duplicate input detection

Author: R27-pixel

crates/floresta-chain/src/pruned_utreexo/consensus.rs

@@ -296,9 +296,24 @@ impl Consensus {
                 return Err(tx_err!(txid, NullPrevOut))?;
             }
 
-            // Check script sizes (current tx scriptsig and TODO witness if present)
+            // Witness size is intentionally not checked here — witness-specific
+            // limits are enforced during script execution, not in context-free checks.
+            // This matches Bitcoin Core's CheckTransaction() which explicitly skips
+            // witness in context-free checks because witness data has not been
+            // checked for malleability at this point.
+            // See: https://github.com/bitcoin/bitcoin/blob/master/src/consensus/tx_check.cpp
             Self::validate_script_size(&input.script_sig, txid)?;
-            // TODO check also witness script size
+        }
+
+        // Check for duplicate inputs (CVE-2018-17144).
+        // UpdateCoins does not detect duplicates — a duplicate prevout causes either
+        // a crash or an inflation bug depending on the coins database implementation.
+        // Bitcoin Core catches this explicitly in CheckTransaction() for the same reason.
+        let mut seen = HashSet::new();
+        for input in &transaction.input {
+            if !seen.insert(&input.previous_output) {
+                 return Err(tx_err!(txid, DuplicateInput))?;
+            }
         }
 
         let out_value = transaction
@@ -983,6 +998,24 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_duplicate_inputs_rejected() {
+        let outpoint = dummy_outpoint();
+
+        // Same prevout used in both inputs
+        let tx = build_tx(
+            vec![txin!(outpoint), txin!(outpoint)],
+            vec![txout!(0, ScriptBuf::new())],
+        );
+
+        match Consensus::check_transaction_context_free(&tx) {
+            Err(BlockchainError::TransactionError(tx_err)) => {
+                assert_eq!(tx_err.error, BlockValidationErrors::DuplicateInput);
+            }
+            other => panic!("Expected DuplicateInput, got: {other:?}"),
+        }
+    }
+
     #[test]
     fn test_input_value_above_max_money() {
         let outpoint = dummy_outpoint();

crates/floresta-chain/src/pruned_utreexo/error.rs

@@ -85,6 +85,7 @@ pub enum BlockValidationErrors {
     CoinbaseNotMatured,
     UnspendableUTXO,
     BIP94TimeWarp,
+    DuplicateInput,
 }
 
 // Helpful macro for generating a TransactionError
@@ -175,6 +176,9 @@ impl Display for BlockValidationErrors {
             BlockValidationErrors::BIP94TimeWarp => {
                 write!(f, "BIP94 time warp detected")
             }
+            BlockValidationErrors::DuplicateInput => {
+                write!(f, "This transaction has duplicate inputs")
+        }
         }
     }
 }

crates/floresta-mempool/src/mempool.rs

@@ -421,6 +421,11 @@ mod tests {
             };
 
             let inputs = rng.gen_range(1..10);
+
+            // Track outpoints already used in this transaction to avoid
+            // duplicate inputs within a single tx, which is never valid.
+            // Conflicts are only meaningful across separate transactions.
+            let mut used_in_this_tx = HashSet::new();
             for _ in 0..inputs {
                 if outputs.is_empty() {
                     break;
@@ -432,6 +437,11 @@ mod tests {
                     true => *outputs.get(index).unwrap(),
                 };
 
+                // Skip if this outpoint is already an input in this tx
+                if !used_in_this_tx.insert(previous_output) {
+                    continue;
+                }
+
                 let input = bitcoin::TxIn {
                     previous_output,
                     script_sig: bitcoin::Script::new().into(),
@@ -505,7 +515,7 @@ mod tests {
         for tx in transactions {
             match mempool.accept_to_mempool(tx) {
                 Ok(_) => {}
-                Err(AcceptToMempoolError::DuplicatedInputs) => {
+                Err(AcceptToMempoolError::ConflictingTransaction) => {
                     did_conflict = true;
                 }
 

crates/floresta-wire/src/p2p_wire/node/blocks.rs

@@ -357,6 +357,7 @@ where
             BlockValidationErrors::InvalidCoinbase(_)
             | BlockValidationErrors::ScriptValidationError(_)
             | BlockValidationErrors::NullPrevOut
+            | BlockValidationErrors::DuplicateInput
             | BlockValidationErrors::EmptyInputs
             | BlockValidationErrors::EmptyOutputs
             | BlockValidationErrors::ScriptError