");
+      witnessAddressField.setAccessible(true);
+      witnessAddressField.set(service, null);
+
+      Method isActiveWitnessMethod = clazz.getDeclaredMethod("isActiveWitness");
+      isActiveWitnessMethod.setAccessible(true);
+
+      Object result = isActiveWitnessMethod.invoke(service);
+      Assert.assertFalse(Boolean.TRUE.equals(result));
+    } catch (NoSuchMethodException | NoSuchFieldException
+        | IllegalAccessException | InvocationTargetException e) {
+      Assert.fail("Reflection invocation failed: " + e.getMessage());
+    }
+  }
+}

gradle/verification-metadata.xml

@@ -1572,12 +1572,12 @@
             <sha256 value="35e49f4134de2ac326c3a50a25762cbb4db56f3802fa3f730cc85b653ad0987b" origin="Generated by Gradle"/>
          </artifact>
       </component>
-      <component group="org.bouncycastle" name="bcprov-jdk15on" version="1.69">
-         <artifact name="bcprov-jdk15on-1.69.jar">
-            <sha256 value="e469bd39f936999f256002631003ff022a22951da9d5bd9789c7abfa9763a292" origin="Generated by Gradle"/>
+      <component group="org.bouncycastle" name="bcprov-jdk18on" version="1.79">
+         <artifact name="bcprov-jdk18on-1.79.jar">
+            <sha256 value="0d81ecc3124536b539bce9aa3fe9621b7f84c9cee371b635a5b31c78b79ab1da" origin="Generated by Gradle"/>
          </artifact>
-         <artifact name="bcprov-jdk15on-1.69.pom">
-            <sha256 value="fd81e2714495bce79e6ae6b3029dacd24cf2cff340241da581055895a7ba78de" origin="Generated by Gradle"/>
+         <artifact name="bcprov-jdk18on-1.79.pom">
+            <sha256 value="d8f1a06b149d746e9d98de54e2f7aa9b2eb613fb35ca67d8ae396ceaac661ee4" origin="Generated by Gradle"/>
          </artifact>
       </component>
       <component group="org.checkerframework" name="checker-compat-qual" version="2.0.0">

plugins/build.gradle

@@ -28,7 +28,7 @@ dependencies {
     implementation group: 'info.picocli', name: 'picocli', version: '4.6.3'
     implementation group: 'com.typesafe', name: 'config', version: '1.3.2'
     implementation group: 'me.tongfei', name: 'progressbar', version: '0.9.3'
-    implementation group: 'org.bouncycastle', name: 'bcprov-jdk15on', version: '1.69'
+    implementation group: 'org.bouncycastle', name: 'bcprov-jdk18on', version: '1.79'
     implementation group: 'org.rocksdb', name: 'rocksdbjni', version: '5.15.10'
     implementation 'io.github.tronprotocol:leveldbjni-all:1.18.2'
     implementation 'io.github.tronprotocol:leveldb:1.18.2'
@@ -157,4 +157,4 @@ task copyToParent(type: Copy) {
 
 
 
-build.finalizedBy(copyToParent)
+build.finalizedBy(copyToParent)