feat: add custom opcode check for datapush

modules/runes/internal/runes/runestone.go

@@ -350,11 +350,10 @@ func runestonePayloadFromTx(tx *types.Transaction) ([]byte, Flaws) {
 			if tokenizer.Err() != nil {
 				return nil, FlawFlagInvalidScript.Mask()
 			}
-			data := tokenizer.Data()
-			if data == nil {
+			if !IsDataPushOpCode(tokenizer.Opcode()) {
 				return nil, FlawFlagOpCode.Mask()
 			}
-			payload = append(payload, data...)
+			payload = append(payload, tokenizer.Data()...)
 		}
 		if tokenizer.Err() != nil {
 			return nil, FlawFlagInvalidScript.Mask()
@@ -383,3 +382,8 @@ func decodeLEB128VarIntsFromPayload(payload []byte) ([]uint128.Uint128, error) {
 
 	return integers, nil
 }
+
+func IsDataPushOpCode(opCode byte) bool {
+	// includes OP_0, OP_DATA_1 to OP_DATA_75, OP_PUSHDATA1, OP_PUSHDATA2, OP_PUSHDATA4
+	return opCode <= txscript.OP_PUSHDATA4
+}

modules/runes/internal/runes/runestone_test.go

@@ -1626,8 +1626,11 @@ func TestDecipherRunestone(t *testing.T) {
 		)
 	})
 	t.Run("all_pushdata_opcodes_are_valid", func(t *testing.T) {
-		// note: ord's original test includes i = 0 case, but in ord code, OP_0 is treated as data push.
-		for i := 1; i < 79; i++ {
+		// PushData opcodes include (per ord's spec):
+		// 1. OP_0
+		// 2. OP_DATA_1 - OP_DATA_76
+		// 3. OP_PUSHDATA1, OP_PUSHDATA2, OP_PUSHDATA4
+		for i := 0; i < 79; i++ {
 			pkScript := make([]byte, 0)
 
 			pkScript = append(pkScript, txscript.OP_RETURN)

modules/runes/processor_process.go

@@ -501,9 +501,13 @@ func (p *Processor) txCommitsToRune(ctx context.Context, tx *types.Transaction,
 			if tapscript.Err() != nil {
 				break
 			}
-			data := tapscript.Data()
+			// check opcode is valid
+			if !runes.IsDataPushOpCode(tapscript.Opcode()) {
+				continue
+			}
+
 			// tapscript must contain commitment of the rune
-			if !bytes.Equal(data, commitment) {
+			if !bytes.Equal(tapscript.Data(), commitment) {
 				continue
 			}