[BUG] Resource Exhaustion in Script Interpreter

[sirdeggen]

Bug Description

Modular Exponentiation leads to resource exhaustion during script execution.

import { Transaction, Script } from '@bsv/sdk'

const sourceTransaction = new Transaction()
sourceTransaction.addInput({
  sourceOutputIndex: 0, 
  sourceTXID: 'beefbeefbeefbeefbeefbeefbeefbeefbeefbeefbeefbeefbeefbeefbeefbeef', unlockingScript: Script.fromASM('OP_TRUE'),
})
sourceTransaction.addOutput({
  lockingScript: Script.fromASM('OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL OP_DUP OP_MUL'),
  satoshis: 1
})

sourceTransaction.merklePath = {}

const tx = new Transaction()

tx.addInput({
  sourceTransaction,
  sourceOutputIndex: 0,
  unlockingScript: Script.fromASM('OP_2')
})

tx.addOutput({
  satoshis: 1,
  lockingScript: Script.fromASM('OP_TRUE')
})

await tx.fee()
await tx.sign()

console.log(sourceTransaction.outputs[0].lockingScript.chunks.length / 2)
await tx.verify('scripts only')

Expected Behavior

Script execution should fail once stack memory usage hits 100 MB since this is the max allowed in node's policy.

Actual Behavior

What actually happened?

Stack Traces or Screenshots

If applicable, add screenshots or stack traces to help explain the issue.

Environment

• OS: MacOS MacBookPro M3
• Node version: LTS
• @bsv/sdk version: 1.3.18

Additional Information

At 22 iterations my machine copes, beyond that it's noticeably lagging each time I add more iterations.

The limit to match current default policy should be 100MB.

[sirdeggen]

Noting here that this is a potential attack on overlays and monetized services if you were to include a parent tx which spends this in a beef transaction. There ought to be a way to configure a memory max usage for the interpreter in SPV scenarios so that once you use ___MB of memory you kill the validation as a failure:

Error('Memory Exhaustion Avoidance Aborted SPV')

Or something like that.

tx.verify(bhs, 1000) // limits memory usage to 1kB