From 5c001efa74854ddfccd0a0f0321b4706f6f64c2d Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Mon, 3 Aug 2026 13:49:13 -0500
Subject: [PATCH 1/2] refactor(utils): let FundTransaction return change to a
 separate script

FundTransaction always paid the change back to the payout script, which only works when that script is spendable. A test funding a governance proposal fee has to burn the amount to an OP_RETURN, so the change needs its own destination.
---
 src/test/util/masternode.cpp | 8 +++++++-
 src/test/util/masternode.h   | 3 +++
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/src/test/util/masternode.cpp b/src/test/util/masternode.cpp
index a40ad701d641..0551591a2f94 100644
--- a/src/test/util/masternode.cpp
+++ b/src/test/util/masternode.cpp
@@ -66,6 +66,12 @@ SimpleUTXOMap BuildSimpleUtxoMap(const std::vector<CTransactionRef>& txs)
 
 SimpleUTXOMap FundTransaction(const ChainstateManager& chainman, CMutableTransaction& tx, SimpleUTXOMap& utxos,
                               const CScript& script_payout, CAmount amount)
+{
+    return FundTransaction(chainman, tx, utxos, script_payout, amount, /*script_change=*/script_payout);
+}
+
+SimpleUTXOMap FundTransaction(const ChainstateManager& chainman, CMutableTransaction& tx, SimpleUTXOMap& utxos,
+                              const CScript& script_payout, CAmount amount, const CScript& script_change)
 {
     CAmount change;
     auto inputs = WITH_LOCK(::cs_main, return SelectUTXOs(chainman.ActiveChain(), utxos, amount, change));
@@ -74,7 +80,7 @@ SimpleUTXOMap FundTransaction(const ChainstateManager& chainman, CMutableTransac
     }
     tx.vout.emplace_back(amount, script_payout);
     if (change != 0) {
-        tx.vout.emplace_back(change, script_payout);
+        tx.vout.emplace_back(change, script_change);
     }
     return inputs;
 }
diff --git a/src/test/util/masternode.h b/src/test/util/masternode.h
index 0a894e157a2c..63b715ae3d5a 100644
--- a/src/test/util/masternode.h
+++ b/src/test/util/masternode.h
@@ -20,6 +20,9 @@ using SimpleUTXOMap = std::map<COutPoint, Coin>;
 SimpleUTXOMap BuildSimpleUtxoMap(const std::vector<CTransactionRef>& txs);
 SimpleUTXOMap FundTransaction(const ChainstateManager& chainman, CMutableTransaction& tx, SimpleUTXOMap& utxos,
                               const CScript& script_payout, CAmount amount);
+//! Overload for payout scripts that cannot receive the change, e.g. an OP_RETURN burn.
+SimpleUTXOMap FundTransaction(const ChainstateManager& chainman, CMutableTransaction& tx, SimpleUTXOMap& utxos,
+                              const CScript& script_payout, CAmount amount, const CScript& script_change);
 void SignTransaction(CMutableTransaction& tx, const SimpleUTXOMap& coins, const CKey& coinbase_key);
 CMutableTransaction CreateProRegTx(const ChainstateManager& chainman, SimpleUTXOMap& utxos, int port,
                                    const CScript& script_payout, const CKey& coinbase_key, CKey& owner_key_ret,

From 6a31b03f68746ca8e5a073fefcbd480619d76a14 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Fri, 7 Aug 2026 17:07:34 -0500
Subject: [PATCH 2/2] test: cover the governance vote signature path with a
 chain-backed fixture

The existing governance unit tests run on a fixture with no chain, so the tip masternode list is empty and every CGovernanceVote::IsValid() call short-circuits at GetMNByCollateral before any signature is verified. Nothing exercised CheckSignature, and nothing proved that a legitimately signed vote is accepted at all.

Add a fixture that mines a regtest chain, registers a masternode via a real ProRegTx and keeps its voting (ECDSA) and operator (BLS) keys, so votes can be signed for real. On top of it: an orphan vote (parent object unknown) from a registered masternode is cached, requested and replayed onto the object once its fee collateral confirms and the proposal arrives; forged voting-key (ECDSA) and operator-key (BLS) signatures, unknown-masternode and future-dated votes are rejected with a peer penalty; and funding votes on a proposal are accepted only from the voting key while other signals accept the operator key.

The orphan replay leaves the vote unindexed in cmapVoteToObject (so the inv relayed during replay cannot be served); the test pins that known gap so a future fix has to update it.

Verified by mutation: inverting a masternode/signature gate in front of the orphan cache fails the orphan test, and making CheckSignature always succeed fails the rejection tests.
---
 src/Makefile.test.include                     |   1 +
 src/test/governance_vote_processing_tests.cpp | 384 ++++++++++++++++++
 2 files changed, 385 insertions(+)
 create mode 100644 src/test/governance_vote_processing_tests.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 44ef47bd7999..70443412e772 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -124,6 +124,7 @@ BITCOIN_TESTS =\
   test/governance_inv_tests.cpp \
   test/governance_superblock_tests.cpp \
   test/governance_validators_tests.cpp \
+  test/governance_vote_processing_tests.cpp \
   test/governance_vote_sync_tests.cpp \
   test/governance_vote_wire_tests.cpp \
   test/coinjoin_inouts_tests.cpp \
diff --git a/src/test/governance_vote_processing_tests.cpp b/src/test/governance_vote_processing_tests.cpp
new file mode 100644
index 000000000000..77e2705e8ae7
--- /dev/null
+++ b/src/test/governance_vote_processing_tests.cpp
@@ -0,0 +1,384 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <consensus/amount.h>
+#include <evo/chainhelper.h>
+#include <evo/deterministicmns.h>
+#include <governance/governance.h>
+#include <governance/object.h>
+#include <governance/vote.h>
+#include <index/txindex.h>
+#include <interfaces/chain.h>
+#include <key.h>
+#include <key_io.h>
+#include <masternode/meta.h>
+#include <masternode/sync.h>
+#include <messagesigner.h>
+#include <netfulfilledman.h>
+#include <primitives/transaction.h>
+#include <script/standard.h>
+#include <timedata.h>
+#include <uint256.h>
+#include <util/strencodings.h>
+#include <util/time.h>
+#include <validation.h>
+#include <validationinterface.h>
+
+#include <test/util/index.h>
+#include <test/util/masternode.h>
+#include <test/util/setup_common.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <chrono>
+#include <memory>
+#include <string>
+#include <vector>
+
+using namespace std::chrono_literals;
+
+namespace {
+// TestChainSetup only accepts checkpointed chain lengths, so 107 blocks plus
+// -dip3params=109:500 is the shortest chain a ProRegTx can be mined on. Same setup as
+// TestChainDIP3Setup in evo_deterministicmns_tests.cpp.
+constexpr int DIP3_ACTIVATION_HEIGHT{109};
+
+void SignWithVotingKey(CGovernanceVote& vote, const CKey& key)
+{
+    std::vector<unsigned char> sig;
+    BOOST_REQUIRE(CMessageSigner::SignMessage(vote.GetSignatureString(), sig, key));
+    vote.SetSignature(sig);
+}
+
+void SignWithOperatorKey(CGovernanceVote& vote, const CBLSSecretKey& key)
+{
+    // Vote signatures are always basic-scheme, regardless of the currently active BLS scheme:
+    // CGovernanceVote::CheckSignature() deserializes and verifies with legacy=false.
+    vote.SetSignature(
+        key.Sign(vote.GetSignatureHash(), /*specificLegacyScheme=*/false).ToByteVector(/*specificLegacyScheme=*/false));
+}
+
+// A chain with one registered masternode whose voting (ECDSA) and operator (BLS) keys are known
+// to the test, so votes can be signed for real and CGovernanceVote::CheckSignature is actually
+// reached. Without a populated masternode list every CGovernanceVote::IsValid() call would
+// short-circuit at GetMNByCollateral and no signature would ever be verified.
+struct GovernanceVoteSetup : public TestChainSetup {
+    CKey mn_voting_key;
+    CBLSSecretKey mn_operator_key;
+    COutPoint mn_collateral;
+    SimpleUTXOMap utxos;
+    //! Fixed so a proposal can be rebuilt bit-for-bit (and keep its hash) once its fee tx is known.
+    int64_t proposal_time{0};
+    std::string proposal_payment_address;
+
+    GovernanceVoteSetup() :
+        TestChainSetup(DIP3_ACTIVATION_HEIGHT - 2, CBaseChainParams::REGTEST, {"-dip3params=109:500"})
+    {
+        // A failed BOOST_REQUIRE below throws, and a throwing constructor means no destructor runs.
+        // Tear the globals down by hand so one broken invariant here doesn't leave a live tx index
+        // (and a dangling m_node reference in it) for every later test in the binary.
+        try {
+            SetUp();
+        } catch (...) {
+            TearDown();
+            throw;
+        }
+    }
+
+    ~GovernanceVoteSetup() { TearDown(); }
+
+    void SetUp()
+    {
+        // CGovernanceObject::IsCollateralValid() reads the proposal fee tx out of the tx index;
+        // without it no proposal can ever be accepted, orphan votes included.
+        g_txindex = std::make_unique<TxIndex>(interfaces::MakeChain(m_node), /*n_cache_size=*/1 << 20,
+                                              /*f_memory=*/true);
+        BOOST_REQUIRE(g_txindex->Start());
+        IndexWaitSynced(*g_txindex);
+
+        utxos = BuildSimpleUtxoMap(m_coinbase_txns);
+
+        // Activate DIP3, then register the masternode that votes in these tests.
+        MineBlocks(1);
+        auto protx = CreateProRegTx(*m_node.chainman, utxos, /*port=*/1, payout_script(), coinbaseKey, mn_voting_key,
+                                    mn_operator_key);
+        mn_collateral = COutPoint(protx.GetHash(), 0);
+        MineBlock({protx});
+        BOOST_REQUIRE(tip_mn_list().GetMNByCollateral(mn_collateral) != nullptr);
+
+        BOOST_REQUIRE(m_node.mn_metaman->LoadCache(/*load_cache=*/false));
+        BOOST_REQUIRE(m_node.netfulfilledman->LoadCache(/*load_cache=*/false));
+        // Governance relay and CheckAndRemove() are no-ops until the node considers itself synced.
+        // Two SwitchToNextAsset() calls get there from BLOCKCHAIN; the bound is just a loop guard.
+        for (int i = 0; i < 5 && !m_node.mn_sync->IsSynced(); ++i) {
+            m_node.mn_sync->SwitchToNextAsset();
+        }
+        BOOST_REQUIRE(m_node.mn_sync->IsSynced());
+
+        m_node.govman = std::make_unique<CGovernanceManager>(*m_node.mn_metaman, *m_node.chainman,
+                                                             *m_node.chain_helper->superblocks, *m_node.dmnman,
+                                                             *m_node.mn_sync);
+        BOOST_REQUIRE(m_node.govman->LoadCache(/*load_cache=*/false));
+
+        proposal_time = TicksSinceEpoch<std::chrono::seconds>(GetAdjustedTime());
+        CKey payment_key;
+        payment_key.MakeNewKey(true);
+        proposal_payment_address = EncodeDestination(PKHash(payment_key.GetPubKey()));
+    }
+
+    void TearDown()
+    {
+        // govman holds a reference into chain_helper, so it must go first (matches PrepareShutdown
+        // ordering in init.cpp).
+        m_node.govman.reset();
+        if (g_txindex) {
+            SyncWithValidationInterfaceQueue();
+            g_txindex->Stop();
+            g_txindex.reset();
+        }
+    }
+
+    CScript coinbase_script() const { return GetScriptForRawPubKey(coinbaseKey.GetPubKey()); }
+
+    //! Masternode payouts and the proposal fee change must go to a P2PKH script (bad-protx-payee
+    //! rejects the raw-pubkey coinbase script, IsCollateralValid() rejects anything else).
+    CScript payout_script() const { return GetScriptForDestination(PKHash(coinbaseKey.GetPubKey())); }
+
+    CDeterministicMNList tip_mn_list() const { return m_node.dmnman->GetListAtChainTip(); }
+
+    void MineBlock(const std::vector<CMutableTransaction>& txns)
+    {
+        const CBlock block = CreateAndProcessBlock(txns, coinbase_script());
+        const CBlockIndex* tip{WITH_LOCK(::cs_main, return m_node.chainman->ActiveChain().Tip())};
+        BOOST_REQUIRE_EQUAL(tip->GetBlockHash(), block.GetHash());
+        m_node.dmnman->UpdatedBlockTip(tip);
+        SetMockTime(GetTime() + 1);
+        IndexWaitSynced(*g_txindex);
+    }
+
+    void MineBlocks(int num_blocks)
+    {
+        for (int i = 0; i < num_blocks; ++i) {
+            MineBlock({});
+        }
+    }
+
+    //! The proposal both the orphan vote and the fee tx below commit to. The object hash
+    //! deliberately excludes the collateral hash, so the same proposal can be built first with an
+    //! empty collateral (to learn its hash) and again once the fee tx paying to that hash exists.
+    CGovernanceObject MakeProposal(const uint256& collateral_hash) const
+    {
+        const std::string data{
+            strprintf("{\"type\":1,\"name\":\"test-proposal\",\"start_epoch\":%d,\"end_epoch\":%d,\"payment_amount\":1.0,\"payment_address\":\"%s\",\"url\":\"https://dash.org\"}",
+                      proposal_time, proposal_time + 100000, proposal_payment_address)};
+        return CGovernanceObject{uint256{}, /*revision=*/1, proposal_time, collateral_hash, HexStr(data)};
+    }
+
+    //! Burns the proposal fee to an OP_RETURN committing to the object hash, the way
+    //! `gobject prepare` does, and buries it under the confirmations the collateral check needs.
+    uint256 ConfirmProposalCollateral(const uint256& govobj_hash)
+    {
+        CMutableTransaction tx;
+        // IsCollateralValid() rejects the fee tx unless every output is P2PKH or unspendable, so
+        // the change cannot go back to the burn script.
+        const auto spent = FundTransaction(*m_node.chainman, tx, utxos,
+                                           CScript() << OP_RETURN << ToByteVector(govobj_hash),
+                                           GOVERNANCE_PROPOSAL_FEE_TX, /*script_change=*/payout_script());
+        SignTransaction(tx, spent, coinbaseKey);
+
+        MineBlock({tx});
+        MineBlocks(GOVERNANCE_FEE_CONFIRMATIONS - 1);
+        return tx.GetHash();
+    }
+
+    //! A vote's hash covers everything but its signature, so votes that should be distinguishable
+    //! (e.g. a re-signed vote) need distinct timestamps.
+    CGovernanceVote MakeVote(const uint256& parent_hash, vote_signal_enum_t signal, vote_outcome_enum_t outcome,
+                             std::chrono::seconds time_offset = 0s) const
+    {
+        CGovernanceVote vote{mn_collateral, parent_hash, signal, outcome};
+        vote.SetTime(GetAdjustedTime() + time_offset);
+        return vote;
+    }
+};
+} // namespace
+
+BOOST_FIXTURE_TEST_SUITE(governance_vote_processing_tests, GovernanceVoteSetup)
+
+// A vote that arrives before its parent object must be kept and replayed once the object shows up,
+// otherwise every vote that races ahead of its proposal is lost for good.
+BOOST_AUTO_TEST_CASE(orphan_vote_is_cached_and_applied_when_parent_arrives)
+{
+    auto& govman = *m_node.govman;
+
+    // Build the proposal but keep it out of the manager: the vote arrives first.
+    const uint256 parent_hash{MakeProposal(uint256{}).GetHash()};
+    BOOST_REQUIRE(!govman.HaveObjectForHash(parent_hash));
+
+    CGovernanceVote vote{MakeVote(parent_hash, VOTE_SIGNAL_FUNDING, VOTE_OUTCOME_YES)};
+    SignWithVotingKey(vote, mn_voting_key);
+    // Guard: the orphan gate rejects a vote it cannot verify against the masternode list, so if
+    // the masternode or its signature were not recognized every check below would fail at once.
+    // Requiring validity up front turns that diffuse failure into one pointed at the setup.
+    BOOST_REQUIRE(vote.IsValid(tip_mn_list(), /*useVotingKey=*/true));
+
+    CGovernanceException exception;
+    uint256 hash_to_request;
+    BOOST_CHECK(!govman.ProcessVote(vote, exception, hash_to_request));
+    BOOST_CHECK_EQUAL(exception.GetType(), GOVERNANCE_EXCEPTION_WARNING);
+    BOOST_CHECK_EQUAL(exception.GetNodePenalty(), 0);
+    // The caller uses this to ask the sending peer for the missing object.
+    BOOST_CHECK_EQUAL(hash_to_request, parent_hash);
+    BOOST_CHECK(govman.GetOrphanVoteObjectHashes() == std::vector<uint256>{parent_hash});
+
+    const uint256 collateral_hash{ConfirmProposalCollateral(parent_hash)};
+    CGovernanceObject proposal{MakeProposal(collateral_hash)};
+    BOOST_REQUIRE_EQUAL(proposal.GetHash(), parent_hash);
+    govman.AddGovernanceObject(proposal, /*peer_str=*/"");
+    BOOST_REQUIRE(govman.HaveObjectForHash(parent_hash));
+
+    // The orphan vote is now applied to the object it was waiting for and is no longer pending.
+    auto stored = govman.FindConstGovernanceObject(parent_hash);
+    BOOST_REQUIRE(stored != nullptr);
+    BOOST_CHECK_EQUAL(stored->GetAbsoluteYesCount(tip_mn_list(), VOTE_SIGNAL_FUNDING), 1);
+    BOOST_CHECK_EQUAL(govman.GetCurrentVotes(parent_hash, mn_collateral).size(), 1U);
+    BOOST_CHECK(govman.GetOrphanVoteObjectHashes().empty());
+    // Known gap, pinned here so a fix has to update this test: CheckOrphanVotes() applies the
+    // vote to the object but never indexes it in cmapVoteToObject, so the vote inv it relays
+    // during the replay cannot be served to a peer that requests it.
+    BOOST_CHECK(!govman.HaveVoteForHash(vote.GetHash()));
+
+    // A peer re-sending the same vote must not be punished for it.
+    CGovernanceException replay_exception;
+    uint256 replay_hash_to_request;
+    BOOST_CHECK(!govman.ProcessVote(vote, replay_exception, replay_hash_to_request));
+    BOOST_CHECK_EQUAL(replay_exception.GetNodePenalty(), 0);
+    BOOST_CHECK_EQUAL(stored->GetAbsoluteYesCount(tip_mn_list(), VOTE_SIGNAL_FUNDING), 1);
+}
+
+// Votes are only counted if they carry a signature from a registered masternode.
+BOOST_AUTO_TEST_CASE(unsigned_and_unknown_masternode_votes_are_rejected)
+{
+    auto& govman = *m_node.govman;
+
+    const CGovernanceObject proposal{MakeProposal(uint256::ONE)};
+    const uint256 parent_hash{proposal.GetHash()};
+    govman.AddGovernanceObjectForTesting(proposal);
+    BOOST_REQUIRE(govman.HaveObjectForHash(parent_hash));
+
+    // Forged signature: right masternode, wrong key.
+    CKey attacker_key;
+    attacker_key.MakeNewKey(true);
+    CGovernanceVote forged{MakeVote(parent_hash, VOTE_SIGNAL_FUNDING, VOTE_OUTCOME_YES)};
+    SignWithVotingKey(forged, attacker_key);
+
+    CGovernanceException exception;
+    uint256 hash_to_request;
+    BOOST_CHECK(!govman.ProcessVote(forged, exception, hash_to_request));
+    BOOST_CHECK_EQUAL(exception.GetType(), GOVERNANCE_EXCEPTION_PERMANENT_ERROR);
+    BOOST_CHECK_EQUAL(exception.GetNodePenalty(), 20);
+    BOOST_CHECK(!govman.HaveVoteForHash(forged.GetHash()));
+
+    // Re-sending a vote already known to be invalid is still punished, without re-verifying it.
+    CGovernanceException repeat_exception;
+    BOOST_CHECK(!govman.ProcessVote(forged, repeat_exception, hash_to_request));
+    BOOST_CHECK_EQUAL(repeat_exception.GetType(), GOVERNANCE_EXCEPTION_PERMANENT_ERROR);
+    BOOST_CHECK_EQUAL(repeat_exception.GetNodePenalty(), 20);
+
+    // Forged operator signature: right masternode, wrong BLS key. A non-funding signal, so the
+    // operator-key (BLS) verification path is the one that must reject it.
+    CBLSSecretKey attacker_operator_key;
+    attacker_operator_key.MakeNewKey();
+    CGovernanceVote forged_bls{MakeVote(parent_hash, VOTE_SIGNAL_VALID, VOTE_OUTCOME_YES)};
+    SignWithOperatorKey(forged_bls, attacker_operator_key);
+
+    CGovernanceException forged_bls_exception;
+    BOOST_CHECK(!govman.ProcessVote(forged_bls, forged_bls_exception, hash_to_request));
+    BOOST_CHECK_EQUAL(forged_bls_exception.GetType(), GOVERNANCE_EXCEPTION_PERMANENT_ERROR);
+    BOOST_CHECK_EQUAL(forged_bls_exception.GetNodePenalty(), 20);
+    BOOST_CHECK(!govman.HaveVoteForHash(forged_bls.GetHash()));
+
+    // Correctly signed, but the outpoint belongs to no masternode.
+    CKey stranger_key;
+    stranger_key.MakeNewKey(true);
+    CGovernanceVote stranger{COutPoint{uint256S("42"), 0}, parent_hash, VOTE_SIGNAL_FUNDING, VOTE_OUTCOME_YES};
+    stranger.SetTime(GetAdjustedTime());
+    SignWithVotingKey(stranger, stranger_key);
+
+    CGovernanceException stranger_exception;
+    BOOST_CHECK(!govman.ProcessVote(stranger, stranger_exception, hash_to_request));
+    BOOST_CHECK_EQUAL(stranger_exception.GetType(), GOVERNANCE_EXCEPTION_PERMANENT_ERROR);
+    BOOST_CHECK_EQUAL(stranger_exception.GetNodePenalty(), 20);
+
+    // A vote dated too far in the future is rejected even with a valid signature.
+    CGovernanceVote from_the_future{MakeVote(parent_hash, VOTE_SIGNAL_FUNDING, VOTE_OUTCOME_YES, 2h)};
+    SignWithVotingKey(from_the_future, mn_voting_key);
+
+    CGovernanceException future_exception;
+    BOOST_CHECK(!govman.ProcessVote(from_the_future, future_exception, hash_to_request));
+    BOOST_CHECK_EQUAL(future_exception.GetType(), GOVERNANCE_EXCEPTION_PERMANENT_ERROR);
+    BOOST_CHECK_EQUAL(future_exception.GetNodePenalty(), 20);
+
+    auto stored = govman.FindConstGovernanceObject(parent_hash);
+    BOOST_REQUIRE(stored != nullptr);
+    BOOST_CHECK_EQUAL(stored->GetAbsoluteYesCount(tip_mn_list(), VOTE_SIGNAL_FUNDING), 0);
+    BOOST_CHECK_EQUAL(stored->GetAbsoluteYesCount(tip_mn_list(), VOTE_SIGNAL_VALID), 0);
+}
+
+// Funding a proposal is the one decision reserved for the voting key; every other signal may be
+// signed by the operator (BLS) key. Mixing the two up must not be accepted either way around.
+//
+// Rate checks are live on this path (unlike the orphan replay above, which disables them), so each
+// vote below has to be the first *accepted* one for its (masternode, signal) pair: a rejected vote
+// leaves last_update at epoch 0, but a second accepted vote for the same signal would be turned
+// away by the 1h GOVERNANCE_UPDATE_MIN limit instead of the rule under test.
+BOOST_AUTO_TEST_CASE(proposal_funding_votes_require_the_voting_key)
+{
+    auto& govman = *m_node.govman;
+
+    const CGovernanceObject proposal{MakeProposal(uint256::ONE)};
+    const uint256 parent_hash{proposal.GetHash()};
+    govman.AddGovernanceObjectForTesting(proposal);
+    auto stored = govman.FindConstGovernanceObject(parent_hash);
+    BOOST_REQUIRE(stored != nullptr);
+
+    // Operator key on a funding vote: valid BLS signature, wrong key for this signal.
+    CGovernanceVote funding_by_operator{MakeVote(parent_hash, VOTE_SIGNAL_FUNDING, VOTE_OUTCOME_YES)};
+    SignWithOperatorKey(funding_by_operator, mn_operator_key);
+    BOOST_REQUIRE(funding_by_operator.IsValid(tip_mn_list(), /*useVotingKey=*/false));
+
+    CGovernanceException exception;
+    uint256 hash_to_request;
+    BOOST_CHECK(!govman.ProcessVote(funding_by_operator, exception, hash_to_request));
+    BOOST_CHECK_EQUAL(exception.GetType(), GOVERNANCE_EXCEPTION_PERMANENT_ERROR);
+    BOOST_CHECK_EQUAL(exception.GetNodePenalty(), 20);
+    BOOST_CHECK_EQUAL(stored->GetAbsoluteYesCount(tip_mn_list(), VOTE_SIGNAL_FUNDING), 0);
+
+    // Voting key on a funding vote: accepted and counted. Dated a second later so it is a vote in
+    // its own right rather than the rejected one above with a different signature glued on.
+    CGovernanceVote funding_by_voting_key{MakeVote(parent_hash, VOTE_SIGNAL_FUNDING, VOTE_OUTCOME_YES, 1s)};
+    SignWithVotingKey(funding_by_voting_key, mn_voting_key);
+
+    CGovernanceException funding_exception;
+    BOOST_CHECK(govman.ProcessVote(funding_by_voting_key, funding_exception, hash_to_request));
+    BOOST_CHECK(govman.HaveVoteForHash(funding_by_voting_key.GetHash()));
+    BOOST_CHECK_EQUAL(stored->GetAbsoluteYesCount(tip_mn_list(), VOTE_SIGNAL_FUNDING), 1);
+
+    // Operator key on a non-funding signal: accepted and counted.
+    CGovernanceVote valid_by_operator{MakeVote(parent_hash, VOTE_SIGNAL_VALID, VOTE_OUTCOME_YES)};
+    SignWithOperatorKey(valid_by_operator, mn_operator_key);
+
+    CGovernanceException valid_exception;
+    BOOST_CHECK(govman.ProcessVote(valid_by_operator, valid_exception, hash_to_request));
+    BOOST_CHECK(govman.HaveVoteForHash(valid_by_operator.GetHash()));
+    BOOST_CHECK_EQUAL(stored->GetAbsoluteYesCount(tip_mn_list(), VOTE_SIGNAL_VALID), 1);
+
+    // A known good vote received twice is dropped quietly, not punished.
+    CGovernanceException duplicate_exception;
+    BOOST_CHECK(!govman.ProcessVote(funding_by_voting_key, duplicate_exception, hash_to_request));
+    BOOST_CHECK_EQUAL(duplicate_exception.GetNodePenalty(), 0);
+    BOOST_CHECK_EQUAL(stored->GetAbsoluteYesCount(tip_mn_list(), VOTE_SIGNAL_FUNDING), 1);
+}
+
+BOOST_AUTO_TEST_SUITE_END()