From 42470b3db8ff9b3bc8ae91bfcb17ce33c2c1bfa4 Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Tue, 1 Oct 2024 12:55:47 +0300
Subject: [PATCH 01/28] WIP

---
 Cargo.toml                         |   7 +-
 core/Cargo.toml                    |   8 +
 core/src/assert/disprove_script.rs |  42 +++++
 core/src/assert/mod.rs             |  20 +++
 core/src/lib.rs                    |   2 +
 core/src/winternitz.rs             | 270 +++++++++++++++++++++++++++++
 splitter/Cargo.toml                |   2 +-
 splitter/src/debug.rs              |  11 ++
 splitter/src/lib.rs                |   2 +-
 9 files changed, 360 insertions(+), 4 deletions(-)
 create mode 100644 core/Cargo.toml
 create mode 100644 core/src/assert/disprove_script.rs
 create mode 100644 core/src/assert/mod.rs
 create mode 100644 core/src/lib.rs
 create mode 100644 core/src/winternitz.rs

diff --git a/Cargo.toml b/Cargo.toml
index aec6998..f2dd00a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,7 +1,10 @@
 [workspace]
-members = ["splitter"]
+members = ["core", "splitter"]
 resolver = "2"
 
+[workspace.dependencies]
+bitcoin = { git = "https://github.com/rust-bitcoin/rust-bitcoin", branch = "bitvm" }
+
 [profile.dev]
 opt-level = 3
 
@@ -30,4 +33,4 @@ branch = "bitvm"
 
 [patch.crates-io.bitcoin-units]
 git = "https://github.com/rust-bitcoin/rust-bitcoin"
-branch = "bitvm"
\ No newline at end of file
+branch = "bitvm"
diff --git a/core/Cargo.toml b/core/Cargo.toml
new file mode 100644
index 0000000..e2bc10b
--- /dev/null
+++ b/core/Cargo.toml
@@ -0,0 +1,8 @@
+[package]
+name = "bitvm2-core"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+bitvm2-splitter.path = "../splitter"
+bitcoin.workspace = true
\ No newline at end of file
diff --git a/core/src/assert/disprove_script.rs b/core/src/assert/disprove_script.rs
new file mode 100644
index 0000000..9a9043d
--- /dev/null
+++ b/core/src/assert/disprove_script.rs
@@ -0,0 +1,42 @@
+use bitvm2_splitter::treepp::*;
+
+use crate::winternitz::{self, PublicKey};
+
+/// Script which let's challengers spent the **Assert** transaction
+/// output if operator computated substates incorrectly.
+///
+/// This a typed version of [`Script`] can be easily converted into it.
+///
+/// The script structure in general is simple:
+///
+/// ```no_run
+/// // push public key's of intermidiate states
+/// { pk_z[i-1] }
+/// { pk_z[i] }
+/// // Check Winternitz signatures expecting public
+/// // keys and signatures from top of the stack
+/// { winternitz::checksig_verify }
+/// // compute result of the subrpogram
+/// { f[i] }
+/// OP_EQUAL
+/// OP_VERIFY
+/// ```
+///
+/// # TODO:
+///
+/// - [ ] Inlcude covenants
+pub struct DisproveScript {
+    intermidiate_state_pubkeys: [PublicKey; 2],
+    subprogram: Script,
+}
+
+impl From<DisproveScript> for Script {
+    fn from(disprove: DisproveScript) -> Self {
+        let [ pk1, pk2 ] = disprove.intermidiate_state_pubkeys;
+        script! {
+            { pk1 }
+            // { winternitz::checksig_verify }
+            { pk2 }
+        }
+    }
+}
diff --git a/core/src/assert/mod.rs b/core/src/assert/mod.rs
new file mode 100644
index 0000000..cb5fe1b
--- /dev/null
+++ b/core/src/assert/mod.rs
@@ -0,0 +1,20 @@
+use bitcoin::TxIn;
+use bitvm2_splitter::{split::intermediate_state::IntermediateState, treepp::Script};
+
+use crate::winternitz::PublicKey;
+
+pub mod disprove_script;
+
+pub struct AssertTransaction<const N: usize> {
+    // Inputs which are used in the transaction.
+    inputs: Vec<TxIn>,
+    // Subprograms $f_{i}$ that will be verified in the transaction.
+    subprograms: [Script; N],
+    // Intermidiate states $z_i$.
+    states: [IntermediateState; N],
+    // Winternitz public keys that are used for verification of
+    // related to intermidiate states' signatures.
+    //
+    // In paper specified as $\mathsf{pk}_{z_i}$.
+    states_pubkeys: [PublicKey; N],
+}
diff --git a/core/src/lib.rs b/core/src/lib.rs
new file mode 100644
index 0000000..5be46ed
--- /dev/null
+++ b/core/src/lib.rs
@@ -0,0 +1,2 @@
+pub mod assert;
+pub mod winternitz;
diff --git a/core/src/winternitz.rs b/core/src/winternitz.rs
new file mode 100644
index 0000000..600f976
--- /dev/null
+++ b/core/src/winternitz.rs
@@ -0,0 +1,270 @@
+//! Winternitz One-time Signatures
+//!
+//!
+//! Winternitz signatures are an improved version of Lamport signatures.
+//! A detailed introduction to Winternitz signatures can be found
+//! in "A Graduate Course in Applied Cryptography" in chapter 14.3
+//! https://toc.cryptobook.us/book.pdf
+//!
+//! We are trying to closely follow the authors' notation here.
+
+//
+// BEAT OUR IMPLEMENTATION AND WIN A CODE GOLF BOUNTY!
+//
+
+use bitvm2_splitter::treepp::*;
+use bitcoin::hashes::{hash160, Hash};
+
+/// Bits per digit
+const LOG_D: u32 = 4;
+/// Digits are base d+1
+pub const D: u32 = (1 << LOG_D) - 1;
+/// Number of digits of the message
+const N0: u32 = 40;
+/// Number of digits of the checksum.  N1 = ⌈log_{D+1}(D*N0)⌉ + 1
+const N1: usize = 4;
+/// Total number of digits to be signed
+const N: u32 = N0 + N1 as u32;
+/// The public key type
+pub type PublicKey = [[u8; 20]; N as usize];
+
+pub type SecretKey = Vec<u8>;
+
+//
+// Helper functions
+//
+
+/// Generate a public key for the i-th digit of the message
+pub fn public_key_for_digit(mut secret_key: Vec<u8>, digit_index: u32) -> [u8; 20] {
+    secret_key.push(digit_index as u8);
+
+    let mut hash = hash160::Hash::hash(&secret_key);
+
+    for _ in 0..D {
+        hash = hash160::Hash::hash(&hash[..]);
+    }
+
+    *hash.as_byte_array()
+}
+
+/// Generate a public key from a secret key 
+pub fn generate_public_key(secret_key: Vec<u8>) -> PublicKey {
+    let mut public_key_array = [[0u8; 20]; N as usize];
+    for i in 0..N {
+        public_key_array[i as usize] = public_key_for_digit(secret_key.clone(), i);
+    }
+    public_key_array
+}
+
+/// Compute the signature for the i-th digit of the message
+pub fn digit_signature(mut secret_key: SecretKey, digit_index: u32, message_digit: u8) -> Script {
+    secret_key.push(digit_index as u8);
+
+    let mut hash = hash160::Hash::hash(&secret_key);
+
+    for _ in 0..message_digit {
+        hash = hash160::Hash::hash(&hash[..]);
+    }
+
+    let hash_bytes = hash.as_byte_array().to_vec();
+
+    script! {
+        { hash_bytes }
+        { message_digit }
+    }
+}
+
+/// Compute the checksum of the message's digits.
+/// Further infos in chapter "A domination free function for Winternitz signatures"
+pub fn checksum(digits: [u8; N0 as usize]) -> u32 {
+    let mut sum = 0;
+    for digit in digits {
+        sum += digit as u32;
+    }
+    D * N0 - sum
+}
+
+/// Convert a number to digits
+pub fn to_digits<const DIGIT_COUNT: usize>(mut number: u32) -> [u8; DIGIT_COUNT] {
+    let mut digits: [u8; DIGIT_COUNT] = [0; DIGIT_COUNT];
+    for i in 0..DIGIT_COUNT {
+        let digit = number % (D + 1);
+        number = (number - digit) / (D + 1);
+        digits[i] = digit as u8;
+    }
+    digits
+}
+
+
+
+/// Compute the signature for a given message
+pub fn sign_digits(secret_key: SecretKey, message_digits: [u8; N0 as usize]) -> Script {
+    // const message_digits = to_digits(message, n0)
+    let mut checksum_digits = to_digits::<N1>(checksum(message_digits)).to_vec();
+    checksum_digits.append(&mut message_digits.to_vec());
+
+    script! {
+        for i in 0..N {
+            { digit_signature(secret_key.clone(), i, checksum_digits[ (N-1-i) as usize]) }
+        }
+    }
+}
+
+pub fn sign(secret_key: SecretKey, message_bytes: &[u8]) -> Script {
+    // Convert message to digits
+    let mut message_digits = [0u8; 20 * 2 as usize];
+    for (digits, byte) in message_digits.chunks_mut(2).zip(message_bytes) {
+        digits[0] = byte & 0b00001111;
+        digits[1] = byte >> 4;
+    }
+
+    sign_digits(secret_key, message_digits)
+}
+
+pub fn checksig_verify(public_key: &PublicKey) -> Script {
+    script! {
+        //
+        // Verify the hash chain for each digit
+        //
+
+        // Repeat this for every of the n many digits
+        for digit_index in 0..N {
+            // Verify that the digit is in the range [0, d]
+            // See https://github.com/BitVM/BitVM/issues/35
+            { D }
+            OP_MIN
+
+            // Push two copies of the digit onto the altstack
+            OP_DUP
+            OP_TOALTSTACK
+            OP_TOALTSTACK
+
+            // Hash the input hash d times and put every result on the stack
+            for _ in 0..D {
+                OP_DUP OP_HASH160
+            }
+
+            // Verify the signature for this digit
+            OP_FROMALTSTACK
+            OP_PICK
+            { public_key[N as usize - 1 - digit_index as usize].to_vec() }
+            OP_EQUALVERIFY
+
+            // Drop the d+1 stack items
+            for _ in 0..(D+1)/2 {
+                OP_2DROP
+            }
+        }
+
+        //
+        // Verify the Checksum
+        //
+
+        // 1. Compute the checksum of the message's digits
+        OP_FROMALTSTACK OP_DUP OP_NEGATE
+        for _ in 1..N0 {
+            OP_FROMALTSTACK OP_TUCK OP_SUB
+        }
+        { D * N0 }
+        OP_ADD
+
+
+        // 2. Sum up the signed checksum's digits
+        OP_FROMALTSTACK
+        for _ in 0..N1 - 1 {
+            for _ in 0..LOG_D {
+                OP_DUP OP_ADD
+            }
+            OP_FROMALTSTACK
+            OP_ADD
+        }
+
+        // 3. Ensure both checksums are equal
+        OP_EQUALVERIFY
+
+
+        // Convert the message's digits to bytes
+        for i in 0..N0 / 2 {
+            OP_SWAP
+            for _ in 0..LOG_D {
+                OP_DUP OP_ADD
+            }
+            OP_ADD
+            // Push all bytes to the altstack, except for the last byte
+            if i != (N0/2) - 1 {
+                OP_TOALTSTACK
+            }
+        }
+        // Read the bytes from the altstack
+        for _ in 0..N0 / 2 - 1{
+            OP_FROMALTSTACK
+        }
+
+    }
+}
+
+
+#[cfg(test)]
+mod test {
+    use bitcoin::hex::FromHex as _;
+
+    use super::*;
+
+    // The secret key
+    const MY_SECKEY: &str = "b138982ce17ac813d505b5b40b665d404e9528e7";
+
+
+    #[test]
+    fn test_winternitz() {
+        // The message to sign
+        #[rustfmt::skip]
+        const MESSAGE: [u8; N0 as usize] = [
+            1, 2, 3, 4, 5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7,
+            1, 2, 3, 4, 5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7,
+        ];
+
+        let secret_key = Vec::<u8>::from_hex(MY_SECKEY).unwrap();
+        let public_key = generate_public_key(secret_key.clone());
+
+        let script = script! {
+            { sign_digits(secret_key.clone(), MESSAGE) }
+            { checksig_verify(&public_key) }
+        };
+
+        println!(
+            "Winternitz signature size:\n \t{:?} bytes / {:?} bits \n\t{:?} bytes / bit",
+            script.len(),
+            N0 * 4,
+            script.len() as f64 / (N0 * 4) as f64
+        );
+
+        run(script! {
+            { sign_digits(secret_key, MESSAGE) }
+            { checksig_verify(&public_key) }
+
+            0x21 OP_EQUALVERIFY
+            0x43 OP_EQUALVERIFY
+            0x65 OP_EQUALVERIFY
+            0x87 OP_EQUALVERIFY
+            0xA9 OP_EQUALVERIFY
+            0xCB OP_EQUALVERIFY
+            0xED OP_EQUALVERIFY
+            0x7F OP_EQUALVERIFY
+            0x77 OP_EQUALVERIFY
+            0x77 OP_EQUALVERIFY
+
+            0x21 OP_EQUALVERIFY
+            0x43 OP_EQUALVERIFY
+            0x65 OP_EQUALVERIFY
+            0x87 OP_EQUALVERIFY
+            0xA9 OP_EQUALVERIFY
+            0xCB OP_EQUALVERIFY
+            0xED OP_EQUALVERIFY
+            0x7F OP_EQUALVERIFY
+            0x77 OP_EQUALVERIFY
+            0x77 OP_EQUAL
+        });
+    }
+
+    // TODO: test the error cases: negative digits, digits > D, ...
+}
diff --git a/splitter/Cargo.toml b/splitter/Cargo.toml
index 383809d..36f1925 100644
--- a/splitter/Cargo.toml
+++ b/splitter/Cargo.toml
@@ -5,7 +5,7 @@ edition = "2021"
 
 [dependencies]
 # Bitcoin Libraries
-bitcoin              = { git = "https://github.com/rust-bitcoin/rust-bitcoin", branch = "bitvm", features = ["rand-std"]}
+bitcoin              = { workspace = true, features = ["rand-std"]}
 bitcoin-script       = { git = "https://github.com/BitVM/rust-bitcoin-script" }
 bitcoin-scriptexec   = { git = "https://github.com/BitVM/rust-bitcoin-scriptexec/"}
 bitcoin-script-stack = { git = "https://github.com/FairgateLabs/rust-bitcoin-script-stack"}
diff --git a/splitter/src/debug.rs b/splitter/src/debug.rs
index 62ac034..1418ad0 100644
--- a/splitter/src/debug.rs
+++ b/splitter/src/debug.rs
@@ -75,6 +75,17 @@ pub fn execute_script(script: ScriptBuf) -> ExecuteInfo {
     }
 }
 
+pub fn run(script: bitcoin::ScriptBuf) {
+    let exec_result = execute_script(script);
+    if !exec_result.success {
+        println!(
+            "ERROR: {:?} <--- \n STACK: {:#?} \n ALTSTACK {:#?}",
+            exec_result.error, exec_result.main_stack, exec_result.alt_stack
+        );
+    }
+    assert!(exec_result.success);
+}
+
 /// Execute a script on stack without `MAX_STACK_SIZE` limit.
 /// This function is only used for script test, not for production.
 ///
diff --git a/splitter/src/lib.rs b/splitter/src/lib.rs
index 734bae2..101b91f 100644
--- a/splitter/src/lib.rs
+++ b/splitter/src/lib.rs
@@ -1,7 +1,7 @@
 #[allow(dead_code)]
 // Re-export what is needed to write treepp scripts
 pub mod treepp {
-    pub use crate::debug::execute_script;
+    pub use crate::debug::{execute_script, run};
     pub use bitcoin_script::{define_pushable, script};
 
     define_pushable!();

From 700a4a78a6fc48bdaa91ec40f5045acb4aa0c301 Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Fri, 4 Oct 2024 11:18:33 +0300
Subject: [PATCH 02/28] :interrobang: preparing for merge

---
 Cargo.toml                               |  36 ---
 splitter/Cargo.toml                      |  31 ---
 splitter/README.md                       |  25 --
 splitter/src/debug.rs                    | 172 --------------
 splitter/src/lib.rs                      |  33 ---
 splitter/src/split/core.rs               |  67 ------
 splitter/src/split/intermediate_state.rs |  54 -----
 splitter/src/split/mod.rs                |   9 -
 splitter/src/split/script.rs             |  92 --------
 splitter/src/split/tests.rs              | 286 -----------------------
 splitter/src/test_scripts/int_add.rs     | 129 ----------
 splitter/src/test_scripts/int_mul.rs     | 122 ----------
 splitter/src/test_scripts/mod.rs         |   9 -
 splitter/src/utils.rs                    |  11 -
 14 files changed, 1076 deletions(-)
 delete mode 100644 Cargo.toml
 delete mode 100644 splitter/Cargo.toml
 delete mode 100644 splitter/README.md
 delete mode 100644 splitter/src/debug.rs
 delete mode 100644 splitter/src/lib.rs
 delete mode 100644 splitter/src/split/core.rs
 delete mode 100644 splitter/src/split/intermediate_state.rs
 delete mode 100644 splitter/src/split/mod.rs
 delete mode 100644 splitter/src/split/script.rs
 delete mode 100644 splitter/src/split/tests.rs
 delete mode 100644 splitter/src/test_scripts/int_add.rs
 delete mode 100644 splitter/src/test_scripts/int_mul.rs
 delete mode 100644 splitter/src/test_scripts/mod.rs
 delete mode 100644 splitter/src/utils.rs

diff --git a/Cargo.toml b/Cargo.toml
deleted file mode 100644
index f2dd00a..0000000
--- a/Cargo.toml
+++ /dev/null
@@ -1,36 +0,0 @@
-[workspace]
-members = ["core", "splitter"]
-resolver = "2"
-
-[workspace.dependencies]
-bitcoin = { git = "https://github.com/rust-bitcoin/rust-bitcoin", branch = "bitvm" }
-
-[profile.dev]
-opt-level = 3
-
-[profile.release]
-lto = true
-
-[patch.crates-io.base58check]
-git = "https://github.com/rust-bitcoin/rust-bitcoin"
-branch = "bitvm"
-
-[patch.crates-io.bitcoin]
-git = "https://github.com/rust-bitcoin/rust-bitcoin"
-branch = "bitvm"
-
-[patch.crates-io.bitcoin_hashes]
-git = "https://github.com/rust-bitcoin/rust-bitcoin"
-branch = "bitvm"
-
-[patch.crates-io.bitcoin-internals]
-git = "https://github.com/rust-bitcoin/rust-bitcoin"
-branch = "bitvm"
-
-[patch.crates-io.bitcoin-io]
-git = "https://github.com/rust-bitcoin/rust-bitcoin"
-branch = "bitvm"
-
-[patch.crates-io.bitcoin-units]
-git = "https://github.com/rust-bitcoin/rust-bitcoin"
-branch = "bitvm"
diff --git a/splitter/Cargo.toml b/splitter/Cargo.toml
deleted file mode 100644
index 36f1925..0000000
--- a/splitter/Cargo.toml
+++ /dev/null
@@ -1,31 +0,0 @@
-[package]
-name    = "bitvm2-splitter"
-version = "0.1.0"
-edition = "2021"
-
-[dependencies]
-# Bitcoin Libraries
-bitcoin              = { workspace = true, features = ["rand-std"]}
-bitcoin-script       = { git = "https://github.com/BitVM/rust-bitcoin-script" }
-bitcoin-scriptexec   = { git = "https://github.com/BitVM/rust-bitcoin-scriptexec/"}
-bitcoin-script-stack = { git = "https://github.com/FairgateLabs/rust-bitcoin-script-stack"}
-# Some test script to test the splitter
-bitcoin-window-mul   = { git = "https://github.com/distributed-lab/bitcoin-window-mul.git" }
-
-# General-purpose libraries
-strum          = "0.26"
-strum_macros   = "0.26"
-serde          = { version = "1.0.197", features = ["derive"] }
-serde_json     = "1.0.116"
-tokio          = { version = "1.37.0", features = ["full"] }
-
-# Crypto libraries
-hex        = "0.4.3"
-num-bigint = { version = "0.4.4", features = ["rand"] }
-num-traits = "0.2.18"
-
-# Random libraries
-rand_chacha = "0.3.1"
-rand        = "0.8.5"
-ark-std     = "0.4.0"
-konst       = "0.3.9"
diff --git a/splitter/README.md b/splitter/README.md
deleted file mode 100644
index 7ca15dd..0000000
--- a/splitter/README.md
+++ /dev/null
@@ -1,25 +0,0 @@
-# :jigsaw: Bitcoin Splitter
-
-This is a crate for splitting the Bitcoin script into multiple parts as suggested by the recent [_BitVM2 paper_](https://bitvm.org/bitvm_bridge.pdf).
-
-## :raising_hand: But What is Bitcoin Splitter?
-
-Suppose we have the input $x$ and the function $f$ and the prover wants to convince the skeptical verifier that $y=f(x)$. Of course, one way to do that is to publish the following Bitcoin script:
-
-```bash
-<x> <f> <y> OP_EQUAL
-```
-
-However, the main issue is that besides basic usages such as hash function computation (in that case, $f=H$ for native _SHA-256_ hash function), typically $f$ is very large. The BitVM2 paper suggests splitting the function $f$ into multiple parts and publishing them separately. Formally, suppose
-
-$$
-f = f_n \circ f_{n-1} \circ \cdots \circ f_1
-$$
-
-Then, instead of proving $y=f(x)$, the prover can prove the following statements:
-
-$$
-z_1 = f_1(z_0), \quad z_2 = f_2(z_1), \quad \ldots, \quad z_n = f_n(z_{n-1})
-$$
-
-for $z_1:=x,z_n:=y$. Then, the prover publishes $z_1,\dots,z_n$ together with $f_1,\dots,f_n$. Then, the verifier can ensure that all $z_1,\dots,z_n$ were obtained correctly. In case something was computed wrong, the verifier can challenge the prover and claim the bounty. For more details, see _BitVM2 paper_.
diff --git a/splitter/src/debug.rs b/splitter/src/debug.rs
deleted file mode 100644
index 1418ad0..0000000
--- a/splitter/src/debug.rs
+++ /dev/null
@@ -1,172 +0,0 @@
-use bitcoin::{hashes::Hash, ScriptBuf, TapLeafHash, Transaction};
-use bitcoin_scriptexec::{Exec, ExecCtx, ExecError, ExecStats, Options, Stack, TxTemplate};
-use core::fmt;
-
-/// Information about the status of the script execution.
-#[derive(Debug)]
-pub struct ExecuteInfo {
-    pub success: bool,
-    pub error: Option<ExecError>,
-    pub main_stack: Stack,
-    pub alt_stack: Stack,
-    pub stats: ExecStats,
-}
-
-impl fmt::Display for ExecuteInfo {
-    /// Formats the `ExecuteInfo` struct for display.
-    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
-        if self.success {
-            writeln!(f, "Script execution successful.")?;
-        } else {
-            writeln!(f, "Script execution failed!")?;
-        }
-
-        if let Some(ref error) = self.error {
-            writeln!(f, "Error: {:?}", error)?;
-        }
-
-        writeln!(f, "Stats: {:?}", self.stats)?;
-        Ok(())
-    }
-}
-
-/// Executes the given script and returns the result of the execution
-/// (success, error, stack, etc.)
-pub fn execute_script(script: ScriptBuf) -> ExecuteInfo {
-    let mut exec = Exec::new(
-        ExecCtx::Tapscript,
-        Options {
-            // TODO: Figure our how to optimize stack_to_script function to avoid disabling require_minimal
-            require_minimal: false,
-            ..Default::default()
-        },
-        TxTemplate {
-            tx: Transaction {
-                version: bitcoin::transaction::Version::TWO,
-                lock_time: bitcoin::locktime::absolute::LockTime::ZERO,
-                input: vec![],
-                output: vec![],
-            },
-            prevouts: vec![],
-            input_idx: 0,
-            taproot_annex_scriptleaf: Some((TapLeafHash::all_zeros(), None)),
-        },
-        script,
-        vec![],
-    )
-    .expect("error when creating the execution body");
-
-    // Execute all the opcodes while possible
-    loop {
-        if exec.exec_next().is_err() {
-            break;
-        }
-    }
-
-    // Obtaining the result of the execution
-    let result = exec.result().unwrap();
-
-    ExecuteInfo {
-        success: result.success,
-        error: result.error.clone(),
-        main_stack: exec.stack().clone(),
-        alt_stack: exec.altstack().clone(),
-        stats: exec.stats().clone(),
-    }
-}
-
-pub fn run(script: bitcoin::ScriptBuf) {
-    let exec_result = execute_script(script);
-    if !exec_result.success {
-        println!(
-            "ERROR: {:?} <--- \n STACK: {:#?} \n ALTSTACK {:#?}",
-            exec_result.error, exec_result.main_stack, exec_result.alt_stack
-        );
-    }
-    assert!(exec_result.success);
-}
-
-/// Execute a script on stack without `MAX_STACK_SIZE` limit.
-/// This function is only used for script test, not for production.
-///
-/// NOTE: Only for test purposes.
-#[allow(dead_code)]
-pub fn execute_script_no_stack_limit(script: bitcoin::ScriptBuf) -> ExecuteInfo {
-    // Get the default options for the script exec.
-    // NOTE: Do not enforce the stack limit.
-    let opts = Options {
-        enforce_stack_limit: false,
-        ..Default::default()
-    };
-
-    let mut exec = Exec::new(
-        ExecCtx::Tapscript,
-        opts,
-        TxTemplate {
-            tx: Transaction {
-                version: bitcoin::transaction::Version::TWO,
-                lock_time: bitcoin::locktime::absolute::LockTime::ZERO,
-                input: vec![],
-                output: vec![],
-            },
-            prevouts: vec![],
-            input_idx: 0,
-            taproot_annex_scriptleaf: Some((TapLeafHash::all_zeros(), None)),
-        },
-        script,
-        vec![],
-    )
-    .expect("error while creating the execution body");
-
-    // Execute all the opcodes while possible
-    loop {
-        if exec.exec_next().is_err() {
-            break;
-        }
-    }
-
-    // Get the result of the execution
-    let result = exec.result().unwrap();
-
-    ExecuteInfo {
-        success: result.success,
-        error: result.error.clone(),
-        main_stack: exec.stack().clone(),
-        alt_stack: exec.altstack().clone(),
-        stats: exec.stats().clone(),
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use super::execute_script_no_stack_limit;
-    use crate::treepp::*;
-
-    #[test]
-    fn test_script_debug() {
-        let script = script! {
-            OP_TRUE
-            DEBUG
-            OP_TRUE
-            OP_VERIFY
-        };
-        let exec_result = execute_script(script);
-        assert!(!exec_result.success);
-    }
-
-    #[test]
-    fn test_script_execute_no_stack_limit() {
-        let script = script! {
-            for _ in 0..1001 {
-                OP_1
-            }
-            for _ in 0..1001 {
-                OP_DROP
-            }
-            OP_1
-        };
-
-        let exec_result = execute_script_no_stack_limit(script);
-        assert!(exec_result.success);
-    }
-}
diff --git a/splitter/src/lib.rs b/splitter/src/lib.rs
deleted file mode 100644
index 101b91f..0000000
--- a/splitter/src/lib.rs
+++ /dev/null
@@ -1,33 +0,0 @@
-#[allow(dead_code)]
-// Re-export what is needed to write treepp scripts
-pub mod treepp {
-    pub use crate::debug::{execute_script, run};
-    pub use bitcoin_script::{define_pushable, script};
-
-    define_pushable!();
-    pub use bitcoin::ScriptBuf as Script;
-}
-
-pub mod split;
-
-pub(crate) mod debug;
-pub(crate) mod test_scripts;
-pub(crate) mod utils;
-
-#[cfg(test)]
-mod tests {
-    use super::treepp::*;
-
-    /// Tests that checks that environment was set up correctly by running a 2+3=5 script.
-    #[test]
-    fn test_healthy_check() {
-        let script = script! {
-            2 3 OP_ADD 5 OP_EQUAL
-        };
-
-        let exec_result = execute_script(script);
-        assert!(exec_result.success);
-
-        println!("Environment is set up correctly!");
-    }
-}
diff --git a/splitter/src/split/core.rs b/splitter/src/split/core.rs
deleted file mode 100644
index 686ee82..0000000
--- a/splitter/src/split/core.rs
+++ /dev/null
@@ -1,67 +0,0 @@
-//! Module containing the logic of splitting the script into smaller parts
-
-use bitcoin::script::Instruction;
-
-use super::script::SplitResult;
-use crate::{split::intermediate_state::IntermediateState, treepp::*};
-
-/// Maximum size of the script in bytes
-pub(super) const MAX_SCRIPT_SIZE: usize = 30000;
-
-// TODO: Currently, the chunk size splits the script into the parts of the same size IN TERMS OF INSTRUCTIONS, not bytes.
-/// Splits the given script into smaller parts
-pub(super) fn split_into_shards(script: &Script, chunk_size: usize) -> Vec<Script> {
-    let instructions: Vec<Instruction> = script
-        .instructions()
-        .map(|instruction| instruction.expect("script is most likely corrupted"))
-        .collect();
-
-    instructions
-        .chunks(chunk_size)
-        .map(|chunk| {
-            let mut shard = Script::new();
-            for instruction in chunk {
-                shard.push_instruction(*instruction);
-            }
-
-            shard
-        })
-        .collect()
-}
-
-pub(super) fn naive_split(input: Script, script: Script) -> SplitResult {
-    // First, we split the script into smaller parts
-    let shards = split_into_shards(&script, MAX_SCRIPT_SIZE);
-    let mut intermediate_states: Vec<IntermediateState> = vec![];
-
-    // Then, we do the following steps:
-    // 1. We execute the first script with the input
-    // 2. We take the stack and write it to the intermediate results
-    // 3. We execute the second script with the saved intermediate results
-    // 4. Take the stask, save to the intermediate results
-    // 5. Repeat until the last script
-
-    intermediate_states.push(IntermediateState::from_input_script(&input, &shards[0]));
-
-    for shard in shards.clone().into_iter().skip(1) {
-        // Executing a piece of the script with the current input.
-        // NOTE #1: unwrap is safe to use here since intermediate_states is of length 1.
-        // NOTE #2: we need to feed in both the stack and the altstack
-
-        intermediate_states.push(IntermediateState::from_intermediate_result(
-            intermediate_states.last().unwrap(),
-            &shard,
-        ));
-    }
-
-    assert_eq!(
-        intermediate_states.len(),
-        shards.len(),
-        "Intermediate results should be the same as the number of scripts"
-    );
-
-    SplitResult {
-        shards,
-        intermediate_states,
-    }
-}
diff --git a/splitter/src/split/intermediate_state.rs b/splitter/src/split/intermediate_state.rs
deleted file mode 100644
index 14393e8..0000000
--- a/splitter/src/split/intermediate_state.rs
+++ /dev/null
@@ -1,54 +0,0 @@
-//! This module contains the [`IntermediateState`] struct, which is used to store the intermediate
-//! state of the stack and altstack during the execution of a script split into the shards (subprograms).
-
-use crate::{treepp::*, utils::stack_to_script};
-use bitcoin_scriptexec::Stack;
-
-pub struct IntermediateState {
-    pub stack: Stack,
-    pub altstack: Stack,
-}
-
-impl IntermediateState {
-    /// Executes the script with the given input and returns the intermediate result,
-    /// that is, the stack and altstack after the execution
-    pub fn from_input_script(input: &Script, script: &Script) -> Self {
-        let script = script! {
-            { input.clone() }
-            { script.clone() }
-        };
-
-        let result = execute_script(script);
-
-        Self {
-            stack: result.main_stack.clone(),
-            altstack: result.alt_stack.clone(),
-        }
-    }
-
-    /// Based on the previous intermediate result, executes the script with the stacks
-    /// and altstacks of the previous result and returns the new intermediate result
-    pub fn from_intermediate_result(result: &Self, script: &Script) -> Self {
-        let Self { stack, altstack } = result;
-
-        let insert_result_script = script! {
-            // Checks for length of the stack and altstack
-            // are used to avoid panic when referencing the first element
-            // of the stack or altstack (by using get(0) method)
-            if !stack.is_empty() {
-                { stack_to_script(stack) }
-            }
-
-            if !altstack.is_empty() {
-                { stack_to_script(altstack) }
-
-                for i in (0..altstack.len()).rev() {
-                    { i } OP_ROLL
-                    OP_TOALTSTACK
-                }
-            }
-        };
-
-        Self::from_input_script(&insert_result_script, script)
-    }
-}
diff --git a/splitter/src/split/mod.rs b/splitter/src/split/mod.rs
deleted file mode 100644
index 88bbd64..0000000
--- a/splitter/src/split/mod.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-//! Module that contains the implementation of the splitter
-//! together with all auxiliary functions and data structures.
-
-pub mod core;
-pub mod intermediate_state;
-pub mod script;
-
-#[cfg(test)]
-pub mod tests;
diff --git a/splitter/src/split/script.rs b/splitter/src/split/script.rs
deleted file mode 100644
index 88dd8c1..0000000
--- a/splitter/src/split/script.rs
+++ /dev/null
@@ -1,92 +0,0 @@
-//! Module containing the structure for scripts that we are going to use
-
-use super::{core::naive_split, intermediate_state::IntermediateState};
-use crate::treepp::*;
-
-/// Structure that represents a pair of input and output scripts. Typically, the prover
-/// wants to prove `script(input) == output`
-pub struct IOPair<const INPUT_SIZE: usize, const OUTPUT_SIZE: usize> {
-    /// Input script containing the elements which will be fed to the main script
-    pub input: Script,
-    /// Output script containing the elements which will be compared to the output of the main script
-    pub output: Script,
-}
-
-/// Structure that represents the result of splitting a script
-pub struct SplitResult {
-    /// Scripts (shards) that constitute the input script
-    pub shards: Vec<Script>,
-    /// Scripts that contain intermediate states (z values in the paper)
-    pub intermediate_states: Vec<IntermediateState>,
-}
-
-impl SplitResult {
-    /// Creates a new instance of the SplitResult
-    pub fn new(shards: Vec<Script>, intermediate_states: Vec<IntermediateState>) -> Self {
-        Self {
-            shards,
-            intermediate_states,
-        }
-    }
-
-    /// Returns the last intermediate state, ignoring the possibility of the empty vector
-    pub fn must_last_state(&self) -> &IntermediateState {
-        self.intermediate_states
-            .last()
-            .expect("Intermediate states should not be empty")
-    }
-
-    /// Returns the total size of the states (stack + altstack)
-    pub fn total_states_size(&self) -> usize {
-        self.intermediate_states
-            .iter()
-            .map(|state| state.stack.len() + state.altstack.len())
-            .sum()
-    }
-}
-
-/// Trait that any script that can be split should implement
-pub trait SplitableScript<const INPUT_SIZE: usize, const OUTPUT_SIZE: usize> {
-    const INPUT_SIZE: usize = INPUT_SIZE;
-    const OUTPUT_SIZE: usize = OUTPUT_SIZE;
-
-    /// Returns the main logic (f) of the script
-    fn script() -> Script;
-
-    /// Generates a random valid input for the script
-    fn generate_valid_io_pair() -> IOPair<INPUT_SIZE, OUTPUT_SIZE>;
-
-    /// Verifies that the input is valid for the script
-    fn verify(input: Script, output: Script) -> bool {
-        let script = script! {
-            { input }
-            { Self::script() }
-            { output }
-
-            // Now, we need to verify that the output is correct.
-            // Since the output is not necessarily a single element, we check
-            // elements one by one
-            for i in (0..OUTPUT_SIZE).rev() {
-                // { <a_1> <a_2> ... <a_n> <b_1> <b_2> ... <b_n> } <- we need to push element <a_n> to the top of the stack
-                { i+1 } OP_ROLL
-                OP_EQUALVERIFY
-            }
-
-            // If everything was verified correctly, we return true to mark the script as successful
-            OP_TRUE
-        };
-
-        execute_script(script).success
-    }
-
-    /// Verifies that the input is valid for the script with random input and output
-    fn verify_random() -> bool {
-        let IOPair { input, output } = Self::generate_valid_io_pair();
-        Self::verify(input, output)
-    }
-
-    /// Splits the script into smaller parts
-    fn split(input: Script) -> SplitResult {
-        naive_split(input, Self::script())
-    }
-}
diff --git a/splitter/src/split/tests.rs b/splitter/src/split/tests.rs
deleted file mode 100644
index ba199d3..0000000
--- a/splitter/src/split/tests.rs
+++ /dev/null
@@ -1,286 +0,0 @@
-use crate::{
-    split::script::{IOPair, SplitableScript},
-    test_scripts::int_mul::U254MulScript,
-    treepp::*,
-    utils::stack_to_script,
-};
-
-use super::{core::split_into_shards, intermediate_state::IntermediateState};
-
-/// Tests whether splitting the script into subprograms (shards)
-/// works properly for the most basic script
-#[test]
-fn test_split_basic() {
-    const CHUNK_SIZE: usize = 3;
-
-    // Adding a toy script to test the splitting
-    let test_script = script! {
-        {13123} {1235} OP_ADD {4234} OP_ADD {3} OP_ADD {18595} OP_EQUAL
-    };
-    println!("Initial script: {}", test_script.to_asm_string());
-    println!("Initial script size: {}", test_script.len());
-
-    // Verifying its correctness
-    let result = execute_script(test_script.clone());
-    assert!(result.success, "Test script failed");
-
-    // Splitting the script into shards
-    let shards = split_into_shards(&test_script, CHUNK_SIZE);
-
-    // Asserting that we have three shards and each shard has at most three elements in the stack
-    assert_eq!(shards.len(), 3, "Shards number is incorrect");
-    for (i, shard) in shards.clone().into_iter().enumerate() {
-        println!("Shard {}: {}", i, shard.to_asm_string());
-        println!("Shard {} size: {}", i, shard.len());
-    }
-
-    // Asserting that the shards are correct
-    let shard_1_script = script! {
-        { shards[0].clone() }
-        { 14358 }
-        OP_EQUAL
-    };
-    let shard_1_result = execute_script(shard_1_script);
-    assert!(shard_1_result.success, "Shard 1 failed");
-
-    let shard_2_script = script! {
-        { 1 }
-        { shards[1].clone() }
-        OP_DROP
-        { 4235 }
-        OP_EQUAL
-    };
-    let shard_2_result = execute_script(shard_2_script);
-    assert!(shard_2_result.success, "Shard 2 failed");
-
-    let shard_3_result = execute_script(shards[2].clone());
-    assert!(
-        !shard_3_result.success,
-        "Shard 3 for somer reason succeeded"
-    );
-
-    // Now, we are going to concatenate all the shards and verify that the script is also correct
-    let verification_script = script! {
-        for shard in shards {
-            { shard }
-        }
-    };
-    let result = execute_script(verification_script);
-    assert!(result.success, "Verification has failed");
-}
-
-/// Tests whether splitting the script into subprograms (shards)
-/// works properly for the most advanced script (two big integers multipication)
-#[test]
-fn test_split_mul() {
-    const CHUNK_SIZE: usize = 100;
-
-    // Generating a random valid input for the script and the script itself
-    let test_script = U254MulScript::script();
-    let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
-    assert!(
-        U254MulScript::verify(input.clone(), output.clone()),
-        "input/output is not correct"
-    );
-
-    // Splitting the script into shards
-    let shards = split_into_shards(&test_script, CHUNK_SIZE);
-
-    // Now, we are going to concatenate all the shards and verify that the script is also correct
-    let verification_script = script! {
-        { input }
-        for shard in shards {
-            { shard }
-        }
-        { output }
-
-        // Now, we need to verify that the output is correct.
-        for i in (0..U254MulScript::OUTPUT_SIZE).rev() {
-            // { <a_1> <a_2> ... <a_n> <b_1> <b_2> ... <b_n> } <- we need to push element <a_n> to the top of the stack
-            { i+1 } OP_ROLL
-            OP_EQUALVERIFY
-        }
-
-        OP_TRUE
-    };
-
-    let result = execute_script(verification_script);
-    assert!(result.success, "Verification has failed");
-}
-
-#[test]
-fn test_from_input_script_mainstack_only() {
-    // Adding input and verification scripts
-    let input_script = script! {
-        { 13123 } { 1235 }
-    };
-    let main_script = script! {
-        OP_ADD 1 OP_ADD 3 OP_ADD
-    };
-
-    // Creating an intermediate state
-    let IntermediateState { stack, altstack } =
-        IntermediateState::from_input_script(&input_script, &main_script);
-
-    // Asserting that the altstack is empty
-    assert!(altstack.is_empty(), "Altstack is not empty");
-
-    // Now, checking that our stack is simply a number 14362
-    let verify_script = script! {
-        { stack_to_script(&stack) }
-        { 14362 }
-        OP_EQUAL
-    };
-    let result = execute_script(verify_script);
-    assert!(result.success, "Verification failed");
-}
-
-#[test]
-fn test_state_from_input_script_mainstack_and_altstack_1() {
-    // Adding input and verification scripts
-    let input_script = script! {
-        {13123} {1235}
-    };
-    let main_script = script! {
-        OP_ADD 1 OP_ADD 3 OP_ADD 5 OP_TOALTSTACK
-    };
-
-    // Creating an intermediate state
-    let IntermediateState { stack, altstack } =
-        IntermediateState::from_input_script(&input_script, &main_script);
-
-    // Now, checking that our stack is simply a number 14362
-    let verify_mainstack_script = script! {
-        { stack_to_script(&stack) }
-        {14362}
-        OP_EQUAL
-    };
-    let result = execute_script(verify_mainstack_script);
-    assert!(result.success, "mainstack verification failed");
-
-    // Asserting that the altstack is correct
-    let verify_altstack_script = script! {
-        { stack_to_script(&altstack) }
-        { 5 }
-        OP_EQUAL
-    };
-    let result = execute_script(verify_altstack_script);
-    assert!(result.success, "altstack verification failed");
-}
-
-#[test]
-fn test_state_from_input_script_mainstack_and_altstack_2() {
-    // Adding input and verification scripts
-    let input_script = script! {
-        { 13123 } { 1235 }
-    };
-    let main_script = script! {
-        OP_ADD OP_1 OP_ADD OP_3 OP_ADD
-        { 5 }  OP_TOALTSTACK
-        { 100 } OP_TOALTSTACK
-        { 20050 } OP_TOALTSTACK
-    };
-
-    // Creating an intermediate state
-    let IntermediateState { stack, altstack } =
-        IntermediateState::from_input_script(&input_script, &main_script);
-
-    // Now, checking that our stack is simply a number 14362
-    let verify_mainstack_script = script! {
-        { stack_to_script(&stack) }
-        { 14362 }
-        OP_EQUAL
-    };
-    let result = execute_script(verify_mainstack_script);
-    assert!(result.success, "mainstack verification failed");
-
-    // Asserting that the altstack is correct
-    let verify_altstack_script = script! {
-        { stack_to_script(&altstack) }
-        { 20050 } OP_EQUALVERIFY
-        { 100 } OP_EQUALVERIFY
-        { 5 } OP_EQUAL
-    };
-    let result = execute_script(verify_altstack_script);
-    assert!(result.success, "altstack verification failed");
-}
-
-#[test]
-fn test_state_from_state() {
-    const CHUNK_SIZE: usize = 3;
-
-    // Adding input and verification scripts
-    let input_script = script! {
-        { 10 } { 20 }
-    };
-    let main_script = script! {
-        OP_1 OP_TOALTSTACK OP_1 OP_TOALTSTACK OP_0 OP_TOALTSTACK
-        OP_FROMALTSTACK OP_FROMALTSTACK OP_FROMALTSTACK
-        OP_ADD OP_ADD OP_ADD
-    };
-
-    // Now, splitting the main_script:
-    let shards = split_into_shards(&main_script, CHUNK_SIZE);
-
-    // Creating the first intermediate state
-    let z1 = IntermediateState::from_input_script(&input_script, &shards[0]);
-
-    // Asserting that both the stack and altstack are correct
-    let verify_main_stack_script = script! {
-        { stack_to_script(&z1.stack) }
-        OP_1 OP_EQUALVERIFY
-        { 20 } OP_EQUALVERIFY
-        { 10 } OP_EQUAL
-    };
-
-    let result = execute_script(verify_main_stack_script);
-    assert!(result.success, "z1 mainstack verification failed");
-
-    let verify_alt_stack_script = script! {
-        { stack_to_script(&z1.altstack) }
-        OP_1 OP_EQUAL
-    };
-    let result = execute_script(verify_alt_stack_script);
-    assert!(result.success, "z1 altstack verification failed");
-
-    // Now, getting the second state
-    let z2 = IntermediateState::from_intermediate_result(&z1, &shards[1]);
-
-    // Asserting that both the stack and altstack are correct
-    let verify_main_stack_script = script! {
-        { stack_to_script(&z2.stack) }
-        { 20 } OP_EQUALVERIFY
-        { 10 } OP_EQUAL
-    };
-    let result = execute_script(verify_main_stack_script);
-    assert!(result.success, "z2 mainstack verification failed");
-
-    let verify_alt_stack_script = script! {
-        { stack_to_script(&z2.altstack) }
-        OP_0 OP_EQUALVERIFY
-        OP_1 OP_EQUALVERIFY
-        OP_1 OP_EQUAL
-    };
-    let result = execute_script(verify_alt_stack_script);
-    assert!(result.success, "z2 altstack verification failed");
-
-    // Now, getting the third state
-    let z3 = IntermediateState::from_intermediate_result(&z2, &shards[2]);
-
-    // Asserting that both the stack and altstack are correct
-    let verify_main_stack_script = script! {
-        { stack_to_script(&z3.stack) }
-        OP_1 OP_EQUALVERIFY
-        OP_1 OP_EQUALVERIFY
-        OP_0 OP_EQUALVERIFY
-        { 20 } OP_EQUALVERIFY
-        { 10 } OP_EQUAL
-    };
-    let result = execute_script(verify_main_stack_script);
-    assert!(result.success, "z3 mainstack verification failed");
-
-    assert!(
-        z3.altstack.is_empty(),
-        "z3 altstack should be empty at this point"
-    );
-}
diff --git a/splitter/src/test_scripts/int_add.rs b/splitter/src/test_scripts/int_add.rs
deleted file mode 100644
index 3597447..0000000
--- a/splitter/src/test_scripts/int_add.rs
+++ /dev/null
@@ -1,129 +0,0 @@
-//! This module contains the test script
-//! for performing the addition of two large integers
-//! (exceeding standard Bitcoin 31-bit integers)
-
-use crate::{
-    split::script::{IOPair, SplitableScript},
-    treepp::*,
-};
-use bitcoin_window_mul::{
-    bigint::U254,
-    traits::{
-        arithmeticable::Arithmeticable,
-        integer::{NonNativeInteger, NonNativeLimbInteger},
-    },
-};
-
-use core::ops::{Rem, Shl};
-use num_bigint::{BigUint, RandomBits};
-use num_traits::One;
-use rand::{Rng, SeedableRng};
-use rand_chacha::ChaCha20Rng;
-
-/// Script that performs the addition of two 254-bit numbers
-pub struct U254AddScript;
-
-/// Input size is double the number of limbs of U254 since we are adding two numbers
-const INPUT_SIZE: usize = 2 * U254::N_LIMBS;
-/// Output size is the number of limbs of U254
-const OUTPUT_SIZE: usize = U254::N_LIMBS;
-
-impl SplitableScript<{ INPUT_SIZE }, { OUTPUT_SIZE }> for U254AddScript {
-    fn script() -> Script {
-        U254::OP_ADD(1, 0)
-    }
-
-    fn generate_valid_io_pair() -> IOPair<{ INPUT_SIZE }, { OUTPUT_SIZE }> {
-        let mut prng = ChaCha20Rng::seed_from_u64(0);
-
-        // Generate two random 254-bit numbers and calculate their sum
-        let num_1: BigUint = prng.sample(RandomBits::new(254));
-        let num_2: BigUint = prng.sample(RandomBits::new(254));
-        let sum: BigUint = (num_1.clone() + num_2.clone()).rem(BigUint::one().shl(254));
-
-        IOPair {
-            input: script! {
-                { U254::OP_PUSH_U32LESLICE(&num_1.to_u32_digits()) }
-                { U254::OP_PUSH_U32LESLICE(&num_2.to_u32_digits()) }
-            },
-            output: U254::OP_PUSH_U32LESLICE(&sum.to_u32_digits()),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use bitcoin_window_mul::traits::comparable::Comparable;
-
-    use crate::utils::stack_to_script;
-
-    use super::*;
-
-    #[test]
-    fn test_verify() {
-        assert!(U254AddScript::verify_random());
-    }
-
-    #[test]
-    fn test_naive_split_correctness() {
-        // Generating a random valid input for the script and the script itself
-        let IOPair { input, output } = U254AddScript::generate_valid_io_pair();
-        assert!(
-            U254AddScript::verify(input.clone(), output.clone()),
-            "input/output is not correct"
-        );
-
-        // Splitting the script into shards
-        let split_result = U254AddScript::split(input.clone());
-
-        // Now, we are going to concatenate all the shards and verify that the script is also correct
-        let verification_script = script! {
-            { input }
-            for shard in split_result.shards {
-                { shard }
-            }
-            { output }
-
-            // Now, we need to verify that the output is correct.
-            for i in (0..U254AddScript::OUTPUT_SIZE).rev() {
-                // { <a_1> <a_2> ... <a_n> <b_1> <b_2> ... <b_n> } <- we need to push element <a_n> to the top of the stack
-                { i+1 } OP_ROLL
-                OP_EQUALVERIFY
-            }
-
-            OP_TRUE
-        };
-
-        let result = execute_script(verification_script);
-        assert!(result.success, "Verification has failed");
-    }
-
-    #[test]
-    fn test_naive_split() {
-        // First, we generate the pair of input and output scripts
-        let IOPair { input, output } = U254AddScript::generate_valid_io_pair();
-
-        // Splitting the script into shards
-        let split_result = U254AddScript::split(input);
-
-        // Checking the last state (which must be equal to the result of the multiplication)
-        let last_state = split_result.must_last_state();
-
-        // Altstack must be empty
-        assert!(last_state.altstack.is_empty(), "altstack is not empty!");
-
-        // The element of the mainstack must be equal to the actual output
-        let verification_script = script! {
-            { stack_to_script(&last_state.stack) }
-            { output }
-            { U254::OP_EQUAL(0, 1) }
-        };
-
-        let result = execute_script(verification_script);
-        assert!(result.success, "verification has failed");
-
-        // Now, we debug the total size of the states
-        let total_size = split_result.total_states_size();
-        println!("Total size of the states: {} bytes", total_size);
-    }
-}
diff --git a/splitter/src/test_scripts/int_mul.rs b/splitter/src/test_scripts/int_mul.rs
deleted file mode 100644
index 1876880..0000000
--- a/splitter/src/test_scripts/int_mul.rs
+++ /dev/null
@@ -1,122 +0,0 @@
-//! This module contains the test script
-//! for performing the multiplication of two large integers
-//! (exceeding standard Bitcoin 31-bit integers)
-
-use crate::{
-    split::script::{IOPair, SplitableScript},
-    treepp::*,
-};
-use bitcoin_window_mul::{
-    bigint::{U254Windowed, U508},
-    traits::integer::{NonNativeInteger, NonNativeLimbInteger},
-};
-
-use num_bigint::{BigUint, RandomBits};
-use rand::{Rng, SeedableRng};
-use rand_chacha::ChaCha20Rng;
-
-/// Script that performs the addition of two 254-bit numbers
-pub struct U254MulScript;
-
-/// Input size is double the number of limbs of U254 since we are multiplying two numbers
-const INPUT_SIZE: usize = 2 * U254Windowed::N_LIMBS;
-/// Output size is the number of limbs of U508
-const OUTPUT_SIZE: usize = U508::N_LIMBS;
-
-impl SplitableScript<{ INPUT_SIZE }, { OUTPUT_SIZE }> for U254MulScript {
-    fn script() -> Script {
-        U254Windowed::OP_WIDENINGMUL::<U508>()
-    }
-
-    fn generate_valid_io_pair() -> IOPair<{ INPUT_SIZE }, { OUTPUT_SIZE }> {
-        let mut prng = ChaCha20Rng::seed_from_u64(0);
-
-        // Generate two random 254-bit numbers and calculate their sum
-        let num_1: BigUint = prng.sample(RandomBits::new(254));
-        let num_2: BigUint = prng.sample(RandomBits::new(254));
-        let product: BigUint = num_1.clone() * num_2.clone();
-
-        IOPair {
-            input: script! {
-                { U254Windowed::OP_PUSH_U32LESLICE(&num_1.to_u32_digits()) }
-                { U254Windowed::OP_PUSH_U32LESLICE(&num_2.to_u32_digits()) }
-            },
-            output: U508::OP_PUSH_U32LESLICE(&product.to_u32_digits()),
-        }
-    }
-}
-
-#[cfg(test)]
-mod tests {
-    use super::*;
-    use crate::utils::stack_to_script;
-    use bitcoin_window_mul::traits::comparable::Comparable;
-
-    #[test]
-    fn test_verify() {
-        assert!(U254MulScript::verify_random());
-    }
-
-    #[test]
-    fn test_naive_split_correctness() {
-        // Generating a random valid input for the script and the script itself
-        let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
-        assert!(
-            U254MulScript::verify(input.clone(), output.clone()),
-            "input/output is not correct"
-        );
-
-        // Splitting the script into shards
-        let split_result = U254MulScript::split(input.clone());
-
-        // Now, we are going to concatenate all the shards and verify that the script is also correct
-        let verification_script = script! {
-            { input }
-            for shard in split_result.shards {
-                { shard }
-            }
-            { output }
-
-            // Now, we need to verify that the output is correct.
-            for i in (0..U254MulScript::OUTPUT_SIZE).rev() {
-                // { <a_1> <a_2> ... <a_n> <b_1> <b_2> ... <b_n> } <- we need to push element <a_n> to the top of the stack
-                { i+1 } OP_ROLL
-                OP_EQUALVERIFY
-            }
-
-            OP_TRUE
-        };
-
-        let result = execute_script(verification_script);
-        assert!(result.success, "Verification has failed");
-    }
-
-    #[test]
-    fn test_naive_split() {
-        // First, we generate the pair of input and output scripts
-        let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
-
-        // Splitting the script into shards
-        let split_result = U254MulScript::split(input);
-
-        // Checking the last state (which must be equal to the result of the multiplication)
-        let last_state = split_result.must_last_state();
-
-        // Altstack must be empty
-        assert!(last_state.altstack.is_empty(), "altstack is not empty!");
-
-        // The element of the mainstack must be equal to the actual output
-        let verification_script = script! {
-            { stack_to_script(&last_state.stack) }
-            { output }
-            { U508::OP_EQUAL(0, 1) }
-        };
-
-        let result = execute_script(verification_script);
-        assert!(result.success, "verification has failed");
-
-        // Now, we debug the total size of the states
-        let total_size = split_result.total_states_size();
-        println!("Total size of the states: {} bytes", total_size);
-    }
-}
diff --git a/splitter/src/test_scripts/mod.rs b/splitter/src/test_scripts/mod.rs
deleted file mode 100644
index 26548cf..0000000
--- a/splitter/src/test_scripts/mod.rs
+++ /dev/null
@@ -1,9 +0,0 @@
-//! This module contains some test scripts to test
-//! the functionality of the splitter.
-//!
-//! Namely, we include:
-//! - A script that performs an addition of two 254-bit numbers.
-//! - A script that performs a multiplication of two 254-bit numbers using w-windowed approach.
-
-pub(crate) mod int_add;
-pub(crate) mod int_mul;
diff --git a/splitter/src/utils.rs b/splitter/src/utils.rs
deleted file mode 100644
index 24ce002..0000000
--- a/splitter/src/utils.rs
+++ /dev/null
@@ -1,11 +0,0 @@
-use bitcoin_scriptexec::Stack;
-
-use crate::treepp::*;
-
-pub(crate) fn stack_to_script(stack: &Stack) -> Script {
-    script! {
-        for element in stack.iter_str() {
-            { element.to_vec() }
-        }
-    }
-}

From bcff390ab584959ed00d0a0954918476f1716838 Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 9 Oct 2024 09:59:47 +0300
Subject: [PATCH 03/28] :bulb: make fuzzy script splitter

---
 bitcoin-splitter/Cargo.toml                   |   1 +
 bitcoin-splitter/src/bitvm/hash/sha256.rs     |   2 +-
 bitcoin-splitter/src/split/core.rs            |  81 ++++++-
 .../src/split/intermediate_state.rs           |  19 ++
 bitcoin-splitter/src/split/script.rs          |  65 ++++-
 bitcoin-splitter/src/split/tests.rs           |   2 +-
 bitcoin-splitter/src/test_scripts/int_add.rs  |   4 +-
 .../src/test_scripts/int_mul_karatsuba.rs     | 225 ++++++++++++++++++
 .../{int_mul.rs => int_mul_windowed.rs}       |  99 +++++++-
 bitcoin-splitter/src/test_scripts/mod.rs      |   3 +-
 bitcoin-splitter/src/test_scripts/sha256.rs   |   9 +-
 11 files changed, 490 insertions(+), 20 deletions(-)
 create mode 100644 bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs
 rename bitcoin-splitter/src/test_scripts/{int_mul.rs => int_mul_windowed.rs} (53%)

diff --git a/bitcoin-splitter/Cargo.toml b/bitcoin-splitter/Cargo.toml
index d6a80db..652edb8 100644
--- a/bitcoin-splitter/Cargo.toml
+++ b/bitcoin-splitter/Cargo.toml
@@ -19,6 +19,7 @@ strum_macros   = "0.26"
 serde          = { version = "1.0.197", features = ["derive"] }
 serde_json     = "1.0.116"
 tokio          = { version = "1.37.0", features = ["full"] }
+indicatif      = "0.17.8" # Progress bar
 
 # Crypto libraries
 hex        = "0.4.3"
diff --git a/bitcoin-splitter/src/bitvm/hash/sha256.rs b/bitcoin-splitter/src/bitvm/hash/sha256.rs
index 35ed12c..60ed4e4 100644
--- a/bitcoin-splitter/src/bitvm/hash/sha256.rs
+++ b/bitcoin-splitter/src/bitvm/hash/sha256.rs
@@ -183,7 +183,7 @@ pub fn sha256_k() -> Vec<Script> {
 }
 
 /// SHA256 transform
-/// 
+///
 /// - **Input**: `[m[15], m[14], ..., m[0], state[7], state[6], ..., state[0]]`
 /// - **Output**: `[state[7], state[6], ..., state[0]]`
 pub fn sha256_transform(xor_depth: u32, k_depth: u32) -> Script {
diff --git a/bitcoin-splitter/src/split/core.rs b/bitcoin-splitter/src/split/core.rs
index 6552f3f..ebb2433 100644
--- a/bitcoin-splitter/src/split/core.rs
+++ b/bitcoin-splitter/src/split/core.rs
@@ -1,9 +1,12 @@
 //! Module containing the logic of splitting the script into smaller parts
 
+use std::{panic, usize};
+
 use bitcoin::{
-    opcodes::all::{OP_ENDIF, OP_IF},
+    opcodes::all::{OP_ENDIF, OP_IF, OP_NOTIF},
     script::Instruction,
 };
+use indicatif::ProgressBar;
 
 use super::script::SplitResult;
 use crate::{split::intermediate_state::IntermediateState, treepp::*};
@@ -15,15 +18,28 @@ use crate::{split::intermediate_state::IntermediateState, treepp::*};
 /// that will be used to split the script and the algorithm
 /// will try to keep the size of the script as close to the optimal
 /// as possible.
-pub(super) const OPTIMAL_SCRIPT_SIZE: usize = 20000;
+pub(super) const DEFAULT_SCRIPT_SIZE: usize = 7000;
 
 /// Maximum scriptsize in bytes that is allowed by the Bitcoin network
 pub(super) const MAX_SCRIPT_SIZE: usize = 50000;
 
+/// When dealing with BitVM2 Disprove transaction,
+/// there are two factors that we need to consider:
+/// 1. The chunk (shard) script size.
+/// 2. The intermediate state size.
+///
+/// The total size of the disprove script is (approximately):
+/// `shard_size_i + (z_i_size + z_(i-1)_size) * STACK_SIZE_INDEX`
+///
+/// The `STACK_SIZE_INDEX` is the factor of how much intermediate states
+/// are contributing to the total size of the script.
+pub(super) const STACK_SIZE_INDEX: usize = 1000;
+
 /// Type of the split that we are going to use
 ///
 /// - [`SplitType::ByInstructions`]- splits the script by the number of instructions
 /// - [`SplitType::ByBytes`] - splits the script by the number of bytes
+#[derive(Debug, Clone, Copy)]
 pub enum SplitType {
     ByInstructions,
     ByBytes,
@@ -63,7 +79,7 @@ pub(super) fn split_into_shards(
         // Checking if the current instruction is OP_IF or OP_ENDIF
         if let Instruction::Op(op) = instruction {
             match op {
-                OP_IF => {
+                OP_IF | OP_NOTIF => {
                     if_count += 1;
                 }
                 OP_ENDIF => {
@@ -77,6 +93,8 @@ pub(super) fn split_into_shards(
         // is the same, we need to create a new one
         if current_shard_size >= chunk_size && if_count == endif_count {
             shards.push(Script::new());
+            if_count = 0;
+            endif_count = 0;
         }
 
         // Checking that the total size has not exceeded the maximum size
@@ -89,14 +107,67 @@ pub(super) fn split_into_shards(
     shards
 }
 
+/// Fuzzy split of the script into smaller parts by searching for the optimal size
+/// by checking various script sizes
+pub(super) fn fuzzy_split(input: Script, script: Script, split_type: SplitType) -> SplitResult {
+    // Define the limits
+    const MIN_CHUNK_SIZE: usize = 100;
+    const MAX_CHUNK_SIZE: usize = MAX_SCRIPT_SIZE;
+    const STEP_SIZE: usize = 20;
+
+    // Defining the final result
+    let mut resultant_split = SplitResult::new(vec![], vec![]);
+    let mut resultant_complexity = usize::MAX;
+
+    // Now, displaying the progress bar
+    let total_progress = (MAX_CHUNK_SIZE - MIN_CHUNK_SIZE) / STEP_SIZE;
+    let bar = ProgressBar::new(total_progress as u64);
+
+    // Trying to find the optimal size of the chunk by checking
+    // each size from MIN_CHUNK_SIZE to MAX_CHUNK_SIZE
+    for chunk_size in (MIN_CHUNK_SIZE..MAX_CHUNK_SIZE).step_by(STEP_SIZE) {
+        // Incrementing the progress bar
+        bar.inc(1);
+        
+        // We are using panic::catch_unwind to catch any panics that might occur
+        // during the splitting process. If a panic occurs, we just skip the current
+        // chunk size and continue with the next one.
+        let current_split_result = panic::catch_unwind(|| {
+            naive_split(input.clone(), script.clone(), split_type, chunk_size)
+        });
+        
+        if let Ok(split_result) = current_split_result {
+            let current_complexity = split_result.complexity_index();
+
+            if current_complexity < resultant_complexity {
+                resultant_complexity = current_complexity;
+                resultant_split = split_result;
+            }
+        }
+    }
+
+    bar.finish();
+    resultant_split
+}
+
+/// Default split of the script into smaller parts with the hard-coded optimal size
+pub(super) fn default_split(input: Script, script: Script, split_type: SplitType) -> SplitResult {
+    naive_split(input, script, split_type, DEFAULT_SCRIPT_SIZE)
+}
+
 /// Naive split of the script into smaller parts. It works as follows:
 /// 1. We split the script into smaller parts
 /// 2. We execute each shard with the input
 /// 3. Save intermediate results
 /// 4. Return all the shards and intermediate results in the form of [`SplitResult`]
-pub(super) fn naive_split(input: Script, script: Script, split_type: SplitType) -> SplitResult {
+pub(super) fn naive_split(
+    input: Script,
+    script: Script,
+    split_type: SplitType,
+    chunk_size: usize,
+) -> SplitResult {
     // First, we split the script into smaller parts
-    let shards = split_into_shards(&script, OPTIMAL_SCRIPT_SIZE, split_type);
+    let shards = split_into_shards(&script, chunk_size, split_type);
     let mut intermediate_states: Vec<IntermediateState> = vec![];
 
     // Then, we do the following steps:
diff --git a/bitcoin-splitter/src/split/intermediate_state.rs b/bitcoin-splitter/src/split/intermediate_state.rs
index 9cea182..5de15f4 100644
--- a/bitcoin-splitter/src/split/intermediate_state.rs
+++ b/bitcoin-splitter/src/split/intermediate_state.rs
@@ -1,6 +1,8 @@
 //! This module contains the [`IntermediateState`] struct, which is used to store the intermediate
 //! state of the stack and altstack during the execution of a script split into the shards (subprograms).
 
+use core::fmt;
+
 use crate::{treepp::*, utils::stack_to_script};
 use bitcoin_scriptexec::Stack;
 
@@ -12,6 +14,13 @@ pub struct IntermediateState {
     pub altstack: Stack,
 }
 
+impl fmt::Debug for IntermediateState {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        writeln!(f, "Stack: {:?}", self.stack)?;
+        writeln!(f, "Altstack: {:?}", self.altstack)
+    }
+}
+
 impl IntermediateState {
     /// Executes the script with the given input and returns the intermediate result,
     /// that is, the stack and altstack after the execution
@@ -54,4 +63,14 @@ impl IntermediateState {
 
         Self::from_input_script(&insert_result_script, script)
     }
+
+    /// Converts the stack to a vector of u32 values
+    pub fn interpret_as_u32_array(&self) -> Vec<u8> {
+        self.stack.clone().serialize_to_bytes()
+    }
+
+    /// Returns the size of the stack and altstack
+    pub fn size(&self) -> usize {
+        self.stack.len() + self.altstack.len()
+    }
 }
diff --git a/bitcoin-splitter/src/split/script.rs b/bitcoin-splitter/src/split/script.rs
index faeb62b..6c4661c 100644
--- a/bitcoin-splitter/src/split/script.rs
+++ b/bitcoin-splitter/src/split/script.rs
@@ -3,7 +3,7 @@
 use core::fmt;
 
 use super::{
-    core::{naive_split, SplitType},
+    core::{default_split, fuzzy_split, naive_split, SplitType, STACK_SIZE_INDEX},
     intermediate_state::IntermediateState,
 };
 use crate::treepp::*;
@@ -54,6 +54,11 @@ impl SplitResult {
         }
     }
 
+    /// Returns the number of intermediate states (and thus the number of shards)
+    pub fn len(&self) -> usize {
+        self.intermediate_states.len()
+    }
+
     /// Returns the last intermediate state, ignoring the possibility of the empty vector
     pub fn must_last_state(&self) -> &IntermediateState {
         self.intermediate_states
@@ -65,9 +70,51 @@ impl SplitResult {
     pub fn total_states_size(&self) -> usize {
         self.intermediate_states
             .iter()
-            .map(|state| state.stack.len() + state.altstack.len())
+            .map(|state| state.size())
             .sum()
     }
+
+    /// Returns the maximal size of the states (stack + altstack)
+    pub fn max_states_size(&self) -> usize {
+        self.intermediate_states
+            .iter()
+            .map(|state| state.size())
+            .max()
+            .unwrap_or(0)
+    }
+
+    /// Returns the maximal size of two adjacent states (stack + altstack)
+    pub fn max_adjacent_states_size(&self) -> usize {
+        self.intermediate_states
+            .windows(2)
+            .map(|states| states[0].size() + states[1].size())
+            .max()
+            .unwrap_or(0)
+    }
+
+    /// Returns the complexity index of the script splitting.
+    /// The complexity index is the approximate worst number of opcodes
+    /// it takes to form the disprove script.
+    pub fn complexity_index(&self) -> usize {
+        let mut resultant_complexity = 0;
+
+        for i in 0..self.len() {
+            // Calculating sizes of the shards and states.
+            // Namely, since z[i] = f[i](z[i-1]), we need to calculate
+            // the size (|z[i]| + |z[i-1]|) * STACK_SIZE_INDEX + |f[i]|
+            resultant_complexity = resultant_complexity.max({
+                let shard_size = self.shards[i].len();
+                let current_state_size = self.intermediate_states[i].size();
+                let previous_state_size = if i > 0 {
+                    self.intermediate_states[i - 1].size()
+                } else { 0 };
+
+                shard_size + (current_state_size + previous_state_size) * STACK_SIZE_INDEX
+            });
+        }
+
+        resultant_complexity
+    }
 }
 
 /// Trait that any script that can be split should implement
@@ -111,7 +158,17 @@ pub trait SplitableScript<const INPUT_SIZE: usize, const OUTPUT_SIZE: usize> {
     }
 
     /// Splits the script into smaller parts
-    fn split(input: Script, split_type: SplitType) -> SplitResult {
-        naive_split(input, Self::script(), split_type)
+    fn default_split(input: Script, split_type: SplitType) -> SplitResult {
+        default_split(input, Self::script(), split_type)
+    }
+
+    /// Splits the script into smaller parts with the specified chunk size
+    fn split(input: Script, split_type: SplitType, chunk_size: usize) -> SplitResult {
+        naive_split(input, Self::script(), split_type, chunk_size)
+    }
+
+    /// Splits the script into smaller parts with the fuzzy split
+    fn fuzzy_split(input: Script, split_type: SplitType) -> SplitResult {
+        fuzzy_split(input, Self::script(), split_type)
     }
 }
diff --git a/bitcoin-splitter/src/split/tests.rs b/bitcoin-splitter/src/split/tests.rs
index 890aefd..b1effa6 100644
--- a/bitcoin-splitter/src/split/tests.rs
+++ b/bitcoin-splitter/src/split/tests.rs
@@ -3,7 +3,7 @@ use crate::{
         core::SplitType,
         script::{IOPair, SplitableScript},
     },
-    test_scripts::int_mul::U254MulScript,
+    test_scripts::int_mul_windowed::U254MulScript,
     treepp::*,
     utils::stack_to_script,
 };
diff --git a/bitcoin-splitter/src/test_scripts/int_add.rs b/bitcoin-splitter/src/test_scripts/int_add.rs
index 36149fb..87929f2 100644
--- a/bitcoin-splitter/src/test_scripts/int_add.rs
+++ b/bitcoin-splitter/src/test_scripts/int_add.rs
@@ -74,7 +74,7 @@ mod tests {
         );
 
         // Splitting the script into shards
-        let split_result = U254AddScript::split(input.clone(), SplitType::ByInstructions);
+        let split_result = U254AddScript::default_split(input.clone(), SplitType::ByInstructions);
 
         // Now, we are going to concatenate all the shards and verify that the script is also correct
         let verification_script = script! {
@@ -104,7 +104,7 @@ mod tests {
         let IOPair { input, output } = U254AddScript::generate_valid_io_pair();
 
         // Splitting the script into shards
-        let split_result = U254AddScript::split(input, SplitType::ByInstructions);
+        let split_result = U254AddScript::default_split(input, SplitType::ByInstructions);
 
         // Checking the last state (which must be equal to the result of the multiplication)
         let last_state = split_result.must_last_state();
diff --git a/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs b/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs
new file mode 100644
index 0000000..8143ec1
--- /dev/null
+++ b/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs
@@ -0,0 +1,225 @@
+//! This module contains the test script
+//! for performing the multiplication of two large integers
+//! (exceeding standard Bitcoin 31-bit integers)
+
+use crate::{
+    split::script::{IOPair, SplitableScript},
+    treepp::*,
+};
+use bitcoin_window_mul::{
+    bigint::{arithmetics::u29x9::u29x9_mul_karazuba, implementation::NonNativeBigIntImpl},
+    traits::integer::{NonNativeInteger, NonNativeLimbInteger},
+};
+
+use num_bigint::{BigUint, RandomBits};
+use rand::{Rng, SeedableRng};
+use rand_chacha::ChaCha20Rng;
+
+pub type U261 = NonNativeBigIntImpl<261, 29>;
+pub type U522 = NonNativeBigIntImpl<522, 29>;
+
+/// Script that performs the addition of two 255-bit numbers
+pub struct U261MulKaratsubaScript;
+
+/// Input size is double the number of limbs of U254 since we are multiplying two numbers
+const INPUT_SIZE: usize = 2 * U261::N_LIMBS;
+/// Output size is the number of limbs of U508
+const OUTPUT_SIZE: usize = U522::N_LIMBS;
+
+impl SplitableScript<{ INPUT_SIZE }, { OUTPUT_SIZE }> for U261MulKaratsubaScript {
+    fn script() -> Script {
+        u29x9_mul_karazuba(0, 1)
+    }
+
+    fn generate_valid_io_pair() -> IOPair<{ INPUT_SIZE }, { OUTPUT_SIZE }> {
+        let mut prng = ChaCha20Rng::seed_from_u64(0);
+
+        // Generate two random 254-bit numbers and calculate their sum
+        let num_1: BigUint = prng.sample(RandomBits::new(254));
+        let num_2: BigUint = prng.sample(RandomBits::new(254));
+        let product: BigUint = num_1.clone() * num_2.clone();
+
+        IOPair {
+            input: script! {
+                { U261::OP_PUSH_U32LESLICE(&num_1.to_u32_digits()) }
+                { U261::OP_PUSH_U32LESLICE(&num_2.to_u32_digits()) }
+            },
+            output: U522::OP_PUSH_U32LESLICE(&product.to_u32_digits()),
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use crate::{split::core::SplitType, utils::stack_to_script};
+    use bitcoin_window_mul::traits::comparable::Comparable;
+
+    #[test]
+    fn test_verify() {
+        assert!(U261MulKaratsubaScript::verify_random());
+    }
+
+    #[test]
+    fn test_naive_split_correctness() {
+        // Generating a random valid input for the script and the script itself
+        let IOPair { input, output } = U261MulKaratsubaScript::generate_valid_io_pair();
+        assert!(
+            U261MulKaratsubaScript::verify(input.clone(), output.clone()),
+            "input/output is not correct"
+        );
+
+        // Splitting the script into shards
+        let split_result =
+            U261MulKaratsubaScript::default_split(input.clone(), SplitType::ByInstructions);
+
+        // Now, we are going to concatenate all the shards and verify that the script is also correct
+        let verification_script = script! {
+            { input }
+            for shard in split_result.shards {
+                { shard }
+            }
+            { output }
+
+            // Now, we need to verify that the output is correct.
+            for i in (0..U261MulKaratsubaScript::OUTPUT_SIZE).rev() {
+                // { <a_1> <a_2> ... <a_n> <b_1> <b_2> ... <b_n> } <- we need to push element <a_n> to the top of the stack
+                { i+1 } OP_ROLL
+                OP_EQUALVERIFY
+            }
+
+            OP_TRUE
+        };
+
+        let result = execute_script(verification_script);
+        assert!(result.success, "Verification has failed");
+    }
+
+    #[test]
+    fn test_naive_split() {
+        // First, we generate the pair of input and output scripts
+        let IOPair { input, output } = U261MulKaratsubaScript::generate_valid_io_pair();
+
+        // Splitting the script into shards
+        let split_result = U261MulKaratsubaScript::default_split(input, SplitType::ByInstructions);
+
+        for shard in split_result.shards.iter() {
+            println!("Shard: {:?}", shard.len());
+        }
+
+        // Debugging the split result
+        println!("Split result: {:?}", split_result);
+
+        // Checking the last state (which must be equal to the result of the multiplication)
+        let last_state = split_result.must_last_state();
+
+        // Altstack must be empty
+        assert!(last_state.altstack.is_empty(), "altstack is not empty!");
+
+        // The element of the mainstack must be equal to the actual output
+        let verification_script = script! {
+            { stack_to_script(&last_state.stack) }
+            { output }
+            { U522::OP_EQUAL(0, 1) }
+        };
+
+        let result = execute_script(verification_script);
+        assert!(result.success, "verification has failed");
+
+        // Printing
+        for (i, state) in split_result.intermediate_states.iter().enumerate() {
+            println!(
+                "Intermediate state #{}: {:?}",
+                i,
+                state.stack.len() + state.altstack.len()
+            );
+        }
+
+        // Now, we debug the total size of the states
+        let total_size = split_result.total_states_size();
+        println!("Total size of the states: {} bytes", total_size);
+    }
+
+    #[test]
+    fn test_fuzzy_split() {
+        // First, we generate the pair of input and output scripts
+        let IOPair { input, output } = U261MulKaratsubaScript::generate_valid_io_pair();
+
+        // Splitting the script into shards
+        let split_result = U261MulKaratsubaScript::fuzzy_split(input, SplitType::ByInstructions);
+
+        for shard in split_result.shards.iter() {
+            println!("Shard: {:?}", shard.len());
+        }
+
+        // Debugging the split result
+        println!("Split result: {:?}", split_result);
+
+        // Checking the last state (which must be equal to the result of the multiplication)
+        let last_state = split_result.must_last_state();
+
+        // Altstack must be empty
+        assert!(last_state.altstack.is_empty(), "altstack is not empty!");
+
+        // The element of the mainstack must be equal to the actual output
+        let verification_script = script! {
+            { stack_to_script(&last_state.stack) }
+            { output }
+            { U522::OP_EQUAL(0, 1) }
+        };
+
+        let result = execute_script(verification_script);
+        assert!(result.success, "verification has failed");
+
+        // Printing
+        for (i, state) in split_result.intermediate_states.iter().enumerate() {
+            println!(
+                "Intermediate state #{}: {:?}",
+                i,
+                state.stack.len() + state.altstack.len()
+            );
+        }
+
+        // Now, we debug the total size of the states
+        let total_size = split_result.total_states_size();
+        println!("Total size of the states: {} bytes", total_size);
+    }
+
+    #[test]
+    #[ignore = "wip"]
+    fn test_to_u32_conversion() {
+        // First, we generate the pair of input and output scripts
+        let IOPair { input, output } = U261MulKaratsubaScript::generate_valid_io_pair();
+
+        // Splitting the script into shards
+        let split_result = U261MulKaratsubaScript::default_split(input, SplitType::ByInstructions);
+
+        // Debugging the split result
+        println!("Split result: {:?}", split_result);
+
+        // Now, verifying tha the split is correct (meaning, the last state is equal to the output)
+        let last_state = split_result.must_last_state();
+
+        // Altstack must be empty
+        assert!(last_state.altstack.is_empty(), "altstack is not empty!");
+
+        // The element of the mainstack must be equal to the actual output
+        let verification_script = script! {
+            { stack_to_script(&last_state.stack) }
+            { output }
+            { U522::OP_EQUAL(0, 1) }
+        };
+
+        let result = execute_script(verification_script);
+        assert!(result.success, "verification has failed");
+
+        // Now, let us debug each of the intermediate states
+        for (i, state) in split_result.intermediate_states.iter().enumerate() {
+            let state_as_bytes = state.stack.clone().serialize_to_bytes();
+
+            println!("Intermediate state #{}: {:?}", i, state);
+            println!("Intermediate state as bytes #{}: {:?}", i, state_as_bytes);
+            // println!("Intermediate state as u32 array #{}: {:?}", i, Stack::from_u8_vec(state_as_bytes));
+        }
+    }
+}
diff --git a/bitcoin-splitter/src/test_scripts/int_mul.rs b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
similarity index 53%
rename from bitcoin-splitter/src/test_scripts/int_mul.rs
rename to bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
index 344db53..5f2d4b0 100644
--- a/bitcoin-splitter/src/test_scripts/int_mul.rs
+++ b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
@@ -67,7 +67,7 @@ mod tests {
         );
 
         // Splitting the script into shards
-        let split_result = U254MulScript::split(input.clone(), SplitType::ByInstructions);
+        let split_result = U254MulScript::default_split(input.clone(), SplitType::ByInstructions);
 
         // Now, we are going to concatenate all the shards and verify that the script is also correct
         let verification_script = script! {
@@ -97,7 +97,56 @@ mod tests {
         let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
 
         // Splitting the script into shards
-        let split_result = U254MulScript::split(input, SplitType::ByInstructions);
+        let split_result = U254MulScript::default_split(input, SplitType::ByInstructions);
+
+        for shard in split_result.shards.iter() {
+            println!("Shard: {:?}", shard.len());
+        }
+
+        // Debugging the split result
+        println!("Split result: {:?}", split_result);
+
+        // Checking the last state (which must be equal to the result of the multiplication)
+        let last_state = split_result.must_last_state();
+
+        // Altstack must be empty
+        assert!(last_state.altstack.is_empty(), "altstack is not empty!");
+
+        // The element of the mainstack must be equal to the actual output
+        let verification_script = script! {
+            { stack_to_script(&last_state.stack) }
+            { output }
+            { U508::OP_EQUAL(0, 1) }
+        };
+
+        let result = execute_script(verification_script);
+        assert!(result.success, "verification has failed");
+
+        // Printing
+        for (i, state) in split_result.intermediate_states.iter().enumerate() {
+            println!(
+                "Intermediate state #{}: {:?}",
+                i,
+                state.stack.len() + state.altstack.len()
+            );
+        }
+
+        // Now, we debug the total size of the states
+        let total_size = split_result.total_states_size();
+        println!("Total size of the states: {} bytes", total_size);
+    }
+
+    #[test]
+    fn test_fuzzy_split() {
+        // First, we generate the pair of input and output scripts
+        let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
+
+        // Splitting the script into shards
+        let split_result = U254MulScript::fuzzy_split(input, SplitType::ByInstructions);
+
+        for shard in split_result.shards.iter() {
+            println!("Shard: {:?}", shard.len());
+        }
 
         // Debugging the split result
         println!("Split result: {:?}", split_result);
@@ -118,8 +167,54 @@ mod tests {
         let result = execute_script(verification_script);
         assert!(result.success, "verification has failed");
 
+        // Printing
+        for (i, state) in split_result.intermediate_states.iter().enumerate() {
+            println!(
+                "Intermediate state #{}: {:?}",
+                i,
+                state.stack.len() + state.altstack.len()
+            );
+        }
+
         // Now, we debug the total size of the states
         let total_size = split_result.total_states_size();
         println!("Total size of the states: {} bytes", total_size);
     }
+
+    #[test]
+    fn test_to_u32_conversion() {
+        // First, we generate the pair of input and output scripts
+        let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
+
+        // Splitting the script into shards
+        let split_result = U254MulScript::default_split(input, SplitType::ByInstructions);
+
+        // Debugging the split result
+        println!("Split result: {:?}", split_result);
+
+        // Now, verifying tha the split is correct (meaning, the last state is equal to the output)
+        let last_state = split_result.must_last_state();
+
+        // Altstack must be empty
+        assert!(last_state.altstack.is_empty(), "altstack is not empty!");
+
+        // The element of the mainstack must be equal to the actual output
+        let verification_script = script! {
+            { stack_to_script(&last_state.stack) }
+            { output }
+            { U508::OP_EQUAL(0, 1) }
+        };
+
+        let result = execute_script(verification_script);
+        assert!(result.success, "verification has failed");
+
+        // Now, let us debug each of the intermediate states
+        for (i, state) in split_result.intermediate_states.iter().enumerate() {
+            let state_as_bytes = state.stack.clone().serialize_to_bytes();
+
+            println!("Intermediate state #{}: {:?}", i, state);
+            println!("Intermediate state as bytes #{}: {:?}", i, state_as_bytes);
+            // println!("Intermediate state as u32 array #{}: {:?}", i, Stack::from_u8_vec(state_as_bytes));
+        }
+    }
 }
diff --git a/bitcoin-splitter/src/test_scripts/mod.rs b/bitcoin-splitter/src/test_scripts/mod.rs
index 7eac377..70b14d3 100644
--- a/bitcoin-splitter/src/test_scripts/mod.rs
+++ b/bitcoin-splitter/src/test_scripts/mod.rs
@@ -6,5 +6,6 @@
 //! - A script that performs a multiplication of two 254-bit numbers using w-windowed approach.
 
 pub(crate) mod int_add;
-pub(crate) mod int_mul;
+pub(crate) mod int_mul_karatsuba;
+pub(crate) mod int_mul_windowed;
 pub(crate) mod sha256;
diff --git a/bitcoin-splitter/src/test_scripts/sha256.rs b/bitcoin-splitter/src/test_scripts/sha256.rs
index a6dbd48..d147510 100644
--- a/bitcoin-splitter/src/test_scripts/sha256.rs
+++ b/bitcoin-splitter/src/test_scripts/sha256.rs
@@ -61,7 +61,7 @@ mod tests {
     #[test]
     fn test_naive_split_correctness() {
         // Choosing the number of bytes for the test
-        const TEST_BYTES_NUM: usize = 80;
+        const TEST_BYTES_NUM: usize = 180;
         type SHA256ScriptType = SHA256Script<TEST_BYTES_NUM>;
 
         // Generating a random valid input for the script and the script itself
@@ -72,7 +72,8 @@ mod tests {
         );
 
         // Splitting the script into shards
-        let split_result = SHA256ScriptType::split(input.clone(), SplitType::ByInstructions);
+        let split_result =
+            SHA256ScriptType::default_split(input.clone(), SplitType::ByInstructions);
 
         // Now, we are going to concatenate all the shards and verify that the script is also correct
         let verification_script = script! {
@@ -99,14 +100,14 @@ mod tests {
     #[test]
     fn test_naive_split() {
         // Choosing the number of bytes for the test
-        const TEST_BYTES_NUM: usize = 80;
+        const TEST_BYTES_NUM: usize = 120;
         type SHA256ScriptType = SHA256Script<TEST_BYTES_NUM>;
 
         // First, we generate the pair of input and output scripts
         let IOPair { input, output } = SHA256ScriptType::generate_valid_io_pair();
 
         // Splitting the script into shards
-        let split_result = SHA256ScriptType::split(input, SplitType::ByInstructions);
+        let split_result = SHA256ScriptType::default_split(input, SplitType::ByInstructions);
         println!("Split result: {:?}", split_result);
 
         // Checking the last state (which must be equal to the result of the multiplication)

From b4e04cd5436019cfb7338ef13a92dad8df23fa2b Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 9 Oct 2024 18:14:54 +0300
Subject: [PATCH 04/28] :bulb: add u32 split functionality

---
 bitcoin-splitter/src/split/core.rs            |  4 +-
 .../src/split/intermediate_state.rs           | 99 ++++++++++++++-----
 bitcoin-splitter/src/split/script.rs          |  4 +-
 .../src/test_scripts/int_mul_karatsuba.rs     |  1 +
 .../src/test_scripts/int_mul_windowed.rs      | 89 ++++++++++-------
 bitcoin-splitter/src/utils.rs                 |  1 +
 6 files changed, 134 insertions(+), 64 deletions(-)

diff --git a/bitcoin-splitter/src/split/core.rs b/bitcoin-splitter/src/split/core.rs
index ebb2433..d54f12f 100644
--- a/bitcoin-splitter/src/split/core.rs
+++ b/bitcoin-splitter/src/split/core.rs
@@ -128,14 +128,14 @@ pub(super) fn fuzzy_split(input: Script, script: Script, split_type: SplitType)
     for chunk_size in (MIN_CHUNK_SIZE..MAX_CHUNK_SIZE).step_by(STEP_SIZE) {
         // Incrementing the progress bar
         bar.inc(1);
-        
+
         // We are using panic::catch_unwind to catch any panics that might occur
         // during the splitting process. If a panic occurs, we just skip the current
         // chunk size and continue with the next one.
         let current_split_result = panic::catch_unwind(|| {
             naive_split(input.clone(), script.clone(), split_type, chunk_size)
         });
-        
+
         if let Ok(split_result) = current_split_result {
             let current_complexity = split_result.complexity_index();
 
diff --git a/bitcoin-splitter/src/split/intermediate_state.rs b/bitcoin-splitter/src/split/intermediate_state.rs
index 5de15f4..3685879 100644
--- a/bitcoin-splitter/src/split/intermediate_state.rs
+++ b/bitcoin-splitter/src/split/intermediate_state.rs
@@ -14,6 +14,13 @@ pub struct IntermediateState {
     pub altstack: Stack,
 }
 
+/// Structure that represents the [`IntermediateState`] where stack and altstack are
+/// serialized to bytes.
+pub struct IntermediateStateAsBytes {
+    pub stack: Vec<u8>,
+    pub altstack: Vec<u8>,
+}
+
 impl fmt::Debug for IntermediateState {
     fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
         writeln!(f, "Stack: {:?}", self.stack)?;
@@ -22,6 +29,28 @@ impl fmt::Debug for IntermediateState {
 }
 
 impl IntermediateState {
+    /// Returns the script that pushes all elements (stack and altstack) to the
+    /// corresponding stacks
+    pub fn inject_script(&self) -> Script {
+        script! {
+            // Checks for length of the stack and altstack
+            // are used to avoid panic when referencing the first element
+            // of the stack or altstack (by using get(0) method)
+            if !self.stack.is_empty() {
+                { stack_to_script(&self.stack) }
+            }
+
+            if !self.altstack.is_empty() {
+                { stack_to_script(&self.altstack) }
+
+                for i in (0..self.altstack.len()).rev() {
+                    { i } OP_ROLL
+                    OP_TOALTSTACK
+                }
+            }
+        }
+    }
+
     /// Executes the script with the given input and returns the intermediate result,
     /// that is, the stack and altstack after the execution
     pub fn from_input_script(input: &Script, script: &Script) -> Self {
@@ -41,32 +70,15 @@ impl IntermediateState {
     /// Based on the previous intermediate result, executes the script with the stacks
     /// and altstacks of the previous result and returns the new intermediate result
     pub fn from_intermediate_result(result: &Self, script: &Script) -> Self {
-        let Self { stack, altstack } = result;
-
-        let insert_result_script = script! {
-            // Checks for length of the stack and altstack
-            // are used to avoid panic when referencing the first element
-            // of the stack or altstack (by using get(0) method)
-            if !stack.is_empty() {
-                { stack_to_script(stack) }
-            }
-
-            if !altstack.is_empty() {
-                { stack_to_script(altstack) }
-
-                for i in (0..altstack.len()).rev() {
-                    { i } OP_ROLL
-                    OP_TOALTSTACK
-                }
-            }
-        };
-
-        Self::from_input_script(&insert_result_script, script)
+        Self::from_input_script(&result.inject_script(), script)
     }
 
-    /// Converts the stack to a vector of u32 values
-    pub fn interpret_as_u32_array(&self) -> Vec<u8> {
-        self.stack.clone().serialize_to_bytes()
+    /// Converts the stack to bytes
+    pub fn to_bytes(&self) -> IntermediateStateAsBytes {
+        IntermediateStateAsBytes {
+            stack: self.stack.clone().serialize_to_bytes(),
+            altstack: self.altstack.clone().serialize_to_bytes(),
+        }
     }
 
     /// Returns the size of the stack and altstack
@@ -74,3 +86,42 @@ impl IntermediateState {
         self.stack.len() + self.altstack.len()
     }
 }
+
+impl IntermediateStateAsBytes {
+    /// Represents the stack as a vector of u32 values.
+    pub fn stack_as_u32(&self) -> Vec<u32> {
+        bytes_to_u32_array(&self.stack)
+    }
+
+    /// Represents the altstack as a vector of u32 values.
+    pub fn altstack_as_u32(&self) -> Vec<u32> {
+        bytes_to_u32_array(&self.altstack)
+    }
+}
+
+/// Converts a slice of bytes to a vector of u32 values.
+pub(super) fn bytes_to_u32_array(bytes: &[u8]) -> Vec<u32> {
+    let mut u32_array = Vec::with_capacity((bytes.len() + 3) / 4); // Ceiling division to account for partial chunks.
+
+    for (i, chunk) in bytes.chunks(4).enumerate() {
+        if i % 2 == 1 {
+            // Skip every second chunk, as it represents the altstack
+            continue;
+        }
+
+        // Handle chunks with fewer than 4 bytes
+        let padded_chunk = match chunk.len() {
+            4 => [chunk[0], chunk[1], chunk[2], chunk[3]],
+            3 => [chunk[0], chunk[1], chunk[2], 0],
+            2 => [chunk[0], chunk[1], 0, 0],
+            1 => [chunk[0], 0, 0, 0],
+            _ => unreachable!(),
+        };
+
+        // Convert the padded chunk to a u32 value
+        let value = u32::from_le_bytes(padded_chunk);
+        u32_array.push(value);
+    }
+
+    u32_array
+}
diff --git a/bitcoin-splitter/src/split/script.rs b/bitcoin-splitter/src/split/script.rs
index 6c4661c..fc3c332 100644
--- a/bitcoin-splitter/src/split/script.rs
+++ b/bitcoin-splitter/src/split/script.rs
@@ -107,7 +107,9 @@ impl SplitResult {
                 let current_state_size = self.intermediate_states[i].size();
                 let previous_state_size = if i > 0 {
                     self.intermediate_states[i - 1].size()
-                } else { 0 };
+                } else {
+                    0
+                };
 
                 shard_size + (current_state_size + previous_state_size) * STACK_SIZE_INDEX
             });
diff --git a/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs b/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs
index 8143ec1..35d3963 100644
--- a/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs
+++ b/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs
@@ -141,6 +141,7 @@ mod tests {
     }
 
     #[test]
+    #[ignore = "too-large computation, run separately"]
     fn test_fuzzy_split() {
         // First, we generate the pair of input and output scripts
         let IOPair { input, output } = U261MulKaratsubaScript::generate_valid_io_pair();
diff --git a/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
index 5f2d4b0..5913ce1 100644
--- a/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
+++ b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
@@ -137,6 +137,58 @@ mod tests {
     }
 
     #[test]
+    fn test_split_each_shard() {
+        // First, we generate the pair of input and output scripts
+        let IOPair { input, output: _ } = U254MulScript::generate_valid_io_pair();
+
+        // Splitting the script into shards
+        let split_result = U254MulScript::default_split(input.clone(), SplitType::ByInstructions);
+
+        for i in 0..split_result.len() {
+            // Forming first two inputs. Note that the first input is the input script itself
+            // while the second input is the output of the previous shard
+            let mut first_input = input.clone();
+            if i > 0 {
+                first_input = split_result.intermediate_states[i - 1].inject_script();
+            }
+
+            let second_input = split_result.intermediate_states[i].inject_script();
+
+            // Forming the function
+            let function = split_result.shards[i].clone();
+
+            let verification_script = script! {
+                { second_input }
+                { first_input }
+                { function }
+
+                // Verifying that the output in mainstack is correct
+                for i in (0..split_result.intermediate_states[i].stack.len()).rev() {
+                    { i+1 } OP_ROLL OP_EQUALVERIFY
+                }
+
+                // Verifying that the output in altstack is correct
+                // Pushing elements to the mainstack
+                for _ in 0..2*split_result.intermediate_states[i].altstack.len() {
+                    OP_FROMALTSTACK
+                }
+
+                // Verifying that altstack elements are correct
+                for i in (0..split_result.intermediate_states[i].altstack.len()).rev() {
+                    { i+1 } OP_ROLL OP_EQUALVERIFY
+                }
+
+                OP_TRUE
+            };
+
+            let result = execute_script(verification_script);
+
+            assert!(result.success, "verification has failed");
+        }
+    }
+
+    #[test]
+    #[ignore = "too-large computation, run separately"]
     fn test_fuzzy_split() {
         // First, we generate the pair of input and output scripts
         let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
@@ -180,41 +232,4 @@ mod tests {
         let total_size = split_result.total_states_size();
         println!("Total size of the states: {} bytes", total_size);
     }
-
-    #[test]
-    fn test_to_u32_conversion() {
-        // First, we generate the pair of input and output scripts
-        let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
-
-        // Splitting the script into shards
-        let split_result = U254MulScript::default_split(input, SplitType::ByInstructions);
-
-        // Debugging the split result
-        println!("Split result: {:?}", split_result);
-
-        // Now, verifying tha the split is correct (meaning, the last state is equal to the output)
-        let last_state = split_result.must_last_state();
-
-        // Altstack must be empty
-        assert!(last_state.altstack.is_empty(), "altstack is not empty!");
-
-        // The element of the mainstack must be equal to the actual output
-        let verification_script = script! {
-            { stack_to_script(&last_state.stack) }
-            { output }
-            { U508::OP_EQUAL(0, 1) }
-        };
-
-        let result = execute_script(verification_script);
-        assert!(result.success, "verification has failed");
-
-        // Now, let us debug each of the intermediate states
-        for (i, state) in split_result.intermediate_states.iter().enumerate() {
-            let state_as_bytes = state.stack.clone().serialize_to_bytes();
-
-            println!("Intermediate state #{}: {:?}", i, state);
-            println!("Intermediate state as bytes #{}: {:?}", i, state_as_bytes);
-            // println!("Intermediate state as u32 array #{}: {:?}", i, Stack::from_u8_vec(state_as_bytes));
-        }
-    }
 }
diff --git a/bitcoin-splitter/src/utils.rs b/bitcoin-splitter/src/utils.rs
index 24ce002..530a0e6 100644
--- a/bitcoin-splitter/src/utils.rs
+++ b/bitcoin-splitter/src/utils.rs
@@ -2,6 +2,7 @@ use bitcoin_scriptexec::Stack;
 
 use crate::treepp::*;
 
+/// Converts a stack to a script that pushes all elements of the stack
 pub(crate) fn stack_to_script(stack: &Stack) -> Script {
     script! {
         for element in stack.iter_str() {

From c3ef167fcf389cfd6d5daf4396456d8c9c83a14d Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 9 Oct 2024 20:13:48 +0300
Subject: [PATCH 05/28] :construction: wip, adding u32 stack split

---
 .../src/split/intermediate_state.rs           | 27 +++++++--
 .../src/test_scripts/int_mul_windowed.rs      | 57 +++++++++++++++++++
 bitcoin-splitter/src/test_scripts/sha256.rs   |  2 +-
 3 files changed, 81 insertions(+), 5 deletions(-)

diff --git a/bitcoin-splitter/src/split/intermediate_state.rs b/bitcoin-splitter/src/split/intermediate_state.rs
index 3685879..a45245c 100644
--- a/bitcoin-splitter/src/split/intermediate_state.rs
+++ b/bitcoin-splitter/src/split/intermediate_state.rs
@@ -97,6 +97,25 @@ impl IntermediateStateAsBytes {
     pub fn altstack_as_u32(&self) -> Vec<u32> {
         bytes_to_u32_array(&self.altstack)
     }
+
+    /// Injects the stack and altstack into the script
+    pub fn inject_script(&self) -> Script {
+        script! {
+            // Inject the stack
+            for stack_element in self.stack_as_u32() {
+                { stack_element }
+            }
+
+            // Inject the altstack
+            for altstack_element in self.altstack_as_u32() {
+                { altstack_element }
+            }
+            for i in (0..self.altstack_as_u32().len()).rev() {
+                { i } OP_ROLL
+                OP_TOALTSTACK
+            }
+        }
+    }
 }
 
 /// Converts a slice of bytes to a vector of u32 values.
@@ -104,10 +123,10 @@ pub(super) fn bytes_to_u32_array(bytes: &[u8]) -> Vec<u32> {
     let mut u32_array = Vec::with_capacity((bytes.len() + 3) / 4); // Ceiling division to account for partial chunks.
 
     for (i, chunk) in bytes.chunks(4).enumerate() {
-        if i % 2 == 1 {
-            // Skip every second chunk, as it represents the altstack
-            continue;
-        }
+        // if i % 2 == 1 {
+        //     // Skip every second chunk, as it represents the altstack
+        //     continue;
+        // }
 
         // Handle chunks with fewer than 4 bytes
         let padded_chunk = match chunk.len() {
diff --git a/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
index 5913ce1..efb8bb4 100644
--- a/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
+++ b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
@@ -187,6 +187,63 @@ mod tests {
         }
     }
 
+    #[test]
+    fn test_split_to_u32() {
+        // First, we generate the pair of input and output scripts
+        let IOPair { input, output: _ } = U254MulScript::generate_valid_io_pair();
+
+        // Splitting the script into shards
+        let split_result = U254MulScript::default_split(input.clone(), SplitType::ByInstructions);
+
+        for i in 0..split_result.len() {
+            // Forming first two inputs. Note that the first input is the input script itself
+            // while the second input is the output of the previous shard
+            let mut first_input = input.clone();
+            if i > 0 {
+                first_input = split_result.intermediate_states[i - 1].to_bytes().inject_script();
+            }
+
+            let second_input = split_result.intermediate_states[i].to_bytes().inject_script();
+
+            println!("Expected: {:?}", split_result.intermediate_states[i].inject_script().len());
+            println!("Actual: {:?}", second_input.to_asm_string().len());
+
+            println!("Expected: {:?}", split_result.intermediate_states[i].inject_script());
+            println!("Actual: {:?}", second_input.to_asm_string());
+
+            // Forming the function
+            let function = split_result.shards[i].clone();
+
+            let verification_script = script! {
+                { second_input }
+                { first_input }
+                { function }
+
+                // Verifying that the output in mainstack is correct
+                for i in (0..split_result.intermediate_states[i].stack.len()).rev() {
+                    { i+1 } OP_ROLL OP_EQUALVERIFY
+                }
+
+                // Verifying that the output in altstack is correct
+                // Pushing elements to the mainstack
+                for _ in 0..2*split_result.intermediate_states[i].altstack.len() {
+                    OP_FROMALTSTACK
+                }
+
+                // Verifying that altstack elements are correct
+                for i in (0..split_result.intermediate_states[i].altstack.len()).rev() {
+                    { i+1 } OP_ROLL OP_EQUALVERIFY
+                }
+
+                OP_TRUE
+            };
+
+            let result = execute_script(verification_script);
+
+            assert!(result.success, "verification has failed");
+        }
+    }
+
     #[test]
     #[ignore = "too-large computation, run separately"]
     fn test_fuzzy_split() {
diff --git a/bitcoin-splitter/src/test_scripts/sha256.rs b/bitcoin-splitter/src/test_scripts/sha256.rs
index d147510..e3f964f 100644
--- a/bitcoin-splitter/src/test_scripts/sha256.rs
+++ b/bitcoin-splitter/src/test_scripts/sha256.rs
@@ -55,7 +55,7 @@ mod tests {
     #[test]
     fn test_sha256_verify() {
         const TEST_BYTES_NUM: usize = 80;
-        assert!(SHA256Script::<TEST_BYTES_NUM>::verify_random());
+        assert!(SHA256Script::<TEST_BYTES_NUM>::verify_random(), "Random verification failed");
     }
 
     #[test]

From 46d0f7d648508d2a220e2ac5bbc5cc14e83caa43 Mon Sep 17 00:00:00 2001
From: Kyrylo Baibula <64193423+Velnbur@users.noreply.github.com>
Date: Wed, 9 Oct 2024 20:09:07 +0300
Subject: [PATCH 06/28] :twisted_rightwards_arrows: Merge `bitcoin-scriptexec`
 from `BitVM` (#10)

# Objective

Since `bitcoin-scriptexec` contains certain logic that has to be changed
for our needs, we fork it and add to our repository.
---
 Cargo.toml                                |    2 +-
 bitcoin-scriptexec/.editorconfig          |    4 +
 bitcoin-scriptexec/.gitignore             |    2 +
 bitcoin-scriptexec/Cargo.toml             |   62 ++
 bitcoin-scriptexec/LICENSE                |  122 +++
 bitcoin-scriptexec/README.md              |   52 ++
 bitcoin-scriptexec/build-wasm.sh          |    3 +
 bitcoin-scriptexec/src/data_structures.rs |  185 ++++
 bitcoin-scriptexec/src/error.rs           |   44 +
 bitcoin-scriptexec/src/json.rs            |   88 ++
 bitcoin-scriptexec/src/lib.rs             | 1024 +++++++++++++++++++++
 bitcoin-scriptexec/src/macros.rs          |   10 +
 bitcoin-scriptexec/src/main.rs            |  130 +++
 bitcoin-scriptexec/src/signatures.rs      |  101 ++
 bitcoin-scriptexec/src/utils.rs           |   80 ++
 bitcoin-scriptexec/src/wasm.rs            |  104 +++
 16 files changed, 2012 insertions(+), 1 deletion(-)
 create mode 100644 bitcoin-scriptexec/.editorconfig
 create mode 100644 bitcoin-scriptexec/.gitignore
 create mode 100644 bitcoin-scriptexec/Cargo.toml
 create mode 100644 bitcoin-scriptexec/LICENSE
 create mode 100644 bitcoin-scriptexec/README.md
 create mode 100755 bitcoin-scriptexec/build-wasm.sh
 create mode 100644 bitcoin-scriptexec/src/data_structures.rs
 create mode 100644 bitcoin-scriptexec/src/error.rs
 create mode 100644 bitcoin-scriptexec/src/json.rs
 create mode 100644 bitcoin-scriptexec/src/lib.rs
 create mode 100644 bitcoin-scriptexec/src/macros.rs
 create mode 100644 bitcoin-scriptexec/src/main.rs
 create mode 100644 bitcoin-scriptexec/src/signatures.rs
 create mode 100644 bitcoin-scriptexec/src/utils.rs
 create mode 100644 bitcoin-scriptexec/src/wasm.rs

diff --git a/Cargo.toml b/Cargo.toml
index fa3038a..1d4eb18 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,5 +1,5 @@
 [workspace]
-members = ["bitcoin-splitter", "integration-tests"]
+members = ["bitcoin-splitter", "integration-tests", "bitcoin-scriptexec"]
 resolver = "2"
 
 [workspace.dependencies]
diff --git a/bitcoin-scriptexec/.editorconfig b/bitcoin-scriptexec/.editorconfig
new file mode 100644
index 0000000..4b555f4
--- /dev/null
+++ b/bitcoin-scriptexec/.editorconfig
@@ -0,0 +1,4 @@
+# see https://editorconfig.org for more options, and setup instructions for yours editor
+
+[*.rs]
+indent_style = tab
diff --git a/bitcoin-scriptexec/.gitignore b/bitcoin-scriptexec/.gitignore
new file mode 100644
index 0000000..f2f9e58
--- /dev/null
+++ b/bitcoin-scriptexec/.gitignore
@@ -0,0 +1,2 @@
+target
+Cargo.lock
\ No newline at end of file
diff --git a/bitcoin-scriptexec/Cargo.toml b/bitcoin-scriptexec/Cargo.toml
new file mode 100644
index 0000000..145d5a2
--- /dev/null
+++ b/bitcoin-scriptexec/Cargo.toml
@@ -0,0 +1,62 @@
+[package]
+name = "bitcoin-scriptexec"
+version = "0.0.0"
+edition = "2021"
+description = "Bitcoin Script interpreter/executor"
+authors = ["Steven Roose <steven@roose.io>"]
+license = "CC0-1.0"
+
+[lib]
+crate-type = ["cdylib", "rlib"]
+
+[[bin]]
+name = "btcexec"
+path = "src/main.rs"
+required-features = ["cli"]
+
+[features]
+default = ["cli", "wasm"]
+json = ["serde", "serde_json", "bitcoin/serde"]
+cli = ["json", "clap"]
+wasm = ["json", "wasm-bindgen", "serde-wasm-bindgen", "console_error_panic_hook", "getrandom/js"]
+
+[dependencies]
+# bitcoin = "0.31.0"
+bitcoin = { git = "https://github.com/rust-bitcoin/rust-bitcoin", branch = "bitvm" }
+lazy_static = "1.4.0"
+
+# cli
+clap = { version = "4", features = [ "derive" ], optional = true }
+
+# wasm
+serde = { version = "1.0", features = [ "derive" ], optional = true }
+serde_json = { version = "1.0", optional = true }
+wasm-bindgen = { version = "0.2.87", optional = true }
+serde-wasm-bindgen = { version = "0.6.1", optional = true }
+console_error_panic_hook = { version = "0.1.7", optional = true }
+# I think we need to mention this for secp256k1-sys to work
+getrandom = { version = "0.2", optional = true }
+
+[patch.crates-io.base58check]
+git = "https://github.com/rust-bitcoin/rust-bitcoin"
+branch = "bitvm"
+
+[patch.crates-io.bitcoin]
+git = "https://github.com/rust-bitcoin/rust-bitcoin"
+branch = "bitvm"
+
+[patch.crates-io.bitcoin_hashes]
+git = "https://github.com/rust-bitcoin/rust-bitcoin"
+branch = "bitvm"
+
+[patch.crates-io.bitcoin-internals]
+git = "https://github.com/rust-bitcoin/rust-bitcoin"
+branch = "bitvm"
+
+[patch.crates-io.bitcoin-io]
+git = "https://github.com/rust-bitcoin/rust-bitcoin"
+branch = "bitvm"
+
+[patch.crates-io.bitcoin-units]
+git = "https://github.com/rust-bitcoin/rust-bitcoin"
+branch = "bitvm"
diff --git a/bitcoin-scriptexec/LICENSE b/bitcoin-scriptexec/LICENSE
new file mode 100644
index 0000000..6ca207e
--- /dev/null
+++ b/bitcoin-scriptexec/LICENSE
@@ -0,0 +1,122 @@
+Creative Commons Legal Code
+
+CC0 1.0 Universal
+
+    CREATIVE COMMONS CORPORATION IS NOT A LAW FIRM AND DOES NOT PROVIDE
+    LEGAL SERVICES. DISTRIBUTION OF THIS DOCUMENT DOES NOT CREATE AN
+    ATTORNEY-CLIENT RELATIONSHIP. CREATIVE COMMONS PROVIDES THIS
+    INFORMATION ON AN "AS-IS" BASIS. CREATIVE COMMONS MAKES NO WARRANTIES
+    REGARDING THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS
+    PROVIDED HEREUNDER, AND DISCLAIMS LIABILITY FOR DAMAGES RESULTING FROM
+    THE USE OF THIS DOCUMENT OR THE INFORMATION OR WORKS PROVIDED
+    HEREUNDER.
+
+Statement of Purpose
+
+The laws of most jurisdictions throughout the world automatically confer
+exclusive Copyright and Related Rights (defined below) upon the creator
+and subsequent owner(s) (each and all, an "owner") of an original work of
+authorship and/or a database (each, a "Work").
+
+Certain owners wish to permanently relinquish those rights to a Work for
+the purpose of contributing to a commons of creative, cultural and
+scientific works ("Commons") that the public can reliably and without fear
+of later claims of infringement build upon, modify, incorporate in other
+works, reuse and redistribute as freely as possible in any form whatsoever
+and for any purposes, including without limitation commercial purposes.
+These owners may contribute to the Commons to promote the ideal of a free
+culture and the further production of creative, cultural and scientific
+works, or to gain reputation or greater distribution for their Work in
+part through the use and efforts of others.
+
+For these and/or other purposes and motivations, and without any
+expectation of additional consideration or compensation, the person
+associating CC0 with a Work (the "Affirmer"), to the extent that he or she
+is an owner of Copyright and Related Rights in the Work, voluntarily
+elects to apply CC0 to the Work and publicly distribute the Work under its
+terms, with knowledge of his or her Copyright and Related Rights in the
+Work and the meaning and intended legal effect of CC0 on those rights.
+
+1. Copyright and Related Rights. A Work made available under CC0 may be
+protected by copyright and related or neighboring rights ("Copyright and
+Related Rights"). Copyright and Related Rights include, but are not
+limited to, the following:
+
+  i. the right to reproduce, adapt, distribute, perform, display,
+     communicate, and translate a Work;
+ ii. moral rights retained by the original author(s) and/or performer(s);
+iii. publicity and privacy rights pertaining to a person's image or
+     likeness depicted in a Work;
+ iv. rights protecting against unfair competition in regards to a Work,
+     subject to the limitations in paragraph 4(a), below;
+  v. rights protecting the extraction, dissemination, use and reuse of data
+     in a Work;
+ vi. database rights (such as those arising under Directive 96/9/EC of the
+     European Parliament and of the Council of 11 March 1996 on the legal
+     protection of databases, and under any national implementation
+     thereof, including any amended or successor version of such
+     directive); and
+vii. other similar, equivalent or corresponding rights throughout the
+     world based on applicable law or treaty, and any national
+     implementations thereof.
+
+2. Waiver. To the greatest extent permitted by, but not in contravention
+of, applicable law, Affirmer hereby overtly, fully, permanently,
+irrevocably and unconditionally waives, abandons, and surrenders all of
+Affirmer's Copyright and Related Rights and associated claims and causes
+of action, whether now known or unknown (including existing as well as
+future claims and causes of action), in the Work (i) in all territories
+worldwide, (ii) for the maximum duration provided by applicable law or
+treaty (including future time extensions), (iii) in any current or future
+medium and for any number of copies, and (iv) for any purpose whatsoever,
+including without limitation commercial, advertising or promotional
+purposes (the "Waiver"). Affirmer makes the Waiver for the benefit of each
+member of the public at large and to the detriment of Affirmer's heirs and
+successors, fully intending that such Waiver shall not be subject to
+revocation, rescission, cancellation, termination, or any other legal or
+equitable action to disrupt the quiet enjoyment of the Work by the public
+as contemplated by Affirmer's express Statement of Purpose.
+
+3. Public License Fallback. Should any part of the Waiver for any reason
+be judged legally invalid or ineffective under applicable law, then the
+Waiver shall be preserved to the maximum extent permitted taking into
+account Affirmer's express Statement of Purpose. In addition, to the
+extent the Waiver is so judged Affirmer hereby grants to each affected
+person a royalty-free, non transferable, non sublicensable, non exclusive,
+irrevocable and unconditional license to exercise Affirmer's Copyright and
+Related Rights in the Work (i) in all territories worldwide, (ii) for the
+maximum duration provided by applicable law or treaty (including future
+time extensions), (iii) in any current or future medium and for any number
+of copies, and (iv) for any purpose whatsoever, including without
+limitation commercial, advertising or promotional purposes (the
+"License"). The License shall be deemed effective as of the date CC0 was
+applied by Affirmer to the Work. Should any part of the License for any
+reason be judged legally invalid or ineffective under applicable law, such
+partial invalidity or ineffectiveness shall not invalidate the remainder
+of the License, and in such case Affirmer hereby affirms that he or she
+will not (i) exercise any of his or her remaining Copyright and Related
+Rights in the Work or (ii) assert any associated claims and causes of
+action with respect to the Work, in either case contrary to Affirmer's
+express Statement of Purpose.
+
+4. Limitations and Disclaimers.
+
+ a. No trademark or patent rights held by Affirmer are waived, abandoned,
+    surrendered, licensed or otherwise affected by this document.
+ b. Affirmer offers the Work as-is and makes no representations or
+    warranties of any kind concerning the Work, express, implied,
+    statutory or otherwise, including without limitation warranties of
+    title, merchantability, fitness for a particular purpose, non
+    infringement, or the absence of latent or other defects, accuracy, or
+    the present or absence of errors, whether or not discoverable, all to
+    the greatest extent permissible under applicable law.
+ c. Affirmer disclaims responsibility for clearing rights of other persons
+    that may apply to the Work or any use thereof, including without
+    limitation any person's Copyright and Related Rights in the Work.
+    Further, Affirmer disclaims responsibility for obtaining any necessary
+    consents, permissions or other rights required for any use of the
+    Work.
+ d. Affirmer understands and acknowledges that Creative Commons is not a
+    party to this document and has no duty or obligation with respect to
+    this CC0 or use of the Work.
+
diff --git a/bitcoin-scriptexec/README.md b/bitcoin-scriptexec/README.md
new file mode 100644
index 0000000..56dbe7d
--- /dev/null
+++ b/bitcoin-scriptexec/README.md
@@ -0,0 +1,52 @@
+
+bitcoin-scriptexec
+==================
+
+A work-in-progress Bitcoin Script execution utility.
+
+**DISCLAIMER: DO NOT EVER, EVER, TRY TO USE THIS CRATE FOR CONSENSUS PURPOSES !!**
+
+
+# Status
+
+This project is a work-in-progress mostly attempting to facilitate BitVM development.
+It does not yet fully implement all opcodes, but as a library already gives you pretty
+good insight into the internals of the execution in a step-wise manner.
+
+
+# Usage
+
+## CLI
+
+You can simply use `cargo run` or build/intall the binary as follows:
+
+```
+# to build in debug mode
+$ cargo build --locked
+# to build in release (optimized) mode
+$ cargo build --locked --release
+# to install in ~/.cargo/bin
+$ cargo install --locked --path .
+```
+
+### Usage
+
+The CLI currently takes only a single argument: the path to the ASM script file:
+
+```
+# using the binary
+$ btcexec <script.bs>
+# using cargo run
+$ cargo run -- <script.bs>
+```
+
+## WASM
+
+There are wasm bindings provided. For API documentation, see the `src/wasm.rs`a file.
+
+To build the WASM bindings, [install wasm-pack](https://rustwasm.github.io/wasm-pack/installer/)
+and then run the following script:
+
+```
+./build-wasm.sh
+```
diff --git a/bitcoin-scriptexec/build-wasm.sh b/bitcoin-scriptexec/build-wasm.sh
new file mode 100755
index 0000000..f7bc520
--- /dev/null
+++ b/bitcoin-scriptexec/build-wasm.sh
@@ -0,0 +1,3 @@
+#!/bin/sh
+
+wasm-pack build --target web -- --features wasm
diff --git a/bitcoin-scriptexec/src/data_structures.rs b/bitcoin-scriptexec/src/data_structures.rs
new file mode 100644
index 0000000..5a95807
--- /dev/null
+++ b/bitcoin-scriptexec/src/data_structures.rs
@@ -0,0 +1,185 @@
+use crate::{read_scriptint, ExecError};
+use alloc::rc::Rc;
+use bitcoin::script;
+use core::cell::RefCell;
+use core::cmp::PartialEq;
+
+#[derive(Clone, Debug, Eq, PartialEq)]
+pub enum StackEntry {
+    Num(i64),
+    StrRef(Rc<RefCell<Vec<u8>>>),
+}
+
+impl StackEntry {
+    // This assumes the StackEntry fit in a u32 and will pad it with leading zeros to 4 bytes.
+    pub fn serialize_to_bytes(self) -> Vec<u8> {
+        match self {
+            StackEntry::Num(num) => {
+                assert!(
+                    num <= u32::MAX.into(),
+                    "There should not be entries with more than 32 bits on the stack at this point"
+                );
+                num.to_le_bytes().to_vec()
+            }
+            StackEntry::StrRef(v) => {
+                let mut v = v.borrow().to_vec();
+                assert!(
+                    v.len() <= 4,
+                    "There should not be entries with more than 32 bits on the stack at this point"
+                );
+                while v.len() < 4 {
+                    v.push(0)
+                }
+                v
+            }
+        }
+    }
+}
+
+#[derive(Clone, Eq, Debug, PartialEq)]
+pub struct Stack(Vec<StackEntry>);
+
+impl Stack {
+    pub fn new() -> Self {
+        Self(Vec::with_capacity(1000))
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.0.is_empty()
+    }
+
+    pub fn last(&self) -> Result<Vec<u8>, ExecError> {
+        self.topstr(-1)
+    }
+
+    pub fn from_u8_vec(v: Vec<Vec<u8>>) -> Self {
+        let mut res = Self::new();
+        for entry in v {
+            res.0.push(StackEntry::StrRef(Rc::new(RefCell::new(entry))));
+        }
+        res
+    }
+
+    pub fn top(&self, offset: isize) -> Result<&StackEntry, ExecError> {
+        debug_assert!(offset < 0, "offsets should be < 0");
+        self.0
+            .len()
+            .checked_sub(offset.unsigned_abs())
+            .map(|i| &self.0[i])
+            .ok_or(ExecError::InvalidStackOperation)
+    }
+
+    pub fn topstr(&self, offset: isize) -> Result<Vec<u8>, ExecError> {
+        let entry = self.top(offset)?;
+        match entry {
+            StackEntry::Num(v) => Ok(script::scriptint_vec(*v)),
+            StackEntry::StrRef(v) => Ok(v.borrow().to_vec()),
+        }
+    }
+
+    pub fn topnum(&self, offset: isize, require_minimal: bool) -> Result<i64, ExecError> {
+        let entry = self.top(offset)?;
+        match entry {
+            StackEntry::Num(v) => {
+                if *v <= i32::MAX as i64 {
+                    Ok(*v)
+                } else {
+                    Err(ExecError::ScriptIntNumericOverflow)
+                }
+            }
+            StackEntry::StrRef(v) => Ok(read_scriptint(v.borrow().as_slice(), 4, require_minimal)?),
+        }
+    }
+
+    pub fn pushnum(&mut self, num: i64) {
+        self.0.push(StackEntry::Num(num));
+    }
+
+    pub fn pushstr(&mut self, v: &[u8]) {
+        self.0
+            .push(StackEntry::StrRef(Rc::new(RefCell::new(v.to_vec()))));
+    }
+
+    pub fn push(&mut self, v: StackEntry) {
+        self.0.push(v);
+    }
+
+    pub fn needn(&self, min_nb_items: usize) -> Result<(), ExecError> {
+        if self.len() < min_nb_items {
+            Err(ExecError::InvalidStackOperation)
+        } else {
+            Ok(())
+        }
+    }
+
+    pub fn popn(&mut self, n: usize) -> Result<(), ExecError> {
+        for _ in 0..n {
+            self.0.pop().ok_or(ExecError::InvalidStackOperation)?;
+        }
+        Ok(())
+    }
+
+    pub fn pop(&mut self) -> Option<StackEntry> {
+        self.0.pop()
+    }
+
+    pub fn popstr(&mut self) -> Result<Vec<u8>, ExecError> {
+        let entry = self.0.pop().ok_or(ExecError::InvalidStackOperation)?;
+        match entry {
+            StackEntry::Num(v) => Ok(script::scriptint_vec(v)),
+            StackEntry::StrRef(v) => Ok(v.borrow().to_vec()),
+        }
+    }
+
+    pub fn popnum(&mut self, require_minimal: bool) -> Result<i64, ExecError> {
+        let entry = self.0.pop().ok_or(ExecError::InvalidStackOperation)?;
+        match entry {
+            StackEntry::Num(v) => {
+                if v <= i32::MAX as i64 {
+                    Ok(v)
+                } else {
+                    Err(ExecError::ScriptIntNumericOverflow)
+                }
+            }
+            StackEntry::StrRef(v) => Ok(read_scriptint(v.borrow().as_slice(), 4, require_minimal)?),
+        }
+    }
+
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub fn remove(&mut self, v: usize) {
+        self.0.remove(v);
+    }
+
+    pub fn iter_str(&self) -> impl DoubleEndedIterator<Item = Vec<u8>> + '_ {
+        self.0.iter().map(|v| match v {
+            StackEntry::Num(v) => script::scriptint_vec(*v),
+            StackEntry::StrRef(v) => v.borrow().to_vec(),
+        })
+    }
+
+    pub fn get(&self, index: usize) -> Vec<u8> {
+        match &self.0[index] {
+            StackEntry::Num(v) => script::scriptint_vec(*v),
+            StackEntry::StrRef(v) => v.borrow().to_vec(),
+        }
+    }
+
+    // Will serialize the stack into a series of bytes such that every 4 bytes correspond to a u32
+    // (or smaller) stack entry (smaller entries are padded with 0).
+    pub fn serialize_to_bytes(self) -> Vec<u8> {
+        let mut bytes = vec![];
+        for entry in self.0 {
+            bytes.extend(entry.serialize_to_bytes());
+        }
+        bytes
+    }
+}
+
+impl Default for Stack {
+    fn default() -> Self {
+        Self::new()
+    }
+}
diff --git a/bitcoin-scriptexec/src/error.rs b/bitcoin-scriptexec/src/error.rs
new file mode 100644
index 0000000..bc40453
--- /dev/null
+++ b/bitcoin-scriptexec/src/error.rs
@@ -0,0 +1,44 @@
+use bitcoin::blockdata::script;
+
+/// Error of a script execution.
+///
+/// Equivalent to Bitcoin Core's `ScriptError_t`.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum ExecError {
+    DisabledOpcode,
+    OpCodeseparator,
+    BadOpcode,
+    OpCount,
+    PushSize,
+    MinimalData,
+    InvalidStackOperation,
+    NegativeLocktime,
+    UnsatisfiedLocktime,
+    UnbalancedConditional,
+    TapscriptMinimalIf,
+    Verify,
+    OpReturn,
+    EqualVerify,
+    NumEqualVerify,
+    CheckSigVerify,
+    TapscriptValidationWeight,
+    PubkeyType,
+    SchnorrSigSize,
+    SchnorrSigHashtype,
+    SchnorrSig,
+    TapscriptCheckMultiSig,
+    PubkeyCount,
+    StackSize,
+    WitnessPubkeyType,
+
+    // new ones for us
+    ScriptIntNumericOverflow,
+    Debug,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub enum Error {
+    Exec(ExecError),
+    InvalidScript(script::Error),
+    Other(&'static str),
+}
diff --git a/bitcoin-scriptexec/src/json.rs b/bitcoin-scriptexec/src/json.rs
new file mode 100644
index 0000000..2ffb33d
--- /dev/null
+++ b/bitcoin-scriptexec/src/json.rs
@@ -0,0 +1,88 @@
+use std::fmt;
+
+use bitcoin::hex::DisplayHex;
+use bitcoin::{Opcode, Script};
+use serde::ser::{Serialize, SerializeMap, SerializeSeq, Serializer};
+
+use crate::ExecStats;
+
+/// Simple utility wrapper to serde-serialize using [fmt::Display].
+struct FmtSer<'a, T: fmt::Display>(&'a T);
+impl<'a, T: fmt::Display> Serialize for FmtSer<'a, T> {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        s.collect_str(&self.0)
+    }
+}
+
+/// Wrapper to fmt::Display a Script as ASM.
+struct ScriptAsm<'a>(&'a Script);
+impl<'a> fmt::Display for ScriptAsm<'a> {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        self.0.fmt_asm(f)
+    }
+}
+
+/// Wrapper to serialize a stack as hex elements.
+struct StackSer<'a>(&'a [Vec<u8>]);
+impl<'a> Serialize for StackSer<'a> {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        let mut seq = s.serialize_seq(Some(self.0.len()))?;
+        for i in self.0.iter() {
+            seq.serialize_element(&FmtSer(&i.as_hex()))?;
+        }
+        seq.end()
+    }
+}
+
+pub struct RunStep<'a> {
+    pub remaining_script: &'a Script,
+    pub stack: &'a [Vec<u8>],
+    pub altstack: &'a [Vec<u8>],
+    pub stats: Option<&'a ExecStats>,
+}
+
+impl<'a> Serialize for RunStep<'a> {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        let mut m = s.serialize_map(None)?;
+        m.serialize_entry(
+            "remaining_script_hex",
+            &FmtSer(&self.remaining_script.as_bytes().as_hex()),
+        )?;
+        m.serialize_entry(
+            "remaining_script_asm",
+            &FmtSer(&ScriptAsm(self.remaining_script)),
+        )?;
+        m.serialize_entry("stack", &StackSer(self.stack))?;
+        m.serialize_entry("altstack", &StackSer(self.altstack))?;
+        if let Some(ref stats) = self.stats {
+            m.serialize_entry("stats", stats)?;
+        }
+        m.end()
+    }
+}
+
+pub struct RunResult<'a> {
+    pub success: bool,
+    pub error: Option<String>,
+    pub opcode: Option<Opcode>,
+    pub final_stack: &'a [Vec<u8>],
+    pub stats: Option<&'a ExecStats>,
+}
+
+impl<'a> Serialize for RunResult<'a> {
+    fn serialize<S: Serializer>(&self, s: S) -> Result<S::Ok, S::Error> {
+        let mut m = s.serialize_map(None)?;
+        m.serialize_entry("success", &self.success)?;
+        if let Some(ref err) = self.error {
+            m.serialize_entry("error", err)?;
+        }
+        if let Some(opcode) = self.opcode {
+            m.serialize_entry("opcode", &FmtSer(&opcode))?;
+        }
+        m.serialize_entry("final_stack", &StackSer(self.final_stack))?;
+        if let Some(ref stats) = self.stats {
+            m.serialize_entry("stats", stats)?;
+        }
+        m.end()
+    }
+}
diff --git a/bitcoin-scriptexec/src/lib.rs b/bitcoin-scriptexec/src/lib.rs
new file mode 100644
index 0000000..e778361
--- /dev/null
+++ b/bitcoin-scriptexec/src/lib.rs
@@ -0,0 +1,1024 @@
+extern crate alloc;
+extern crate core;
+
+use alloc::borrow::Cow;
+use core::cmp;
+
+use bitcoin::consensus::Encodable;
+use bitcoin::hashes::{hash160, ripemd160, sha1, sha256, sha256d, Hash};
+use bitcoin::opcodes::{all::*, Opcode};
+use bitcoin::script::{self, Instruction, Instructions, Script, ScriptBuf};
+use bitcoin::sighash::SighashCache;
+use bitcoin::taproot::{self, TapLeafHash};
+use bitcoin::transaction::{self, Transaction, TxOut};
+
+#[macro_use]
+mod macros;
+
+mod utils;
+use utils::ConditionStack;
+
+mod signatures;
+
+mod error;
+pub use error::{Error, ExecError};
+
+#[cfg(feature = "json")]
+pub mod json;
+#[cfg(feature = "wasm")]
+mod wasm;
+
+mod data_structures;
+pub use data_structures::Stack;
+
+/// Maximum number of non-push operations per script
+const MAX_OPS_PER_SCRIPT: usize = 201;
+
+/// Maximum number of bytes pushable to the stack
+const MAX_SCRIPT_ELEMENT_SIZE: usize = 520;
+
+/// Maximum number of values on script interpreter stack
+const MAX_STACK_SIZE: usize = 1000;
+
+/// If this flag is set, CTxIn::nSequence is NOT interpreted as a
+/// relative lock-time.
+/// It skips SequenceLocks() for any input that has it set (BIP 68).
+/// It fails OP_CHECKSEQUENCEVERIFY/CheckSequence() for any input that has
+/// it set (BIP 112).
+const SEQUENCE_LOCKTIME_DISABLE_FLAG: u32 = 1 << 31;
+
+/// How much weight budget is added to the witness size (Tapscript only, see BIP 342).
+const VALIDATION_WEIGHT_OFFSET: i64 = 50;
+
+/// Validation weight per passing signature (Tapscript only, see BIP 342).
+const VALIDATION_WEIGHT_PER_SIGOP_PASSED: i64 = 50;
+
+// Maximum number of public keys per multisig
+const _MAX_PUBKEYS_PER_MULTISIG: i64 = 20;
+
+/// Used to enable experimental script features.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Experimental {
+    /// Enable an experimental implementation of OP_CAT.
+    pub op_cat: bool,
+}
+
+/// Used to fine-tune different variables during execution.
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct Options {
+    /// Require data pushes be minimally encoded.
+    pub require_minimal: bool, //TODO(stevenroose) double check all fRequireMinimal usage in Core
+    /// Verify OP_CHECKLOCKTIMEVERIFY.
+    pub verify_cltv: bool,
+    /// Verify OP_CHECKSEQUENCEVERIFY.
+    pub verify_csv: bool,
+    /// Verify conditionals are minimally encoded.
+    pub verify_minimal_if: bool,
+    /// Enfore a strict limit of 1000 total stack items.
+    pub enforce_stack_limit: bool,
+
+    pub experimental: Experimental,
+}
+
+impl Default for Options {
+    fn default() -> Self {
+        Options {
+            require_minimal: true,
+            verify_cltv: true,
+            verify_csv: true,
+            verify_minimal_if: true,
+            enforce_stack_limit: true,
+            experimental: Experimental { op_cat: true },
+        }
+    }
+}
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum ExecCtx {
+    Legacy,
+    SegwitV0,
+    Tapscript,
+}
+
+pub struct TxTemplate {
+    pub tx: Transaction,
+    pub prevouts: Vec<TxOut>,
+    pub input_idx: usize,
+    pub taproot_annex_scriptleaf: Option<(TapLeafHash, Option<Vec<u8>>)>,
+}
+
+#[derive(Debug, Clone, PartialEq, Eq)]
+pub struct ExecutionResult {
+    pub success: bool,
+    pub error: Option<ExecError>,
+    pub opcode: Option<Opcode>,
+    pub final_stack: Stack,
+}
+
+impl ExecutionResult {
+    fn from_final_stack(ctx: ExecCtx, final_stack: Stack) -> ExecutionResult {
+        ExecutionResult {
+            success: match ctx {
+                ExecCtx::Legacy => {
+                    if final_stack.is_empty() {
+                        false
+                    } else {
+                        script::read_scriptbool(&final_stack.last().unwrap())
+                    }
+                }
+                ExecCtx::SegwitV0 | ExecCtx::Tapscript => {
+                    if final_stack.len() != 1 {
+                        false
+                    } else {
+                        script::read_scriptbool(&final_stack.last().unwrap())
+                    }
+                }
+            },
+            final_stack,
+            error: None,
+            opcode: None,
+        }
+    }
+}
+
+#[derive(Debug, Clone, PartialEq, Eq, Default)]
+#[cfg_attr(feature = "serde", derive(serde::Serialize, serde::Deserialize))]
+pub struct ExecStats {
+    /// The highest number of stack items occurred during execution.
+    /// This counts both the stack and the altstack.
+    pub max_nb_stack_items: usize,
+
+    /// The number of opcodes executed, plus an additional one
+    /// per signature in CHECKMULTISIG.
+    pub opcode_count: usize,
+
+    /// The validation weight execution started with.
+    pub start_validation_weight: i64,
+    /// The current remaining validation weight.
+    pub validation_weight: i64,
+}
+
+/// Partial execution of a script.
+pub struct Exec {
+    ctx: ExecCtx,
+    opt: Options,
+    tx: TxTemplate,
+    result: Option<ExecutionResult>,
+
+    sighashcache: SighashCache<Transaction>,
+    script: &'static Script,
+    instructions: Instructions<'static>,
+    current_position: usize,
+    cond_stack: ConditionStack,
+    stack: Stack,
+    altstack: Stack,
+    last_codeseparator_pos: Option<u32>,
+    // Initially set to the whole script, but updated when
+    // OP_CODESEPARATOR is encountered.
+    script_code: &'static Script,
+
+    opcode_count: usize,
+    validation_weight: i64,
+
+    // runtime statistics
+    stats: ExecStats,
+}
+
+impl std::ops::Drop for Exec {
+    fn drop(&mut self) {
+        // we need to safely drop the script we allocated
+        unsafe {
+            let script = core::mem::replace(&mut self.script, Script::from_bytes(&[]));
+            let _ = Box::from_raw(script as *const Script as *mut Script);
+        }
+    }
+}
+
+impl Exec {
+    pub fn new(
+        ctx: ExecCtx,
+        opt: Options,
+        tx: TxTemplate,
+        script: ScriptBuf,
+        script_witness: Vec<Vec<u8>>,
+    ) -> Result<Exec, Error> {
+        if ctx == ExecCtx::Tapscript {
+            if tx.taproot_annex_scriptleaf.is_none() {
+                return Err(Error::Other("missing taproot tx info in tapscript context"));
+            }
+
+            if let Some((_, Some(ref annex))) = tx.taproot_annex_scriptleaf {
+                if annex.first() != Some(&taproot::TAPROOT_ANNEX_PREFIX) {
+                    return Err(Error::Other("invalid annex: missing prefix"));
+                }
+            }
+        }
+
+        // We want to make sure the script is valid so we don't have to throw parsing errors
+        // while executing.
+        let instructions = if opt.require_minimal {
+            script.instructions_minimal()
+        } else {
+            script.instructions()
+        };
+        if let Some(err) = instructions.clone().find_map(|res| res.err()) {
+            return Err(Error::InvalidScript(err));
+        }
+
+        // *****
+        // Make sure there is no more possible exit path after this point!
+        // Otherwise we are leaking memory.
+        // *****
+
+        // We box alocate the script to get a static Instructions iterator.
+        // We will manually drop this allocation in the ops::Drop impl.
+        let script = Box::leak(script.into_boxed_script()) as &'static Script;
+        let instructions = if opt.require_minimal {
+            script.instructions_minimal()
+        } else {
+            script.instructions()
+        };
+
+        //TODO(stevenroose) make this more efficient
+        let witness_size =
+            Encodable::consensus_encode(&script_witness, &mut bitcoin::io::sink()).unwrap();
+        let start_validation_weight = VALIDATION_WEIGHT_OFFSET + witness_size as i64;
+
+        let mut ret = Exec {
+            ctx,
+            result: None,
+
+            sighashcache: SighashCache::new(tx.tx.clone()),
+            script,
+            instructions,
+            current_position: 0,
+            cond_stack: ConditionStack::new(),
+            //TODO(stevenroose) does this need to be reversed?
+            stack: Stack::from_u8_vec(script_witness),
+            altstack: Stack::new(),
+            opcode_count: 0,
+            validation_weight: start_validation_weight,
+            last_codeseparator_pos: None,
+            script_code: script,
+
+            opt,
+            tx,
+
+            stats: ExecStats {
+                start_validation_weight,
+                validation_weight: start_validation_weight,
+                ..Default::default()
+            },
+        };
+        ret.update_stats();
+        Ok(ret)
+    }
+
+    pub fn with_stack(
+        ctx: ExecCtx,
+        opt: Options,
+        tx: TxTemplate,
+        script: ScriptBuf,
+        script_witness: Vec<Vec<u8>>,
+        stack: Stack,
+        altstack: Stack,
+    ) -> Result<Exec, Error> {
+        let mut ret = Self::new(ctx, opt, tx, script, script_witness);
+        if let Ok(exec) = &mut ret {
+            exec.stack = stack;
+            exec.altstack = altstack;
+        }
+        ret
+    }
+    //////////////////
+    // SOME GETTERS //
+    //////////////////
+
+    pub fn result(&self) -> Option<&ExecutionResult> {
+        self.result.as_ref()
+    }
+
+    pub fn script_position(&self) -> usize {
+        self.script.len() - self.instructions.as_script().len()
+    }
+
+    pub fn remaining_script(&self) -> &Script {
+        let pos = self.script_position();
+        &self.script[pos..]
+    }
+
+    pub fn stack(&self) -> &Stack {
+        &self.stack
+    }
+
+    pub fn altstack(&self) -> &Stack {
+        &self.altstack
+    }
+
+    pub fn stats(&self) -> &ExecStats {
+        &self.stats
+    }
+
+    ///////////////
+    // UTILITIES //
+    ///////////////
+
+    fn fail(&mut self, err: ExecError) -> Result<(), &ExecutionResult> {
+        let res = ExecutionResult {
+            success: false,
+            error: Some(err),
+            opcode: None,
+            final_stack: self.stack.clone(),
+        };
+        self.result = Some(res);
+        Err(self.result.as_ref().unwrap())
+    }
+
+    fn failop(&mut self, err: ExecError, op: Opcode) -> Result<(), &ExecutionResult> {
+        let res = ExecutionResult {
+            success: false,
+            error: Some(err),
+            opcode: Some(op),
+            final_stack: self.stack.clone(),
+        };
+        self.result = Some(res);
+        Err(self.result.as_ref().unwrap())
+    }
+
+    fn check_lock_time(&mut self, lock_time: i64) -> bool {
+        use bitcoin::locktime::absolute::LockTime;
+        let lock_time = match lock_time.try_into() {
+            Ok(l) => LockTime::from_consensus(l),
+            Err(_) => return false,
+        };
+
+        match (lock_time, self.tx.tx.lock_time) {
+            (LockTime::Blocks(h1), LockTime::Blocks(h2)) if h1 > h2 => return false,
+            (LockTime::Seconds(t1), LockTime::Seconds(t2)) if t1 > t2 => return false,
+            (LockTime::Blocks(_), LockTime::Seconds(_)) => return false,
+            (LockTime::Seconds(_), LockTime::Blocks(_)) => return false,
+            _ => {}
+        }
+
+        if self.tx.tx.input[self.tx.input_idx].sequence.is_final() {
+            return false;
+        }
+
+        true
+    }
+
+    fn check_sequence(&mut self, sequence: i64) -> bool {
+        use bitcoin::locktime::relative::LockTime;
+
+        // Fail if the transaction's version number is not set high
+        // enough to trigger BIP 68 rules.
+        if self.tx.tx.version < transaction::Version::TWO {
+            return false;
+        }
+
+        let input_sequence = self.tx.tx.input[self.tx.input_idx].sequence;
+        let input_lock_time = match input_sequence.to_relative_lock_time() {
+            Some(lt) => lt,
+            None => return false,
+        };
+
+        let lock_time = match LockTime::from_num(sequence) {
+            Some(lt) => lt,
+            None => return false,
+        };
+
+        match (lock_time, input_lock_time) {
+            (LockTime::Blocks(h1), LockTime::Blocks(h2)) if h1 > h2 => return false,
+            (LockTime::Time(t1), LockTime::Time(t2)) if t1 > t2 => return false,
+            (LockTime::Blocks(_), LockTime::Time(_)) => return false,
+            (LockTime::Time(_), LockTime::Blocks(_)) => return false,
+            _ => {}
+        }
+
+        true
+    }
+
+    fn check_sig_pre_tap(&mut self, sig: &[u8], pk: &[u8]) -> Result<bool, ExecError> {
+        //TODO(stevenroose) somehow sigops limit should be checked somewhere
+
+        // Drop the signature in pre-segwit scripts but not segwit scripts
+        let mut scriptcode = Cow::Borrowed(self.script_code.as_bytes());
+        if self.ctx == ExecCtx::Legacy {
+            let mut i = 0;
+            while i < scriptcode.len() - sig.len() {
+                if &scriptcode[i..i + sig.len()] == sig {
+                    scriptcode.to_mut().drain(i..i + sig.len());
+                } else {
+                    i += 1;
+                }
+            }
+        }
+
+        //TODO(stevenroose) the signature and pk encoding checks we use here
+        // might not be exactly identical to Core's
+
+        if self.ctx == ExecCtx::SegwitV0 && pk.len() == 65 {
+            return Err(ExecError::WitnessPubkeyType);
+        }
+
+        Ok(self.check_sig_ecdsa(sig, pk, &scriptcode))
+    }
+
+    fn check_sig_tap(&mut self, sig: &[u8], pk: &[u8]) -> Result<bool, ExecError> {
+        if !sig.is_empty() {
+            self.validation_weight -= VALIDATION_WEIGHT_PER_SIGOP_PASSED;
+            if self.validation_weight < 0 {
+                return Err(ExecError::TapscriptValidationWeight);
+            }
+        }
+
+        if pk.is_empty() {
+            Err(ExecError::PubkeyType)
+        } else if pk.len() == 32 {
+            if !sig.is_empty() {
+                self.check_sig_schnorr(sig, pk)?;
+                Ok(true)
+            } else {
+                Ok(false)
+            }
+        } else {
+            Ok(true)
+        }
+    }
+
+    fn check_sig(&mut self, sig: &[u8], pk: &[u8]) -> Result<bool, ExecError> {
+        match self.ctx {
+            ExecCtx::Legacy | ExecCtx::SegwitV0 => self.check_sig_pre_tap(sig, pk),
+            ExecCtx::Tapscript => self.check_sig_tap(sig, pk),
+        }
+    }
+
+    ///////////////
+    // EXECUTION //
+    ///////////////
+
+    /// Returns true when execution is done.
+    pub fn exec_next(&mut self) -> Result<(), &ExecutionResult> {
+        if let Some(ref res) = self.result {
+            return Err(res);
+        }
+
+        self.current_position = self.script.len() - self.instructions.as_script().len();
+        let instruction = match self.instructions.next() {
+            Some(Ok(i)) => i,
+            None => {
+                let res = ExecutionResult::from_final_stack(self.ctx, self.stack.clone());
+                self.result = Some(res);
+                return Err(self.result.as_ref().unwrap());
+            }
+            Some(Err(_)) => unreachable!("we checked the script beforehand"),
+        };
+
+        let exec = self.cond_stack.all_true();
+        match instruction {
+            Instruction::PushBytes(p) => {
+                if p.len() > MAX_SCRIPT_ELEMENT_SIZE {
+                    return self.fail(ExecError::PushSize);
+                }
+                if exec {
+                    self.stack.pushstr(p.as_bytes());
+                }
+            }
+            Instruction::Op(op) => {
+                // Some things we do even when we're not executing.
+
+                // Note how OP_RESERVED does not count towards the opcode limit.
+                if (self.ctx == ExecCtx::Legacy || self.ctx == ExecCtx::SegwitV0) && op.to_u8() > OP_PUSHNUM_16.to_u8() {
+                        self.opcode_count += 1;
+                        if self.opcode_count > MAX_OPS_PER_SCRIPT {
+                            return self.fail(ExecError::OpCount);
+                        }
+                    }
+
+                match op {
+                    OP_CAT if !self.opt.experimental.op_cat || self.ctx != ExecCtx::Tapscript => {
+                        return self.failop(ExecError::DisabledOpcode, op);
+                    }
+                    OP_SUBSTR | OP_LEFT | OP_RIGHT | OP_INVERT | OP_AND | OP_OR | OP_XOR
+                    | OP_2MUL | OP_2DIV | OP_MUL | OP_DIV | OP_MOD | OP_LSHIFT | OP_RSHIFT => {
+                        return self.failop(ExecError::DisabledOpcode, op);
+                    }
+                    OP_RESERVED => {
+                        return self.failop(ExecError::Debug, op);
+                    }
+
+                    _ => {}
+                }
+
+                if exec || (op.to_u8() >= OP_IF.to_u8() && op.to_u8() <= OP_ENDIF.to_u8()) {
+                    if let Err(err) = self.exec_opcode(op) {
+                        return self.failop(err, op);
+                    }
+                }
+            }
+        }
+
+        self.update_stats();
+        Ok(())
+    }
+
+    fn exec_opcode(&mut self, op: Opcode) -> Result<(), ExecError> {
+        let exec = self.cond_stack.all_true();
+
+        // Remember to leave stack intact until all errors have occurred.
+        match op {
+            //
+            // Push value
+            OP_PUSHNUM_NEG1 | OP_PUSHNUM_1 | OP_PUSHNUM_2 | OP_PUSHNUM_3 | OP_PUSHNUM_4
+            | OP_PUSHNUM_5 | OP_PUSHNUM_6 | OP_PUSHNUM_7 | OP_PUSHNUM_8 | OP_PUSHNUM_9
+            | OP_PUSHNUM_10 | OP_PUSHNUM_11 | OP_PUSHNUM_12 | OP_PUSHNUM_13 | OP_PUSHNUM_14
+            | OP_PUSHNUM_15 | OP_PUSHNUM_16 => {
+                let n = op.to_u8() - (OP_PUSHNUM_1.to_u8() - 2);
+                self.stack.pushnum((n as i64) - 1);
+            }
+
+            //
+            // Control
+            OP_NOP => {}
+
+            OP_CLTV if self.opt.verify_cltv => {
+                let top = self.stack.topstr(-1)?;
+
+                // Note that elsewhere numeric opcodes are limited to
+                // operands in the range -2**31+1 to 2**31-1, however it is
+                // legal for opcodes to produce results exceeding that
+                // range. This limitation is implemented by CScriptNum's
+                // default 4-byte limit.
+                //
+                // If we kept to that limit we'd have a year 2038 problem,
+                // even though the nLockTime field in transactions
+                // themselves is uint32 which only becomes meaningless
+                // after the year 2106.
+                //
+                // Thus as a special case we tell CScriptNum to accept up
+                // to 5-byte bignums, which are good until 2**39-1, well
+                // beyond the 2**32-1 limit of the nLockTime field itself.
+                let n = read_scriptint(&top, 5, self.opt.require_minimal)?;
+
+                if n < 0 {
+                    return Err(ExecError::NegativeLocktime);
+                }
+
+                if !self.check_lock_time(n) {
+                    return Err(ExecError::UnsatisfiedLocktime);
+                }
+            }
+            OP_CLTV => {} // otherwise nop
+
+            OP_CSV if self.opt.verify_csv => {
+                let top = self.stack.topstr(-1)?;
+
+                // nSequence, like nLockTime, is a 32-bit unsigned integer
+                // field. See the comment in CHECKLOCKTIMEVERIFY regarding
+                // 5-byte numeric operands.
+                let n = read_scriptint(&top, 5, self.opt.require_minimal)?;
+
+                if n < 0 {
+                    return Err(ExecError::NegativeLocktime);
+                }
+
+                //TODO(stevenroose) check this logic
+                //TODO(stevenroose) check if this cast is ok
+                if n & SEQUENCE_LOCKTIME_DISABLE_FLAG as i64 == 0 && !self.check_sequence(n) {
+                    return Err(ExecError::UnsatisfiedLocktime);
+                }
+            }
+            OP_CSV => {} // otherwise nop
+
+            OP_NOP1 | OP_NOP4 | OP_NOP5 | OP_NOP6 | OP_NOP7 | OP_NOP8 | OP_NOP9 | OP_NOP10 => {
+                // nops
+            }
+
+            OP_IF | OP_NOTIF => {
+                if exec {
+                    let top = self.stack.topstr(-1)?;
+
+                    // Tapscript requires minimal IF/NOTIF inputs as a consensus rule.
+                    if self.ctx == ExecCtx::Tapscript {
+                        // The input argument to the OP_IF and OP_NOTIF opcodes must be either
+                        // exactly 0 (the empty vector) or exactly 1 (the one-byte vector with value 1).
+                        if top.len() > 1 || (top.len() == 1 && top[0] != 1) {
+                            return Err(ExecError::TapscriptMinimalIf);
+                        }
+                    }
+                    // Under segwit v0 only enabled as policy.
+                    if self.opt.verify_minimal_if && self.ctx == ExecCtx::SegwitV0 && (top.len() > 1 || (top.len() == 1 && top[0] != 1)) {
+                        return Err(ExecError::TapscriptMinimalIf);
+                    }
+                    let b = if op == OP_NOTIF {
+                        !script::read_scriptbool(&top)
+                    } else {
+                        script::read_scriptbool(&top)
+                    };
+                    self.stack.pop().unwrap();
+                    self.cond_stack.push(b);
+                } else {
+                    self.cond_stack.push(false);
+                }
+            }
+
+            OP_ELSE => {
+                if !self.cond_stack.toggle_top() {
+                    return Err(ExecError::UnbalancedConditional);
+                }
+            }
+
+            OP_ENDIF => {
+                if !self.cond_stack.pop() {
+                    return Err(ExecError::UnbalancedConditional);
+                }
+            }
+
+            OP_VERIFY => {
+                let top = self.stack.topstr(-1)?;
+
+                if !script::read_scriptbool(&top) {
+                    return Err(ExecError::Verify);
+                } else {
+                    self.stack.pop().unwrap();
+                }
+            }
+
+            OP_RETURN => return Err(ExecError::OpReturn),
+
+            //
+            // Stack operations
+            OP_TOALTSTACK => {
+                let top = self.stack.pop().ok_or(ExecError::InvalidStackOperation)?;
+                self.altstack.push(top);
+            }
+
+            OP_FROMALTSTACK => {
+                let top = self
+                    .altstack
+                    .pop()
+                    .ok_or(ExecError::InvalidStackOperation)?;
+                self.stack.push(top);
+            }
+
+            OP_2DROP => {
+                // (x1 x2 -- )
+                self.stack.needn(2)?;
+                self.stack.popn(2).unwrap();
+            }
+
+            OP_2DUP => {
+                // (x1 x2 -- x1 x2 x1 x2)
+                let x1 = self.stack.top(-2)?.clone();
+                let x2 = self.stack.top(-1)?.clone();
+                self.stack.push(x1);
+                self.stack.push(x2);
+            }
+
+            OP_3DUP => {
+                // (x1 x2 x3 -- x1 x2 x3 x1 x2 x3)
+                let x1 = self.stack.top(-3)?.clone();
+                let x2 = self.stack.top(-2)?.clone();
+                let x3 = self.stack.top(-1)?.clone();
+                self.stack.push(x1);
+                self.stack.push(x2);
+                self.stack.push(x3);
+            }
+
+            OP_2OVER => {
+                // (x1 x2 x3 x4 -- x1 x2 x3 x4 x1 x2)
+                self.stack.needn(4)?;
+                let x1 = self.stack.top(-4)?.clone();
+                let x2 = self.stack.top(-3)?.clone();
+                self.stack.push(x1);
+                self.stack.push(x2);
+            }
+
+            OP_2ROT => {
+                // (x1 x2 x3 x4 x5 x6 -- x3 x4 x5 x6 x1 x2)
+                self.stack.needn(6)?;
+                let x6 = self.stack.pop().unwrap();
+                let x5 = self.stack.pop().unwrap();
+                let x4 = self.stack.pop().unwrap();
+                let x3 = self.stack.pop().unwrap();
+                let x2 = self.stack.pop().unwrap();
+                let x1 = self.stack.pop().unwrap();
+                self.stack.push(x3);
+                self.stack.push(x4);
+                self.stack.push(x5);
+                self.stack.push(x6);
+                self.stack.push(x1);
+                self.stack.push(x2);
+            }
+
+            OP_2SWAP => {
+                // (x1 x2 x3 x4 -- x3 x4 x1 x2)
+                self.stack.needn(4)?;
+                let x4 = self.stack.pop().unwrap();
+                let x3 = self.stack.pop().unwrap();
+                let x2 = self.stack.pop().unwrap();
+                let x1 = self.stack.pop().unwrap();
+                self.stack.push(x3);
+                self.stack.push(x4);
+                self.stack.push(x1);
+                self.stack.push(x2);
+            }
+
+            OP_IFDUP => {
+                // (x - 0 | x x)
+                let top = self.stack.topstr(-1)?;
+                if script::read_scriptbool(&top) {
+                    self.stack.push(self.stack.top(-1)?.clone());
+                }
+            }
+
+            OP_DEPTH => {
+                // -- stacksize
+                self.stack.pushnum(self.stack.len() as i64);
+            }
+
+            OP_DROP => {
+                // (x -- )
+                if self.stack.pop().is_none() {
+                    return Err(ExecError::InvalidStackOperation);
+                }
+            }
+
+            OP_DUP => {
+                // (x -- x x)
+                let top = self.stack.top(-1)?.clone();
+                self.stack.push(top);
+            }
+
+            OP_NIP => {
+                // (x1 x2 -- x2)
+                self.stack.needn(2)?;
+                let x2 = self.stack.pop().unwrap();
+                self.stack.pop().unwrap();
+                self.stack.push(x2);
+            }
+
+            OP_OVER => {
+                // (x1 x2 -- x1 x2 x1)
+                let under_top = self.stack.top(-2)?.clone();
+                self.stack.push(under_top);
+            }
+
+            OP_PICK | OP_ROLL => {
+                // (xn ... x2 x1 x0 n - xn ... x2 x1 x0 xn)
+                // (xn ... x2 x1 x0 n - ... x2 x1 x0 xn)
+                let x = self.stack.topnum(-1, self.opt.require_minimal)?;
+                if x < 0 || x >= self.stack.len() as i64 {
+                    return Err(ExecError::InvalidStackOperation);
+                }
+                self.stack.pop().unwrap();
+                let elem = self.stack.top(-x as isize - 1).unwrap().clone();
+                if op == OP_ROLL {
+                    self.stack.remove(self.stack.len() - x as usize - 1);
+                }
+                self.stack.push(elem);
+            }
+
+            OP_ROT => {
+                // (x1 x2 x3 -- x2 x3 x1)
+                self.stack.needn(3)?;
+                let x3 = self.stack.pop().unwrap();
+                let x2 = self.stack.pop().unwrap();
+                let x1 = self.stack.pop().unwrap();
+                self.stack.push(x2);
+                self.stack.push(x3);
+                self.stack.push(x1);
+            }
+
+            OP_SWAP => {
+                // (x1 x2 -- x2 x1)
+                self.stack.needn(2)?;
+                let x2 = self.stack.pop().unwrap();
+                let x1 = self.stack.pop().unwrap();
+                self.stack.push(x2);
+                self.stack.push(x1);
+            }
+
+            OP_TUCK => {
+                // (x1 x2 -- x2 x1 x2)
+                self.stack.needn(2)?;
+                let x2 = self.stack.pop().unwrap();
+                let x1 = self.stack.pop().unwrap();
+                self.stack.push(x2.clone());
+                self.stack.push(x1);
+                self.stack.push(x2);
+            }
+
+            OP_CAT if self.opt.experimental.op_cat && self.ctx == ExecCtx::Tapscript => {
+                // (x1 x2 -- x1|x2)
+                self.stack.needn(2)?;
+                let x2 = self.stack.popstr().unwrap();
+                let x1 = self.stack.popstr().unwrap();
+                let ret: Vec<u8> = x1.into_iter().chain(x2).collect();
+                if ret.len() > MAX_SCRIPT_ELEMENT_SIZE {
+                    return Err(ExecError::PushSize);
+                }
+                self.stack.pushstr(&ret);
+            }
+
+            OP_SIZE => {
+                // (in -- in size)
+                let top = self.stack.topstr(-1)?;
+                self.stack.pushnum(top.len() as i64);
+            }
+
+            //
+            // Bitwise logic
+            OP_EQUAL | OP_EQUALVERIFY => {
+                // (x1 x2 - bool)
+                self.stack.needn(2)?;
+                let x2 = self.stack.popstr().unwrap();
+                let x1 = self.stack.popstr().unwrap();
+                let equal = x1 == x2;
+                if op == OP_EQUALVERIFY && !equal {
+                    return Err(ExecError::EqualVerify);
+                }
+                if op == OP_EQUAL {
+                    let item = if equal { 1 } else { 0 };
+                    self.stack.pushnum(item);
+                }
+            }
+
+            //
+            // Numeric
+            OP_1ADD | OP_1SUB | OP_NEGATE | OP_ABS | OP_NOT | OP_0NOTEQUAL => {
+                // (in -- out)
+                let x = self.stack.topnum(-1, self.opt.require_minimal)?;
+                let res = match op {
+                    OP_1ADD => x
+                        .checked_add(1)
+                        .ok_or(ExecError::ScriptIntNumericOverflow)?,
+                    OP_1SUB => x
+                        .checked_sub(1)
+                        .ok_or(ExecError::ScriptIntNumericOverflow)?,
+                    OP_NEGATE => x.checked_neg().ok_or(ExecError::ScriptIntNumericOverflow)?,
+                    OP_ABS => x.abs(),
+                    OP_NOT => (x == 0) as i64,
+                    OP_0NOTEQUAL => (x != 0) as i64,
+                    _ => unreachable!(),
+                };
+                self.stack.pop().unwrap();
+                self.stack.pushnum(res);
+            }
+
+            OP_ADD
+            | OP_SUB
+            | OP_BOOLAND
+            | OP_BOOLOR
+            | OP_NUMEQUAL
+            | OP_NUMEQUALVERIFY
+            | OP_NUMNOTEQUAL
+            | OP_LESSTHAN
+            | OP_GREATERTHAN
+            | OP_LESSTHANOREQUAL
+            | OP_GREATERTHANOREQUAL
+            | OP_MIN
+            | OP_MAX => {
+                // (x1 x2 -- out)
+                let x1 = self.stack.topnum(-2, self.opt.require_minimal)?;
+                let x2 = self.stack.topnum(-1, self.opt.require_minimal)?;
+                let res = match op {
+                    OP_ADD => x1
+                        .checked_add(x2)
+                        .ok_or(ExecError::ScriptIntNumericOverflow)?,
+                    OP_SUB => x1
+                        .checked_sub(x2)
+                        .ok_or(ExecError::ScriptIntNumericOverflow)?,
+                    OP_BOOLAND => (x1 != 0 && x2 != 0) as i64,
+                    OP_BOOLOR => (x1 != 0 || x2 != 0) as i64,
+                    OP_NUMEQUAL => (x1 == x2) as i64,
+                    OP_NUMEQUALVERIFY => (x1 == x2) as i64,
+                    OP_NUMNOTEQUAL => (x1 != x2) as i64,
+                    OP_LESSTHAN => (x1 < x2) as i64,
+                    OP_GREATERTHAN => (x1 > x2) as i64,
+                    OP_LESSTHANOREQUAL => (x1 <= x2) as i64,
+                    OP_GREATERTHANOREQUAL => (x1 >= x2) as i64,
+                    OP_MIN => cmp::min(x1, x2),
+                    OP_MAX => cmp::max(x1, x2),
+                    _ => unreachable!(),
+                };
+                if op == OP_NUMEQUALVERIFY && res == 0 {
+                    return Err(ExecError::NumEqualVerify);
+                }
+                self.stack.popn(2).unwrap();
+                if op != OP_NUMEQUALVERIFY {
+                    self.stack.pushnum(res);
+                }
+            }
+
+            OP_WITHIN => {
+                // (x min max -- out)
+                let x1 = self.stack.topnum(-3, self.opt.require_minimal)?;
+                let x2 = self.stack.topnum(-2, self.opt.require_minimal)?;
+                let x3 = self.stack.topnum(-1, self.opt.require_minimal)?;
+                self.stack.popn(3).unwrap();
+                let res = x2 <= x1 && x1 < x3;
+                let item = if res { 1 } else { 0 };
+                self.stack.pushnum(item);
+            }
+
+            //
+            // Crypto
+
+            // (in -- hash)
+            OP_RIPEMD160 => {
+                let top = self.stack.popstr()?;
+                self.stack
+                    .pushstr(&ripemd160::Hash::hash(&top[..]).to_byte_array());
+            }
+            OP_SHA1 => {
+                let top = self.stack.popstr()?;
+                self.stack
+                    .pushstr(&sha1::Hash::hash(&top[..]).to_byte_array());
+            }
+            OP_SHA256 => {
+                let top = self.stack.popstr()?;
+                self.stack
+                    .pushstr(&sha256::Hash::hash(&top[..]).to_byte_array());
+            }
+            OP_HASH160 => {
+                let top = self.stack.popstr()?;
+                self.stack
+                    .pushstr(&hash160::Hash::hash(&top[..]).to_byte_array());
+            }
+            OP_HASH256 => {
+                let top = self.stack.popstr()?;
+                self.stack
+                    .pushstr(&sha256d::Hash::hash(&top[..]).to_byte_array());
+            }
+
+            OP_CODESEPARATOR => {
+                // Store this CODESEPARATOR position and update the scriptcode.
+                self.last_codeseparator_pos = Some(self.current_position as u32);
+                self.script_code = &self.script[self.current_position..];
+            }
+
+            OP_CHECKSIG | OP_CHECKSIGVERIFY => {
+                let sig = self.stack.topstr(-2)?.clone();
+                let pk = self.stack.topstr(-1)?.clone();
+                let res = self.check_sig(&sig, &pk)?;
+                self.stack.popn(2).unwrap();
+                if op == OP_CHECKSIGVERIFY && !res {
+                    return Err(ExecError::CheckSigVerify);
+                }
+                if op == OP_CHECKSIG {
+                    let ret = if res { 1 } else { 0 };
+                    self.stack.pushnum(ret);
+                }
+            }
+
+            OP_CHECKSIGADD => {
+                if self.ctx == ExecCtx::Legacy || self.ctx == ExecCtx::SegwitV0 {
+                    return Err(ExecError::BadOpcode);
+                }
+                let sig = self.stack.topstr(-3)?.clone();
+                let mut n = self.stack.topnum(-2, self.opt.require_minimal)?;
+                let pk = self.stack.topstr(-1)?.clone();
+                let res = self.check_sig(&sig, &pk)?;
+                self.stack.popn(3).unwrap();
+                if res {
+                    n += 1;
+                }
+                self.stack.pushnum(n);
+            }
+
+            OP_CHECKMULTISIG | OP_CHECKMULTISIGVERIFY => {
+                unimplemented!();
+            }
+
+            // remainder
+            _ => return Err(ExecError::BadOpcode),
+        }
+
+        if self.opt.enforce_stack_limit && self.stack.len() + self.altstack.len() > MAX_STACK_SIZE {
+            return Err(ExecError::StackSize);
+        }
+
+        Ok(())
+    }
+
+    ////////////////
+    // STATISTICS //
+    ////////////////
+
+    fn update_stats(&mut self) {
+        let stack_items = self.stack.len() + self.altstack.len();
+        self.stats.max_nb_stack_items = cmp::max(self.stats.max_nb_stack_items, stack_items);
+
+        self.stats.opcode_count = self.opcode_count;
+        self.stats.validation_weight = self.validation_weight;
+    }
+}
+
+fn read_scriptint(item: &[u8], size: usize, minimal: bool) -> Result<i64, ExecError> {
+    script::read_scriptint_size(item, size, minimal).map_err(|e| match e {
+        script::ScriptIntError::NonMinimalPush => ExecError::MinimalData,
+        // only possible if size is 4 or lower
+        script::ScriptIntError::NumericOverflow => ExecError::ScriptIntNumericOverflow,
+    })
+}
diff --git a/bitcoin-scriptexec/src/macros.rs b/bitcoin-scriptexec/src/macros.rs
new file mode 100644
index 0000000..52c6fd1
--- /dev/null
+++ b/bitcoin-scriptexec/src/macros.rs
@@ -0,0 +1,10 @@
+#[macro_export]
+macro_rules! or_else {
+	($e:expr, $($else:tt)+) => {
+		if let Some(v) = $e {
+			v
+		} else {
+			return $($else)+;
+		}
+	};
+}
diff --git a/bitcoin-scriptexec/src/main.rs b/bitcoin-scriptexec/src/main.rs
new file mode 100644
index 0000000..6a6d54b
--- /dev/null
+++ b/bitcoin-scriptexec/src/main.rs
@@ -0,0 +1,130 @@
+use std::fmt;
+use std::io::{self, Write};
+use std::path::PathBuf;
+
+use bitcoin::hashes::Hash;
+use bitcoin::hex::DisplayHex;
+use bitcoin::taproot::TapLeafHash;
+use bitcoin::{ScriptBuf, Transaction};
+use clap::Parser;
+
+use bitcoin_scriptexec::*;
+
+#[derive(Parser)]
+#[command(author = "Steven Roose <steven@roose.io>", version, about)]
+struct Args {
+    /// filepath to script ASM file
+    #[arg(required = true)]
+    script_path: PathBuf,
+    /// Whether to print debug info
+    #[arg(long)]
+    debug: bool,
+    /// Whether to output result in JSON.
+    #[arg(long)]
+    json: bool,
+}
+
+/// A wrapper for the stack types to print them better.
+struct FmtStack<'a>(&'a Stack);
+impl<'a> fmt::Display for FmtStack<'a> {
+    fn fmt(&self, f: &mut fmt::Formatter) -> fmt::Result {
+        let mut iter = self.0.iter_str().rev().peekable();
+        while let Some(item) = iter.next() {
+            write!(f, "<{}>", item.as_hex())?;
+            if iter.peek().is_some() {
+                write!(f, " ")?;
+            }
+        }
+        Ok(())
+    }
+}
+
+fn inner_main() -> Result<(), String> {
+    let args = Args::parse();
+
+    let script_asm = std::fs::read_to_string(args.script_path).expect("error reading script file");
+    let script = ScriptBuf::parse_asm(&script_asm).expect("error parsing script");
+    println!("Script in hex: {}", script.as_bytes().to_lower_hex_string());
+    println!("Script size: {} bytes", script.as_bytes().len());
+
+    let start = std::time::Instant::now();
+    let mut exec = Exec::new(
+        ExecCtx::Tapscript,
+        Options::default(),
+        TxTemplate {
+            tx: Transaction {
+                version: bitcoin::transaction::Version::TWO,
+                lock_time: bitcoin::locktime::absolute::LockTime::ZERO,
+                input: vec![],
+                output: vec![],
+            },
+            prevouts: vec![],
+            input_idx: 0,
+            taproot_annex_scriptleaf: Some((TapLeafHash::all_zeros(), None)),
+        },
+        script,
+        vec![],
+    )
+    .expect("error creating exec");
+
+    const SEP: &str = "--------------------------------------------------";
+
+    let mut out = io::stdout();
+    println!("{}", SEP);
+    loop {
+        if args.debug {
+            if args.json {
+                let step = json::RunStep {
+                    remaining_script: exec.remaining_script(),
+                    stack: &exec.stack().iter_str().collect::<Vec<Vec<u8>>>(),
+                    altstack: &exec.altstack().iter_str().collect::<Vec<Vec<u8>>>(),
+                    stats: Some(exec.stats()),
+                };
+                serde_json::to_writer(&out, &step).expect("I/O error");
+                out.write_all('\n'.to_string().as_bytes()).expect("I/O error");
+            } else {
+                println!(
+                    "Remaining script: {}",
+                    exec.remaining_script().to_asm_string()
+                );
+                println!("Stack: {}", FmtStack(exec.stack()));
+                println!("AltStack: {}", FmtStack(exec.altstack()));
+                println!("{}", SEP);
+            }
+        }
+
+        if exec.exec_next().is_err() {
+            break;
+        }
+    }
+
+    let res = exec.result().unwrap().clone();
+    if args.json {
+        let ret = json::RunResult {
+            success: res.success,
+            error: res.error.map(|e| format!("{:?}", e)), //TODO(stevenroose) fmt::Display
+            opcode: res.opcode,
+            final_stack: &res.final_stack.iter_str().collect::<Vec<Vec<u8>>>(),
+            stats: Some(exec.stats()),
+        };
+        serde_json::to_writer(&out, &ret).expect("I/O error");
+    } else {
+        println!("Execution ended. Success: {}", res.success);
+        print!("Final stack: {}", FmtStack(&res.final_stack));
+        println!();
+        if !res.success {
+            println!("Failed on opcode: {:?}", res.opcode);
+            println!("Error: {:?}", res.error);
+        }
+        println!("Stats:\n{:#?}", exec.stats());
+        println!("Time elapsed: {}ms", start.elapsed().as_millis());
+    }
+	
+    Ok(())
+}
+
+fn main() {
+    if let Err(e) = inner_main() {
+        eprintln!("ERROR: {}", e);
+    }
+}
diff --git a/bitcoin-scriptexec/src/signatures.rs b/bitcoin-scriptexec/src/signatures.rs
new file mode 100644
index 0000000..98c274f
--- /dev/null
+++ b/bitcoin-scriptexec/src/signatures.rs
@@ -0,0 +1,101 @@
+use bitcoin::secp256k1::{self, PublicKey, XOnlyPublicKey};
+use bitcoin::sighash::{Annex, EcdsaSighashType, Prevouts, TapSighashType};
+
+use crate::*;
+
+lazy_static::lazy_static! {
+    static ref SECP: secp256k1::Secp256k1<secp256k1::All> = secp256k1::Secp256k1::new();
+}
+
+impl Exec {
+    pub fn check_sig_ecdsa(&mut self, sig: &[u8], pk: &[u8], script_code: &[u8]) -> bool {
+        let pk = match PublicKey::from_slice(pk) {
+            Ok(pk) => pk,
+            Err(_) => return false,
+        };
+
+        if sig.is_empty() {
+            return false;
+        }
+
+        let hashtype = *sig.last().unwrap();
+        let sig = match secp256k1::ecdsa::Signature::from_der(&sig[0..sig.len() - 1]) {
+            Ok(s) => s,
+            Err(_) => return false,
+        };
+
+        let sighash = if self.ctx == ExecCtx::SegwitV0 {
+            self.sighashcache
+                .p2wsh_signature_hash(
+                    self.tx.input_idx,
+                    Script::from_bytes(script_code),
+                    self.tx.prevouts[self.tx.input_idx].value,
+                    //TODO(stevenroose) this might not actually emulate consensus behavior
+                    EcdsaSighashType::from_consensus(hashtype as u32),
+                )
+                .expect("only happens on prevout index out of bounds")
+                .into()
+        } else if self.ctx == ExecCtx::Legacy {
+            self.sighashcache
+                .legacy_signature_hash(
+                    self.tx.input_idx,
+                    Script::from_bytes(script_code),
+                    hashtype as u32,
+                )
+                .expect("TODO(stevenroose) seems to only happen if prevout index out of bound")
+                .into()
+        } else {
+            unreachable!();
+        };
+
+        SECP.verify_ecdsa(&sighash, &sig, &pk).is_ok()
+    }
+
+    /// pk should be passed as 32-bytes.
+    pub fn check_sig_schnorr(&mut self, sig: &[u8], pk: &[u8]) -> Result<(), ExecError> {
+        assert_eq!(pk.len(), 32);
+
+        if sig.len() != 64 && sig.len() != 65 {
+            return Err(ExecError::SchnorrSigSize);
+        }
+
+        let pk = XOnlyPublicKey::from_slice(pk).expect("TODO(stevenroose) what to do here?");
+        let (sig, hashtype) = if sig.len() == 65 {
+            let b = *sig.last().unwrap();
+            let sig = secp256k1::schnorr::Signature::from_slice(&sig[0..sig.len() - 1])
+                .map_err(|_| ExecError::SchnorrSig)?;
+
+            if b == TapSighashType::Default as u8 {
+                return Err(ExecError::SchnorrSigHashtype);
+            }
+            //TODO(stevenroose) core does not error here
+            let sht =
+                TapSighashType::from_consensus_u8(b).map_err(|_| ExecError::SchnorrSigHashtype)?;
+            (sig, sht)
+        } else {
+            let sig = secp256k1::schnorr::Signature::from_slice(sig)
+                .map_err(|_| ExecError::SchnorrSig)?;
+            (sig, TapSighashType::Default)
+        };
+
+        let (leaf_hash, annex) = self.tx.taproot_annex_scriptleaf.as_ref().unwrap();
+        let sighash = self
+            .sighashcache
+            .taproot_signature_hash(
+                self.tx.input_idx,
+                &Prevouts::All(&self.tx.prevouts),
+                annex
+                    .as_ref()
+                    .map(|a| Annex::new(a).expect("we checked annex prefix before")),
+                Some((*leaf_hash, self.last_codeseparator_pos.unwrap_or(u32::MAX))),
+                hashtype,
+            )
+            .expect("TODO(stevenroose) seems to only happen if prevout index out of bound");
+
+        if SECP.verify_schnorr(&sig, &sighash.into(), &pk) != Ok(()) {
+            return Err(ExecError::SchnorrSig);
+        }
+
+        Ok(())
+    }
+}
diff --git a/bitcoin-scriptexec/src/utils.rs b/bitcoin-scriptexec/src/utils.rs
new file mode 100644
index 0000000..c4cace4
--- /dev/null
+++ b/bitcoin-scriptexec/src/utils.rs
@@ -0,0 +1,80 @@
+///  A data type to abstract out the condition stack during script execution.
+///
+/// Conceptually it acts like a vector of booleans, one for each level of nested
+/// IF/THEN/ELSE, indicating whether we're in the active or inactive branch of
+/// each.
+///
+/// The elements on the stack cannot be observed individually; we only need to
+/// expose whether the stack is empty and whether or not any false values are
+/// present at all. To implement OP_ELSE, a toggle_top modifier is added, which
+/// flips the last value without returning it.
+///
+/// This uses an optimized implementation that does not materialize the
+/// actual stack. Instead, it just stores the size of the would-be stack,
+/// and the position of the first false value in it.
+pub struct ConditionStack {
+    /// The size of the implied stack.
+    size: usize,
+    /// The position of the first false value on the implied stack,
+    /// or NO_FALSE if all true.
+    first_false_pos: usize,
+}
+
+impl ConditionStack {
+    /// A constant for first_false_pos to indicate there are no falses.
+    const NO_FALSE: usize = usize::MAX;
+
+    pub fn new() -> Self {
+        Self {
+            size: 0,
+            first_false_pos: Self::NO_FALSE,
+        }
+    }
+
+    pub fn all_true(&self) -> bool {
+        self.first_false_pos == Self::NO_FALSE
+    }
+
+    pub fn push(&mut self, v: bool) {
+        if self.first_false_pos == Self::NO_FALSE && !v {
+            // The stack consists of all true values, and a false is added.
+            // The first false value will appear at the current size.
+            self.first_false_pos = self.size;
+        }
+        self.size += 1;
+    }
+
+    /// Returns [false] if it was empty, [true] otherwise.
+    ///
+    /// Note that the popped value is not returned.
+    pub fn pop(&mut self) -> bool {
+        if self.size == 0 {
+            false
+        } else {
+            self.size -= 1;
+            if self.first_false_pos == self.size {
+                // When popping off the first false value, everything becomes true.
+                self.first_false_pos = Self::NO_FALSE;
+            }
+            true
+        }
+    }
+
+    pub fn toggle_top(&mut self) -> bool {
+        if self.size == 0 {
+            false
+        } else {
+            if self.first_false_pos == Self::NO_FALSE {
+                // The current stack is all true values; the first false will be the top.
+                self.first_false_pos = self.size - 1;
+            } else if self.first_false_pos == self.size - 1 {
+                // The top is the first false value; toggling it will make everything true.
+                self.first_false_pos = Self::NO_FALSE;
+            } else {
+                // There is a false value, but not on top. No action is needed as toggling
+                // anything but the first false value is unobservable.
+            }
+            true
+        }
+    }
+}
diff --git a/bitcoin-scriptexec/src/wasm.rs b/bitcoin-scriptexec/src/wasm.rs
new file mode 100644
index 0000000..69136ad
--- /dev/null
+++ b/bitcoin-scriptexec/src/wasm.rs
@@ -0,0 +1,104 @@
+use bitcoin::hashes::Hash;
+use bitcoin::hex::{DisplayHex, FromHex};
+use bitcoin::taproot::TapLeafHash;
+use bitcoin::{ScriptBuf, Transaction};
+use serde_json::json;
+use wasm_bindgen::prelude::*;
+
+use crate::*;
+
+/// Compile ASM into script hex.
+#[wasm_bindgen]
+pub fn script_asm_to_hex(script_asm: &str) -> Result<String, JsValue> {
+    let script =
+        ScriptBuf::parse_asm(script_asm).map_err(|e| format!("error parsing script: {:?}", e))?;
+    Ok(script.as_bytes().as_hex().to_string())
+}
+
+/// Decode compiled script hex into ASM.
+#[wasm_bindgen]
+pub fn script_hex_to_asm(script_hex: &str) -> Result<String, JsValue> {
+    let script = ScriptBuf::from_hex(script_hex).map_err(|e| format!("invalid hex: {}", e))?;
+    Ok(script.to_asm_string())
+}
+
+/// Run the given script.
+///
+/// Fields on the return value are:
+/// - success: bool
+/// - final_stack: list of hex stack items after execution
+/// - error: (optional) error that caused execution halt
+/// - last_opcode: (optional) last opcode run before error produced
+/// - stats: execution runtime statistics with following fields:
+///   - max_nb_stack_items
+///   - max_stack_size
+///   - max_stack_item_size
+///   - start_validation_weight
+///   - validation_weight
+#[wasm_bindgen]
+#[allow(clippy::boxed_local)] // NOTE(Velnbur): just a wasm_bindgen thing
+pub fn run_script(script_hex: &str, script_witness: Box<[JsValue]>) -> Result<JsValue, JsValue> {
+    console_error_panic_hook::set_once();
+
+    let script =
+        ScriptBuf::from_hex(script_hex).map_err(|e| format!("invalid hex script: {:?}", e))?;
+    let witness = {
+        let mut ret = Vec::with_capacity(script_witness.len());
+        for item in script_witness.iter() {
+            let hex = item
+                .as_string()
+                .ok_or("script witness must be list of hex strings")?;
+            let bytes = Vec::from_hex(&hex).map_err(|_| "invalid hex in script witness")?;
+            ret.push(bytes);
+        }
+        ret
+    };
+
+    let mut exec = Exec::new(
+        ExecCtx::Tapscript,
+        Options::default(),
+        TxTemplate {
+            tx: Transaction {
+                version: bitcoin::transaction::Version::TWO,
+                lock_time: bitcoin::locktime::absolute::LockTime::ZERO,
+                input: vec![],
+                output: vec![],
+            },
+            prevouts: vec![],
+            input_idx: 0,
+            taproot_annex_scriptleaf: Some((TapLeafHash::all_zeros(), None)),
+        },
+        script,
+        witness,
+    )
+    .map_err(|e| format!("error creating exec: {:?}", e))?;
+
+    loop {
+        if let Err(res) = exec.exec_next() {
+            let res = res.clone();
+            let mut ret = json!({
+                "success": res.success,
+                "final_stack": res.final_stack.iter_str()
+                    .map(|i| i.as_hex().to_string())
+                    .collect::<Vec<_>>(),
+                "stats": serde_json::to_value(exec.stats()).unwrap(),
+            });
+            if !res.success {
+                let obj = ret.as_object_mut().unwrap();
+                obj.insert(
+                    "last_opcode".into(),
+                    res.opcode.map(|o| o.to_string()).unwrap_or_default().into(),
+                );
+                obj.insert(
+                    "error".into(),
+                    res.error
+                        .map(|o| format!("{:?}", o))
+                        .unwrap_or_default()
+                        .into(),
+                );
+            }
+
+            return Ok(serde_wasm_bindgen::to_value(&ret).unwrap());
+        }
+    }
+}

From fc1e257cafdfaf3b7b938a7b202b2512efa7cf5c Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Tue, 1 Oct 2024 12:55:47 +0300
Subject: [PATCH 07/28] WIP

---
 Cargo.toml                    |  2 +-
 bitcoin-splitter/Cargo.toml   |  2 +-
 bitcoin-splitter/src/debug.rs | 11 +++++++++++
 bitcoin-splitter/src/lib.rs   |  2 +-
 4 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/Cargo.toml b/Cargo.toml
index 1d4eb18..e34665c 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -36,4 +36,4 @@ branch = "bitvm"
 
 [patch.crates-io.bitcoin-units]
 git = "https://github.com/rust-bitcoin/rust-bitcoin"
-branch = "bitvm"
\ No newline at end of file
+branch = "bitvm"
diff --git a/bitcoin-splitter/Cargo.toml b/bitcoin-splitter/Cargo.toml
index 652edb8..ece6ddb 100644
--- a/bitcoin-splitter/Cargo.toml
+++ b/bitcoin-splitter/Cargo.toml
@@ -5,7 +5,7 @@ edition = "2021"
 
 [dependencies]
 # Bitcoin Libraries
-bitcoin              = { git = "https://github.com/rust-bitcoin/rust-bitcoin", branch = "bitvm", features = ["rand-std"]}
+bitcoin              = { workspace = true, features = ["rand-std"]}
 bitcoin-script       = { git = "https://github.com/BitVM/rust-bitcoin-script" }
 bitcoin-scriptexec   = { git = "https://github.com/BitVM/rust-bitcoin-scriptexec/"}
 bitcoin-script-stack = { git = "https://github.com/FairgateLabs/rust-bitcoin-script-stack"}
diff --git a/bitcoin-splitter/src/debug.rs b/bitcoin-splitter/src/debug.rs
index c4d1cf7..4178891 100644
--- a/bitcoin-splitter/src/debug.rs
+++ b/bitcoin-splitter/src/debug.rs
@@ -76,6 +76,17 @@ pub fn execute_script(script: ScriptBuf) -> ExecuteInfo {
     }
 }
 
+pub fn run(script: bitcoin::ScriptBuf) {
+    let exec_result = execute_script(script);
+    if !exec_result.success {
+        println!(
+            "ERROR: {:?} <--- \n STACK: {:#?} \n ALTSTACK {:#?}",
+            exec_result.error, exec_result.main_stack, exec_result.alt_stack
+        );
+    }
+    assert!(exec_result.success);
+}
+
 /// Execute a script on stack without `MAX_STACK_SIZE` limit.
 /// This function is only used for script test, not for production.
 ///
diff --git a/bitcoin-splitter/src/lib.rs b/bitcoin-splitter/src/lib.rs
index e6622a8..62b8aaa 100644
--- a/bitcoin-splitter/src/lib.rs
+++ b/bitcoin-splitter/src/lib.rs
@@ -1,7 +1,7 @@
 #[allow(dead_code)]
 // Re-export what is needed to write treepp scripts
 pub mod treepp {
-    pub use crate::debug::execute_script;
+    pub use crate::debug::{execute_script, run};
     pub use bitcoin_script::{define_pushable, script};
 
     define_pushable!();

From 0ea730da205e53bac0e73ddce89735f9a606f50d Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 9 Oct 2024 20:20:51 +0300
Subject: [PATCH 08/28] :construction: wip, adding u32 stack split

---
 bitcoin-splitter/src/split/core.rs               | 2 --
 bitcoin-splitter/src/split/intermediate_state.rs | 5 +++++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/bitcoin-splitter/src/split/core.rs b/bitcoin-splitter/src/split/core.rs
index d54f12f..f364c39 100644
--- a/bitcoin-splitter/src/split/core.rs
+++ b/bitcoin-splitter/src/split/core.rs
@@ -128,14 +128,12 @@ pub(super) fn fuzzy_split(input: Script, script: Script, split_type: SplitType)
     for chunk_size in (MIN_CHUNK_SIZE..MAX_CHUNK_SIZE).step_by(STEP_SIZE) {
         // Incrementing the progress bar
         bar.inc(1);
-
         // We are using panic::catch_unwind to catch any panics that might occur
         // during the splitting process. If a panic occurs, we just skip the current
         // chunk size and continue with the next one.
         let current_split_result = panic::catch_unwind(|| {
             naive_split(input.clone(), script.clone(), split_type, chunk_size)
         });
-
         if let Ok(split_result) = current_split_result {
             let current_complexity = split_result.complexity_index();
 
diff --git a/bitcoin-splitter/src/split/intermediate_state.rs b/bitcoin-splitter/src/split/intermediate_state.rs
index a45245c..fc389dc 100644
--- a/bitcoin-splitter/src/split/intermediate_state.rs
+++ b/bitcoin-splitter/src/split/intermediate_state.rs
@@ -85,6 +85,11 @@ impl IntermediateState {
     pub fn size(&self) -> usize {
         self.stack.len() + self.altstack.len()
     }
+
+    /// Converts the stack to a vector of u32 values
+    pub fn interpret_as_u32_array(&self) -> Vec<u8> {
+        self.stack.clone().serialize_to_bytes()
+    }
 }
 
 impl IntermediateStateAsBytes {

From 3791c02d402deb4a2b87a51fd07090b1ffacfb84 Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 9 Oct 2024 20:40:02 +0300
Subject: [PATCH 09/28] :tada: it works

---
 bitcoin-scriptexec/src/data_structures.rs       |  2 ++
 bitcoin-scriptexec/src/lib.rs                   | 17 +++++++++++------
 bitcoin-scriptexec/src/main.rs                  |  5 +++--
 bitcoin-splitter/Cargo.toml                     |  2 +-
 bitcoin-splitter/src/split/core.rs              |  2 +-
 .../src/split/intermediate_state.rs             |  7 +------
 bitcoin-splitter/src/split/script.rs            |  5 +++++
 .../src/test_scripts/int_mul_windowed.rs        | 15 ++++++---------
 bitcoin-splitter/src/test_scripts/sha256.rs     |  5 ++++-
 9 files changed, 34 insertions(+), 26 deletions(-)

diff --git a/bitcoin-scriptexec/src/data_structures.rs b/bitcoin-scriptexec/src/data_structures.rs
index 5a95807..1fc299e 100644
--- a/bitcoin-scriptexec/src/data_structures.rs
+++ b/bitcoin-scriptexec/src/data_structures.rs
@@ -19,6 +19,8 @@ impl StackEntry {
                     num <= u32::MAX.into(),
                     "There should not be entries with more than 32 bits on the stack at this point"
                 );
+                // Since num is for sure <= u32::MAX, we can safely convert it to u32
+                let num = num as u32;
                 num.to_le_bytes().to_vec()
             }
             StackEntry::StrRef(v) => {
diff --git a/bitcoin-scriptexec/src/lib.rs b/bitcoin-scriptexec/src/lib.rs
index e778361..84a4a8f 100644
--- a/bitcoin-scriptexec/src/lib.rs
+++ b/bitcoin-scriptexec/src/lib.rs
@@ -488,12 +488,14 @@ impl Exec {
                 // Some things we do even when we're not executing.
 
                 // Note how OP_RESERVED does not count towards the opcode limit.
-                if (self.ctx == ExecCtx::Legacy || self.ctx == ExecCtx::SegwitV0) && op.to_u8() > OP_PUSHNUM_16.to_u8() {
-                        self.opcode_count += 1;
-                        if self.opcode_count > MAX_OPS_PER_SCRIPT {
-                            return self.fail(ExecError::OpCount);
-                        }
+                if (self.ctx == ExecCtx::Legacy || self.ctx == ExecCtx::SegwitV0)
+                    && op.to_u8() > OP_PUSHNUM_16.to_u8()
+                {
+                    self.opcode_count += 1;
+                    if self.opcode_count > MAX_OPS_PER_SCRIPT {
+                        return self.fail(ExecError::OpCount);
                     }
+                }
 
                 match op {
                     OP_CAT if !self.opt.experimental.op_cat || self.ctx != ExecCtx::Tapscript => {
@@ -607,7 +609,10 @@ impl Exec {
                         }
                     }
                     // Under segwit v0 only enabled as policy.
-                    if self.opt.verify_minimal_if && self.ctx == ExecCtx::SegwitV0 && (top.len() > 1 || (top.len() == 1 && top[0] != 1)) {
+                    if self.opt.verify_minimal_if
+                        && self.ctx == ExecCtx::SegwitV0
+                        && (top.len() > 1 || (top.len() == 1 && top[0] != 1))
+                    {
                         return Err(ExecError::TapscriptMinimalIf);
                     }
                     let b = if op == OP_NOTIF {
diff --git a/bitcoin-scriptexec/src/main.rs b/bitcoin-scriptexec/src/main.rs
index 6a6d54b..c5b3f0f 100644
--- a/bitcoin-scriptexec/src/main.rs
+++ b/bitcoin-scriptexec/src/main.rs
@@ -81,7 +81,8 @@ fn inner_main() -> Result<(), String> {
                     stats: Some(exec.stats()),
                 };
                 serde_json::to_writer(&out, &step).expect("I/O error");
-                out.write_all('\n'.to_string().as_bytes()).expect("I/O error");
+                out.write_all('\n'.to_string().as_bytes())
+                    .expect("I/O error");
             } else {
                 println!(
                     "Remaining script: {}",
@@ -119,7 +120,7 @@ fn inner_main() -> Result<(), String> {
         println!("Stats:\n{:#?}", exec.stats());
         println!("Time elapsed: {}ms", start.elapsed().as_millis());
     }
-	
+
     Ok(())
 }
 
diff --git a/bitcoin-splitter/Cargo.toml b/bitcoin-splitter/Cargo.toml
index ece6ddb..cd9d46e 100644
--- a/bitcoin-splitter/Cargo.toml
+++ b/bitcoin-splitter/Cargo.toml
@@ -7,7 +7,7 @@ edition = "2021"
 # Bitcoin Libraries
 bitcoin              = { workspace = true, features = ["rand-std"]}
 bitcoin-script       = { git = "https://github.com/BitVM/rust-bitcoin-script" }
-bitcoin-scriptexec   = { git = "https://github.com/BitVM/rust-bitcoin-scriptexec/"}
+bitcoin-scriptexec   = { path = "../bitcoin-scriptexec" }
 bitcoin-script-stack = { git = "https://github.com/FairgateLabs/rust-bitcoin-script-stack"}
 
 # BitVM scripts
diff --git a/bitcoin-splitter/src/split/core.rs b/bitcoin-splitter/src/split/core.rs
index f364c39..fe7178d 100644
--- a/bitcoin-splitter/src/split/core.rs
+++ b/bitcoin-splitter/src/split/core.rs
@@ -1,6 +1,6 @@
 //! Module containing the logic of splitting the script into smaller parts
 
-use std::{panic, usize};
+use std::panic;
 
 use bitcoin::{
     opcodes::all::{OP_ENDIF, OP_IF, OP_NOTIF},
diff --git a/bitcoin-splitter/src/split/intermediate_state.rs b/bitcoin-splitter/src/split/intermediate_state.rs
index fc389dc..cf2b81e 100644
--- a/bitcoin-splitter/src/split/intermediate_state.rs
+++ b/bitcoin-splitter/src/split/intermediate_state.rs
@@ -127,12 +127,7 @@ impl IntermediateStateAsBytes {
 pub(super) fn bytes_to_u32_array(bytes: &[u8]) -> Vec<u32> {
     let mut u32_array = Vec::with_capacity((bytes.len() + 3) / 4); // Ceiling division to account for partial chunks.
 
-    for (i, chunk) in bytes.chunks(4).enumerate() {
-        // if i % 2 == 1 {
-        //     // Skip every second chunk, as it represents the altstack
-        //     continue;
-        // }
-
+    for chunk in bytes.chunks(4) {
         // Handle chunks with fewer than 4 bytes
         let padded_chunk = match chunk.len() {
             4 => [chunk[0], chunk[1], chunk[2], chunk[3]],
diff --git a/bitcoin-splitter/src/split/script.rs b/bitcoin-splitter/src/split/script.rs
index fc3c332..f58ca10 100644
--- a/bitcoin-splitter/src/split/script.rs
+++ b/bitcoin-splitter/src/split/script.rs
@@ -59,6 +59,11 @@ impl SplitResult {
         self.intermediate_states.len()
     }
 
+    /// Returns whether the split result is empty
+    pub fn is_empty(&self) -> bool {
+        self.intermediate_states.is_empty()
+    }
+
     /// Returns the last intermediate state, ignoring the possibility of the empty vector
     pub fn must_last_state(&self) -> &IntermediateState {
         self.intermediate_states
diff --git a/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
index efb8bb4..0c7f350 100644
--- a/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
+++ b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
@@ -200,16 +200,13 @@ mod tests {
             // while the second input is the output of the previous shard
             let mut first_input = input.clone();
             if i > 0 {
-                first_input = split_result.intermediate_states[i - 1].to_bytes().inject_script();
+                first_input = split_result.intermediate_states[i - 1]
+                    .to_bytes()
+                    .inject_script();
             }
-
-            let second_input = split_result.intermediate_states[i].to_bytes().inject_script();
-
-            println!("Expected: {:?}", split_result.intermediate_states[i].inject_script().len());
-            println!("Actual: {:?}", second_input.to_asm_string().len());
-
-            println!("Expected: {:?}", split_result.intermediate_states[i].inject_script());
-            println!("Actual: {:?}", second_input.to_asm_string());
+            let second_input = split_result.intermediate_states[i]
+                .to_bytes()
+                .inject_script();
 
             // Forming the function
             let function = split_result.shards[i].clone();
diff --git a/bitcoin-splitter/src/test_scripts/sha256.rs b/bitcoin-splitter/src/test_scripts/sha256.rs
index e3f964f..9e47417 100644
--- a/bitcoin-splitter/src/test_scripts/sha256.rs
+++ b/bitcoin-splitter/src/test_scripts/sha256.rs
@@ -55,7 +55,10 @@ mod tests {
     #[test]
     fn test_sha256_verify() {
         const TEST_BYTES_NUM: usize = 80;
-        assert!(SHA256Script::<TEST_BYTES_NUM>::verify_random(), "Random verification failed");
+        assert!(
+            SHA256Script::<TEST_BYTES_NUM>::verify_random(),
+            "Random verification failed"
+        );
     }
 
     #[test]

From 515ca3dbeb664c50516df04500d7cce9c8a004d4 Mon Sep 17 00:00:00 2001
From: Kyrylo Baibula <64193423+Velnbur@users.noreply.github.com>
Date: Wed, 9 Oct 2024 20:09:07 +0300
Subject: [PATCH 10/28] :twisted_rightwards_arrows: Merge `bitcoin-scriptexec`
 from `BitVM` (#10)

Since `bitcoin-scriptexec` contains certain logic that has to be changed
for our needs, we fork it and add to our repository.
---
 bitcoin-scriptexec/src/main.rs | 1 -
 1 file changed, 1 deletion(-)

diff --git a/bitcoin-scriptexec/src/main.rs b/bitcoin-scriptexec/src/main.rs
index c5b3f0f..4df5657 100644
--- a/bitcoin-scriptexec/src/main.rs
+++ b/bitcoin-scriptexec/src/main.rs
@@ -120,7 +120,6 @@ fn inner_main() -> Result<(), String> {
         println!("Stats:\n{:#?}", exec.stats());
         println!("Time elapsed: {}ms", start.elapsed().as_millis());
     }
-
     Ok(())
 }
 

From 3ef1e1afea8ef40280839cf567c9503f37bfd2ee Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Wed, 9 Oct 2024 20:25:08 +0300
Subject: [PATCH 11/28] Implement basic winternitz

---
 Cargo.toml                    |  10 +-
 bitcoin-winternitz/Cargo.toml |  18 +++
 bitcoin-winternitz/src/lib.rs | 214 ++++++++++++++++++++++++++++++++++
 3 files changed, 239 insertions(+), 3 deletions(-)
 create mode 100644 bitcoin-winternitz/Cargo.toml
 create mode 100644 bitcoin-winternitz/src/lib.rs

diff --git a/Cargo.toml b/Cargo.toml
index e34665c..3bd742a 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -1,13 +1,17 @@
 [workspace]
-members = ["bitcoin-splitter", "integration-tests", "bitcoin-scriptexec"]
+members = [
+	"bitcoin-splitter",
+	"integration-tests",
+	"bitcoin-winternitz",
+	"bitcoin-scriptexec"
+]
 resolver = "2"
 
 [workspace.dependencies]
-bitcoin = { git = "https://github.com/rust-bitcoin/rust-bitcoin", branch = "bitvm" }
+bitcoin = { git = "https://github.com/rust-bitcoin/rust-bitcoin", branch = "bitvm", features = ["rand-std"]}
 tracing = "0.1.40"
 tracing-subscriber = "0.3.18"
 
-
 [profile.dev]
 opt-level = 3
 
diff --git a/bitcoin-winternitz/Cargo.toml b/bitcoin-winternitz/Cargo.toml
new file mode 100644
index 0000000..c9d9829
--- /dev/null
+++ b/bitcoin-winternitz/Cargo.toml
@@ -0,0 +1,18 @@
+[package]
+name = "bitcoin-winternitz"
+version = "0.1.0"
+edition = "2021"
+
+[dependencies]
+bitcoin.workspace = true
+bitvec = { version = "1.0.1", default-features = false }
+rand = { version = "0.8.5", default-features = false, optional = true, features = ["min_const_gen"] }
+
+[features]
+default = ["rand"]
+rand = ["dep:rand"]
+
+[dev-dependencies]
+quickcheck = "1.0.3"
+quickcheck_macros = "1.0.0"
+rand = { version = "0.8.5", default-features = false, features = ["min_const_gen", "small_rng"] }
diff --git a/bitcoin-winternitz/src/lib.rs b/bitcoin-winternitz/src/lib.rs
new file mode 100644
index 0000000..d65e2d2
--- /dev/null
+++ b/bitcoin-winternitz/src/lib.rs
@@ -0,0 +1,214 @@
+use bitvec::{order::Lsb0, slice::BitSlice};
+use std::vec::Vec;
+
+/// Secret key is array of $N$ chunks by $D$ bits, where the whole number
+/// of bits is equal to $v$.
+#[derive(Clone, Debug)]
+pub struct SecretKey<const N: usize>(Vec<[u8; N]>);
+
+impl<const N: usize> SecretKey<N> {
+    pub fn new(chunks: Vec<[u8; N]>) -> Self {
+        Self(chunks)
+    }
+
+    #[cfg(feature = "rand")]
+    pub fn from_seed<Seed, Rng>(seed: Seed, chunks_num: usize) -> Self
+    where
+        Seed: Sized + Default + AsMut<[u8]>,
+        Rng: rand::SeedableRng<Seed = Seed> + rand::Rng,
+    {
+        let mut rng = Rng::from_seed(seed);
+
+        let mut chunks = Vec::new();
+
+        for _ in 0..chunks_num {
+            chunks.push(rng.sample(rand::distributions::Standard));
+        }
+
+        Self(chunks)
+    }
+
+    pub fn public_key<Hash>(&self) -> PublicKey<N>
+    where
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N]>,
+    {
+        PublicKey(
+            self.0
+                .iter()
+                .map(|chunk| {
+                    let mut chunk = *chunk;
+                    for _ in 0..D {
+                        chunk =
+                            <Hash as bitcoin::hashes::Hash>::hash(chunk.as_slice()).to_byte_array();
+                    }
+                    chunk
+                })
+                .collect::<Vec<_>>(),
+        )
+    }
+
+    pub fn sign<Hash>(&self, msg: &Message) -> Signature<N>
+    where
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N]>,
+    {
+        let hash_offsets = msg.to_offsets();
+
+        let hashes = self
+            .0
+            .iter()
+            .zip(hash_offsets)
+            .map(|(chunk, times)| {
+                let mut chunk = *chunk;
+                for _ in 0..times {
+                    chunk = <Hash as bitcoin::hashes::Hash>::hash(chunk.as_slice()).to_byte_array();
+                }
+                chunk
+            })
+            .collect::<Vec<_>>();
+
+        Signature(hashes)
+    }
+}
+
+/// Public key is hashed $D$ times each of the $N$ chunks of the
+/// [`SecretKey`].
+#[derive(Clone, Debug)]
+pub struct PublicKey<const N: usize>(Vec<[u8; N]>);
+
+impl<const N: usize> PublicKey<N> {
+    pub fn verify<Hash>(&self, msg: &Message, sig: &Signature<N>) -> bool
+    where
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N]>,
+    {
+        let offsets = msg.to_offsets();
+
+        for ((pubkey_chunk, offset), sig_chunk) in
+            self.0.iter().zip(offsets.into_iter()).zip(sig.0.iter())
+        {
+            let mut sig_chunk = *sig_chunk;
+            for _ in 0..(D - offset) {
+                sig_chunk =
+                    <Hash as bitcoin::hashes::Hash>::hash(sig_chunk.as_slice()).to_byte_array();
+            }
+
+            if *pubkey_chunk != sig_chunk {
+                return false;
+            }
+        }
+
+        true
+    }
+}
+
+pub const D: usize = 3;
+pub const BASE: usize = (D + 1).ilog2() as usize;
+
+/// Representation of $I_d^n$ - the vector of length $n$ with bit
+/// arrays of lentg $d$.
+///
+/// # Inner representation
+///
+/// Inner representation for now is `Vec<u8>`, which means, that each
+/// "digit" is 8 bits max.
+#[derive(Clone, Debug)]
+pub struct Message(Vec<u8>);
+
+impl Message {
+    pub fn from_bytes(msg: &[u8]) -> Self {
+        let mut result = Vec::with_capacity(msg.len() * 8 / D);
+        let bits = BitSlice::<_, Lsb0>::from_slice(msg);
+
+        // TODO: this is very unoptimized, so I would consider
+        // reimplementing it in future.
+        for chunk in bits.chunks(BASE) {
+            let mut bitbuf = 0u8;
+            for (idx, bit) in chunk.iter().enumerate() {
+                bitbuf |= (*bit.as_ref() as u8) << idx;
+            }
+            result.push(bitbuf);
+        }
+
+        Self(result)
+    }
+
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+
+    pub fn to_offsets(&self) -> Vec<usize> {
+        self.0.iter().map(|chunk| *chunk as usize).collect()
+    }
+}
+
+#[derive(Clone, Debug)]
+pub struct Signature<const N: usize>(Vec<[u8; N]>);
+
+#[cfg(test)]
+mod tests {
+
+    #[cfg(feature = "rand")]
+    mod with_rand {
+        use quickcheck::{Arbitrary, Gen};
+        use quickcheck_macros::quickcheck;
+
+        use super::super::*;
+
+        use bitcoin::hashes::hash160::Hash as Hash160;
+        use bitcoin::hashes::ripemd160::Hash as Ripemd160;
+        use bitcoin::hashes::Hash;
+
+        use rand::rngs::SmallRng;
+
+        #[test]
+        fn test_with_rand_public_key_with_ripemd_160() {
+            const N: usize = Ripemd160::LEN;
+            const MESSAGE: &[u8] = b"Hello, world!";
+
+            let message = Message::from_bytes(MESSAGE);
+
+            let n = message.len();
+
+            let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32], n);
+            let public_key: PublicKey<N> = secret_key.public_key::<Ripemd160>();
+
+            let signature = secret_key.sign::<Ripemd160>(&message);
+
+            assert!(public_key.verify::<Ripemd160>(&message, &signature));
+        }
+
+        #[derive(Clone, Debug)]
+        struct TestInput {
+            seed: [u8; 32],
+            msg: String,
+        }
+
+        impl Arbitrary for TestInput {
+            fn arbitrary(g: &mut Gen) -> Self {
+                TestInput {
+                    seed: [(); 32].map(|_| u8::arbitrary(g)),
+                    msg: String::arbitrary(g),
+                }
+            }
+        }
+
+        #[quickcheck]
+        fn any_msg_with_any_seed_works(TestInput { seed, msg }: TestInput) -> bool {
+            const N: usize = Hash160::LEN;
+
+            let message = Message::from_bytes(msg.as_bytes());
+
+            let n = message.len();
+
+            let secret_key = SecretKey::from_seed::<_, SmallRng>(seed, n);
+            let public_key: PublicKey<N> = secret_key.public_key::<Hash160>();
+
+            let signature = secret_key.sign::<Hash160>(&message);
+
+            public_key.verify::<Hash160>(&message, &signature)
+        }
+    }
+}

From 957f331b15d14569fd1964fbabcb9593b8e3688b Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Mon, 30 Sep 2024 11:45:16 +0300
Subject: [PATCH 12/28] Add checksum calculations

---
 bitcoin-winternitz/src/lib.rs | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/bitcoin-winternitz/src/lib.rs b/bitcoin-winternitz/src/lib.rs
index d65e2d2..6623fba 100644
--- a/bitcoin-winternitz/src/lib.rs
+++ b/bitcoin-winternitz/src/lib.rs
@@ -115,12 +115,37 @@ pub struct Message(Vec<u8>);
 
 impl Message {
     pub fn from_bytes(msg: &[u8]) -> Self {
+        if msg.is_empty() {
+            return Self(Vec::new());
+        }
+
         let mut result = Vec::with_capacity(msg.len() * 8 / D);
         let bits = BitSlice::<_, Lsb0>::from_slice(msg);
 
+        let v = msg.len();
+        // the same as v/log_2(D+1) with rounding to positive infinity.
+        let n0 = v.div_ceil(BASE);
+
+        // TODO: this is very unoptimized, so I would consider
+        // reimplementing it in future.
+        for chunk in bits.chunks(BASE).take(n0) {
+            let mut bitbuf = 0u8;
+            for (idx, bit) in chunk.iter().enumerate() {
+                bitbuf |= (*bit.as_ref() as u8) << idx;
+            }
+            result.push(bitbuf);
+        }
+
+        let n1 = ((D * n0).ilog(D + 1) + 1) as usize;
+        // debug_assert_eq!(n0 + n1, v, "n0: {n0}, n1: {n1}, v: {v}");
+
+        let checksum = ((D * n0) as u128) - result.iter().map(|v| *v as u128).sum::<u128>();
+
+        let checksum_bytes = checksum.to_be_bytes();
+        let bits = BitSlice::<_, Lsb0>::from_slice(&checksum_bytes);
         // TODO: this is very unoptimized, so I would consider
         // reimplementing it in future.
-        for chunk in bits.chunks(BASE) {
+        for chunk in bits.chunks(BASE).take(n1) {
             let mut bitbuf = 0u8;
             for (idx, bit) in chunk.iter().enumerate() {
                 bitbuf |= (*bit.as_ref() as u8) << idx;

From 6556c3931e0e3eb59929ea4010b858e0fafeb7d2 Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Mon, 30 Sep 2024 12:38:32 +0300
Subject: [PATCH 13/28] Optimize memory allocations using lazy iterators

---
 bitcoin-winternitz/src/lib.rs | 92 +++++++++++++++++++----------------
 1 file changed, 51 insertions(+), 41 deletions(-)

diff --git a/bitcoin-winternitz/src/lib.rs b/bitcoin-winternitz/src/lib.rs
index 6623fba..fa09b1e 100644
--- a/bitcoin-winternitz/src/lib.rs
+++ b/bitcoin-winternitz/src/lib.rs
@@ -1,3 +1,4 @@
+use bitcoin::hashes::HashEngine;
 use bitvec::{order::Lsb0, slice::BitSlice};
 use std::vec::Vec;
 
@@ -28,23 +29,20 @@ impl<const N: usize> SecretKey<N> {
         Self(chunks)
     }
 
-    pub fn public_key<Hash>(&self) -> PublicKey<N>
+    pub fn public_key<Hash, Eng>(&self) -> PublicKey<N>
     where
-        Hash: bitcoin::hashes::Hash<Bytes = [u8; N]>,
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
+        Eng: HashEngine<MidState = [u8; N]>,
     {
-        PublicKey(
-            self.0
-                .iter()
-                .map(|chunk| {
-                    let mut chunk = *chunk;
-                    for _ in 0..D {
-                        chunk =
-                            <Hash as bitcoin::hashes::Hash>::hash(chunk.as_slice()).to_byte_array();
-                    }
-                    chunk
-                })
-                .collect::<Vec<_>>(),
-        )
+        let hash_chunks = self.0.iter().map(|chunk| {
+            let mut chunk = *chunk;
+            for _ in 0..D {
+                chunk = <Hash as bitcoin::hashes::Hash>::hash(chunk.as_slice()).to_byte_array();
+            }
+            chunk
+        });
+
+        PublicKey::from_hashes::<Hash, _>(hash_chunks)
     }
 
     pub fn sign<Hash>(&self, msg: &Message) -> Signature<N>
@@ -72,31 +70,45 @@ impl<const N: usize> SecretKey<N> {
 
 /// Public key is hashed $D$ times each of the $N$ chunks of the
 /// [`SecretKey`].
-#[derive(Clone, Debug)]
-pub struct PublicKey<const N: usize>(Vec<[u8; N]>);
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct PublicKey<const N: usize>([u8; N]);
 
 impl<const N: usize> PublicKey<N> {
-    pub fn verify<Hash>(&self, msg: &Message, sig: &Signature<N>) -> bool
+    pub fn from_hashes<Hash, Eng>(chunks: impl Iterator<Item = [u8; N]>) -> Self
     where
-        Hash: bitcoin::hashes::Hash<Bytes = [u8; N]>,
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
+        Eng: HashEngine<MidState = [u8; N]>,
     {
-        let offsets = msg.to_offsets();
-
-        for ((pubkey_chunk, offset), sig_chunk) in
-            self.0.iter().zip(offsets.into_iter()).zip(sig.0.iter())
-        {
-            let mut sig_chunk = *sig_chunk;
-            for _ in 0..(D - offset) {
-                sig_chunk =
-                    <Hash as bitcoin::hashes::Hash>::hash(sig_chunk.as_slice()).to_byte_array();
-            }
+        let mut hasher = Hash::engine();
 
-            if *pubkey_chunk != sig_chunk {
-                return false;
-            }
+        for chunk in chunks {
+            hasher.input(&chunk);
         }
 
-        true
+        Self(hasher.midstate())
+    }
+
+    pub fn verify<Hash, Eng>(&self, msg: &Message, sig: &Signature<N>) -> bool
+    where
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
+        Eng: HashEngine<MidState = [u8; N]>,
+    {
+        let offsets = msg.to_offsets();
+
+        // or $\hat{y}$
+        let pubkey_chunks = offsets
+            .into_iter()
+            .zip(sig.0.iter())
+            .map(|(offset, sig_chunk)| {
+                let mut sig_chunk = *sig_chunk;
+                for _ in 0..(D - offset) {
+                    sig_chunk =
+                        <Hash as bitcoin::hashes::Hash>::hash(sig_chunk.as_slice()).to_byte_array();
+                }
+                sig_chunk
+            });
+
+        *self == (Self::from_hashes::<Hash, Eng>(pubkey_chunks))
     }
 }
 
@@ -137,7 +149,6 @@ impl Message {
         }
 
         let n1 = ((D * n0).ilog(D + 1) + 1) as usize;
-        // debug_assert_eq!(n0 + n1, v, "n0: {n0}, n1: {n1}, v: {v}");
 
         let checksum = ((D * n0) as u128) - result.iter().map(|v| *v as u128).sum::<u128>();
 
@@ -182,7 +193,6 @@ mod tests {
 
         use super::super::*;
 
-        use bitcoin::hashes::hash160::Hash as Hash160;
         use bitcoin::hashes::ripemd160::Hash as Ripemd160;
         use bitcoin::hashes::Hash;
 
@@ -198,11 +208,11 @@ mod tests {
             let n = message.len();
 
             let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32], n);
-            let public_key: PublicKey<N> = secret_key.public_key::<Ripemd160>();
+            let public_key: PublicKey<N> = secret_key.public_key::<Ripemd160, _>();
 
             let signature = secret_key.sign::<Ripemd160>(&message);
 
-            assert!(public_key.verify::<Ripemd160>(&message, &signature));
+            assert!(public_key.verify::<Ripemd160, _>(&message, &signature));
         }
 
         #[derive(Clone, Debug)]
@@ -222,18 +232,18 @@ mod tests {
 
         #[quickcheck]
         fn any_msg_with_any_seed_works(TestInput { seed, msg }: TestInput) -> bool {
-            const N: usize = Hash160::LEN;
+            const N: usize = Ripemd160::LEN;
 
             let message = Message::from_bytes(msg.as_bytes());
 
             let n = message.len();
 
             let secret_key = SecretKey::from_seed::<_, SmallRng>(seed, n);
-            let public_key: PublicKey<N> = secret_key.public_key::<Hash160>();
+            let public_key: PublicKey<N> = secret_key.public_key::<Ripemd160, _>();
 
-            let signature = secret_key.sign::<Hash160>(&message);
+            let signature = secret_key.sign::<Ripemd160>(&message);
 
-            public_key.verify::<Hash160>(&message, &signature)
+            public_key.verify::<Ripemd160, _>(&message, &signature)
         }
     }
 }

From be69602c27ddd7df59db45800a743ddb39007e75 Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Mon, 30 Sep 2024 12:51:18 +0300
Subject: [PATCH 14/28] Add comments

---
 bitcoin-winternitz/src/lib.rs | 53 ++++++++++++++++++++---------------
 1 file changed, 30 insertions(+), 23 deletions(-)

diff --git a/bitcoin-winternitz/src/lib.rs b/bitcoin-winternitz/src/lib.rs
index fa09b1e..a23a5d3 100644
--- a/bitcoin-winternitz/src/lib.rs
+++ b/bitcoin-winternitz/src/lib.rs
@@ -8,11 +8,14 @@ use std::vec::Vec;
 pub struct SecretKey<const N: usize>(Vec<[u8; N]>);
 
 impl<const N: usize> SecretKey<N> {
+    /// Construct new [`SecretKey`] from given secret parts.
     pub fn new(chunks: Vec<[u8; N]>) -> Self {
         Self(chunks)
     }
 
     #[cfg(feature = "rand")]
+    /// Construct new [`SecretKey`] from seed, by generating required
+    /// number of parts (chunks).
     pub fn from_seed<Seed, Rng>(seed: Seed, chunks_num: usize) -> Self
     where
         Seed: Sized + Default + AsMut<[u8]>,
@@ -29,6 +32,7 @@ impl<const N: usize> SecretKey<N> {
         Self(chunks)
     }
 
+    /// Return public key derived from secret one.
     pub fn public_key<Hash, Eng>(&self) -> PublicKey<N>
     where
         Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
@@ -45,19 +49,18 @@ impl<const N: usize> SecretKey<N> {
         PublicKey::from_hashes::<Hash, _>(hash_chunks)
     }
 
+    /// Generate [`Signature`] from [`Message`].
     pub fn sign<Hash>(&self, msg: &Message) -> Signature<N>
     where
         Hash: bitcoin::hashes::Hash<Bytes = [u8; N]>,
     {
-        let hash_offsets = msg.to_offsets();
-
         let hashes = self
             .0
             .iter()
-            .zip(hash_offsets)
-            .map(|(chunk, times)| {
+            .zip(msg.0.iter())
+            .map(|(chunk, hash_times)| {
                 let mut chunk = *chunk;
-                for _ in 0..times {
+                for _ in 0..*hash_times {
                     chunk = <Hash as bitcoin::hashes::Hash>::hash(chunk.as_slice()).to_byte_array();
                 }
                 chunk
@@ -74,6 +77,8 @@ impl<const N: usize> SecretKey<N> {
 pub struct PublicKey<const N: usize>([u8; N]);
 
 impl<const N: usize> PublicKey<N> {
+    /// Construct [`PublicKey`] from iterator of hashes, by concatinating
+    /// and hashing all sub-hashes.
     pub fn from_hashes<Hash, Eng>(chunks: impl Iterator<Item = [u8; N]>) -> Self
     where
         Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
@@ -88,35 +93,36 @@ impl<const N: usize> PublicKey<N> {
         Self(hasher.midstate())
     }
 
+    /// Verify signature for given message.    
     pub fn verify<Hash, Eng>(&self, msg: &Message, sig: &Signature<N>) -> bool
     where
         Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
         Eng: HashEngine<MidState = [u8; N]>,
     {
-        let offsets = msg.to_offsets();
-
         // or $\hat{y}$
-        let pubkey_chunks = offsets
-            .into_iter()
-            .zip(sig.0.iter())
-            .map(|(offset, sig_chunk)| {
-                let mut sig_chunk = *sig_chunk;
-                for _ in 0..(D - offset) {
-                    sig_chunk =
-                        <Hash as bitcoin::hashes::Hash>::hash(sig_chunk.as_slice()).to_byte_array();
-                }
-                sig_chunk
-            });
+        let pubkey_chunks = msg.0.iter().zip(sig.0.iter()).map(|(offset, sig_chunk)| {
+            let mut sig_chunk = *sig_chunk;
+            for _ in 0..(D - *offset as usize) {
+                sig_chunk =
+                    <Hash as bitcoin::hashes::Hash>::hash(sig_chunk.as_slice()).to_byte_array();
+            }
+            sig_chunk
+        });
 
         *self == (Self::from_hashes::<Hash, Eng>(pubkey_chunks))
     }
 }
 
+/// Fixed value of $d$ specified in original doc.
+///
+/// This value is used to set [`BASE`] of digits the algorithm splits
+/// message by.
 pub const D: usize = 3;
+
 pub const BASE: usize = (D + 1).ilog2() as usize;
 
 /// Representation of $I_d^n$ - the vector of length $n$ with bit
-/// arrays of lentg $d$.
+/// arrays of length $d$.
 ///
 /// # Inner representation
 ///
@@ -126,6 +132,10 @@ pub const BASE: usize = (D + 1).ilog2() as usize;
 pub struct Message(Vec<u8>);
 
 impl Message {
+    /// Construct the $I_d^n$ repsentation of `msg`.
+    ///
+    /// Due to the winternitz paper, message here is splitted into `n0` and
+    /// `n1` `d+1`-base digits.
     pub fn from_bytes(msg: &[u8]) -> Self {
         if msg.is_empty() {
             return Self(Vec::new());
@@ -174,12 +184,9 @@ impl Message {
     pub fn is_empty(&self) -> bool {
         self.len() == 0
     }
-
-    pub fn to_offsets(&self) -> Vec<usize> {
-        self.0.iter().map(|chunk| *chunk as usize).collect()
-    }
 }
 
+/// Winternitz signature. The array of intermidiate hashes of secret key.
 #[derive(Clone, Debug)]
 pub struct Signature<const N: usize>(Vec<[u8; N]>);
 

From 5c214a520f7cc5885aae42f3b3bba6fd94d946c7 Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Mon, 30 Sep 2024 18:31:45 +0300
Subject: [PATCH 15/28] Return Chunked pubkey

---
 bitcoin-winternitz/src/lib.rs | 108 +++++++++++++++++++++++++++++-----
 1 file changed, 92 insertions(+), 16 deletions(-)

diff --git a/bitcoin-winternitz/src/lib.rs b/bitcoin-winternitz/src/lib.rs
index a23a5d3..de251fe 100644
--- a/bitcoin-winternitz/src/lib.rs
+++ b/bitcoin-winternitz/src/lib.rs
@@ -2,6 +2,16 @@ use bitcoin::hashes::HashEngine;
 use bitvec::{order::Lsb0, slice::BitSlice};
 use std::vec::Vec;
 
+use bitvm2_splitter::treepp::*;
+
+/// Fixed value of $d$ specified in original doc.
+///
+/// This value is used to set [`BASE`] of digits the algorithm splits
+/// message by.
+pub const D: usize = 3;
+
+pub const BASE: usize = (D + 1).ilog2() as usize;
+
 /// Secret key is array of $N$ chunks by $D$ bits, where the whole number
 /// of bits is equal to $v$.
 #[derive(Clone, Debug)]
@@ -38,15 +48,33 @@ impl<const N: usize> SecretKey<N> {
         Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
         Eng: HashEngine<MidState = [u8; N]>,
     {
-        let hash_chunks = self.0.iter().map(|chunk| {
+        let hash_chunks = self.hashed_d_times_chunks::<Hash>();
+
+        PublicKey::from_hashes::<Hash, Eng>(hash_chunks)
+    }
+
+    /// Return chunked public key derived from secret one.
+    pub fn chunked_public_key<Hash, Eng>(&self) -> ChunkedPublicKey<N>
+    where
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
+        Eng: HashEngine<MidState = [u8; N]>,
+    {
+        let hash_chunks = self.hashed_d_times_chunks::<Hash>().into_iter().collect();
+
+        ChunkedPublicKey::new(hash_chunks)
+    }
+
+    fn hashed_d_times_chunks<Hash>(&self) -> impl IntoIterator<Item = [u8; N]> + '_
+    where
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N]>,
+    {
+        self.0.iter().map(|chunk| {
             let mut chunk = *chunk;
             for _ in 0..D {
                 chunk = <Hash as bitcoin::hashes::Hash>::hash(chunk.as_slice()).to_byte_array();
             }
             chunk
-        });
-
-        PublicKey::from_hashes::<Hash, _>(hash_chunks)
+        })
     }
 
     /// Generate [`Signature`] from [`Message`].
@@ -71,15 +99,55 @@ impl<const N: usize> SecretKey<N> {
     }
 }
 
-/// Public key is hashed $D$ times each of the $N$ chunks of the
+/// Public key is a hashed $D$ times each of the $n$ parts of the
 /// [`SecretKey`].
 #[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
+pub struct ChunkedPublicKey<const N: usize>(Vec<[u8; N]>);
+
+impl<const N: usize> ChunkedPublicKey<N> {
+    pub fn new(chunks: Vec<[u8; N]>) -> Self {
+        Self(chunks)
+    }
+
+    /// Construct [`PublicKey`] from [`ChunkedPublicKey`]
+    pub fn into_public_key<Hash, Eng>(self) -> PublicKey<N>
+    where
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
+        Eng: HashEngine<MidState = [u8; N]>,
+    {
+        PublicKey::from_hashes::<Hash, Eng>(self.0)
+    }
+
+    /// Verify signature for given message.    
+    pub fn verify<Hash, Eng>(&self, msg: &Message, sig: &Signature<N>) -> bool
+    where
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
+        Eng: HashEngine<MidState = [u8; N]>,
+    {
+        for ((offset, sig_chunk), pubkey_chunk) in msg.0.iter().zip(sig.0.iter()).zip(self.0.iter())
+        {
+            let mut sig_chunk = *sig_chunk;
+            for _ in 0..(D - *offset as usize) {
+                sig_chunk =
+                    <Hash as bitcoin::hashes::Hash>::hash(sig_chunk.as_slice()).to_byte_array();
+            }
+            if sig_chunk != *pubkey_chunk {
+                return false;
+            }
+        }
+
+        true
+    }
+}
+
+/// The hash of concatenated chunks of [`ChunkedPublicKey`]
+#[derive(Clone, Debug, PartialEq, Eq, PartialOrd, Ord)]
 pub struct PublicKey<const N: usize>([u8; N]);
 
 impl<const N: usize> PublicKey<N> {
     /// Construct [`PublicKey`] from iterator of hashes, by concatinating
     /// and hashing all sub-hashes.
-    pub fn from_hashes<Hash, Eng>(chunks: impl Iterator<Item = [u8; N]>) -> Self
+    pub fn from_hashes<Hash, Eng>(chunks: impl IntoIterator<Item = [u8; N]>) -> Self
     where
         Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
         Eng: HashEngine<MidState = [u8; N]>,
@@ -113,14 +181,6 @@ impl<const N: usize> PublicKey<N> {
     }
 }
 
-/// Fixed value of $d$ specified in original doc.
-///
-/// This value is used to set [`BASE`] of digits the algorithm splits
-/// message by.
-pub const D: usize = 3;
-
-pub const BASE: usize = (D + 1).ilog2() as usize;
-
 /// Representation of $I_d^n$ - the vector of length $n$ with bit
 /// arrays of length $d$.
 ///
@@ -206,7 +266,7 @@ mod tests {
         use rand::rngs::SmallRng;
 
         #[test]
-        fn test_with_rand_public_key_with_ripemd_160() {
+        fn test_public_key_with_ripemd_160() {
             const N: usize = Ripemd160::LEN;
             const MESSAGE: &[u8] = b"Hello, world!";
 
@@ -238,7 +298,7 @@ mod tests {
         }
 
         #[quickcheck]
-        fn any_msg_with_any_seed_works(TestInput { seed, msg }: TestInput) -> bool {
+        fn test_any_msg_with_any_seed_works(TestInput { seed, msg }: TestInput) -> bool {
             const N: usize = Ripemd160::LEN;
 
             let message = Message::from_bytes(msg.as_bytes());
@@ -252,5 +312,21 @@ mod tests {
 
             public_key.verify::<Ripemd160, _>(&message, &signature)
         }
+
+        #[quickcheck]
+        fn test_chunked_any_msg_with_any_seed_works(TestInput { seed, msg }: TestInput) -> bool {
+            const N: usize = Ripemd160::LEN;
+
+            let message = Message::from_bytes(msg.as_bytes());
+
+            let n = message.len();
+
+            let secret_key = SecretKey::from_seed::<_, SmallRng>(seed, n);
+            let public_key: ChunkedPublicKey<N> = secret_key.chunked_public_key::<Ripemd160, _>();
+
+            let signature = secret_key.sign::<Ripemd160>(&message);
+
+            public_key.verify::<Ripemd160, _>(&message, &signature)
+        }
     }
 }

From 04a1996acae944a412b03b2422b2077dec00778b Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Mon, 30 Sep 2024 18:35:35 +0300
Subject: [PATCH 16/28] Push initial version of Winternitz verification script

---
 bitcoin-winternitz/Cargo.toml |  1 +
 bitcoin-winternitz/src/lib.rs | 87 +++++++++++++++++++++++++++++++++++
 2 files changed, 88 insertions(+)

diff --git a/bitcoin-winternitz/Cargo.toml b/bitcoin-winternitz/Cargo.toml
index c9d9829..aee8ee2 100644
--- a/bitcoin-winternitz/Cargo.toml
+++ b/bitcoin-winternitz/Cargo.toml
@@ -7,6 +7,7 @@ edition = "2021"
 bitcoin.workspace = true
 bitvec = { version = "1.0.1", default-features = false }
 rand = { version = "0.8.5", default-features = false, optional = true, features = ["min_const_gen"] }
+bitvm2-splitter.path = "../splitter"
 
 [features]
 default = ["rand"]
diff --git a/bitcoin-winternitz/src/lib.rs b/bitcoin-winternitz/src/lib.rs
index de251fe..5c20180 100644
--- a/bitcoin-winternitz/src/lib.rs
+++ b/bitcoin-winternitz/src/lib.rs
@@ -250,6 +250,93 @@ impl Message {
 #[derive(Clone, Debug)]
 pub struct Signature<const N: usize>(Vec<[u8; N]>);
 
+pub fn checksig_verify_script<const N: usize>(
+    public_key: &ChunkedPublicKey<N>,
+    n: usize,
+    n0: usize,
+    n1: usize,
+) -> Script {
+    script! {
+        //
+        // Verify the hash chain for each digit
+        //
+
+        // Repeat this for every of the n many digits
+        for digit_index in 0..n {
+            // Verify that the digit is in the range [0, d]
+            // See https://github.com/BitVM/BitVM/issues/35
+            { D }
+            OP_MIN
+
+            // Push two copies of the digit onto the altstack
+            OP_DUP
+            OP_TOALTSTACK
+            OP_TOALTSTACK
+
+            // Hash the input hash d times and put every result on the stack
+            for _ in 0..D {
+                OP_DUP OP_HASH160
+            }
+
+            // Verify the signature for this digit
+            OP_FROMALTSTACK
+            OP_PICK
+            { public_key.0[n - 1 - digit_index].to_vec() }
+            OP_EQUALVERIFY
+
+            // Drop the d+1 stack items
+            for _ in 0..(D+1)/2 {
+                OP_2DROP
+            }
+        }
+
+        //
+        // Verify the Checksum
+        //
+
+        // 1. Compute the checksum of the message's digits
+        OP_FROMALTSTACK OP_DUP OP_NEGATE
+        for _ in 1..n0 {
+            OP_FROMALTSTACK OP_TUCK OP_SUB
+        }
+        { D * n0 }
+        OP_ADD
+
+
+        // 2. Sum up the signed checksum's digits
+        OP_FROMALTSTACK
+        for _ in 0..n1 - 1 {
+            for _ in 0..BASE {
+                OP_DUP OP_ADD
+            }
+            OP_FROMALTSTACK
+            OP_ADD
+        }
+
+        // 3. Ensure both checksums are equal
+        OP_EQUALVERIFY
+
+
+        // Convert the message's digits to bytes
+        for i in 0..n0 / 2 {
+            OP_SWAP
+            for _ in 0..BASE {
+                OP_DUP OP_ADD
+            }
+            OP_ADD
+            // Push all bytes to the altstack, except for the last byte
+            if i != (n0/2) - 1 {
+                OP_TOALTSTACK
+            }
+        }
+        // Read the bytes from the altstack
+        for _ in 0..n0 / 2 - 1{
+            OP_FROMALTSTACK
+        }
+
+    }
+}
+
 #[cfg(test)]
 mod tests {
 

From 5b75b45760cdbacad366b95cd898f233c650f21f Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Thu, 3 Oct 2024 11:06:21 +0300
Subject: [PATCH 17/28] Store n0 and n1 value to message's parts

---
 bitcoin-winternitz/src/lib.rs | 61 +++++++++++++++++++++++------------
 1 file changed, 40 insertions(+), 21 deletions(-)

diff --git a/bitcoin-winternitz/src/lib.rs b/bitcoin-winternitz/src/lib.rs
index 5c20180..01b1e4b 100644
--- a/bitcoin-winternitz/src/lib.rs
+++ b/bitcoin-winternitz/src/lib.rs
@@ -85,7 +85,7 @@ impl<const N: usize> SecretKey<N> {
         let hashes = self
             .0
             .iter()
-            .zip(msg.0.iter())
+            .zip(msg.parts.iter())
             .map(|(chunk, hash_times)| {
                 let mut chunk = *chunk;
                 for _ in 0..*hash_times {
@@ -124,7 +124,8 @@ impl<const N: usize> ChunkedPublicKey<N> {
         Hash: bitcoin::hashes::Hash<Bytes = [u8; N], Engine = Eng>,
         Eng: HashEngine<MidState = [u8; N]>,
     {
-        for ((offset, sig_chunk), pubkey_chunk) in msg.0.iter().zip(sig.0.iter()).zip(self.0.iter())
+        for ((offset, sig_chunk), pubkey_chunk) in
+            msg.parts.iter().zip(sig.0.iter()).zip(self.0.iter())
         {
             let mut sig_chunk = *sig_chunk;
             for _ in 0..(D - *offset as usize) {
@@ -168,14 +169,18 @@ impl<const N: usize> PublicKey<N> {
         Eng: HashEngine<MidState = [u8; N]>,
     {
         // or $\hat{y}$
-        let pubkey_chunks = msg.0.iter().zip(sig.0.iter()).map(|(offset, sig_chunk)| {
-            let mut sig_chunk = *sig_chunk;
-            for _ in 0..(D - *offset as usize) {
-                sig_chunk =
-                    <Hash as bitcoin::hashes::Hash>::hash(sig_chunk.as_slice()).to_byte_array();
-            }
-            sig_chunk
-        });
+        let pubkey_chunks = msg
+            .parts
+            .iter()
+            .zip(sig.0.iter())
+            .map(|(offset, sig_chunk)| {
+                let mut sig_chunk = *sig_chunk;
+                for _ in 0..(D - *offset as usize) {
+                    sig_chunk =
+                        <Hash as bitcoin::hashes::Hash>::hash(sig_chunk.as_slice()).to_byte_array();
+                }
+                sig_chunk
+            });
 
         *self == (Self::from_hashes::<Hash, Eng>(pubkey_chunks))
     }
@@ -188,8 +193,12 @@ impl<const N: usize> PublicKey<N> {
 ///
 /// Inner representation for now is `Vec<u8>`, which means, that each
 /// "digit" is 8 bits max.
-#[derive(Clone, Debug)]
-pub struct Message(Vec<u8>);
+#[derive(Clone, Debug, Default)]
+pub struct Message {
+    parts: Vec<u8>,
+    n0: usize,
+    n1: usize,
+}
 
 impl Message {
     /// Construct the $I_d^n$ repsentation of `msg`.
@@ -198,10 +207,10 @@ impl Message {
     /// `n1` `d+1`-base digits.
     pub fn from_bytes(msg: &[u8]) -> Self {
         if msg.is_empty() {
-            return Self(Vec::new());
+            return Self::default();
         }
 
-        let mut result = Vec::with_capacity(msg.len() * 8 / D);
+        let mut parts = Vec::with_capacity(msg.len() * 8 / D);
         let bits = BitSlice::<_, Lsb0>::from_slice(msg);
 
         let v = msg.len();
@@ -215,12 +224,12 @@ impl Message {
             for (idx, bit) in chunk.iter().enumerate() {
                 bitbuf |= (*bit.as_ref() as u8) << idx;
             }
-            result.push(bitbuf);
+            parts.push(bitbuf);
         }
 
         let n1 = ((D * n0).ilog(D + 1) + 1) as usize;
 
-        let checksum = ((D * n0) as u128) - result.iter().map(|v| *v as u128).sum::<u128>();
+        let checksum = ((D * n0) as u128) - parts.iter().map(|v| *v as u128).sum::<u128>();
 
         let checksum_bytes = checksum.to_be_bytes();
         let bits = BitSlice::<_, Lsb0>::from_slice(&checksum_bytes);
@@ -231,14 +240,24 @@ impl Message {
             for (idx, bit) in chunk.iter().enumerate() {
                 bitbuf |= (*bit.as_ref() as u8) << idx;
             }
-            result.push(bitbuf);
+            parts.push(bitbuf);
         }
 
-        Self(result)
+        Self { parts, n0, n1 }
+    }
+
+    #[inline]
+    pub const fn n0(&self) -> usize {
+        self.n0
+    }
+
+    #[inline]
+    pub const fn n1(&self) -> usize {
+        self.n1
     }
 
     pub fn len(&self) -> usize {
-        self.0.len()
+        self.parts.len()
     }
 
     pub fn is_empty(&self) -> bool {
@@ -252,10 +271,10 @@ pub struct Signature<const N: usize>(Vec<[u8; N]>);
 
 pub fn checksig_verify_script<const N: usize>(
     public_key: &ChunkedPublicKey<N>,
-    n: usize,
     n0: usize,
     n1: usize,
 ) -> Script {
+    let n = n0 + n1;
     script! {
         //
         // Verify the hash chain for each digit
@@ -275,7 +294,7 @@ pub fn checksig_verify_script<const N: usize>(
 
             // Hash the input hash d times and put every result on the stack
             for _ in 0..D {
-                OP_DUP OP_HASH160
+                OP_DUP OP_RIPEMD160
             }
 
             // Verify the signature for this digit

From c048bca5649196da0b6b64f8734595e2cfa05891 Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Mon, 7 Oct 2024 18:48:22 +0300
Subject: [PATCH 18/28] Add u32 implementation of winternitz

---
 bitcoin-splitter/src/debug.rs |  11 +
 bitcoin-winternitz/Cargo.toml |   4 +-
 bitcoin-winternitz/src/lib.rs | 204 +++++++++++++--
 bitcoin-winternitz/src/u32.rs | 469 ++++++++++++++++++++++++++++++++++
 4 files changed, 665 insertions(+), 23 deletions(-)
 create mode 100644 bitcoin-winternitz/src/u32.rs

diff --git a/bitcoin-splitter/src/debug.rs b/bitcoin-splitter/src/debug.rs
index 4178891..a25b4e7 100644
--- a/bitcoin-splitter/src/debug.rs
+++ b/bitcoin-splitter/src/debug.rs
@@ -27,6 +27,17 @@ impl fmt::Display for ExecuteInfo {
         }
 
         writeln!(f, "Stats: {:?}", self.stats)?;
+
+        writeln!(f, "Stack:")?;
+        for element in self.main_stack.iter_str() {
+            writeln!(f, "> {}", hex::encode(element))?;
+        }
+
+        writeln!(f, "\nAltStack:")?;
+        for element in self.alt_stack.iter_str() {
+            writeln!(f, "> {}", hex::encode(element))?;
+        }
+
         Ok(())
     }
 }
diff --git a/bitcoin-winternitz/Cargo.toml b/bitcoin-winternitz/Cargo.toml
index aee8ee2..95e1d7d 100644
--- a/bitcoin-winternitz/Cargo.toml
+++ b/bitcoin-winternitz/Cargo.toml
@@ -5,9 +5,9 @@ edition = "2021"
 
 [dependencies]
 bitcoin.workspace = true
-bitvec = { version = "1.0.1", default-features = false }
+bitvec = { version = "1.0.1", default-features = false, features = ["alloc"] }
 rand = { version = "0.8.5", default-features = false, optional = true, features = ["min_const_gen"] }
-bitvm2-splitter.path = "../splitter"
+bitcoin-splitter.path = "../bitcoin-splitter"
 
 [features]
 default = ["rand"]
diff --git a/bitcoin-winternitz/src/lib.rs b/bitcoin-winternitz/src/lib.rs
index 01b1e4b..2a4d4a5 100644
--- a/bitcoin-winternitz/src/lib.rs
+++ b/bitcoin-winternitz/src/lib.rs
@@ -1,16 +1,25 @@
 use bitcoin::hashes::HashEngine;
-use bitvec::{order::Lsb0, slice::BitSlice};
+use bitvec::{order::Lsb0, slice::BitSlice, vec::BitVec};
 use std::vec::Vec;
 
-use bitvm2_splitter::treepp::*;
+use bitcoin_splitter::treepp::*;
+
+pub mod u32;
 
 /// Fixed value of $d$ specified in original doc.
 ///
 /// This value is used to set [`BASE`] of digits the algorithm splits
 /// message by.
-pub const D: usize = 3;
+pub const D: usize = 15;
+
+pub const BITS_PER_DIGIT: usize = (D + 1).ilog2() as usize;
 
-pub const BASE: usize = (D + 1).ilog2() as usize;
+/// Check that BITS_PER_DIGIT is not bigger than 8 bits
+const _: () = {
+    if BITS_PER_DIGIT > 8 {
+        panic!("Current implement of message partition requires to have at max 8 bits per digit");
+    }
+};
 
 /// Secret key is array of $N$ chunks by $D$ bits, where the whole number
 /// of bits is equal to $v$.
@@ -97,6 +106,27 @@ impl<const N: usize> SecretKey<N> {
 
         Signature(hashes)
     }
+
+    /// Generate [`Signature`] from [`Message`].
+    pub fn sign_extended<Hash>(&self, msg: &Message) -> ExtendedSignature<N>
+    where
+        Hash: bitcoin::hashes::Hash<Bytes = [u8; N]>,
+    {
+        let hashes = self
+            .0
+            .iter()
+            .zip(msg.parts.iter())
+            .map(|(chunk, hash_times)| {
+                let mut chunk = *chunk;
+                for _ in 0..*hash_times {
+                    chunk = <Hash as bitcoin::hashes::Hash>::hash(chunk.as_slice()).to_byte_array();
+                }
+                (*hash_times, chunk)
+            })
+            .collect::<Vec<_>>();
+
+        ExtendedSignature(hashes)
+    }
 }
 
 /// Public key is a hashed $D$ times each of the $n$ parts of the
@@ -213,13 +243,13 @@ impl Message {
         let mut parts = Vec::with_capacity(msg.len() * 8 / D);
         let bits = BitSlice::<_, Lsb0>::from_slice(msg);
 
-        let v = msg.len();
+        let v = msg.len() * 8;
         // the same as v/log_2(D+1) with rounding to positive infinity.
-        let n0 = v.div_ceil(BASE);
+        let n0 = v.div_ceil(BITS_PER_DIGIT);
 
         // TODO: this is very unoptimized, so I would consider
         // reimplementing it in future.
-        for chunk in bits.chunks(BASE).take(n0) {
+        for chunk in bits.chunks(BITS_PER_DIGIT).take(n0) {
             let mut bitbuf = 0u8;
             for (idx, bit) in chunk.iter().enumerate() {
                 bitbuf |= (*bit.as_ref() as u8) << idx;
@@ -231,11 +261,11 @@ impl Message {
 
         let checksum = ((D * n0) as u128) - parts.iter().map(|v| *v as u128).sum::<u128>();
 
-        let checksum_bytes = checksum.to_be_bytes();
+        let checksum_bytes = checksum.to_le_bytes();
         let bits = BitSlice::<_, Lsb0>::from_slice(&checksum_bytes);
         // TODO: this is very unoptimized, so I would consider
         // reimplementing it in future.
-        for chunk in bits.chunks(BASE).take(n1) {
+        for chunk in bits.chunks(BITS_PER_DIGIT).take(n1) {
             let mut bitbuf = 0u8;
             for (idx, bit) in chunk.iter().enumerate() {
                 bitbuf |= (*bit.as_ref() as u8) << idx;
@@ -246,6 +276,20 @@ impl Message {
         Self { parts, n0, n1 }
     }
 
+    pub fn recover_message(&self) -> Vec<u8> {
+        let mut bitvec = BitVec::<_, Lsb0>::with_capacity(self.n0 * BITS_PER_DIGIT);
+
+        for part in self.parts.iter().take(self.n0) {
+            let part_bytes = part.to_le_bytes();
+            let part_bits = BitSlice::<u8, Lsb0>::from_slice(&part_bytes);
+
+            // We only need first `BITS_PER_DIGIT` bits of representation.
+            bitvec.extend_from_bitslice(&part_bits[..BITS_PER_DIGIT]);
+        }
+
+        bitvec.into_vec()
+    }
+
     #[inline]
     pub const fn n0(&self) -> usize {
         self.n0
@@ -269,6 +313,64 @@ impl Message {
 #[derive(Clone, Debug)]
 pub struct Signature<const N: usize>(Vec<[u8; N]>);
 
+impl<const N: usize> Signature<N> {
+    pub fn len(&self) -> usize {
+        self.0.len()
+    }
+
+    pub fn is_empty(&self) -> bool {
+        self.len() == 0
+    }
+}
+
+/// Winternitz signature. The array of pair of the number of hashes $s_i$,
+/// and hashed $s_i$ times secret key.
+#[derive(Clone, Debug)]
+pub struct ExtendedSignature<const N: usize>(Vec<(u8, [u8; N])>);
+
+impl<const N: usize> ExtendedSignature<N> {
+    /// Returns [`ExtendedSignature`] from message and signature.
+    pub fn from_msg_and_sig(msg: &Message, sig: &Signature<N>) -> Option<Self> {
+        if msg.len() != sig.len() {
+            return None;
+        }
+
+        Some(Self(
+            msg.parts
+                .iter()
+                .copied()
+                .zip(sig.0.iter().copied())
+                .collect(),
+        ))
+    }
+
+    /// Creates bitcoin script with pushed to stack pairs of signature and and
+    /// number of times it was hashed.
+    pub fn to_script_sig(&self) -> Script {
+        script! {
+            for (times, sig) in &self.0 {
+                { sig.to_vec() }
+                { *times }
+            }
+        }
+    }
+
+    /// Convert signature back to message for recovery.
+    pub fn msg_recover(&self, n0: usize, n1: usize) -> Message {
+        Message {
+            parts: self.0.iter().map(|(times, _)| *times).collect(),
+            n0,
+            n1,
+        }
+    }
+}
+
+impl<const N: usize> From<ExtendedSignature<N>> for Signature<N> {
+    fn from(value: ExtendedSignature<N>) -> Self {
+        Self(value.0.iter().map(|(_, part)| *part).collect())
+    }
+}
+
 pub fn checksig_verify_script<const N: usize>(
     public_key: &ChunkedPublicKey<N>,
     n0: usize,
@@ -325,7 +427,7 @@ pub fn checksig_verify_script<const N: usize>(
         // 2. Sum up the signed checksum's digits
         OP_FROMALTSTACK
         for _ in 0..n1 - 1 {
-            for _ in 0..BASE {
+            for _ in 0..BITS_PER_DIGIT {
                 OP_DUP OP_ADD
             }
             OP_FROMALTSTACK
@@ -339,7 +441,7 @@ pub fn checksig_verify_script<const N: usize>(
         // Convert the message's digits to bytes
         for i in 0..n0 / 2 {
             OP_SWAP
-            for _ in 0..BASE {
+            for _ in 0..BITS_PER_DIGIT {
                 OP_DUP OP_ADD
             }
             OP_ADD
@@ -352,7 +454,6 @@ pub fn checksig_verify_script<const N: usize>(
         for _ in 0..n0 / 2 - 1{
             OP_FROMALTSTACK
         }
-
     }
 }
 
@@ -367,13 +468,11 @@ mod tests {
         use super::super::*;
 
         use bitcoin::hashes::ripemd160::Hash as Ripemd160;
-        use bitcoin::hashes::Hash;
 
         use rand::rngs::SmallRng;
 
         #[test]
         fn test_public_key_with_ripemd_160() {
-            const N: usize = Ripemd160::LEN;
             const MESSAGE: &[u8] = b"Hello, world!";
 
             let message = Message::from_bytes(MESSAGE);
@@ -381,13 +480,80 @@ mod tests {
             let n = message.len();
 
             let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32], n);
-            let public_key: PublicKey<N> = secret_key.public_key::<Ripemd160, _>();
+            let public_key = secret_key.public_key::<Ripemd160, _>();
 
             let signature = secret_key.sign::<Ripemd160>(&message);
 
             assert!(public_key.verify::<Ripemd160, _>(&message, &signature));
         }
 
+        #[test]
+        fn test_check_bitvm_example_script_works() {
+            const MESSAGE: [u8; 40] = [
+                1, 2, 3, 4, 5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7, 1, 2, 3, 4,
+                5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7,
+            ];
+
+            let message = Message::from_bytes(&MESSAGE);
+
+            let n = message.len();
+
+            let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32], n);
+            let public_key = secret_key.chunked_public_key::<Ripemd160, _>();
+
+            let signature = secret_key.sign_extended::<Ripemd160>(&message);
+
+            let script = script! {
+                { signature.to_script_sig() }
+                { checksig_verify_script(&public_key, message.n0(), message.n1()) }
+            };
+
+            let result = execute_script(script);
+
+            println!("{}", result);
+
+            assert!(result.success);
+        }
+
+        #[test]
+        fn test_check_u32_signign_works() {
+            const MESSAGE: u32 = 123123123;
+
+            let message = Message::from_bytes(&MESSAGE.to_le_bytes());
+
+            let n = message.len();
+
+            let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32], n);
+            let public_key = secret_key.chunked_public_key::<Ripemd160, _>();
+
+            let signature = secret_key.sign_extended::<Ripemd160>(&message);
+
+            let script = script! {
+                { signature.to_script_sig() }
+                { checksig_verify_script(&public_key, message.n0(), message.n1()) }
+            };
+
+            let result = execute_script(script);
+
+            println!("{}", result);
+
+            assert!(result.success);
+        }
+
+        #[test]
+        fn test_message_recovery_is_the_same_as_msg() {
+            const MESSAGE: &[u8] = b"Hello, world!";
+
+            let msg = Message::from_bytes(MESSAGE);
+
+            assert_eq!(
+                MESSAGE,
+                msg.recover_message(),
+                "message partition = {:?}",
+                msg
+            );
+        }
+
         #[derive(Clone, Debug)]
         struct TestInput {
             seed: [u8; 32],
@@ -405,14 +571,12 @@ mod tests {
 
         #[quickcheck]
         fn test_any_msg_with_any_seed_works(TestInput { seed, msg }: TestInput) -> bool {
-            const N: usize = Ripemd160::LEN;
-
             let message = Message::from_bytes(msg.as_bytes());
 
             let n = message.len();
 
             let secret_key = SecretKey::from_seed::<_, SmallRng>(seed, n);
-            let public_key: PublicKey<N> = secret_key.public_key::<Ripemd160, _>();
+            let public_key = secret_key.public_key::<Ripemd160, _>();
 
             let signature = secret_key.sign::<Ripemd160>(&message);
 
@@ -421,14 +585,12 @@ mod tests {
 
         #[quickcheck]
         fn test_chunked_any_msg_with_any_seed_works(TestInput { seed, msg }: TestInput) -> bool {
-            const N: usize = Ripemd160::LEN;
-
             let message = Message::from_bytes(msg.as_bytes());
 
             let n = message.len();
 
             let secret_key = SecretKey::from_seed::<_, SmallRng>(seed, n);
-            let public_key: ChunkedPublicKey<N> = secret_key.chunked_public_key::<Ripemd160, _>();
+            let public_key = secret_key.chunked_public_key::<Ripemd160, _>();
 
             let signature = secret_key.sign::<Ripemd160>(&message);
 
diff --git a/bitcoin-winternitz/src/u32.rs b/bitcoin-winternitz/src/u32.rs
new file mode 100644
index 0000000..9973774
--- /dev/null
+++ b/bitcoin-winternitz/src/u32.rs
@@ -0,0 +1,469 @@
+//! Special Winternitz implementation for u32 message.
+
+use bitcoin_splitter::treepp::*;
+
+use bitcoin::hashes::hash160::Hash as Hash160;
+use bitcoin::hashes::Hash;
+
+/// Fixed value of $d$ specified in original doc.
+///
+/// This value is used to set [`BASE`] of digits the algorithm splits
+/// message by.
+pub const D: usize = 15;
+
+pub const BITS_PER_DIGIT: usize = (D + 1).ilog2() as usize;
+
+/// Number of bits in the message.
+pub const V: usize = 31;
+
+/// The number of partitions without checksum
+pub const N0: usize = V.div_ceil(BITS_PER_DIGIT);
+
+/// The number of partinitions of checksum
+pub const N1: usize = ((D * N0).ilog(D + 1) + 1) as usize;
+
+/// The total number of partitions.
+pub const N: usize = N0 + N1;
+
+/// Secret key is array of $N$ chunks by $D$ bits, where the whole number
+/// of bits is equal to $v$.
+#[derive(Clone, Debug, Copy)]
+pub struct SecretKey([Hash160; N]);
+
+impl SecretKey {
+    /// Construct new [`SecretKey`] from given secret parts.
+    pub const fn new(chunks: [Hash160; N]) -> Self {
+        Self(chunks)
+    }
+
+    #[cfg(feature = "rand")]
+    /// Construct new [`SecretKey`] from seed, by generating required
+    /// number of parts (chunks).
+    pub fn from_seed<Seed, Rng>(seed: Seed) -> Self
+    where
+        Seed: Sized + Default + AsMut<[u8]>,
+        Rng: rand::SeedableRng<Seed = Seed> + rand::Rng,
+    {
+        let mut buf = [Hash160::all_zeros(); N];
+        let mut rng = Rng::from_seed(seed);
+
+        for chunk in &mut buf {
+            *chunk = Hash160::from_byte_array(rng.sample(rand::distributions::Standard));
+        }
+
+        Self(buf)
+    }
+
+    /// Return public key derived from secret one.
+    pub fn public_key(&self) -> PublicKey {
+        let mut buf = self.0;
+
+        for element in &mut buf {
+            for _ in 0..D {
+                *element = Hash160::hash(element.to_byte_array().as_slice());
+            }
+        }
+
+        PublicKey(buf)
+    }
+
+    /// Generate [`Signature`] from [`Message`].
+    pub fn sign(&self, msg: &Message) -> Signature {
+        let mut buf = [(0u8, Hash160::all_zeros()); N];
+
+        for (idx, (hash, times)) in self.0.iter().zip(msg.0.iter()).enumerate() {
+            let mut hash = *hash;
+            let times = *times;
+            for _ in 0..times {
+                hash = Hash160::hash(hash.to_byte_array().as_slice());
+            }
+            buf[idx] = (times, hash);
+        }
+
+        Signature(buf)
+    }
+}
+
+/// Public key is a hashed $D$ times each of the $n$ parts of the
+/// [`SecretKey`].
+#[derive(Clone, Copy, Debug)]
+pub struct PublicKey([Hash160; N]);
+
+impl PublicKey {
+    /// Verify signature for given message.    
+    pub fn verify(&self, msg: &Message, sig: &Signature) -> bool {
+        for ((pubkey, times), (_, sig)) in self.0.iter().zip(msg.0.iter()).zip(sig.0.iter()) {
+            let mut hash = *sig;
+
+            for _ in 0..(D - *times as usize) {
+                hash = Hash160::hash(hash.to_byte_array().as_slice());
+            }
+
+            if hash != *pubkey {
+                return false;
+            }
+        }
+
+        true
+    }
+}
+
+#[derive(Clone, Copy, Debug, Default)]
+pub struct Message([u8; N]);
+
+impl Message {
+    /// Returns message partition for u32.
+    ///
+    /// Under the hood uses bit masked to retrieve 4 bit parts from u32
+    /// message.
+    pub const fn from_u32(mut msg: u32) -> Self {
+        debug_assert!(msg < (1 << V));
+        const MASK: u32 = 0x0000000F;
+
+        let mut buf = [0u8; N];
+
+        // retrieve message partition
+        let mut i = 0;
+        let mut sum = 0u8;
+        while i < N0 {
+            let masked = msg & MASK;
+            buf[i] = masked as u8;
+
+            msg >>= 4;
+            sum += buf[i];
+            i += 1;
+        }
+
+        // calculate checksum and fill the next `buf` elements with
+        // first and last 4 bits of it.
+        let checksum = ((D * N0) as u8) - sum;
+        buf[i] = checksum & 0x0F;
+        buf[i + 1] = checksum >> 4;
+
+        Self(buf)
+    }
+
+    /// Recover the message it was created from.
+    pub const fn into_u32(self) -> u32 {
+        let mut result = 0u32;
+        let mut i = 0;
+
+        while i < N0 {
+            result |= (self.0[i] as u32) << (4 * i);
+            i += 1;
+        }
+
+        result
+    }
+
+    /// Returns Bitcoin script which recovers the message from 4 bit parts
+    /// placed on the stack, assuming that checksum was already
+    /// excluded. Also, assuming that the least significant 4-bit part is at
+    /// the top of the stack.
+    ///
+    /// # Algorithm
+    ///
+    /// Assuming that D=15, and `u32` is splitted into eight 4-bit parts named
+    /// $p$, to recover the message $m$, depending on the part position $i$,
+    /// the recovering is simply:
+    ///
+    /// \[
+    /// m = \sum_{i=0}^{8} p * 2^{4 * i}
+    /// \]
+    ///
+    /// As the upper bound for sum is fixed, the $2^{4 * i}$ are constants,
+    /// and as Bitcoin lacks the `OP_MUL` opcode, we can instead make `OP_DUP`
+    /// `OP_ADD` $4i$ times for each part and then sum the results.
+    pub fn recovery_script() -> Script {
+        script! {
+            for i in 0..N0 {
+                for _ in 0..(4 * i) {
+                    OP_DUP
+                    OP_ADD
+                }
+                // TODO(Velnbur): the last `OP_TOALTSTACK` is redundant, as
+                // we getting it back in the next opcode, so later we can
+                // optimize it.
+                OP_TOALTSTACK
+            }
+            OP_FROMALTSTACK
+            for _ in 0..N0-1 {
+                OP_FROMALTSTACK
+                OP_ADD
+            }
+        }
+    }
+}
+
+/// Winternitz signature. The array of intermidiate hashes of secret key.
+#[derive(Clone, Copy, Debug)]
+pub struct Signature([(u8, Hash160); N]);
+
+impl Signature {
+    /// Creates bitcoin script with pushed to stack pairs of signature and
+    /// number of times it was hashed.
+    pub fn to_script_sig(&self) -> Script {
+        script! {
+            for (times, sig) in self.0.iter().rev() {
+                // TODO(Velnbur): we can get rid of additional allocation
+                // here by implemention Pushable for all hash types from
+                // Bitcoin crate. Do that after bitcoin-execscript fork.
+                { sig.to_byte_array().to_vec() }
+                { *times }
+            }
+        }
+    }
+}
+
+pub fn checksig_verify_script(public_key: &PublicKey) -> Script {
+    script! {
+        //
+        // Verify the hash chain for each digit
+        //
+
+        // Repeat this for every of the n many digits
+        for digit_index in 0..N {
+            // Verify that the digit is in the range [0, d]
+            // See https://github.com/BitVM/BitVM/issues/35
+            { D }
+            OP_MIN
+
+            // Push two copies of the digit onto the altstack
+            OP_DUP
+            OP_TOALTSTACK
+            OP_TOALTSTACK
+
+            // Hash the input hash d times and put every result on the stack
+            for _ in 0..D {
+                OP_DUP OP_HASH160
+            }
+
+            // Verify the signature for this digit
+            OP_FROMALTSTACK
+            OP_PICK
+            { public_key.0[digit_index].as_byte_array().to_vec() }
+            OP_EQUALVERIFY
+
+            // Drop the d+1 stack items
+            for _ in 0..(D+1)/2 {
+                OP_2DROP
+            }
+        }
+
+        //
+        // Verify the Checksum
+        //
+
+        // 1. Sum up the signed checksum's digits
+        OP_FROMALTSTACK
+        for _ in 0..N1 - 1 {
+            for _ in 0..BITS_PER_DIGIT {
+                OP_DUP OP_ADD
+            }
+            OP_FROMALTSTACK
+            OP_ADD
+        }
+
+        // 2. Compute the checksum of the message's digits
+        OP_FROMALTSTACK OP_DUP OP_NEGATE
+        for _ in 1..N0 {
+            OP_FROMALTSTACK OP_TUCK OP_SUB
+        }
+        { D * N0 }
+        OP_ADD
+
+        // Get result from step 1 by moving it to the top
+        // of the stack.
+        { N0 + 1 }
+        OP_ROLL
+
+        // 3. Ensure both checksums are equal
+        OP_EQUALVERIFY
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+    use quickcheck_macros::quickcheck;
+
+    #[test]
+    fn test_message_partition() {
+        const MSG: u32 = 0x02345678;
+        const EXPECTED: [u8; N] = [0x8, 0x7, 0x6, 0x5, 0x4, 0x3, 0x2, 0x0, 0x5, 0x5];
+
+        let got = Message::from_u32(MSG);
+
+        assert_eq!(EXPECTED, got.0);
+        assert_eq!(MSG, got.into_u32());
+    }
+
+    #[test]
+    fn test_message_recovery_script() {
+        let msg = Message::from_u32(0x2FEEDDCC);
+
+        let recovery_script = Message::recovery_script();
+
+        let script = script! {
+            for part in msg.0.iter().take(N0).rev() {
+                { *part }
+            }
+
+            { recovery_script }
+            0x2FEEDDCC
+            OP_EQUAL
+        };
+
+        let result = execute_script(script);
+
+        println!("{}", result);
+
+        assert!(result.success);
+    }
+
+    #[quickcheck]
+    fn test_message_recovery_script_any(msg_int: u32) -> bool {
+        let msg_int = msg_int >> 1;
+        let msg = Message::from_u32(msg_int);
+
+        let script = script! {
+            for part in msg.0.iter().take(N0).rev() {
+                { *part }
+            }
+
+            { Message::recovery_script() }
+            { msg_int }
+            OP_EQUAL
+        };
+
+        let result = execute_script(script);
+
+        result.success
+    }
+
+    #[quickcheck]
+    fn test_message_recovery_any(msg_int: u32) -> bool {
+        let msg_int = msg_int >> 1;
+        let msg = Message::from_u32(msg_int);
+
+        println!("{:?}", msg);
+
+        msg.into_u32() == msg_int
+    }
+
+    #[cfg(feature = "rand")]
+    mod with_rand {
+        use quickcheck::{Arbitrary, Gen};
+        use quickcheck_macros::quickcheck;
+
+        use super::super::*;
+
+        use rand::rngs::SmallRng;
+
+        #[test]
+        fn test_public_key_with_ripemd_160() {
+            const MESSAGE: u32 = 0xFFFFFFF;
+
+            let message = Message::from_u32(MESSAGE);
+
+            let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32]);
+            let public_key = secret_key.public_key();
+            let signature = secret_key.sign(&message);
+
+            assert!(public_key.verify(&message, &signature));
+        }
+
+        #[test]
+        fn test_signature_verification_in_script_works() {
+            const MSG: u32 = 0x2FEEDDCC;
+            let msg = Message::from_u32(MSG);
+
+            let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32]);
+            let public_key = secret_key.public_key();
+            let signature = secret_key.sign(&msg);
+
+            let checksig_script = checksig_verify_script(&public_key);
+            println!("ChecksigScript: {}", checksig_script.as_bytes().len());
+            let recovery_script = Message::recovery_script();
+            println!("RecoveryScript: {}", recovery_script.as_bytes().len());
+
+            let script_sig = signature.to_script_sig();
+            println!("ScriptSig: {}", script_sig.as_bytes().len());
+            let script_pubkey = script! {
+                { checksig_script }
+                { recovery_script }
+                { MSG }
+                OP_EQUAL
+            };
+
+            println!("ScriptPubkey: {}", script_pubkey.as_bytes().len());
+            let script = script! {
+                { script_sig }
+                { script_pubkey }
+            };
+            println!("Script: {}", script.as_bytes().len());
+            let result = execute_script(script);
+            println!("{}", result);
+
+            assert!(result.success);
+        }
+
+        #[derive(Clone, Debug)]
+        struct TestInput {
+            seed: [u8; 32],
+            msg: u32,
+        }
+
+        impl Arbitrary for TestInput {
+            fn arbitrary(g: &mut Gen) -> Self {
+                TestInput {
+                    seed: [(); 32].map(|_| u8::arbitrary(g)),
+                    msg: u32::arbitrary(g) >> 1,
+                }
+            }
+        }
+
+        #[quickcheck]
+        fn test_any_msg_with_any_seed_works(TestInput { seed, msg }: TestInput) -> bool {
+            let message = Message::from_u32(msg);
+
+            let secret_key = SecretKey::from_seed::<_, SmallRng>(seed);
+            let public_key = secret_key.public_key();
+
+            let signature = secret_key.sign(&message);
+
+            public_key.verify(&message, &signature)
+        }
+
+        #[quickcheck]
+        fn test_signature_verification_in_script_works_any(
+            TestInput { seed, msg }: TestInput,
+        ) -> bool {
+            let message = Message::from_u32(msg);
+
+            let secret_key = SecretKey::from_seed::<_, SmallRng>(seed);
+            let public_key = secret_key.public_key();
+            let signature = secret_key.sign(&message);
+
+            let checksig_script = checksig_verify_script(&public_key);
+            let recovery_script = Message::recovery_script();
+
+            let script_sig = signature.to_script_sig();
+            let script_pubkey = script! {
+                { checksig_script }
+                { recovery_script }
+                { msg }
+                OP_EQUAL
+            };
+
+            let script = script! {
+                { script_sig }
+                { script_pubkey }
+            };
+            let result = execute_script(script);
+            println!("{}", result);
+
+            result.success
+        }
+    }
+}

From 204a36a0fc4fe3ef3dbeb067126feb922ccbf69a Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Tue, 8 Oct 2024 09:12:24 +0300
Subject: [PATCH 19/28] Add comments

---
 bitcoin-winternitz/src/u32.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bitcoin-winternitz/src/u32.rs b/bitcoin-winternitz/src/u32.rs
index 9973774..08698c3 100644
--- a/bitcoin-winternitz/src/u32.rs
+++ b/bitcoin-winternitz/src/u32.rs
@@ -215,6 +215,8 @@ impl Signature {
     }
 }
 
+/// Returns the script which verifies the Winternitz signature (see
+/// [`Signature`]) from top of the stack.
 pub fn checksig_verify_script(public_key: &PublicKey) -> Script {
     script! {
         //

From 7dd6be2799db2b0660ceb6dc80b46065604c52e3 Mon Sep 17 00:00:00 2001
From: Velnbur <kyrylo.baybula@distributedlab.com>
Date: Tue, 8 Oct 2024 09:58:41 +0300
Subject: [PATCH 20/28] Fix tests and doc comments

---
 bitcoin-winternitz/src/lib.rs | 72 +++++++++++++++++------------------
 bitcoin-winternitz/src/u32.rs |  4 +-
 2 files changed, 38 insertions(+), 38 deletions(-)

diff --git a/bitcoin-winternitz/src/lib.rs b/bitcoin-winternitz/src/lib.rs
index 2a4d4a5..e578c0b 100644
--- a/bitcoin-winternitz/src/lib.rs
+++ b/bitcoin-winternitz/src/lib.rs
@@ -8,7 +8,7 @@ pub mod u32;
 
 /// Fixed value of $d$ specified in original doc.
 ///
-/// This value is used to set [`BASE`] of digits the algorithm splits
+/// This value is used to set [`BITS_PER_DIGIT`] of digits the algorithm splits
 /// message by.
 pub const D: usize = 15;
 
@@ -487,58 +487,58 @@ mod tests {
             assert!(public_key.verify::<Ripemd160, _>(&message, &signature));
         }
 
-        #[test]
-        fn test_check_bitvm_example_script_works() {
-            const MESSAGE: [u8; 40] = [
-                1, 2, 3, 4, 5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7, 1, 2, 3, 4,
-                5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7,
-            ];
+        // #[test]
+        // fn test_check_bitvm_example_script_works() {
+        //     const MESSAGE: [u8; 40] = [
+        //         1, 2, 3, 4, 5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7, 1, 2, 3, 4,
+        //         5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7,
+        //     ];
 
-            let message = Message::from_bytes(&MESSAGE);
+        //     let message = Message::from_bytes(&MESSAGE);
 
-            let n = message.len();
+        //     let n = message.len();
 
-            let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32], n);
-            let public_key = secret_key.chunked_public_key::<Ripemd160, _>();
+        //     let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32], n);
+        //     let public_key = secret_key.chunked_public_key::<Ripemd160, _>();
 
-            let signature = secret_key.sign_extended::<Ripemd160>(&message);
+        //     let signature = secret_key.sign_extended::<Ripemd160>(&message);
 
-            let script = script! {
-                { signature.to_script_sig() }
-                { checksig_verify_script(&public_key, message.n0(), message.n1()) }
-            };
+        //     let script = script! {
+        //         { signature.to_script_sig() }
+        //         { checksig_verify_script(&public_key, message.n0(), message.n1()) }
+        //     };
 
-            let result = execute_script(script);
+        //     let result = execute_script(script);
 
-            println!("{}", result);
+        //     println!("{}", result);
 
-            assert!(result.success);
-        }
+        //     assert!(result.success);
+        // }
 
-        #[test]
-        fn test_check_u32_signign_works() {
-            const MESSAGE: u32 = 123123123;
+        // #[test]
+        // fn test_check_u32_signign_works() {
+        //     const MESSAGE: u32 = 123123123;
 
-            let message = Message::from_bytes(&MESSAGE.to_le_bytes());
+        //     let message = Message::from_bytes(&MESSAGE.to_le_bytes());
 
-            let n = message.len();
+        //     let n = message.len();
 
-            let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32], n);
-            let public_key = secret_key.chunked_public_key::<Ripemd160, _>();
+        //     let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32], n);
+        //     let public_key = secret_key.chunked_public_key::<Ripemd160, _>();
 
-            let signature = secret_key.sign_extended::<Ripemd160>(&message);
+        //     let signature = secret_key.sign_extended::<Ripemd160>(&message);
 
-            let script = script! {
-                { signature.to_script_sig() }
-                { checksig_verify_script(&public_key, message.n0(), message.n1()) }
-            };
+        //     let script = script! {
+        //         { signature.to_script_sig() }
+        //         { checksig_verify_script(&public_key, message.n0(), message.n1()) }
+        //     };
 
-            let result = execute_script(script);
+        //     let result = execute_script(script);
 
-            println!("{}", result);
+        //     println!("{}", result);
 
-            assert!(result.success);
-        }
+        //     assert!(result.success);
+        // }
 
         #[test]
         fn test_message_recovery_is_the_same_as_msg() {
diff --git a/bitcoin-winternitz/src/u32.rs b/bitcoin-winternitz/src/u32.rs
index 08698c3..736c1f1 100644
--- a/bitcoin-winternitz/src/u32.rs
+++ b/bitcoin-winternitz/src/u32.rs
@@ -7,8 +7,8 @@ use bitcoin::hashes::Hash;
 
 /// Fixed value of $d$ specified in original doc.
 ///
-/// This value is used to set [`BASE`] of digits the algorithm splits
-/// message by.
+/// This value is used to set [`BITS_PER_DIGIT`] of digits the algorithm
+/// splits message by.
 pub const D: usize = 15;
 
 pub const BITS_PER_DIGIT: usize = (D + 1).ilog2() as usize;

From aebb7e6ce6917c92416f1d56ec228bd62879db13 Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Tue, 15 Oct 2024 01:37:11 +0300
Subject: [PATCH 21/28] :construction: wip, finalizing disprove script

---
 Cargo.toml                         |   3 +-
 core/Cargo.toml                    |  34 ++++-
 core/src/assert/disprove_script.rs | 101 ++++++++++-----
 core/src/assert/mod.rs             |  14 ++-
 core/src/assert/signing.rs         | 124 ++++++++++++++++++
 core/src/assert/tests.rs           |  29 +++++
 core/src/debug.rs                  | 195 +++++++++++++++++++++++++++++
 core/src/lib.rs                    |  11 ++
 core/src/winternitz.rs             |   8 +-
 9 files changed, 476 insertions(+), 43 deletions(-)
 create mode 100644 core/src/assert/signing.rs
 create mode 100644 core/src/assert/tests.rs
 create mode 100644 core/src/debug.rs

diff --git a/Cargo.toml b/Cargo.toml
index 3bd742a..7e8c5cb 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -3,7 +3,8 @@ members = [
 	"bitcoin-splitter",
 	"integration-tests",
 	"bitcoin-winternitz",
-	"bitcoin-scriptexec"
+	"bitcoin-scriptexec",
+    "core"
 ]
 resolver = "2"
 
diff --git a/core/Cargo.toml b/core/Cargo.toml
index e2bc10b..f32814e 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -1,8 +1,36 @@
 [package]
-name = "bitvm2-core"
+name    = "bitvm2-core"
 version = "0.1.0"
 edition = "2021"
 
 [dependencies]
-bitvm2-splitter.path = "../splitter"
-bitcoin.workspace = true
\ No newline at end of file
+# Bitcoin Libraries
+bitcoin              = { workspace = true, features = ["rand-std"]}
+bitcoin-script       = { git = "https://github.com/BitVM/rust-bitcoin-script" }
+bitcoin-scriptexec   = { path = "../bitcoin-scriptexec" }
+bitcoin-script-stack = { git = "https://github.com/FairgateLabs/rust-bitcoin-script-stack"}
+
+# BitVM scripts
+bitcoin-window-mul = { git = "https://github.com/distributed-lab/bitcoin-window-mul.git" }
+bitcoin-winternitz = { path = "../bitcoin-winternitz" }
+bitcoin-splitter = { path = "../bitcoin-splitter" }
+
+# General-purpose libraries
+strum          = "0.26"
+strum_macros   = "0.26"
+serde          = { version = "1.0.197", features = ["derive"] }
+serde_json     = "1.0.116"
+tokio          = { version = "1.37.0", features = ["full"] }
+indicatif      = "0.17.8" # Progress bar
+
+# Crypto libraries
+hex        = "0.4.3"
+sha2       = "0.10.8"
+num-bigint = { version = "0.4.4", features = ["rand"] }
+num-traits = "0.2.18"
+
+# Random libraries
+rand_chacha = "0.3.1"
+rand        = "0.8.5"
+ark-std     = "0.4.0"
+konst       = "0.3.9"
diff --git a/core/src/assert/disprove_script.rs b/core/src/assert/disprove_script.rs
index 9a9043d..92edabe 100644
--- a/core/src/assert/disprove_script.rs
+++ b/core/src/assert/disprove_script.rs
@@ -1,42 +1,87 @@
-use bitvm2_splitter::treepp::*;
+use crate::treepp::*;
+use super::signing::SignedIntermediateState;
 
-use crate::winternitz::{self, PublicKey};
+use bitcoin_splitter::split::intermediate_state::IntermediateState;
 
-/// Script which let's challengers spent the **Assert** transaction
-/// output if operator computated substates incorrectly.
+/// Script letting challengers spend the **Assert** transaction
+/// output if the operator computated substates incorrectly.
 ///
 /// This a typed version of [`Script`] can be easily converted into it.
 ///
 /// The script structure in general is simple:
-///
-/// ```no_run
-/// // push public key's of intermidiate states
-/// { pk_z[i-1] }
-/// { pk_z[i] }
-/// // Check Winternitz signatures expecting public
-/// // keys and signatures from top of the stack
-/// { winternitz::checksig_verify }
-/// // compute result of the subrpogram
-/// { f[i] }
-/// OP_EQUAL
-/// OP_VERIFY
+/// ## Witness:
+/// ```
+/// { Enc(z[i+1]) and Sig[i+1] } // Zipped
+/// { Enc(z[i]) and Sig[i] }     // Zipped
 /// ```
 ///
-/// # TODO:
-///
-/// - [ ] Inlcude covenants
+/// ## Script:
+/// ```
+/// { pk[i] }                // { Zip(Enc(z[i+1]), Sig[i+1]), Zip(Enc(z[i]), Sig[i]), pk[i] }
+/// { OP_WINTERNITZVERIFY }  // { Zip(Enc(z[i+1]), Sig[i+1]), Enc(z[i]) }
+/// { OP_RESTORE }           // { Zip(Enc(z[i+1]), Sig[i+1]), z[i] }
+/// { OP_TOALTSTACK }        // { Zip(Enc(z[i+1]), Sig[i+1]) }
+/// { pk[i+1] }              // { Zip(Enc(z[i+1]), Sig[i+1]), pk[i+1] }
+/// { OP_WINTERNITZVERIFY }  // { Enc(z[i+1]) }
+/// { OP_RESTORE }           // { z[i+1] }
+/// { OP_FROMALTSTACK }      // { z[i+1] z[i] }
+/// { fn[i] }                // { z[i+1] fn[i](z[i]) }
+/// { OP_EQUAL }             // { z[i+1] == fn[i](z[i]) }
+/// { OP_NOT }               // { z[i+1] != fn[i](z[i]) }
+/// ```
 pub struct DisproveScript {
-    intermidiate_state_pubkeys: [PublicKey; 2],
-    subprogram: Script,
+    pub script_witness: Script,
+    pub script_pubkey: Script,
 }
 
-impl From<DisproveScript> for Script {
-    fn from(disprove: DisproveScript) -> Self {
-        let [ pk1, pk2 ] = disprove.intermidiate_state_pubkeys;
-        script! {
-            { pk1 }
-            // { winternitz::checksig_verify }
-            { pk2 }
+impl DisproveScript {
+    /// Given the previous and current states, and the function that was executed,
+    /// creates a new DisproveScript according to the BitVM2 protocol.
+    pub fn new(from: IntermediateState, to: IntermediateState, function: Script) -> Self {
+        // Step 1.
+        // First, we sign the states
+        let from_signed = SignedIntermediateState::sign(from);
+        let to_signed = SignedIntermediateState::sign(to);
+
+        // Step 2.
+        // Now, we form the witness script. Just pushing all
+        // signatures + messages to the witness script
+        let script_witness = script! {
+            { from_signed.witness_script() } // Zipped Enc(z[i]) and Sig[i]
+            { to_signed.witness_script() }   // Zipped Enc(z[i+1]) and Sig[i+1]
+        };
+
+        // Step 3.
+        // Now, we form the script pubkey
+        let script_pubkey = script! {
+            // 1. Public key + verification of "to" state
+            { to_signed.verification_script_toaltstack() } // This leaves z[i+1] in the altstack
+            { from_signed.verification_script() } // This leaves z[i].mainstack in the mainstack, while (z[i+1], z[i].altstack) is still in the altstack
+            
+            // 2. Applying function and popping "to" state
+            { function } // This leaves f[i](z[i]).mainstack in the mainstack and z[i+1] in the altstack
+            { to_signed.verification_script_fromaltstack() } // This leaves z[i+1].mainstack and f[i](z[i]).mainstack in the mainstack, while f[i](z[i]).altstack and z[i+1].alstack is in the altstack
+            
+            // 3. Checking if z[i+1] == f(z[i])
+            // 3.1. First, check mainstack equality
+            for j in (0..to_signed.stack.len()).into_iter().rev() {
+                { j } OP_ROLL OP_EQUALVERIFY // This checks if z[i+1][j] == f(z[i])[j] for each j
+            }
+            // 3.2. Pop all elements from the altstack
+            for _ in 0..2*to_signed.altstack.len() {
+                OP_FROMALTSTACK
+            }
+            // 3.3. Compare altstack elements in the mainstack
+            for j in (0..to_signed.altstack.len()).into_iter().rev() {
+                { j } OP_ROLL OP_EQUALVERIFY // This checks if z[i+1][j] == f(z[i])[j] for each j
+            }
+
+            OP_TRUE
+        };
+
+        Self {
+            script_witness,
+            script_pubkey,
         }
     }
 }
diff --git a/core/src/assert/mod.rs b/core/src/assert/mod.rs
index cb5fe1b..684cc0b 100644
--- a/core/src/assert/mod.rs
+++ b/core/src/assert/mod.rs
@@ -1,20 +1,24 @@
 use bitcoin::TxIn;
-use bitvm2_splitter::{split::intermediate_state::IntermediateState, treepp::Script};
+use bitcoin_splitter::{split::intermediate_state::IntermediateState, treepp::Script};
 
 use crate::winternitz::PublicKey;
 
+pub mod signing;
 pub mod disprove_script;
 
+#[cfg(test)]
+mod tests;
+
 pub struct AssertTransaction<const N: usize> {
     // Inputs which are used in the transaction.
-    inputs: Vec<TxIn>,
+    pub inputs: Vec<TxIn>,
     // Subprograms $f_{i}$ that will be verified in the transaction.
-    subprograms: [Script; N],
+    pub subprograms: [Script; N],
     // Intermidiate states $z_i$.
-    states: [IntermediateState; N],
+    pub states: [IntermediateState; N],
     // Winternitz public keys that are used for verification of
     // related to intermidiate states' signatures.
     //
     // In paper specified as $\mathsf{pk}_{z_i}$.
-    states_pubkeys: [PublicKey; N],
+    pub states_pubkeys: [PublicKey; N],
 }
diff --git a/core/src/assert/signing.rs b/core/src/assert/signing.rs
new file mode 100644
index 0000000..7db8f60
--- /dev/null
+++ b/core/src/assert/signing.rs
@@ -0,0 +1,124 @@
+use crate::treepp::*;
+
+use bitcoin_splitter::split::intermediate_state::IntermediateState;
+use bitcoin_winternitz::u32::{checksig_verify_script, Message, PublicKey, SecretKey, Signature};
+use rand::rngs::SmallRng;
+
+/// Struct handling information about a single u32 element in the state array.
+/// Namely, besides the element itself, it also contains the public key, secret key,
+/// and the signature of the element.
+#[derive(Clone, Copy, Debug)]
+pub struct SignedStackElement {
+    pub stack_element: u32,
+    pub encoding: Message,
+    pub public_key: PublicKey,
+    pub secret_key: SecretKey,
+    pub signature: Signature,
+}
+
+impl SignedStackElement {
+    /// Creates a new [`SignedStackElement`] by signing the given stack element
+    fn sign(stack_element: u32) -> Self {
+        // Creating a keypair
+        let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32]);
+        let public_key = secret_key.public_key();
+
+        // Signing the message
+        let message = Message::from_u32(stack_element);
+        let signature = secret_key.sign(&message);
+
+        Self {
+            stack_element,
+            encoding: message,
+            public_key,
+            secret_key,
+            signature,
+        }
+    }
+}
+
+/// Struct holding the intermediate state of the script execution.
+///
+/// Note that the intermediate state itself is just an array of
+/// u32 values (both in mainstack and altstack), but this struct
+/// also contains the public keys, secret keys, and signatures
+/// of the elements in the state array.
+#[derive(Clone, Debug)]
+pub struct SignedIntermediateState {
+    pub stack: Vec<SignedStackElement>,
+    pub altstack: Vec<SignedStackElement>,
+}
+
+impl SignedIntermediateState {
+    /// Creates a new IntermediateStateHolder from the given intermediate state
+    pub fn sign(state: IntermediateState) -> Self {
+        let stack = state.to_bytes().stack_as_u32();
+        let altstack = state.to_bytes().altstack_as_u32();
+
+        let stack = stack.into_iter().map(SignedStackElement::sign).collect();
+        let altstack = altstack.into_iter().map(SignedStackElement::sign).collect();
+
+        Self { stack, altstack }
+    }
+
+    /// Script that pushes zipped signature and message to the stack for
+    /// each signed element in the stack and altstack.
+    pub fn witness_script(&self) -> Script {
+        script! {
+            // Pushing the stack
+            for element in &self.stack {
+                { element.signature.to_script_sig() }
+            }
+
+            // Pushing the altstack
+            for element in &self.altstack {
+                { element.signature.to_script_sig() }
+            }
+        }
+    }
+
+    /// Script for verification of the witness script. Additionally,
+    /// the verification leaves the original stack and altstack of
+    /// the intermediate state.
+    pub fn verification_script_toaltstack(&self) -> Script {
+        script! {
+            // For each element, we need to push the public key and run the 
+            // Winternitz verification script
+            for element in self.altstack.clone().into_iter().rev() {
+                { checksig_verify_script(&element.public_key) }
+                { Message::recovery_script() }
+                OP_TOALTSTACK
+            }
+
+            // Do the same for the mainstack
+            for element in self.stack.clone().into_iter().rev() {
+                { checksig_verify_script(&element.public_key) }
+                { Message::recovery_script() }
+                OP_TOALTSTACK
+            }
+        }
+    }
+
+    /// Script that pops the elements from the altstack after 
+    /// the verification of the witness script.
+    pub fn verification_script_fromaltstack(&self) -> Script {
+        script! {
+            // Currently, the altstack contains the following elements:
+            // { altstack_elements, stack_elements }
+            // Thus, we can simply pop top stack elements and call it a day
+            for _ in 0..self.stack.len() {
+                OP_FROMALTSTACK
+            }
+        }
+    }
+
+    /// Script that verifies the witness script and the public keys
+    /// of the elements in the stack and altstack. The verification
+    /// leaves the original stack and altstack of the intermediate state.
+    pub fn verification_script(&self) -> Script {
+        script! {
+            { self.verification_script_toaltstack() }
+            { self.verification_script_fromaltstack() }
+        }
+    }
+}
diff --git a/core/src/assert/tests.rs b/core/src/assert/tests.rs
new file mode 100644
index 0000000..3a92fbc
--- /dev/null
+++ b/core/src/assert/tests.rs
@@ -0,0 +1,29 @@
+
+// #[test]
+// pub fn test_verify() {
+//     assert!(Message::verify_random());
+// }
+
+// #[test]
+// pub fn test_encode_restore() {
+//     // Create a function
+
+//     let msg = Message::from_u32(0x2FEEDDCC);
+//     let recovery_script = Message::recovery_script();
+
+//     let script = script! {
+//         for part in msg.0.iter().take(N0).rev() {
+//             { *part }
+//         }
+
+//         { recovery_script }
+//         0x2FEEDDCC
+//         OP_EQUAL
+//     };
+
+//     let result = execute_script(script);
+
+//     println!("{}", result);
+
+//     assert!(result.success);
+// }
diff --git a/core/src/debug.rs b/core/src/debug.rs
new file mode 100644
index 0000000..a25b4e7
--- /dev/null
+++ b/core/src/debug.rs
@@ -0,0 +1,195 @@
+use crate::treepp;
+use bitcoin::{hashes::Hash, ScriptBuf, TapLeafHash, Transaction};
+use bitcoin_scriptexec::{Exec, ExecCtx, ExecError, ExecStats, Options, Stack, TxTemplate};
+use core::fmt;
+
+/// Information about the status of the script execution.
+#[derive(Debug)]
+pub struct ExecuteInfo {
+    pub success: bool,
+    pub error: Option<ExecError>,
+    pub main_stack: Stack,
+    pub alt_stack: Stack,
+    pub stats: ExecStats,
+}
+
+impl fmt::Display for ExecuteInfo {
+    /// Formats the `ExecuteInfo` struct for display.
+    fn fmt(&self, f: &mut fmt::Formatter<'_>) -> fmt::Result {
+        if self.success {
+            writeln!(f, "Script execution successful.")?;
+        } else {
+            writeln!(f, "Script execution failed!")?;
+        }
+
+        if let Some(ref error) = self.error {
+            writeln!(f, "Error: {:?}", error)?;
+        }
+
+        writeln!(f, "Stats: {:?}", self.stats)?;
+
+        writeln!(f, "Stack:")?;
+        for element in self.main_stack.iter_str() {
+            writeln!(f, "> {}", hex::encode(element))?;
+        }
+
+        writeln!(f, "\nAltStack:")?;
+        for element in self.alt_stack.iter_str() {
+            writeln!(f, "> {}", hex::encode(element))?;
+        }
+
+        Ok(())
+    }
+}
+
+/// Executes the given script and returns the result of the execution
+/// (success, error, stack, etc.)
+pub fn execute_script(script: ScriptBuf) -> ExecuteInfo {
+    let mut exec = Exec::new(
+        ExecCtx::Tapscript,
+        Options {
+            // TODO: Figure our how to optimize stack_to_script function to avoid disabling require_minimal
+            require_minimal: false,
+            ..Default::default()
+        },
+        TxTemplate {
+            tx: Transaction {
+                version: bitcoin::transaction::Version::TWO,
+                lock_time: bitcoin::locktime::absolute::LockTime::ZERO,
+                input: vec![],
+                output: vec![],
+            },
+            prevouts: vec![],
+            input_idx: 0,
+            taproot_annex_scriptleaf: Some((TapLeafHash::all_zeros(), None)),
+        },
+        script,
+        vec![],
+    )
+    .expect("error when creating the execution body");
+
+    // Execute all the opcodes while possible
+    loop {
+        if exec.exec_next().is_err() {
+            break;
+        }
+    }
+
+    // Obtaining the result of the execution
+    let result = exec.result().unwrap();
+
+    ExecuteInfo {
+        success: result.success,
+        error: result.error.clone(),
+        main_stack: exec.stack().clone(),
+        alt_stack: exec.altstack().clone(),
+        stats: exec.stats().clone(),
+    }
+}
+
+pub fn run(script: bitcoin::ScriptBuf) {
+    let exec_result = execute_script(script);
+    if !exec_result.success {
+        println!(
+            "ERROR: {:?} <--- \n STACK: {:#?} \n ALTSTACK {:#?}",
+            exec_result.error, exec_result.main_stack, exec_result.alt_stack
+        );
+    }
+    assert!(exec_result.success);
+}
+
+/// Execute a script on stack without `MAX_STACK_SIZE` limit.
+/// This function is only used for script test, not for production.
+///
+/// NOTE: Only for test purposes.
+#[allow(dead_code)]
+pub fn execute_script_no_stack_limit(script: bitcoin::ScriptBuf) -> ExecuteInfo {
+    // Get the default options for the script exec.
+    // NOTE: Do not enforce the stack limit.
+    let opts = Options {
+        enforce_stack_limit: false,
+        ..Default::default()
+    };
+
+    let mut exec = Exec::new(
+        ExecCtx::Tapscript,
+        opts,
+        TxTemplate {
+            tx: Transaction {
+                version: bitcoin::transaction::Version::TWO,
+                lock_time: bitcoin::locktime::absolute::LockTime::ZERO,
+                input: vec![],
+                output: vec![],
+            },
+            prevouts: vec![],
+            input_idx: 0,
+            taproot_annex_scriptleaf: Some((TapLeafHash::all_zeros(), None)),
+        },
+        script,
+        vec![],
+    )
+    .expect("error while creating the execution body");
+
+    // Execute all the opcodes while possible
+    loop {
+        if exec.exec_next().is_err() {
+            break;
+        }
+    }
+
+    // Get the result of the execution
+    let result = exec.result().unwrap();
+
+    ExecuteInfo {
+        success: result.success,
+        error: result.error.clone(),
+        main_stack: exec.stack().clone(),
+        alt_stack: exec.altstack().clone(),
+        stats: exec.stats().clone(),
+    }
+}
+
+/// Run the given script and panic if the script execution fails.
+#[allow(dead_code)]
+pub fn run_and_assert(script: treepp::Script) {
+    let exec_result = execute_script(script);
+    if !exec_result.success {
+        println!("Script execution failed!");
+    }
+
+    assert!(exec_result.success, "Script execution failed!");
+}
+
+#[cfg(test)]
+mod test {
+    use super::execute_script_no_stack_limit;
+    use crate::treepp::*;
+
+    #[test]
+    fn test_script_debug() {
+        let script = script! {
+            OP_TRUE
+            DEBUG
+            OP_TRUE
+            OP_VERIFY
+        };
+        let exec_result = execute_script(script);
+        assert!(!exec_result.success);
+    }
+
+    #[test]
+    fn test_script_execute_no_stack_limit() {
+        let script = script! {
+            for _ in 0..1001 {
+                OP_1
+            }
+            for _ in 0..1001 {
+                OP_DROP
+            }
+            OP_1
+        };
+
+        let exec_result = execute_script_no_stack_limit(script);
+        assert!(exec_result.success);
+    }
+}
diff --git a/core/src/lib.rs b/core/src/lib.rs
index 5be46ed..2a23083 100644
--- a/core/src/lib.rs
+++ b/core/src/lib.rs
@@ -1,2 +1,13 @@
 pub mod assert;
+pub mod debug;
 pub mod winternitz;
+
+#[allow(dead_code)]
+// Re-export what is needed to write treepp scripts
+pub mod treepp {
+    pub use crate::debug::{execute_script, run};
+    pub use bitcoin_script::{define_pushable, script};
+
+    define_pushable!();
+    pub use bitcoin::ScriptBuf as Script;
+}
diff --git a/core/src/winternitz.rs b/core/src/winternitz.rs
index 600f976..0ae9505 100644
--- a/core/src/winternitz.rs
+++ b/core/src/winternitz.rs
@@ -12,7 +12,7 @@
 // BEAT OUR IMPLEMENTATION AND WIN A CODE GOLF BOUNTY!
 //
 
-use bitvm2_splitter::treepp::*;
+use crate::treepp::*;
 use bitcoin::hashes::{hash160, Hash};
 
 /// Bits per digit
@@ -47,7 +47,7 @@ pub fn public_key_for_digit(mut secret_key: Vec<u8>, digit_index: u32) -> [u8; 2
     *hash.as_byte_array()
 }
 
-/// Generate a public key from a secret key 
+/// Generate a public key from a secret key
 pub fn generate_public_key(secret_key: Vec<u8>) -> PublicKey {
     let mut public_key_array = [[0u8; 20]; N as usize];
     for i in 0..N {
@@ -95,8 +95,6 @@ pub fn to_digits<const DIGIT_COUNT: usize>(mut number: u32) -> [u8; DIGIT_COUNT]
     digits
 }
 
-
-
 /// Compute the signature for a given message
 pub fn sign_digits(secret_key: SecretKey, message_digits: [u8; N0 as usize]) -> Script {
     // const message_digits = to_digits(message, n0)
@@ -203,7 +201,6 @@ pub fn checksig_verify(public_key: &PublicKey) -> Script {
     }
 }
 
-
 #[cfg(test)]
 mod test {
     use bitcoin::hex::FromHex as _;
@@ -213,7 +210,6 @@ mod test {
     // The secret key
     const MY_SECKEY: &str = "b138982ce17ac813d505b5b40b665d404e9528e7";
 
-
     #[test]
     fn test_winternitz() {
         // The message to sign

From 7246059d64574dbd68da902092eef4a01c48015e Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Tue, 15 Oct 2024 03:15:16 +0300
Subject: [PATCH 22/28] :test_tube: add first tests in the `core` package

---
 bitcoin-winternitz/src/u32.rs | 23 ++++++----
 core/Cargo.toml               |  9 +++-
 core/src/assert/signing.rs    |  6 ++-
 core/src/assert/tests.rs      | 79 +++++++++++++++++++++++++----------
 4 files changed, 86 insertions(+), 31 deletions(-)

diff --git a/bitcoin-winternitz/src/u32.rs b/bitcoin-winternitz/src/u32.rs
index 736c1f1..131da78 100644
--- a/bitcoin-winternitz/src/u32.rs
+++ b/bitcoin-winternitz/src/u32.rs
@@ -37,23 +37,32 @@ impl SecretKey {
     }
 
     #[cfg(feature = "rand")]
-    /// Construct new [`SecretKey`] from seed, by generating required
-    /// number of parts (chunks).
-    pub fn from_seed<Seed, Rng>(seed: Seed) -> Self
+    /// Contruct new [`SecretKey`] randomly
+    pub fn random<Rng>(rng: &mut Rng) -> Self
     where
-        Seed: Sized + Default + AsMut<[u8]>,
-        Rng: rand::SeedableRng<Seed = Seed> + rand::Rng,
+        Rng: rand::Rng,
     {
         let mut buf = [Hash160::all_zeros(); N];
-        let mut rng = Rng::from_seed(seed);
 
         for chunk in &mut buf {
-            *chunk = Hash160::from_byte_array(rng.sample(rand::distributions::Standard));
+            *chunk = Hash160::from_byte_array(rng.gen());
         }
 
         Self(buf)
     }
 
+    #[cfg(feature = "rand")]
+    /// Construct new [`SecretKey`] from seed, by generating required
+    /// number of parts (chunks).
+    pub fn from_seed<Seed, Rng>(seed: Seed) -> Self
+    where
+        Seed: Sized + Default + AsMut<[u8]>,
+        Rng: rand::SeedableRng<Seed = Seed> + rand::Rng,
+    {
+        let mut rng = Rng::from_seed(seed);
+        Self::random(&mut rng)
+    }
+
     /// Return public key derived from secret one.
     pub fn public_key(&self) -> PublicKey {
         let mut buf = self.0;
diff --git a/core/Cargo.toml b/core/Cargo.toml
index f32814e..173891c 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -30,7 +30,14 @@ num-bigint = { version = "0.4.4", features = ["rand"] }
 num-traits = "0.2.18"
 
 # Random libraries
+rand        = { version = "0.8.5", default-features = false, optional = true, features = ["min_const_gen"] }
 rand_chacha = "0.3.1"
-rand        = "0.8.5"
 ark-std     = "0.4.0"
 konst       = "0.3.9"
+
+[features]
+default = ["rand"]
+rand    = ["dep:rand"]
+
+[dev-dependencies]
+rand = { version = "0.8.5", default-features = false, features = ["min_const_gen", "small_rng"] }
diff --git a/core/src/assert/signing.rs b/core/src/assert/signing.rs
index 7db8f60..3585d0c 100644
--- a/core/src/assert/signing.rs
+++ b/core/src/assert/signing.rs
@@ -2,7 +2,7 @@ use crate::treepp::*;
 
 use bitcoin_splitter::split::intermediate_state::IntermediateState;
 use bitcoin_winternitz::u32::{checksig_verify_script, Message, PublicKey, SecretKey, Signature};
-use rand::rngs::SmallRng;
+use rand::{rngs::SmallRng, SeedableRng};
 
 /// Struct handling information about a single u32 element in the state array.
 /// Namely, besides the element itself, it also contains the public key, secret key,
@@ -20,7 +20,9 @@ impl SignedStackElement {
     /// Creates a new [`SignedStackElement`] by signing the given stack element
     fn sign(stack_element: u32) -> Self {
         // Creating a keypair
-        let secret_key = SecretKey::from_seed::<_, SmallRng>([1u8; 32]);
+        // TODO(@ZamDimon): Reconsider rng usage
+        let mut rng = SmallRng::from_entropy();
+        let secret_key = SecretKey::random(&mut rng);
         let public_key = secret_key.public_key();
 
         // Signing the message
diff --git a/core/src/assert/tests.rs b/core/src/assert/tests.rs
index 3a92fbc..b88eb30 100644
--- a/core/src/assert/tests.rs
+++ b/core/src/assert/tests.rs
@@ -1,29 +1,66 @@
+use crate::treepp::*;
+use bitcoin_splitter::split::intermediate_state::IntermediateState;
 
-// #[test]
-// pub fn test_verify() {
-//     assert!(Message::verify_random());
-// }
+use super::signing::SignedIntermediateState;
 
-// #[test]
-// pub fn test_encode_restore() {
-//     // Create a function
+#[test]
+pub fn test_stack_sign_and_verify() {
+    // Define the test intermediate state
+    let state = IntermediateState::from_input_script(
+        &script!{}, 
+        &script!{
+        OP_2 OP_3 OP_4
+    });
+    
+    // Now, we sign the state
+    let signed_state = SignedIntermediateState::sign(state);
 
-//     let msg = Message::from_u32(0x2FEEDDCC);
-//     let recovery_script = Message::recovery_script();
+    // Check that witness + verification scripts are correct
+    let verify_script = script! {
+        { signed_state.witness_script() }
+        { signed_state.verification_script() }
+        OP_4 OP_EQUALVERIFY
+        OP_3 OP_EQUALVERIFY
+        OP_2 OP_EQUALVERIFY
+        OP_TRUE
+    };
 
-//     let script = script! {
-//         for part in msg.0.iter().take(N0).rev() {
-//             { *part }
-//         }
+    let result = execute_script(verify_script);
+    assert!(result.success, "Verification failed");
+}
 
-//         { recovery_script }
-//         0x2FEEDDCC
-//         OP_EQUAL
-//     };
+#[test]
+pub fn test_stack_sign_and_verify_with_altstack() {
+    // Define the test intermediate state
+    let state = IntermediateState::from_input_script(
+        &script!{}, 
+        &script!{
+        { 2345 } OP_3 { 1636 }
+        OP_5 OP_TOALTSTACK
+        OP_6 OP_TOALTSTACK
+        OP_7 OP_TOALTSTACK
+    });
+    
+    // Now, we sign the state
+    let signed_state = SignedIntermediateState::sign(state);
 
-//     let result = execute_script(script);
+    // Check that witness + verification scripts are correct
+    let verify_script = script! {
+        { signed_state.witness_script() }
+        { signed_state.verification_script() }
+        { 1636 } OP_EQUALVERIFY
+        OP_3 OP_EQUALVERIFY
+        { 2345 } OP_EQUALVERIFY
+        OP_FROMALTSTACK OP_5 OP_EQUALVERIFY
+        OP_FROMALTSTACK OP_6 OP_EQUALVERIFY
+        OP_FROMALTSTACK OP_7 OP_EQUALVERIFY
+        OP_TRUE
+    };
 
-//     println!("{}", result);
+    for state in signed_state.stack {
+        println!("Stack element: {:?}", state.public_key);
+    }
 
-//     assert!(result.success);
-// }
+    let result = execute_script(verify_script);
+    assert!(result.success, "Verification failed");
+}

From 8a7fe9630110e93f5eec3ec64c17a761d9cd7ba4 Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 16 Oct 2024 01:56:09 +0300
Subject: [PATCH 23/28] :art: finalize disprove script

---
 bitcoin-splitter/src/lib.rs                   |   4 +-
 bitcoin-splitter/src/split/core.rs            |   3 +-
 .../src/split/intermediate_state.rs           |  12 +
 bitcoin-splitter/src/test_scripts/mod.rs      |   8 +-
 bitcoin-splitter/src/utils.rs                 |   2 +-
 core/src/assert/disprove_script.rs            |  82 +++--
 core/src/assert/mod.rs                        |   2 +-
 core/src/assert/signing.rs                    |  26 +-
 core/src/assert/tests.rs                      | 285 ++++++++++++++++--
 core/src/debug.rs                             |   4 +-
 core/src/lib.rs                               |   1 +
 core/src/utils.rs                             |  32 ++
 12 files changed, 404 insertions(+), 57 deletions(-)
 create mode 100644 core/src/utils.rs

diff --git a/bitcoin-splitter/src/lib.rs b/bitcoin-splitter/src/lib.rs
index 62b8aaa..d671b7c 100644
--- a/bitcoin-splitter/src/lib.rs
+++ b/bitcoin-splitter/src/lib.rs
@@ -9,12 +9,12 @@ pub mod treepp {
 }
 
 pub mod split;
+pub mod test_scripts;
+pub mod utils;
 
 pub(crate) mod bitvm;
 pub(crate) mod debug;
 pub(crate) mod pseudo;
-pub(crate) mod test_scripts;
-pub(crate) mod utils;
 
 #[cfg(test)]
 mod tests {
diff --git a/bitcoin-splitter/src/split/core.rs b/bitcoin-splitter/src/split/core.rs
index fe7178d..b880153 100644
--- a/bitcoin-splitter/src/split/core.rs
+++ b/bitcoin-splitter/src/split/core.rs
@@ -39,8 +39,9 @@ pub(super) const STACK_SIZE_INDEX: usize = 1000;
 ///
 /// - [`SplitType::ByInstructions`]- splits the script by the number of instructions
 /// - [`SplitType::ByBytes`] - splits the script by the number of bytes
-#[derive(Debug, Clone, Copy)]
+#[derive(Debug, Clone, Copy, Default)]
 pub enum SplitType {
+    #[default]
     ByInstructions,
     ByBytes,
 }
diff --git a/bitcoin-splitter/src/split/intermediate_state.rs b/bitcoin-splitter/src/split/intermediate_state.rs
index cf2b81e..ee41d32 100644
--- a/bitcoin-splitter/src/split/intermediate_state.rs
+++ b/bitcoin-splitter/src/split/intermediate_state.rs
@@ -9,6 +9,7 @@ use bitcoin_scriptexec::Stack;
 /// Structure that represents the intermediate state.
 /// It contains the stack and altstack after the execution of the
 /// corresponding shard.
+#[derive(Clone)]
 pub struct IntermediateState {
     pub stack: Stack,
     pub altstack: Stack,
@@ -51,6 +52,17 @@ impl IntermediateState {
         }
     }
 
+    /// Creates a new instance of the IntermediateState based on the given
+    /// script and the stack and altstack after the execution of the script
+    pub fn from_inject_script(inject_script: &Script) -> Self {
+        let result = execute_script(inject_script.clone());
+
+        Self {
+            stack: result.main_stack.clone(),
+            altstack: result.alt_stack.clone(),
+        }
+    }
+
     /// Executes the script with the given input and returns the intermediate result,
     /// that is, the stack and altstack after the execution
     pub fn from_input_script(input: &Script, script: &Script) -> Self {
diff --git a/bitcoin-splitter/src/test_scripts/mod.rs b/bitcoin-splitter/src/test_scripts/mod.rs
index 70b14d3..816b37f 100644
--- a/bitcoin-splitter/src/test_scripts/mod.rs
+++ b/bitcoin-splitter/src/test_scripts/mod.rs
@@ -5,7 +5,7 @@
 //! - A script that performs an addition of two 254-bit numbers.
 //! - A script that performs a multiplication of two 254-bit numbers using w-windowed approach.
 
-pub(crate) mod int_add;
-pub(crate) mod int_mul_karatsuba;
-pub(crate) mod int_mul_windowed;
-pub(crate) mod sha256;
+pub mod int_add;
+pub mod int_mul_karatsuba;
+pub mod int_mul_windowed;
+pub mod sha256;
diff --git a/bitcoin-splitter/src/utils.rs b/bitcoin-splitter/src/utils.rs
index 530a0e6..9089bd2 100644
--- a/bitcoin-splitter/src/utils.rs
+++ b/bitcoin-splitter/src/utils.rs
@@ -3,7 +3,7 @@ use bitcoin_scriptexec::Stack;
 use crate::treepp::*;
 
 /// Converts a stack to a script that pushes all elements of the stack
-pub(crate) fn stack_to_script(stack: &Stack) -> Script {
+pub fn stack_to_script(stack: &Stack) -> Script {
     script! {
         for element in stack.iter_str() {
             { element.to_vec() }
diff --git a/core/src/assert/disprove_script.rs b/core/src/assert/disprove_script.rs
index 92edabe..bbf76a7 100644
--- a/core/src/assert/disprove_script.rs
+++ b/core/src/assert/disprove_script.rs
@@ -1,7 +1,9 @@
-use crate::treepp::*;
 use super::signing::SignedIntermediateState;
+use crate::{treepp::*, utils::OP_LONGEQUALVERIFY};
 
-use bitcoin_splitter::split::intermediate_state::IntermediateState;
+use bitcoin_splitter::split::{
+    core::SplitType, intermediate_state::IntermediateState, script::SplitableScript,
+};
 
 /// Script letting challengers spend the **Assert** transaction
 /// output if the operator computated substates incorrectly.
@@ -10,13 +12,13 @@ use bitcoin_splitter::split::intermediate_state::IntermediateState;
 ///
 /// The script structure in general is simple:
 /// ## Witness:
-/// ```
+/// ```no_run
 /// { Enc(z[i+1]) and Sig[i+1] } // Zipped
 /// { Enc(z[i]) and Sig[i] }     // Zipped
 /// ```
 ///
 /// ## Script:
-/// ```
+/// ```no_run
 /// { pk[i] }                // { Zip(Enc(z[i+1]), Sig[i+1]), Zip(Enc(z[i]), Sig[i]), pk[i] }
 /// { OP_WINTERNITZVERIFY }  // { Zip(Enc(z[i+1]), Sig[i+1]), Enc(z[i]) }
 /// { OP_RESTORE }           // { Zip(Enc(z[i+1]), Sig[i+1]), z[i] }
@@ -29,6 +31,7 @@ use bitcoin_splitter::split::intermediate_state::IntermediateState;
 /// { OP_EQUAL }             // { z[i+1] == fn[i](z[i]) }
 /// { OP_NOT }               // { z[i+1] != fn[i](z[i]) }
 /// ```
+#[derive(Debug, Clone)]
 pub struct DisproveScript {
     pub script_witness: Script,
     pub script_pubkey: Script,
@@ -37,7 +40,7 @@ pub struct DisproveScript {
 impl DisproveScript {
     /// Given the previous and current states, and the function that was executed,
     /// creates a new DisproveScript according to the BitVM2 protocol.
-    pub fn new(from: IntermediateState, to: IntermediateState, function: Script) -> Self {
+    pub fn new(from: &IntermediateState, to: &IntermediateState, function: &Script) -> Self {
         // Step 1.
         // First, we sign the states
         let from_signed = SignedIntermediateState::sign(from);
@@ -57,24 +60,34 @@ impl DisproveScript {
             // 1. Public key + verification of "to" state
             { to_signed.verification_script_toaltstack() } // This leaves z[i+1] in the altstack
             { from_signed.verification_script() } // This leaves z[i].mainstack in the mainstack, while (z[i+1], z[i].altstack) is still in the altstack
-            
+
             // 2. Applying function and popping "to" state
-            { function } // This leaves f[i](z[i]).mainstack in the mainstack and z[i+1] in the altstack
+            { function.clone() } // This leaves f[i](z[i]).mainstack in the mainstack and { z[i+1].altstack, f[i](z[i]).altstack } in the altstack
+            for _ in 0..to_signed.altstack.len() {
+                OP_FROMALTSTACK
+            }
             { to_signed.verification_script_fromaltstack() } // This leaves z[i+1].mainstack and f[i](z[i]).mainstack in the mainstack, while f[i](z[i]).altstack and z[i+1].alstack is in the altstack
-            
-            // 3. Checking if z[i+1] == f(z[i])
-            // 3.1. First, check mainstack equality
-            for j in (0..to_signed.stack.len()).into_iter().rev() {
-                { j } OP_ROLL OP_EQUALVERIFY // This checks if z[i+1][j] == f(z[i])[j] for each j
+
+            // At tbis point, our stack consists of:
+            // { f[i](z[i]).mainstack, f[i](z[i]).altstack, z[i+1].mainstack }
+            // while the altstack has z[i+1].altstack.
+            // Thus, we have to pick f[i](z[i]).mainstack to the top of the stack
+            for _ in (0..to_signed.stack.len()).into_iter().rev() {
+                { to_signed.total_len() + to_signed.stack.len() - 1 } OP_ROLL
             }
-            // 3.2. Pop all elements from the altstack
-            for _ in 0..2*to_signed.altstack.len() {
+
+            // At this point, we should have
+            // { f[i](z[i]).altstack, z[i+1].mainstack, f[i](z[i]).mainstack }
+
+            // 3. Checking if z[i+1] == f(z[i])
+            // 3.1. Mainstack verification
+            { OP_LONGEQUALVERIFY(to_signed.stack.len()) }
+
+            // 3.2. Altstack verification
+            for _ in 0..to_signed.altstack.len() {
                 OP_FROMALTSTACK
             }
-            // 3.3. Compare altstack elements in the mainstack
-            for j in (0..to_signed.altstack.len()).into_iter().rev() {
-                { j } OP_ROLL OP_EQUALVERIFY // This checks if z[i+1][j] == f(z[i])[j] for each j
-            }
+            { OP_LONGEQUALVERIFY(to_signed.altstack.len()) }
 
             OP_TRUE
         };
@@ -85,3 +98,36 @@ impl DisproveScript {
         }
     }
 }
+
+/// Given the script and its input, does the following:
+/// - Splits the script into shards
+/// - For each shard, creates a DisproveScript
+/// - Returns the list of DisproveScripts
+pub fn form_disprove_scripts<const I: usize, const O: usize, S: SplitableScript<I, O>>(
+    input: Script,
+) -> Vec<DisproveScript> {
+    // Splitting the script into shards
+    let split_result = S::default_split(input.clone(), SplitType::default());
+
+    assert_eq!(
+        split_result.shards.len(),
+        split_result.intermediate_states.len(),
+        "Shards and intermediate states must have the same length"
+    );
+
+    (0..split_result.shards.len())
+        .map(|i| {
+            let from_state = if i == 0 {
+                IntermediateState::from_inject_script(&input.clone())
+            } else {
+                split_result.intermediate_states[i - 1].clone()
+            };
+
+            DisproveScript::new(
+                &from_state,
+                &split_result.intermediate_states[i],
+                &split_result.shards[i],
+            )
+        })
+        .collect()
+}
diff --git a/core/src/assert/mod.rs b/core/src/assert/mod.rs
index 684cc0b..c5a72ee 100644
--- a/core/src/assert/mod.rs
+++ b/core/src/assert/mod.rs
@@ -3,8 +3,8 @@ use bitcoin_splitter::{split::intermediate_state::IntermediateState, treepp::Scr
 
 use crate::winternitz::PublicKey;
 
-pub mod signing;
 pub mod disprove_script;
+pub mod signing;
 
 #[cfg(test)]
 mod tests;
diff --git a/core/src/assert/signing.rs b/core/src/assert/signing.rs
index 3585d0c..6eb3176 100644
--- a/core/src/assert/signing.rs
+++ b/core/src/assert/signing.rs
@@ -4,6 +4,9 @@ use bitcoin_splitter::split::intermediate_state::IntermediateState;
 use bitcoin_winternitz::u32::{checksig_verify_script, Message, PublicKey, SecretKey, Signature};
 use rand::{rngs::SmallRng, SeedableRng};
 
+/// Maximum value of the stack element
+const MAX_STACK_ELEMENT_VALUE: u32 = (1 << 31) - 1;
+
 /// Struct handling information about a single u32 element in the state array.
 /// Namely, besides the element itself, it also contains the public key, secret key,
 /// and the signature of the element.
@@ -53,27 +56,38 @@ pub struct SignedIntermediateState {
 
 impl SignedIntermediateState {
     /// Creates a new IntermediateStateHolder from the given intermediate state
-    pub fn sign(state: IntermediateState) -> Self {
+    pub fn sign(state: &IntermediateState) -> Self {
         let stack = state.to_bytes().stack_as_u32();
         let altstack = state.to_bytes().altstack_as_u32();
 
+        // Now, verifying that all elements are below 1<<31 - 1
+        for element in stack.iter().chain(altstack.iter()) {
+            assert!(*element <= MAX_STACK_ELEMENT_VALUE, "element is too large");
+        }
+
+        // Signing each element
         let stack = stack.into_iter().map(SignedStackElement::sign).collect();
         let altstack = altstack.into_iter().map(SignedStackElement::sign).collect();
 
         Self { stack, altstack }
     }
 
+    /// Returns the total length of the stack and altstack
+    pub fn total_len(&self) -> usize {
+        self.stack.len() + self.altstack.len()
+    }
+
     /// Script that pushes zipped signature and message to the stack for
     /// each signed element in the stack and altstack.
     pub fn witness_script(&self) -> Script {
         script! {
             // Pushing the stack
-            for element in &self.stack {
+            for element in self.stack.clone() {
                 { element.signature.to_script_sig() }
             }
 
             // Pushing the altstack
-            for element in &self.altstack {
+            for element in self.altstack.clone().into_iter().rev() {
                 { element.signature.to_script_sig() }
             }
         }
@@ -84,9 +98,9 @@ impl SignedIntermediateState {
     /// the intermediate state.
     pub fn verification_script_toaltstack(&self) -> Script {
         script! {
-            // For each element, we need to push the public key and run the 
+            // For each element, we need to push the public key and run the
             // Winternitz verification script
-            for element in self.altstack.clone().into_iter().rev() {
+            for element in self.altstack.clone() {
                 { checksig_verify_script(&element.public_key) }
                 { Message::recovery_script() }
                 OP_TOALTSTACK
@@ -101,7 +115,7 @@ impl SignedIntermediateState {
         }
     }
 
-    /// Script that pops the elements from the altstack after 
+    /// Script that pops the elements from the altstack after
     /// the verification of the witness script.
     pub fn verification_script_fromaltstack(&self) -> Script {
         script! {
diff --git a/core/src/assert/tests.rs b/core/src/assert/tests.rs
index b88eb30..fd2a11c 100644
--- a/core/src/assert/tests.rs
+++ b/core/src/assert/tests.rs
@@ -1,19 +1,30 @@
-use crate::treepp::*;
-use bitcoin_splitter::split::intermediate_state::IntermediateState;
+use crate::{assert::disprove_script::DisproveScript, treepp::*, utils::OP_LONGEQUALVERIFY};
+use bitcoin_splitter::{
+    split::{
+        core::SplitType,
+        intermediate_state::IntermediateState,
+        script::{IOPair, SplitableScript},
+    },
+    test_scripts::int_mul_windowed::U254MulScript,
+    utils::stack_to_script,
+};
+use bitcoin_window_mul::{bigint::U508, traits::comparable::Comparable};
 
-use super::signing::SignedIntermediateState;
+use super::{disprove_script::form_disprove_scripts, signing::SignedIntermediateState};
 
 #[test]
 pub fn test_stack_sign_and_verify() {
+    let a: u32 = (1 << 31) - 1;
     // Define the test intermediate state
     let state = IntermediateState::from_input_script(
-        &script!{}, 
-        &script!{
-        OP_2 OP_3 OP_4
-    });
-    
+        &script! {},
+        &script! {
+            { a } OP_3 OP_4
+        },
+    );
+
     // Now, we sign the state
-    let signed_state = SignedIntermediateState::sign(state);
+    let signed_state = SignedIntermediateState::sign(&state);
 
     // Check that witness + verification scripts are correct
     let verify_script = script! {
@@ -21,7 +32,36 @@ pub fn test_stack_sign_and_verify() {
         { signed_state.verification_script() }
         OP_4 OP_EQUALVERIFY
         OP_3 OP_EQUALVERIFY
-        OP_2 OP_EQUALVERIFY
+        { a } OP_EQUALVERIFY
+        OP_TRUE
+    };
+
+    let result = execute_script(verify_script);
+    assert!(result.success, "Verification failed");
+}
+
+#[test]
+pub fn test_zero_stack_sign_and_verify() {
+    // Define the test intermediate state
+    let state = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            for _ in 0..30 {
+                OP_0
+            }
+        },
+    );
+
+    // Now, we sign the state
+    let signed_state = SignedIntermediateState::sign(&state);
+
+    // Check that witness + verification scripts are correct
+    let verify_script = script! {
+        { signed_state.witness_script() }
+        { signed_state.verification_script() }
+        for _ in 0..30 {
+            OP_0 OP_EQUALVERIFY
+        }
         OP_TRUE
     };
 
@@ -33,16 +73,17 @@ pub fn test_stack_sign_and_verify() {
 pub fn test_stack_sign_and_verify_with_altstack() {
     // Define the test intermediate state
     let state = IntermediateState::from_input_script(
-        &script!{}, 
-        &script!{
-        { 2345 } OP_3 { 1636 }
-        OP_5 OP_TOALTSTACK
-        OP_6 OP_TOALTSTACK
-        OP_7 OP_TOALTSTACK
-    });
-    
+        &script! {},
+        &script! {
+            { 2345 } OP_3 { 1636 }
+            OP_5 OP_TOALTSTACK
+            OP_6 OP_TOALTSTACK
+            OP_7 OP_TOALTSTACK
+        },
+    );
+
     // Now, we sign the state
-    let signed_state = SignedIntermediateState::sign(state);
+    let signed_state = SignedIntermediateState::sign(&state);
 
     // Check that witness + verification scripts are correct
     let verify_script = script! {
@@ -51,16 +92,214 @@ pub fn test_stack_sign_and_verify_with_altstack() {
         { 1636 } OP_EQUALVERIFY
         OP_3 OP_EQUALVERIFY
         { 2345 } OP_EQUALVERIFY
-        OP_FROMALTSTACK OP_5 OP_EQUALVERIFY
-        OP_FROMALTSTACK OP_6 OP_EQUALVERIFY
         OP_FROMALTSTACK OP_7 OP_EQUALVERIFY
+        OP_FROMALTSTACK OP_6 OP_EQUALVERIFY
+        OP_FROMALTSTACK OP_5 OP_EQUALVERIFY
         OP_TRUE
     };
 
-    for state in signed_state.stack {
-        println!("Stack element: {:?}", state.public_key);
+    let result = execute_script(verify_script);
+    assert!(result.success, "Verification failed");
+}
+
+#[test]
+pub fn test_stack_sign_and_verify_bigint() {
+    // First, we generate the pair of input and output scripts
+    let IOPair { input, output: _ } = U254MulScript::generate_valid_io_pair();
+
+    // Splitting the script into shards
+    let split_result = U254MulScript::default_split(input, SplitType::ByInstructions);
+
+    for (i, intermediate_state) in split_result.intermediate_states.into_iter().enumerate() {
+        // Now, we sign the state
+        let signed_state = SignedIntermediateState::sign(&intermediate_state.clone());
+
+        // Check that witness + verification scripts are correct
+        let verify_script = script! {
+            { signed_state.witness_script() }
+            { signed_state.verification_script() }
+            { stack_to_script(&intermediate_state.stack) }
+            { OP_LONGEQUALVERIFY(signed_state.stack.len()) }
+            OP_TRUE
+        };
+
+        let result = execute_script(verify_script);
+        assert!(result.success, "Verification {:?} failed", i);
     }
+}
+
+#[test]
+pub fn test_trivial_disprove_script() {
+    // Define the following setup:
+    // Transition function: OP_ADD
+    // From: {3, 4}
+    // To:   {7}
+    let state_from = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_3 OP_4
+        },
+    );
+    let state_to = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_7
+        },
+    );
+    let function = script! {
+        OP_ADD
+    };
+
+    // Now, form the disprove script
+    let disprove_script = DisproveScript::new(&state_from, &state_to, &function);
+
+    // Check that witness + verification scripts are satisfied
+    let verify_script = script! {
+        { disprove_script.script_witness }
+        { disprove_script.script_pubkey }
+    };
 
     let result = execute_script(verify_script);
+
     assert!(result.success, "Verification failed");
 }
+
+#[test]
+pub fn test_disprove_script_with_altstack_1() {
+    // Define the following setup:
+    // Transition function: {OP_ADD OP_TOALTSTACK OP_TOALTSTACK}
+    // From: { mainstack: { 1, 2, 3, 4, 5 }, altstack: { } }
+    // To:   { mainstack: { 1, 2 }, altstack: { 9, 3 } }
+    let state_from = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_1 OP_2 OP_3 OP_4 OP_5
+        },
+    );
+    let state_to = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_1 OP_2 OP_9 OP_TOALTSTACK OP_3 OP_TOALTSTACK
+        },
+    );
+    let function = script! {
+        OP_ADD OP_TOALTSTACK OP_TOALTSTACK
+    };
+
+    // Now, form the disprove script
+    let disprove_script = DisproveScript::new(&state_from, &state_to, &function);
+
+    // Check that witness + verification scripts are satisfied
+    let verify_script = script! {
+        { disprove_script.script_witness }
+        { disprove_script.script_pubkey }
+    };
+
+    let result = execute_script(verify_script);
+
+    assert!(result.success, "Verification failed");
+}
+
+#[test]
+pub fn test_disprove_script_with_altstack_2() {
+    // Define the following setup:
+    // Transition function: { OP_FROMALTSTACK OP_ADD OP_TOALTSTACK OP_TOALTSTACK }
+    // From: { mainstack: { 1, 2, 3 }, altstack: { 4, 5 } }
+    // To:   { mainstack: { 1 }, altstack: { 4, 8, 2 } }
+    let state_from = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_1 OP_2 OP_3 OP_4 OP_TOALTSTACK OP_5 OP_TOALTSTACK
+        },
+    );
+    let state_to = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_1 OP_4 OP_TOALTSTACK OP_8 OP_TOALTSTACK OP_2 OP_TOALTSTACK
+        },
+    );
+    let function = script! {
+        OP_FROMALTSTACK OP_ADD OP_TOALTSTACK OP_TOALTSTACK
+    };
+
+    // Now, form the disprove script
+    let disprove_script = DisproveScript::new(&state_from, &state_to, &function);
+
+    // Check that witness + verification scripts are satisfied
+    let verify_script = script! {
+        { disprove_script.script_witness }
+        { disprove_script.script_pubkey }
+    };
+
+    let result = execute_script(verify_script);
+
+    assert!(result.success, "Verification failed");
+}
+
+#[test]
+pub fn test_disprove_script_mul_script() {
+    // First, we generate the pair of input and output scripts
+    let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
+
+    // Splitting the script into shards
+    let split_result = U254MulScript::default_split(input, SplitType::ByInstructions);
+
+    // Checking the last state (which must be equal to the result of the multiplication)
+    let last_state = split_result.must_last_state();
+
+    // Altstack must be empty
+    assert!(last_state.altstack.is_empty(), "altstack is not empty!");
+
+    // The element of the mainstack must be equal to the actual output
+    let verification_script = script! {
+        { stack_to_script(&last_state.stack) }
+        { output }
+        { U508::OP_EQUAL(0, 1) }
+    };
+
+    let result = execute_script(verification_script);
+    assert!(result.success, "verification has failed");
+
+    // Now, we form the disprove script for each shard
+    for i in 0..(split_result.shards.len() - 1) {
+        let disprove_script = DisproveScript::new(
+            &split_result.intermediate_states[i],
+            &split_result.intermediate_states[i + 1],
+            &split_result.shards[i + 1],
+        );
+
+        // Check that witness + verification scripts are satisfied
+        let verify_script = script! {
+            { disprove_script.script_witness }
+            { disprove_script.script_pubkey }
+        };
+
+        let result = execute_script(verify_script);
+        assert!(result.success, "Verification {:?} failed", i + 1);
+    }
+}
+
+#[test]
+pub fn test_disprove_script_batch_correctness() {
+    // First, we generate the pair of input and output scripts
+    let IOPair { input, output: _ } = U254MulScript::generate_valid_io_pair();
+
+    // Splitting the script into shards
+    let disprove_scripts = form_disprove_scripts::<
+        { U254MulScript::INPUT_SIZE },
+        { U254MulScript::OUTPUT_SIZE },
+        U254MulScript,
+    >(input.clone());
+
+    // Now, we form the disprove script for each shard
+    for (i,disprove_script) in disprove_scripts.into_iter().enumerate() {
+        // Check that witness + verification scripts are satisfied
+        let verify_script = script! {
+            { disprove_script.script_witness }
+            { disprove_script.script_pubkey }
+        };
+
+        let result = execute_script(verify_script);
+        assert!(result.success, "Verification {:?} failed", i + 1);
+    }
+}
diff --git a/core/src/debug.rs b/core/src/debug.rs
index a25b4e7..f6093fb 100644
--- a/core/src/debug.rs
+++ b/core/src/debug.rs
@@ -48,8 +48,10 @@ pub fn execute_script(script: ScriptBuf) -> ExecuteInfo {
     let mut exec = Exec::new(
         ExecCtx::Tapscript,
         Options {
-            // TODO: Figure our how to optimize stack_to_script function to avoid disabling require_minimal
+            // TODO(@ZamDimon): Figure out how to optimize stack_to_script function to avoid disabling require_minimal
             require_minimal: false,
+            // TODO(@ZamDimon): Currently, Winternitz does not work with the stack limit
+            enforce_stack_limit: false,
             ..Default::default()
         },
         TxTemplate {
diff --git a/core/src/lib.rs b/core/src/lib.rs
index 2a23083..2d33e8d 100644
--- a/core/src/lib.rs
+++ b/core/src/lib.rs
@@ -1,5 +1,6 @@
 pub mod assert;
 pub mod debug;
+pub mod utils;
 pub mod winternitz;
 
 #[allow(dead_code)]
diff --git a/core/src/utils.rs b/core/src/utils.rs
new file mode 100644
index 0000000..51dcda5
--- /dev/null
+++ b/core/src/utils.rs
@@ -0,0 +1,32 @@
+use crate::treepp::*;
+
+/// Checks whether two elements, consisting of multiple limbs, are equal.
+///
+/// - **Input:** `{ a[0], a[1], ..., a[l-1], b[0], b[1], ..., b[l-1] }`
+/// - **Returns:** `{ a[0] == b[0] && a[1] == b[1] && ... && a[l-1] == b[l-1] }`
+#[allow(non_snake_case)]
+pub fn OP_LONGEQUALVERIFY(length: usize) -> Script {
+    script! {
+        for j in (0..length).into_iter().rev() {
+            { j+1 } OP_ROLL OP_EQUALVERIFY
+        }
+    }
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn test_OP_LONGEQUALVERIFY() {
+        let script = script! {
+            1 2 3 4 5 1 2 3 4 5
+            { OP_LONGEQUALVERIFY(5) }
+            OP_TRUE
+        };
+
+        let exec_result = execute_script(script);
+        assert!(exec_result.success, "OP_LONGEQUALVERIFY(5) failed");
+    }
+}

From 29815e222c782c4e834f630689a5f5e546103270 Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 16 Oct 2024 03:40:09 +0300
Subject: [PATCH 24/28] :adhesive_bandage: finalize disprove script

---
 bitcoin-splitter/src/split/script.rs          |  6 ++
 bitcoin-splitter/src/test_scripts/int_add.rs  | 21 ++++
 .../src/test_scripts/int_mul_karatsuba.rs     | 21 ++++
 .../src/test_scripts/int_mul_windowed.rs      | 30 ++++++
 bitcoin-splitter/src/test_scripts/sha256.rs   | 26 ++++-
 core/src/assert/disprove_script.rs            | 15 ++-
 core/src/assert/tests.rs                      | 96 ++++++++++++++++---
 core/src/utils.rs                             | 95 +++++++++++++++++-
 8 files changed, 290 insertions(+), 20 deletions(-)

diff --git a/bitcoin-splitter/src/split/script.rs b/bitcoin-splitter/src/split/script.rs
index f58ca10..f7cb3ba 100644
--- a/bitcoin-splitter/src/split/script.rs
+++ b/bitcoin-splitter/src/split/script.rs
@@ -135,6 +135,12 @@ pub trait SplitableScript<const INPUT_SIZE: usize, const OUTPUT_SIZE: usize> {
     /// Generates a random valid input for the script
     fn generate_valid_io_pair() -> IOPair<INPUT_SIZE, OUTPUT_SIZE>;
 
+    /// Genreates invalid input for the script
+    ///
+    /// NOTE: This function is used for testing purposes, specifically
+    /// for testing the **Disprove** script.
+    fn generate_invalid_io_pair() -> IOPair<INPUT_SIZE, OUTPUT_SIZE>;
+
     /// Verifies that the input is valid for the script
     fn verify(input: Script, output: Script) -> bool {
         let script = script! {
diff --git a/bitcoin-splitter/src/test_scripts/int_add.rs b/bitcoin-splitter/src/test_scripts/int_add.rs
index 87929f2..2ec63ca 100644
--- a/bitcoin-splitter/src/test_scripts/int_add.rs
+++ b/bitcoin-splitter/src/test_scripts/int_add.rs
@@ -49,6 +49,27 @@ impl SplitableScript<{ INPUT_SIZE }, { OUTPUT_SIZE }> for U254AddScript {
             output: U254::OP_PUSH_U32LESLICE(&sum.to_u32_digits()),
         }
     }
+
+    fn generate_invalid_io_pair() -> IOPair<{ INPUT_SIZE }, { OUTPUT_SIZE }> {
+        let mut prng = ChaCha20Rng::seed_from_u64(0);
+
+        // Generate two random 254-bit numbers and calculate their sum
+        let num_1: BigUint = prng.sample(RandomBits::new(254));
+        let num_2: BigUint = prng.sample(RandomBits::new(254));
+        let mut sum: BigUint = (num_1.clone() + num_2.clone()).rem(BigUint::one().shl(254));
+
+        // Flip a random bit in the sum
+        let bit_to_flip = prng.gen_range(0..sum.bits());
+        sum.set_bit(bit_to_flip, !sum.bit(bit_to_flip));
+
+        IOPair {
+            input: script! {
+                { U254::OP_PUSH_U32LESLICE(&num_1.to_u32_digits()) }
+                { U254::OP_PUSH_U32LESLICE(&num_2.to_u32_digits()) }
+            },
+            output: U254::OP_PUSH_U32LESLICE(&sum.to_u32_digits()),
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs b/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs
index 35d3963..bfb69e8 100644
--- a/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs
+++ b/bitcoin-splitter/src/test_scripts/int_mul_karatsuba.rs
@@ -47,6 +47,27 @@ impl SplitableScript<{ INPUT_SIZE }, { OUTPUT_SIZE }> for U261MulKaratsubaScript
             output: U522::OP_PUSH_U32LESLICE(&product.to_u32_digits()),
         }
     }
+
+    fn generate_invalid_io_pair() -> IOPair<{ INPUT_SIZE }, { OUTPUT_SIZE }> {
+        let mut prng = ChaCha20Rng::seed_from_u64(0);
+
+        // Generate two random 254-bit numbers and calculate their sum
+        let num_1: BigUint = prng.sample(RandomBits::new(254));
+        let num_2: BigUint = prng.sample(RandomBits::new(254));
+        let mut product: BigUint = num_1.clone() * num_2.clone();
+
+        // Flip a random bit in the product
+        let bit_to_flip = prng.gen_range(0..product.bits());
+        product.set_bit(bit_to_flip, !product.bit(bit_to_flip));
+
+        IOPair {
+            input: script! {
+                { U261::OP_PUSH_U32LESLICE(&num_1.to_u32_digits()) }
+                { U261::OP_PUSH_U32LESLICE(&num_2.to_u32_digits()) }
+            },
+            output: U522::OP_PUSH_U32LESLICE(&product.to_u32_digits()),
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
index 0c7f350..950018b 100644
--- a/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
+++ b/bitcoin-splitter/src/test_scripts/int_mul_windowed.rs
@@ -44,6 +44,27 @@ impl SplitableScript<{ INPUT_SIZE }, { OUTPUT_SIZE }> for U254MulScript {
             output: U508::OP_PUSH_U32LESLICE(&product.to_u32_digits()),
         }
     }
+
+    fn generate_invalid_io_pair() -> IOPair<{ INPUT_SIZE }, { OUTPUT_SIZE }> {
+        let mut prng = ChaCha20Rng::seed_from_u64(0);
+
+        // Generate two random 254-bit numbers and calculate their sum
+        let num_1: BigUint = prng.sample(RandomBits::new(254));
+        let num_2: BigUint = prng.sample(RandomBits::new(254));
+        let mut product: BigUint = num_1.clone() * num_2.clone();
+
+        // Flip a random bit in the product
+        let bit_to_flip = prng.gen_range(0..product.bits());
+        product.set_bit(bit_to_flip, !product.bit(bit_to_flip));
+
+        IOPair {
+            input: script! {
+                { U254Windowed::OP_PUSH_U32LESLICE(&num_1.to_u32_digits()) }
+                { U254Windowed::OP_PUSH_U32LESLICE(&num_2.to_u32_digits()) }
+            },
+            output: U508::OP_PUSH_U32LESLICE(&product.to_u32_digits()),
+        }
+    }
 }
 
 #[cfg(test)]
@@ -57,6 +78,15 @@ mod tests {
         assert!(U254MulScript::verify_random());
     }
 
+    #[test]
+    fn test_invalid_generate() {
+        let IOPair { input, output } = U254MulScript::generate_invalid_io_pair();
+        assert!(
+            !U254MulScript::verify(input.clone(), output.clone()),
+            "input/output is correct"
+        );
+    }
+
     #[test]
     fn test_naive_split_correctness() {
         // Generating a random valid input for the script and the script itself
diff --git a/bitcoin-splitter/src/test_scripts/sha256.rs b/bitcoin-splitter/src/test_scripts/sha256.rs
index 9e47417..b9276f4 100644
--- a/bitcoin-splitter/src/test_scripts/sha256.rs
+++ b/bitcoin-splitter/src/test_scripts/sha256.rs
@@ -8,7 +8,7 @@ use crate::{
     treepp::*,
 };
 
-use rand::RngCore;
+use rand::{Rng, RngCore};
 use sha2::{Digest, Sha256};
 
 /// Script that performs the addition of two 254-bit numbers
@@ -44,6 +44,30 @@ impl<const INPUT_SIZE: usize> SplitableScript<INPUT_SIZE, { OUTPUT_SIZE }>
             },
         }
     }
+
+    fn generate_invalid_io_pair() -> IOPair<INPUT_SIZE, { OUTPUT_SIZE }> {
+        // Generate a random array of bytes
+        let mut data = [0; INPUT_SIZE];
+        rand::thread_rng().fill_bytes(&mut data);
+        let data_hex = hex::encode(data);
+
+        // Creating a SHA-256 hasher and find digest of the data
+        let mut hasher = Sha256::new();
+        hasher.update(data);
+        let mut result = hasher.finalize();
+        // Flipping a random bit in the result
+        let bit_to_flip = rand::thread_rng().gen_range(0..result.len());
+        result[bit_to_flip] ^= 1;
+
+        IOPair {
+            input: script! {
+                { push_bytes_hex(data_hex.as_str()) }
+            },
+            output: script! {
+                { push_bytes_hex(hex::encode(result).as_str()) }
+            },
+        }
+    }
 }
 
 #[cfg(test)]
diff --git a/core/src/assert/disprove_script.rs b/core/src/assert/disprove_script.rs
index bbf76a7..3469769 100644
--- a/core/src/assert/disprove_script.rs
+++ b/core/src/assert/disprove_script.rs
@@ -1,5 +1,5 @@
 use super::signing::SignedIntermediateState;
-use crate::{treepp::*, utils::OP_LONGEQUALVERIFY};
+use crate::{treepp::*, utils::OP_LONGNOTEQUAL};
 
 use bitcoin_splitter::split::{
     core::SplitType, intermediate_state::IntermediateState, script::SplitableScript,
@@ -81,15 +81,22 @@ impl DisproveScript {
 
             // 3. Checking if z[i+1] == f(z[i])
             // 3.1. Mainstack verification
-            { OP_LONGEQUALVERIFY(to_signed.stack.len()) }
+            { OP_LONGNOTEQUAL(to_signed.stack.len()) }
 
             // 3.2. Altstack verification
             for _ in 0..to_signed.altstack.len() {
                 OP_FROMALTSTACK
             }
-            { OP_LONGEQUALVERIFY(to_signed.altstack.len()) }
 
-            OP_TRUE
+            // Since currently our stack looks like:
+            // { f[i](z[i]).altstack, {bit}, z[i+1].altstack, },
+            // we need to push f[i](z[i]).altstack to the top of the stack
+            for _ in 0..to_signed.altstack.len() {
+                { 2*to_signed.altstack.len() } OP_ROLL
+            }
+
+            { OP_LONGNOTEQUAL(to_signed.altstack.len()) }
+            OP_BOOLOR
         };
 
         Self {
diff --git a/core/src/assert/tests.rs b/core/src/assert/tests.rs
index fd2a11c..4bf0998 100644
--- a/core/src/assert/tests.rs
+++ b/core/src/assert/tests.rs
@@ -129,11 +129,11 @@ pub fn test_stack_sign_and_verify_bigint() {
 }
 
 #[test]
-pub fn test_trivial_disprove_script() {
+pub fn test_trivial_disprove_script_success() {
     // Define the following setup:
     // Transition function: OP_ADD
     // From: {3, 4}
-    // To:   {7}
+    // To:   Should be { 7 }, but we have { 8 }
     let state_from = IntermediateState::from_input_script(
         &script! {},
         &script! {
@@ -143,7 +143,7 @@ pub fn test_trivial_disprove_script() {
     let state_to = IntermediateState::from_input_script(
         &script! {},
         &script! {
-            OP_7
+            OP_8
         },
     );
     let function = script! {
@@ -160,12 +160,47 @@ pub fn test_trivial_disprove_script() {
     };
 
     let result = execute_script(verify_script);
-
     assert!(result.success, "Verification failed");
 }
 
 #[test]
-pub fn test_disprove_script_with_altstack_1() {
+pub fn test_trivial_disprove_script_should_fail() {
+    // Define the following setup:
+    // Transition function: OP_ADD
+    // From: {3, 4}
+    // To:   Should be { 7 }, but we have { 8 }
+    let state_from = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_3 OP_4
+        },
+    );
+    let state_to = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_7
+        },
+    );
+    let function = script! {
+        OP_ADD
+    };
+
+    // Now, form the disprove script
+    let disprove_script = DisproveScript::new(&state_from, &state_to, &function);
+
+    // Check that witness + verification scripts are satisfied
+    let verify_script = script! {
+        { disprove_script.script_witness }
+        { disprove_script.script_pubkey }
+    };
+
+    let result = execute_script(verify_script);
+    println!("{:?}", stack_to_script(&result.main_stack).to_asm_string());
+    assert!(!result.success, "Verification failed");
+}
+
+#[test]
+pub fn test_disprove_script_with_altstack_should_fail() {
     // Define the following setup:
     // Transition function: {OP_ADD OP_TOALTSTACK OP_TOALTSTACK}
     // From: { mainstack: { 1, 2, 3, 4, 5 }, altstack: { } }
@@ -197,6 +232,42 @@ pub fn test_disprove_script_with_altstack_1() {
 
     let result = execute_script(verify_script);
 
+    assert!(!result.success, "Verification failed");
+}
+
+#[test]
+pub fn test_disprove_script_with_altstack_success() {
+    // Define the following setup:
+    // Transition function: {OP_ADD OP_TOALTSTACK OP_TOALTSTACK}
+    // From: { mainstack: { 1, 2, 3, 4, 5 }, altstack: { } }
+    // To:   { mainstack: { 1, 2 }, altstack: { 9, 3 } }
+    let state_from = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_1 OP_2 OP_3 OP_4 OP_5
+        },
+    );
+    let state_to = IntermediateState::from_input_script(
+        &script! {},
+        &script! {
+            OP_10 OP_2 OP_9 OP_TOALTSTACK OP_3 OP_TOALTSTACK
+        },
+    );
+    let function = script! {
+        OP_ADD OP_TOALTSTACK OP_TOALTSTACK
+    };
+
+    // Now, form the disprove script
+    let disprove_script = DisproveScript::new(&state_from, &state_to, &function);
+
+    // Check that witness + verification scripts are satisfied
+    let verify_script = script! {
+        { disprove_script.script_witness }
+        { disprove_script.script_pubkey }
+    };
+
+    let result = execute_script(verify_script);
+
     assert!(result.success, "Verification failed");
 }
 
@@ -233,13 +304,13 @@ pub fn test_disprove_script_with_altstack_2() {
 
     let result = execute_script(verify_script);
 
-    assert!(result.success, "Verification failed");
+    assert!(!result.success, "Verification failed");
 }
 
 #[test]
 pub fn test_disprove_script_mul_script() {
     // First, we generate the pair of input and output scripts
-    let IOPair { input, output } = U254MulScript::generate_valid_io_pair();
+    let IOPair { input, output } = U254MulScript::generate_invalid_io_pair();
 
     // Splitting the script into shards
     let split_result = U254MulScript::default_split(input, SplitType::ByInstructions);
@@ -247,9 +318,6 @@ pub fn test_disprove_script_mul_script() {
     // Checking the last state (which must be equal to the result of the multiplication)
     let last_state = split_result.must_last_state();
 
-    // Altstack must be empty
-    assert!(last_state.altstack.is_empty(), "altstack is not empty!");
-
     // The element of the mainstack must be equal to the actual output
     let verification_script = script! {
         { stack_to_script(&last_state.stack) }
@@ -258,7 +326,7 @@ pub fn test_disprove_script_mul_script() {
     };
 
     let result = execute_script(verification_script);
-    assert!(result.success, "verification has failed");
+    assert!(!result.success, "verification has failed");
 
     // Now, we form the disprove script for each shard
     for i in 0..(split_result.shards.len() - 1) {
@@ -275,7 +343,7 @@ pub fn test_disprove_script_mul_script() {
         };
 
         let result = execute_script(verify_script);
-        assert!(result.success, "Verification {:?} failed", i + 1);
+        assert!(!result.success, "Verification {:?} failed", i + 1);
     }
 }
 
@@ -292,7 +360,7 @@ pub fn test_disprove_script_batch_correctness() {
     >(input.clone());
 
     // Now, we form the disprove script for each shard
-    for (i,disprove_script) in disprove_scripts.into_iter().enumerate() {
+    for (i, disprove_script) in disprove_scripts.into_iter().enumerate() {
         // Check that witness + verification scripts are satisfied
         let verify_script = script! {
             { disprove_script.script_witness }
@@ -300,6 +368,6 @@ pub fn test_disprove_script_batch_correctness() {
         };
 
         let result = execute_script(verify_script);
-        assert!(result.success, "Verification {:?} failed", i + 1);
+        assert!(!result.success, "Verification {:?} failed", i + 1);
     }
 }
diff --git a/core/src/utils.rs b/core/src/utils.rs
index 51dcda5..5bf763c 100644
--- a/core/src/utils.rs
+++ b/core/src/utils.rs
@@ -1,11 +1,15 @@
 use crate::treepp::*;
 
-/// Checks whether two elements, consisting of multiple limbs, are equal.
+/// Asserts that two elements, consisting of multiple limbs, are equal.
 ///
 /// - **Input:** `{ a[0], a[1], ..., a[l-1], b[0], b[1], ..., b[l-1] }`
 /// - **Returns:** `{ a[0] == b[0] && a[1] == b[1] && ... && a[l-1] == b[l-1] }`
 #[allow(non_snake_case)]
 pub fn OP_LONGEQUALVERIFY(length: usize) -> Script {
+    if length == 0 {
+        return script! { OP_RETURN };
+    }
+
     script! {
         for j in (0..length).into_iter().rev() {
             { j+1 } OP_ROLL OP_EQUALVERIFY
@@ -13,6 +17,43 @@ pub fn OP_LONGEQUALVERIFY(length: usize) -> Script {
     }
 }
 
+/// Checks whether two elements, consisting of multiple limbs, are not equal.
+///
+/// - **Input:** `{ a[0], a[1], ..., a[l-1], b[0], b[1], ..., b[l-1] }`
+/// - **Returns:** `{ a[0] != b[0] || a[1] != b[1] || ... || a[l-1] != b[l-1] }`
+#[allow(non_snake_case)]
+pub fn OP_LONGNOTEQUAL(length: usize) -> Script {
+    if length == 0 {
+        return script! { OP_FALSE };
+    }
+
+    script! {
+        // Writing bits a[i] != b[i] for each i in the altstack
+        for j in (0..length).into_iter().rev() {
+            { j+1 } OP_ROLL OP_EQUAL OP_NOT OP_TOALTSTACK
+        }
+
+        // Verifying that at least one of the bits is true
+        OP_FROMALTSTACK
+        for _ in 0..length - 1 {
+            OP_FROMALTSTACK
+            OP_BOOLOR
+        }
+    }
+}
+
+/// Asserts that two elements, consisting of multiple limbs, are not equal.
+///
+/// - **Input:** `{ a[0], a[1], ..., a[l-1], b[0], b[1], ..., b[l-1] }`
+/// - **Returns:** `{ a[0] != b[0] || a[1] != b[1] || ... || a[l-1] != b[l-1] }`
+#[allow(non_snake_case)]
+pub fn OP_LONGNOTEQUALVERIFY(length: usize) -> Script {
+    script! {
+        { OP_LONGNOTEQUAL(length) }
+        { 1 } OP_EQUALVERIFY
+    }
+}
+
 #[cfg(test)]
 mod tests {
     use super::*;
@@ -29,4 +70,56 @@ mod tests {
         let exec_result = execute_script(script);
         assert!(exec_result.success, "OP_LONGEQUALVERIFY(5) failed");
     }
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn test_OP_LONGNOTEQUALVERIFY_happy_flow() {
+        let script = script! {
+            1 2 3 4 5 1 2 4 4 5
+            { OP_LONGNOTEQUAL(5) }
+            { 1 } OP_EQUAL
+        };
+
+        let exec_result = execute_script(script);
+        assert!(exec_result.success, "OP_LONGNOTEQUALVERIFY(5) failed");
+    }
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn test_OP_LONGNOTEQUALVERIFY_should_fail() {
+        let script = script! {
+            1 2 3 4 5 1 2 3 4 5
+            { OP_LONGNOTEQUAL(5) }
+            { 0 } OP_EQUAL
+        };
+
+        let exec_result = execute_script(script);
+        assert!(exec_result.success, "OP_LONGNOTEQUALVERIFY(5) failed");
+    }
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn test_OP_LONGNOTEQUAL_short_1() {
+        let script = script! {
+            1 2
+            { OP_LONGNOTEQUAL(1) }
+            { 1 } OP_EQUAL
+        };
+
+        let exec_result = execute_script(script);
+        assert!(exec_result.success, "OP_LONGNOTEQUAL(1) failed");
+    }
+
+    #[test]
+    #[allow(non_snake_case)]
+    fn test_OP_LONGNOTEQUAL_short_2() {
+        let script = script! {
+            3 3
+            { OP_LONGNOTEQUAL(1) }
+            { 0 } OP_EQUAL
+        };
+
+        let exec_result = execute_script(script);
+        assert!(exec_result.success, "OP_LONGNOTEQUAL(1) failed");
+    }
 }

From 9f7a9f54db00bc416dec04d9ef0e29b30b0cf4c4 Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 16 Oct 2024 03:45:02 +0300
Subject: [PATCH 25/28] :bug: fix bug after merge

---
 bitcoin-scriptexec/src/main.rs | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/bitcoin-scriptexec/src/main.rs b/bitcoin-scriptexec/src/main.rs
index 0c7aa93..c5b3f0f 100644
--- a/bitcoin-scriptexec/src/main.rs
+++ b/bitcoin-scriptexec/src/main.rs
@@ -120,6 +120,8 @@ fn inner_main() -> Result<(), String> {
         println!("Stats:\n{:#?}", exec.stats());
         println!("Time elapsed: {}ms", start.elapsed().as_millis());
     }
+
+    Ok(())
 }
 
 fn main() {

From 128069cecd76c974e88fd0fa85147b52a6dcb838 Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 16 Oct 2024 03:50:44 +0300
Subject: [PATCH 26/28] :art: polishing repo

---
 core/src/assert/disprove_script.rs |  2 +-
 core/src/utils.rs                  |  4 ++--
 core/src/winternitz.rs             | 10 +++++-----
 3 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/core/src/assert/disprove_script.rs b/core/src/assert/disprove_script.rs
index 3469769..109559a 100644
--- a/core/src/assert/disprove_script.rs
+++ b/core/src/assert/disprove_script.rs
@@ -72,7 +72,7 @@ impl DisproveScript {
             // { f[i](z[i]).mainstack, f[i](z[i]).altstack, z[i+1].mainstack }
             // while the altstack has z[i+1].altstack.
             // Thus, we have to pick f[i](z[i]).mainstack to the top of the stack
-            for _ in (0..to_signed.stack.len()).into_iter().rev() {
+            for _ in (0..to_signed.stack.len()).rev() {
                 { to_signed.total_len() + to_signed.stack.len() - 1 } OP_ROLL
             }
 
diff --git a/core/src/utils.rs b/core/src/utils.rs
index 5bf763c..f623ef3 100644
--- a/core/src/utils.rs
+++ b/core/src/utils.rs
@@ -11,7 +11,7 @@ pub fn OP_LONGEQUALVERIFY(length: usize) -> Script {
     }
 
     script! {
-        for j in (0..length).into_iter().rev() {
+        for j in (0..length).rev() {
             { j+1 } OP_ROLL OP_EQUALVERIFY
         }
     }
@@ -29,7 +29,7 @@ pub fn OP_LONGNOTEQUAL(length: usize) -> Script {
 
     script! {
         // Writing bits a[i] != b[i] for each i in the altstack
-        for j in (0..length).into_iter().rev() {
+        for j in (0..length).rev() {
             { j+1 } OP_ROLL OP_EQUAL OP_NOT OP_TOALTSTACK
         }
 
diff --git a/core/src/winternitz.rs b/core/src/winternitz.rs
index 0ae9505..4fc3528 100644
--- a/core/src/winternitz.rs
+++ b/core/src/winternitz.rs
@@ -86,13 +86,13 @@ pub fn checksum(digits: [u8; N0 as usize]) -> u32 {
 
 /// Convert a number to digits
 pub fn to_digits<const DIGIT_COUNT: usize>(mut number: u32) -> [u8; DIGIT_COUNT] {
-    let mut digits: [u8; DIGIT_COUNT] = [0; DIGIT_COUNT];
-    for i in 0..DIGIT_COUNT {
+    let mut result_digits: [u8; DIGIT_COUNT] = [0; DIGIT_COUNT];
+    for result_digit in result_digits.iter_mut().take(DIGIT_COUNT) {
         let digit = number % (D + 1);
         number = (number - digit) / (D + 1);
-        digits[i] = digit as u8;
+        *result_digit = digit as u8;
     }
-    digits
+    result_digits
 }
 
 /// Compute the signature for a given message
@@ -110,7 +110,7 @@ pub fn sign_digits(secret_key: SecretKey, message_digits: [u8; N0 as usize]) ->
 
 pub fn sign(secret_key: SecretKey, message_bytes: &[u8]) -> Script {
     // Convert message to digits
-    let mut message_digits = [0u8; 20 * 2 as usize];
+    let mut message_digits = [0u8; 20 * 2];
     for (digits, byte) in message_digits.chunks_mut(2).zip(message_bytes) {
         digits[0] = byte & 0b00001111;
         digits[1] = byte >> 4;

From f82339d0702876955520b9443f3f8897d32042d2 Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 16 Oct 2024 18:19:48 +0300
Subject: [PATCH 27/28] :art: tiny polishes

---
 bitcoin-splitter/src/split/core.rs | 2 +-
 core/Cargo.toml                    | 8 +-------
 core/src/assert/disprove_script.rs | 4 ++--
 3 files changed, 4 insertions(+), 10 deletions(-)

diff --git a/bitcoin-splitter/src/split/core.rs b/bitcoin-splitter/src/split/core.rs
index b880153..94570c3 100644
--- a/bitcoin-splitter/src/split/core.rs
+++ b/bitcoin-splitter/src/split/core.rs
@@ -47,7 +47,7 @@ pub enum SplitType {
 }
 
 /// Splits the given script into smaller parts. Tries to keep each chunk size
-/// to the optimal size ([`OPTIMAL_SCRIPT_SIZE`]) as close as possible.
+/// to the optimal size `chunk_size` as close as possible.
 pub(super) fn split_into_shards(
     script: &Script,
     chunk_size: usize,
diff --git a/core/Cargo.toml b/core/Cargo.toml
index 173891c..db864da 100644
--- a/core/Cargo.toml
+++ b/core/Cargo.toml
@@ -30,14 +30,8 @@ num-bigint = { version = "0.4.4", features = ["rand"] }
 num-traits = "0.2.18"
 
 # Random libraries
-rand        = { version = "0.8.5", default-features = false, optional = true, features = ["min_const_gen"] }
+rand        = { version = "0.8.5", default-features = false, features = ["min_const_gen", "small_rng"] }
 rand_chacha = "0.3.1"
 ark-std     = "0.4.0"
 konst       = "0.3.9"
 
-[features]
-default = ["rand"]
-rand    = ["dep:rand"]
-
-[dev-dependencies]
-rand = { version = "0.8.5", default-features = false, features = ["min_const_gen", "small_rng"] }
diff --git a/core/src/assert/disprove_script.rs b/core/src/assert/disprove_script.rs
index 109559a..4952bf0 100644
--- a/core/src/assert/disprove_script.rs
+++ b/core/src/assert/disprove_script.rs
@@ -12,13 +12,13 @@ use bitcoin_splitter::split::{
 ///
 /// The script structure in general is simple:
 /// ## Witness:
-/// ```no_run
+/// ```bitcoin_script
 /// { Enc(z[i+1]) and Sig[i+1] } // Zipped
 /// { Enc(z[i]) and Sig[i] }     // Zipped
 /// ```
 ///
 /// ## Script:
-/// ```no_run
+/// ```bitcoin_script
 /// { pk[i] }                // { Zip(Enc(z[i+1]), Sig[i+1]), Zip(Enc(z[i]), Sig[i]), pk[i] }
 /// { OP_WINTERNITZVERIFY }  // { Zip(Enc(z[i+1]), Sig[i+1]), Enc(z[i]) }
 /// { OP_RESTORE }           // { Zip(Enc(z[i+1]), Sig[i+1]), z[i] }

From 698be8acbf1a28eb5bef9a27b08849b77f79b4fb Mon Sep 17 00:00:00 2001
From: ZamDimon <zamdmytro@gmail.com>
Date: Wed, 16 Oct 2024 18:27:45 +0300
Subject: [PATCH 28/28] :truck: restructure the `core` package

---
 core/src/assert/mod.rs                        |  24 --
 .../disprove_script.rs => disprove/mod.rs}    |   8 +-
 core/src/{assert => disprove}/signing.rs      |   0
 core/src/{assert => disprove}/tests.rs        |   4 +-
 core/src/lib.rs                               |   1 +
 core/src/winternitz.rs                        | 266 ------------------
 6 files changed, 10 insertions(+), 293 deletions(-)
 rename core/src/{assert/disprove_script.rs => disprove/mod.rs} (98%)
 rename core/src/{assert => disprove}/signing.rs (100%)
 rename core/src/{assert => disprove}/tests.rs (98%)

diff --git a/core/src/assert/mod.rs b/core/src/assert/mod.rs
index c5a72ee..e69de29 100644
--- a/core/src/assert/mod.rs
+++ b/core/src/assert/mod.rs
@@ -1,24 +0,0 @@
-use bitcoin::TxIn;
-use bitcoin_splitter::{split::intermediate_state::IntermediateState, treepp::Script};
-
-use crate::winternitz::PublicKey;
-
-pub mod disprove_script;
-pub mod signing;
-
-#[cfg(test)]
-mod tests;
-
-pub struct AssertTransaction<const N: usize> {
-    // Inputs which are used in the transaction.
-    pub inputs: Vec<TxIn>,
-    // Subprograms $f_{i}$ that will be verified in the transaction.
-    pub subprograms: [Script; N],
-    // Intermidiate states $z_i$.
-    pub states: [IntermediateState; N],
-    // Winternitz public keys that are used for verification of
-    // related to intermidiate states' signatures.
-    //
-    // In paper specified as $\mathsf{pk}_{z_i}$.
-    pub states_pubkeys: [PublicKey; N],
-}
diff --git a/core/src/assert/disprove_script.rs b/core/src/disprove/mod.rs
similarity index 98%
rename from core/src/assert/disprove_script.rs
rename to core/src/disprove/mod.rs
index 4952bf0..5a62fb8 100644
--- a/core/src/assert/disprove_script.rs
+++ b/core/src/disprove/mod.rs
@@ -1,10 +1,15 @@
-use super::signing::SignedIntermediateState;
 use crate::{treepp::*, utils::OP_LONGNOTEQUAL};
+use signing::SignedIntermediateState;
 
 use bitcoin_splitter::split::{
     core::SplitType, intermediate_state::IntermediateState, script::SplitableScript,
 };
 
+pub mod signing;
+
+#[cfg(test)]
+mod tests;
+
 /// Script letting challengers spend the **Assert** transaction
 /// output if the operator computated substates incorrectly.
 ///
@@ -138,3 +143,4 @@ pub fn form_disprove_scripts<const I: usize, const O: usize, S: SplitableScript<
         })
         .collect()
 }
+
diff --git a/core/src/assert/signing.rs b/core/src/disprove/signing.rs
similarity index 100%
rename from core/src/assert/signing.rs
rename to core/src/disprove/signing.rs
diff --git a/core/src/assert/tests.rs b/core/src/disprove/tests.rs
similarity index 98%
rename from core/src/assert/tests.rs
rename to core/src/disprove/tests.rs
index 4bf0998..b58c70b 100644
--- a/core/src/assert/tests.rs
+++ b/core/src/disprove/tests.rs
@@ -1,4 +1,4 @@
-use crate::{assert::disprove_script::DisproveScript, treepp::*, utils::OP_LONGEQUALVERIFY};
+use crate::{disprove::DisproveScript, treepp::*, utils::OP_LONGEQUALVERIFY};
 use bitcoin_splitter::{
     split::{
         core::SplitType,
@@ -10,7 +10,7 @@ use bitcoin_splitter::{
 };
 use bitcoin_window_mul::{bigint::U508, traits::comparable::Comparable};
 
-use super::{disprove_script::form_disprove_scripts, signing::SignedIntermediateState};
+use super::{form_disprove_scripts, signing::SignedIntermediateState};
 
 #[test]
 pub fn test_stack_sign_and_verify() {
diff --git a/core/src/lib.rs b/core/src/lib.rs
index 2d33e8d..643ce0d 100644
--- a/core/src/lib.rs
+++ b/core/src/lib.rs
@@ -1,3 +1,4 @@
+pub mod disprove;
 pub mod assert;
 pub mod debug;
 pub mod utils;
diff --git a/core/src/winternitz.rs b/core/src/winternitz.rs
index 4fc3528..e69de29 100644
--- a/core/src/winternitz.rs
+++ b/core/src/winternitz.rs
@@ -1,266 +0,0 @@
-//! Winternitz One-time Signatures
-//!
-//!
-//! Winternitz signatures are an improved version of Lamport signatures.
-//! A detailed introduction to Winternitz signatures can be found
-//! in "A Graduate Course in Applied Cryptography" in chapter 14.3
-//! https://toc.cryptobook.us/book.pdf
-//!
-//! We are trying to closely follow the authors' notation here.
-
-//
-// BEAT OUR IMPLEMENTATION AND WIN A CODE GOLF BOUNTY!
-//
-
-use crate::treepp::*;
-use bitcoin::hashes::{hash160, Hash};
-
-/// Bits per digit
-const LOG_D: u32 = 4;
-/// Digits are base d+1
-pub const D: u32 = (1 << LOG_D) - 1;
-/// Number of digits of the message
-const N0: u32 = 40;
-/// Number of digits of the checksum.  N1 = ⌈log_{D+1}(D*N0)⌉ + 1
-const N1: usize = 4;
-/// Total number of digits to be signed
-const N: u32 = N0 + N1 as u32;
-/// The public key type
-pub type PublicKey = [[u8; 20]; N as usize];
-
-pub type SecretKey = Vec<u8>;
-
-//
-// Helper functions
-//
-
-/// Generate a public key for the i-th digit of the message
-pub fn public_key_for_digit(mut secret_key: Vec<u8>, digit_index: u32) -> [u8; 20] {
-    secret_key.push(digit_index as u8);
-
-    let mut hash = hash160::Hash::hash(&secret_key);
-
-    for _ in 0..D {
-        hash = hash160::Hash::hash(&hash[..]);
-    }
-
-    *hash.as_byte_array()
-}
-
-/// Generate a public key from a secret key
-pub fn generate_public_key(secret_key: Vec<u8>) -> PublicKey {
-    let mut public_key_array = [[0u8; 20]; N as usize];
-    for i in 0..N {
-        public_key_array[i as usize] = public_key_for_digit(secret_key.clone(), i);
-    }
-    public_key_array
-}
-
-/// Compute the signature for the i-th digit of the message
-pub fn digit_signature(mut secret_key: SecretKey, digit_index: u32, message_digit: u8) -> Script {
-    secret_key.push(digit_index as u8);
-
-    let mut hash = hash160::Hash::hash(&secret_key);
-
-    for _ in 0..message_digit {
-        hash = hash160::Hash::hash(&hash[..]);
-    }
-
-    let hash_bytes = hash.as_byte_array().to_vec();
-
-    script! {
-        { hash_bytes }
-        { message_digit }
-    }
-}
-
-/// Compute the checksum of the message's digits.
-/// Further infos in chapter "A domination free function for Winternitz signatures"
-pub fn checksum(digits: [u8; N0 as usize]) -> u32 {
-    let mut sum = 0;
-    for digit in digits {
-        sum += digit as u32;
-    }
-    D * N0 - sum
-}
-
-/// Convert a number to digits
-pub fn to_digits<const DIGIT_COUNT: usize>(mut number: u32) -> [u8; DIGIT_COUNT] {
-    let mut result_digits: [u8; DIGIT_COUNT] = [0; DIGIT_COUNT];
-    for result_digit in result_digits.iter_mut().take(DIGIT_COUNT) {
-        let digit = number % (D + 1);
-        number = (number - digit) / (D + 1);
-        *result_digit = digit as u8;
-    }
-    result_digits
-}
-
-/// Compute the signature for a given message
-pub fn sign_digits(secret_key: SecretKey, message_digits: [u8; N0 as usize]) -> Script {
-    // const message_digits = to_digits(message, n0)
-    let mut checksum_digits = to_digits::<N1>(checksum(message_digits)).to_vec();
-    checksum_digits.append(&mut message_digits.to_vec());
-
-    script! {
-        for i in 0..N {
-            { digit_signature(secret_key.clone(), i, checksum_digits[ (N-1-i) as usize]) }
-        }
-    }
-}
-
-pub fn sign(secret_key: SecretKey, message_bytes: &[u8]) -> Script {
-    // Convert message to digits
-    let mut message_digits = [0u8; 20 * 2];
-    for (digits, byte) in message_digits.chunks_mut(2).zip(message_bytes) {
-        digits[0] = byte & 0b00001111;
-        digits[1] = byte >> 4;
-    }
-
-    sign_digits(secret_key, message_digits)
-}
-
-pub fn checksig_verify(public_key: &PublicKey) -> Script {
-    script! {
-        //
-        // Verify the hash chain for each digit
-        //
-
-        // Repeat this for every of the n many digits
-        for digit_index in 0..N {
-            // Verify that the digit is in the range [0, d]
-            // See https://github.com/BitVM/BitVM/issues/35
-            { D }
-            OP_MIN
-
-            // Push two copies of the digit onto the altstack
-            OP_DUP
-            OP_TOALTSTACK
-            OP_TOALTSTACK
-
-            // Hash the input hash d times and put every result on the stack
-            for _ in 0..D {
-                OP_DUP OP_HASH160
-            }
-
-            // Verify the signature for this digit
-            OP_FROMALTSTACK
-            OP_PICK
-            { public_key[N as usize - 1 - digit_index as usize].to_vec() }
-            OP_EQUALVERIFY
-
-            // Drop the d+1 stack items
-            for _ in 0..(D+1)/2 {
-                OP_2DROP
-            }
-        }
-
-        //
-        // Verify the Checksum
-        //
-
-        // 1. Compute the checksum of the message's digits
-        OP_FROMALTSTACK OP_DUP OP_NEGATE
-        for _ in 1..N0 {
-            OP_FROMALTSTACK OP_TUCK OP_SUB
-        }
-        { D * N0 }
-        OP_ADD
-
-
-        // 2. Sum up the signed checksum's digits
-        OP_FROMALTSTACK
-        for _ in 0..N1 - 1 {
-            for _ in 0..LOG_D {
-                OP_DUP OP_ADD
-            }
-            OP_FROMALTSTACK
-            OP_ADD
-        }
-
-        // 3. Ensure both checksums are equal
-        OP_EQUALVERIFY
-
-
-        // Convert the message's digits to bytes
-        for i in 0..N0 / 2 {
-            OP_SWAP
-            for _ in 0..LOG_D {
-                OP_DUP OP_ADD
-            }
-            OP_ADD
-            // Push all bytes to the altstack, except for the last byte
-            if i != (N0/2) - 1 {
-                OP_TOALTSTACK
-            }
-        }
-        // Read the bytes from the altstack
-        for _ in 0..N0 / 2 - 1{
-            OP_FROMALTSTACK
-        }
-
-    }
-}
-
-#[cfg(test)]
-mod test {
-    use bitcoin::hex::FromHex as _;
-
-    use super::*;
-
-    // The secret key
-    const MY_SECKEY: &str = "b138982ce17ac813d505b5b40b665d404e9528e7";
-
-    #[test]
-    fn test_winternitz() {
-        // The message to sign
-        #[rustfmt::skip]
-        const MESSAGE: [u8; N0 as usize] = [
-            1, 2, 3, 4, 5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7,
-            1, 2, 3, 4, 5, 6, 7, 8, 9, 0xA, 0xB, 0xC, 0xD, 0xE, 0xF, 7, 7, 7, 7, 7,
-        ];
-
-        let secret_key = Vec::<u8>::from_hex(MY_SECKEY).unwrap();
-        let public_key = generate_public_key(secret_key.clone());
-
-        let script = script! {
-            { sign_digits(secret_key.clone(), MESSAGE) }
-            { checksig_verify(&public_key) }
-        };
-
-        println!(
-            "Winternitz signature size:\n \t{:?} bytes / {:?} bits \n\t{:?} bytes / bit",
-            script.len(),
-            N0 * 4,
-            script.len() as f64 / (N0 * 4) as f64
-        );
-
-        run(script! {
-            { sign_digits(secret_key, MESSAGE) }
-            { checksig_verify(&public_key) }
-
-            0x21 OP_EQUALVERIFY
-            0x43 OP_EQUALVERIFY
-            0x65 OP_EQUALVERIFY
-            0x87 OP_EQUALVERIFY
-            0xA9 OP_EQUALVERIFY
-            0xCB OP_EQUALVERIFY
-            0xED OP_EQUALVERIFY
-            0x7F OP_EQUALVERIFY
-            0x77 OP_EQUALVERIFY
-            0x77 OP_EQUALVERIFY
-
-            0x21 OP_EQUALVERIFY
-            0x43 OP_EQUALVERIFY
-            0x65 OP_EQUALVERIFY
-            0x87 OP_EQUALVERIFY
-            0xA9 OP_EQUALVERIFY
-            0xCB OP_EQUALVERIFY
-            0xED OP_EQUALVERIFY
-            0x7F OP_EQUALVERIFY
-            0x77 OP_EQUALVERIFY
-            0x77 OP_EQUAL
-        });
-    }
-
-    // TODO: test the error cases: negative digits, digits > D, ...
-}