BTGS Security Update 30.2.2

.github/ISSUE_TEMPLATE/bug.yml

@@ -68,7 +68,7 @@ body:
     attributes:
       label: What version of BTGS Core are you using?
       description: Run `btgsd --version`, `bitcoind --version`, or in BTGS-Qt use `Help > About BTGS-Qt`, depending on your build.
-      placeholder: e.g. v30.2.1 or main@73628c5
+      placeholder: e.g. v30.2.2 or main@3ce9729
     validations:
       required: true
   - type: input

.github/workflows/build-release.yml

@@ -11,7 +11,7 @@ permissions:
   contents: read
 
 env:
-  VERSION: "30.2.1"
+  VERSION: "30.2.2"
   MAKEJOBS: "3"
 
 jobs:

.github/workflows/ci.yml

@@ -12,6 +12,7 @@ on:
       - 'share/examples/btgs.conf'
       - 'share/setup.nsi.in'
       - 'src/common/args.cpp'
+      - 'src/consensus/tx_verify.cpp'
       - 'src/kernel/chainparams.cpp'
       - 'src/qt/guiconstants.h'
   pull_request:
@@ -23,6 +24,7 @@ on:
       - 'share/examples/btgs.conf'
       - 'share/setup.nsi.in'
       - 'src/common/args.cpp'
+      - 'src/consensus/tx_verify.cpp'
       - 'src/kernel/chainparams.cpp'
       - 'src/qt/guiconstants.h'
   workflow_dispatch:
@@ -41,7 +43,7 @@ jobs:
 
     steps:
       - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@v6
 
       - name: Verify BTGS metadata
         shell: bash
@@ -55,7 +57,7 @@ jobs:
           grep -Fq 'set(CLIENT_NAME "Bitcoin Gold BTGS Core")' CMakeLists.txt
           grep -Fq 'set(CLIENT_VERSION_MAJOR 30)' CMakeLists.txt
           grep -Fq 'set(CLIENT_VERSION_MINOR 2)' CMakeLists.txt
-          grep -Fq 'set(CLIENT_VERSION_BUILD 1)' CMakeLists.txt
+          grep -Fq 'set(CLIENT_VERSION_BUILD 2)' CMakeLists.txt
 
           grep -Fq '#define QAPP_ORG_NAME "BTGS"' src/qt/guiconstants.h
           grep -Fq '#define QAPP_APP_NAME_DEFAULT "BTGS-Qt"' src/qt/guiconstants.h
@@ -66,6 +68,10 @@ jobs:
           grep -Fq '00000000000000138aa6a00283533f9c13ba50f210479bd6abee12f2a52d2dab' src/kernel/chainparams.cpp
           grep -Fq '0000000000000000000000000000000000000000000000c881c9a24f9120650a' src/kernel/chainparams.cpp
 
+          grep -Fq 'BTGS_BURN_FREEZE_HEIGHT{9599}' src/consensus/tx_verify.cpp
+          grep -Fq 'bad-txns-burn-address-spend' src/consensus/tx_verify.cpp
+          grep -Fq '0x00, 0x13, 0xd9, 0x93' src/consensus/tx_verify.cpp
+
           grep -Fq 'aarch64-apple-darwin' .github/workflows/build-release.yml
           grep -Fq 'x86_64-linux-gnu' .github/workflows/build-release.yml
           grep -Fq 'aarch64-linux-gnu' .github/workflows/build-release.yml

CMakeLists.txt

@@ -29,7 +29,7 @@ get_directory_property(precious_variables CACHE_VARIABLES)
 set(CLIENT_NAME "Bitcoin Gold BTGS Core")
 set(CLIENT_VERSION_MAJOR 30)
 set(CLIENT_VERSION_MINOR 2)
-set(CLIENT_VERSION_BUILD 1)
+set(CLIENT_VERSION_BUILD 2)
 set(CLIENT_VERSION_RC 0)
 set(CLIENT_VERSION_IS_RELEASE "true")
 set(COPYRIGHT_YEAR "2026")

src/consensus/tx_verify.cpp

@@ -11,9 +11,31 @@
 #include <consensus/validation.h>
 #include <primitives/transaction.h>
 #include <script/interpreter.h>
+#include <script/script.h>
 #include <util/check.h>
 #include <util/moneystr.h>
 
+#include <vector>
+
+namespace {
+static constexpr int BTGS_BURN_FREEZE_HEIGHT{9599};
+
+const CScript& BTGSBurnScriptPubKey()
+{
+    static const CScript burn_script_pubkey = CScript() << OP_0 << std::vector<unsigned char>{
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+        0x00, 0x00, 0x00, 0x00, 0x00, 0x13, 0xd9, 0x93};
+    return burn_script_pubkey;
+}
+
+bool IsBTGSBurnSpend(const CScript& script_pubkey)
+{
+    return script_pubkey == BTGSBurnScriptPubKey();
+}
+} // namespace
+
 bool IsFinalTx(const CTransaction &tx, int nBlockHeight, int64_t nBlockTime)
 {
     if (tx.nLockTime == 0)
@@ -175,6 +197,11 @@ bool Consensus::CheckTxInputs(const CTransaction& tx, TxValidationState& state,
         const Coin& coin = inputs.AccessCoin(prevout);
         assert(!coin.IsSpent());
 
+        if (nSpendHeight >= BTGS_BURN_FREEZE_HEIGHT && IsBTGSBurnSpend(coin.out.scriptPubKey)) {
+            return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-txns-burn-address-spend",
+                "attempted to spend frozen BTGS burn address output");
+        }
+
         // If prev is coinbase, check that it's matured
         if (coin.IsCoinBase() && nSpendHeight - coin.nHeight < COINBASE_MATURITY) {
             return state.Invalid(TxValidationResult::TX_PREMATURE_SPEND, "bad-txns-premature-spend-of-coinbase",