{
 "number": 36398,
 "input_hash": "399be004121032d6",
 "model": "ledger",
 "prompt_hash": null,
 "created": "2026-10-26T01:22:33+00:00",
 "result": {
  "summary": "Restricts wallet periodic rebroadcast and mempool resubmission on startup or import to transactions originating from the wallet. Unconfirmed transactions that do not spend any wallet inputs (i.e. incoming payments) are skipped.",
  "problem": "Nodes leak network identity simply by passively running a wallet: if an attacker sends a low-fee transaction to a target address, the recipient node will rebroadcast it after a timeout or retain it across restarts, allowing observers to associate the node's IP address with the wallet.",
  "card": "Restricts wallet rebroadcasting and startup mempool resubmission exclusively to transactions originating from the wallet (`IsFromMe`). Currently, running a wallet passively rebroadcasts unconfirmed incoming transactions, enabling an attacker to identify a node's IP address by sending low-fee transactions to an address and watching for rebroadcasts or probing mempool retention across restarts. This resolves long-standing issue #3828, with the tradeoff that recipients must manually resubmit stuck incoming payments if the sender does not rebroadcast.",
  "evidence": [
   "Fixes issue #3828 ('Clients leak IPs if they are recipients of a transaction'), open since 2014.",
   "PR description notes: 'rebroadcast of transactions paying the wallet (but not spending any wallet inputs) is a privacy leak, since anyone can generate these, choose a low fee, and observe who rebroadcasts them.'"
  ],
  "scope_notes": "",
  "changed_since_previous": "Added release notes detailing that incoming transactions are no longer rebroadcast or reloaded into the mempool on startup.",
  "thread": {
   "last_event_at": "2026-10-25T11:23:34Z",
   "events": 5,
   "head_sha": "f63a38f781ad91c2047a1bdf5112477e87b6531d",
   "schema_floor": 2,
   "schema": 2
  },
  "waiting_on": [
   {
    "at": "2026-10-25",
    "id": "c:6397012438",
    "on": "author",
    "url": "https://github.com/bitcoin/bitcoin/pull/36398#issuecomment-6397012438",
    "what": "response to objections regarding CPFP rebroadcast and mempool re-entry"
   }
  ],
  "risk": {
   "level": "medium",
   "touches": [
    "wallet"
   ],
   "why": "A flaw in identifying originating transactions could cause a user's own outgoing transactions not to rebroadcast if dropped from the mempool."
  },
  "discussion": {
   "author_status": "last statement processed 2026-10-25",
   "open_concerns": [
    "achow101: Rebroadcasting incoming transactions is useful to help get them confirmed",
    "achow101: Incoming transactions must be in the mempool for the wallet to CPFP them",
    "achow101: Consider enabling rebroadcasting in a privacy-preserving manner, such as a node rebroadcast pool, rather than deleting it",
    "vasild: Make the behavior configurable (such as extending -walletbroadcast) so users can decide what fits their priorities",
    "fametrano: A CPFP child created by the wallet stays out of the mempool and is not rebroadcast after a restart without mempool.dat or mempool expiry because its unconfirmed parent is skipped"
   ],
   "resolved_concerns": [
    "instagibbs: Start a fresh issue to lay down and compare rebroadcast alternatives side by side (answered by achow101 2026-10-01)"
   ]
  },
  "reviewability": {
   "state": "Paused",
   "label": "Waiting on author",
   "reason": "Open objections from achow101, fametrano, vasild with no author reply for 7 days; review would repeat what has been asked."
  },
  "agreement": {
   "state": "Blocked",
   "summary": "Blocked: objection that needs a change, nobody has replied (achow101, fametrano)",
   "reason": "Added an objection from fametrano detailing that wallet-created CPFP children fail to re-enter the mempool or rebroadcast after restart or expiry because unconfirmed parents are omitted. The PR remains blocked awaiting author reply.",
   "evidence": [
    "achow101 (objection, approach, must be changed, open): Rebroadcasting incoming transactions is useful to help get them confirmed",
    "achow101 (objection, correctness, must be changed, open): Incoming transactions must be in the mempool for the wallet to CPFP them",
    "achow101 (suggestion, approach, must be answered, open): Consider enabling rebroadcasting in a privacy-preserving manner, such as a node rebroadcast pool, rather than deleting it",
    "vasild (suggestion, interface, must be answered, open): Make the behavior configurable (such as extending -walletbroadcast) so users can decide what fits their priorities",
    "fametrano (objection, correctness, must be changed, open): A CPFP child created by the wallet stays out of the mempool and is not rebroadcast after a restart without mempool.dat or mempool expiry because its unconfirmed parent is skipped",
    "vasild: Concept ACK \u2014 make this configurable somehow to let users decide what is best for them"
   ],
   "objections": [
    {
     "reviewer": "achow101",
     "association": "MEMBER",
     "type": "objection",
     "kind": "approach",
     "harm": "Rebroadcasting incoming transactions is useful to help get them confirmed",
     "request": "",
     "question": "",
     "text": "Rebroadcasting incoming transactions is useful to help get them confirmed",
     "clears_with": "change",
     "blocking": true,
     "status": "open",
     "status_note": "",
     "cleared": false,
     "author_replied": false,
     "others_replied": false,
     "fix_pushed": false,
     "replies": [],
     "evidence": "2026-10-01: 'Rebroadcasting transactions that are not ours is useful as rebroadcasting does have an effect on getting such transactions confirmed.'",
     "url": "https://github.com/bitcoin/bitcoin/pull/36398#issuecomment-5936779475",
     "id": "c:5936779475",
     "at": "2026-10-01",
     "status_at": null,
     "status_by": null,
     "resolution_evidence": "",
     "pin": null,
     "from_schema": 2
    },
    {
     "reviewer": "achow101",
     "association": "MEMBER",
     "type": "objection",
     "kind": "correctness",
     "harm": "Incoming transactions must be in the mempool for the wallet to CPFP them",
     "request": "",
     "question": "",
     "text": "Incoming transactions must be in the mempool for the wallet to CPFP them",
     "clears_with": "change",
     "blocking": true,
     "status": "open",
     "status_note": "",
     "cleared": false,
     "author_replied": false,
     "others_replied": false,
     "fix_pushed": false,
     "replies": [],
     "evidence": "2026-10-01: 'Furthermore, if we want to CPFP a transaction, it needs to be in our mempool first, otherwise the wallet will be unable to broadcast the child.'",
     "url": "https://github.com/bitcoin/bitcoin/pull/36398#issuecomment-5936779475",
     "id": "c:5936779475#2",
     "at": "2026-10-01",
     "status_at": null,
     "status_by": null,
     "resolution_evidence": "",
     "pin": null,
     "from_schema": 2
    },
    {
     "reviewer": "achow101",
     "association": "MEMBER",
     "type": "suggestion",
     "kind": "approach",
     "harm": "",
     "request": "Consider enabling rebroadcasting in a privacy-preserving manner, such as a node rebroadcast pool, rather than deleting it",
     "question": "",
     "text": "Consider enabling rebroadcasting in a privacy-preserving manner, such as a node rebroadcast pool, rather than deleting it",
     "clears_with": "answer",
     "blocking": false,
     "status": "open",
     "status_note": "",
     "cleared": false,
     "author_replied": false,
     "others_replied": false,
     "fix_pushed": false,
     "replies": [],
     "evidence": "2026-10-01: 'Instead of trying to delete rebroadcasting in the name of privacy, we should consider other ways to enable rebroadcasting in a privacy preserving manner, such as a rebroadcast pool in the node.'",
     "url": "https://github.com/bitcoin/bitcoin/pull/36398#issuecomment-5936779475",
     "id": "c:5936779475#3",
     "at": "2026-10-01",
     "status_at": null,
     "status_by": null,
     "resolution_evidence": "",
     "pin": null,
     "from_schema": 2
    },
    {
     "reviewer": "instagibbs",
     "association": "MEMBER",
     "type": "suggestion",
     "kind": "approach",
     "harm": "",
     "request": "Start a fresh issue to lay down and compare rebroadcast alternatives side by side",
     "question": "",
     "text": "Start a fresh issue to lay down and compare rebroadcast alternatives side by side",
     "clears_with": "answer",
     "blocking": false,
     "status": "answered",
     "status_note": "achow101 opened issue #36403 for discussion",
     "cleared": true,
     "author_replied": false,
     "others_replied": true,
     "fix_pushed": false,
     "replies": [
      "c:5939298900"
     ],
     "evidence": "2026-10-01: 'I think we need to start a fresh issue on the topic and lay down alternatives side by side'",
     "url": "https://github.com/bitcoin/bitcoin/pull/36398#issuecomment-5937194951",
     "id": "c:5937194951",
     "at": "2026-10-01",
     "status_at": "2026-10-01",
     "status_by": "achow101",
     "resolution_evidence": "2026-10-01: achow101: 'I've opened #36403 where we can have more high level discussion about transaction rebroadcast in general.'",
     "pin": null,
     "from_schema": 2
    },
    {
     "reviewer": "vasild",
     "association": "MEMBER",
     "type": "suggestion",
     "kind": "interface",
     "harm": "",
     "request": "Make the behavior configurable (such as extending -walletbroadcast) so users can decide what fits their priorities",
     "question": "",
     "text": "Make the behavior configurable (such as extending -walletbroadcast) so users can decide what fits their priorities",
     "clears_with": "answer",
     "blocking": false,
     "status": "open",
     "status_note": "",
     "cleared": false,
     "author_replied": false,
     "others_replied": false,
     "fix_pushed": false,
     "replies": [],
     "evidence": "2026-10-06: 'Concept ACK, but make this configurable somehow.'",
     "url": "https://github.com/bitcoin/bitcoin/pull/36398#issuecomment-6012406070",
     "id": "c:6012406070",
     "at": "2026-10-06",
     "status_at": null,
     "status_by": null,
     "resolution_evidence": "",
     "pin": null,
     "from_schema": 2
    },
    {
     "reviewer": "fametrano",
     "association": "CONTRIBUTOR",
     "type": "objection",
     "kind": "correctness",
     "harm": "A CPFP child created by the wallet stays out of the mempool and is not rebroadcast after a restart without mempool.dat or mempool expiry because its unconfirmed parent is skipped",
     "request": "",
     "question": "",
     "text": "A CPFP child created by the wallet stays out of the mempool and is not rebroadcast after a restart without mempool.dat or mempool expiry because its unconfirmed parent is skipped",
     "clears_with": "change",
     "blocking": true,
     "status": "open",
     "status_note": "",
     "cleared": false,
     "author_replied": false,
     "others_replied": false,
     "fix_pushed": false,
     "replies": [],
     "evidence": "2026-10-25: 'After a restart without mempool.dat, or after mempool expiry, a CPFP child that the wallet itself created for an incoming payment stays out of the mempool on this branch, and no resend timer brings it back.'",
     "url": "https://github.com/bitcoin/bitcoin/pull/36398#issuecomment-6397012438",
     "id": "c:6397012438",
     "at": "2026-10-25",
     "status_at": null,
     "status_by": null,
     "resolution_evidence": "",
     "pin": null,
     "from_schema": 2
    }
   ],
   "support": [
    {
     "reviewer": "vasild",
     "reason": "make this configurable somehow to let users decide what is best for them",
     "substantive": false,
     "verdict": "Concept ACK",
     "id": "c:6012406070",
     "url": "https://github.com/bitcoin/bitcoin/pull/36398#issuecomment-6012406070",
     "at": "2026-10-06",
     "association": "MEMBER",
     "evidence": "none",
     "areas": []
    }
   ],
   "participants": [
    {
     "login": "achow101",
     "stance": "objection",
     "note": "Concept NACK-ish: notes rebroadcasting incoming txs helps confirmation and is needed for CPFP; suggests a node rebroadcast pool",
     "association": "MEMBER",
     "comments": 2,
     "first": "2026-10-01",
     "last": "2026-10-01"
    },
    {
     "login": "instagibbs",
     "stance": "neutral",
     "note": "linked past rebroadcast pool PRs and suggested opening an issue to compare alternatives",
     "association": "MEMBER",
     "comments": 1,
     "first": "2026-10-01",
     "last": "2026-10-01"
    },
    {
     "login": "vasild",
     "stance": "support",
     "note": "Concept ACK, suggested making the behavior configurable",
     "association": "MEMBER",
     "comments": 1,
     "first": "2026-10-06",
     "last": "2026-10-06"
    },
    {
     "login": "fametrano",
     "stance": "objection",
     "note": "demonstrated regression where wallet CPFP child transactions fail to re-enter mempool or rebroadcast after restart or mempool expiry",
     "association": "CONTRIBUTOR",
     "comments": 1,
     "first": "2026-10-25",
     "last": "2026-10-25"
    }
   ],
   "derivation": "objection that needs a change, nobody has replied (achow101, fametrano)",
   "model_state": null,
   "corrections": [],
   "notes": "Added an objection from fametrano detailing that wallet-created CPFP children fail to re-enter the mempool or rebroadcast after restart or expiry because unconfirmed parents are omitted. The PR remains blocked awaiting author reply."
  },
  "dependencies": {
   "depends_on": [],
   "enables": []
  },
  "categories": [
   {
    "name": "docs",
    "member": false,
    "evidence": "Release note file doc/release-notes-36398.md merely accompanies a wallet code change.",
    "band": "Unranked",
    "reason_tag": "cleanup",
    "score": 0.0,
    "factors": {
     "bug_severity": 2,
     "leverage": 0,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Category covers documentation as the primary change and explicitly excludes code changes that merely update their docs."
   },
   {
    "name": "wallet",
    "member": true,
    "evidence": "Has Wallet label and modifies wallet rebroadcast logic in src/wallet/wallet.cpp.",
    "band": "P1",
    "reason_tag": "bug fix",
    "score": 0.8,
    "factors": {
     "bug_severity": 2,
     "leverage": 0,
     "performance": 0,
     "security_stability": 2,
     "user_value": 2
    },
    "rationale": "Fixes a long-standing network privacy leak where nodes rebroadcast incoming payments. As noted in issue #3828, an attacker can send low-fee transactions to target addresses and observe which node rebroadcasts them, leaking the wallet holder's IP address."
   }
  ],
  "confidence": "high",
  "uncertainties": [],
  "needs": []
 },
 "cost_usd": 0.0,
 "source": {
  "record": "2026-10-26T01:22:33+00:00",
  "code": "2026-10-03T01:29:03+00:00",
  "judgments": 2
 }
}