{ "number": 36437, "input_hash": "541977f91712e942", "model": "ledger", "prompt_hash": null, "created": "2026-10-26T01:21:48+00:00", "result": { "summary": "Fixes a transaction relay liveness bug in TxOrphanage by reassigning orphan reconsideration to another announcer when the currently assigned announcer's entry is erased due to disconnect or eviction. It also adds an end-to-end P2P fuzz target (`p2p_1p1c_liveness`) that drives PeerManager with real messages and validation to verify 1-parent-1-child relay under adversarial conditions.", "problem": "When a missing parent transaction is accepted, its orphan children are assigned to a single announcer's work set for reconsideration. If that announcer disconnects or gets evicted before the node retries the orphan, the transaction remains stranded in the orphanage without being processed; because the node already holds the orphan, re-announcements from other peers do not re-fetch it, allowing peers to stall CPFP child relay until the orphan is evicted.", "card": "This pull request fixes a transaction relay liveness hole in TxOrphanage where an orphan queued for reconsideration is abandoned if its assigned announcer disconnects or is evicted before retry. Because the transaction remains held in the orphanage, subsequent announcements from honest peers are ignored, allowing peers to deliberately delay transactions such as CPFP children until eviction. TxOrphanage now reassigns reconsideration to a remaining announcer on erasure. The PR also introduces an end-to-end fuzz harness that reproduces this vulnerability on master in under an hour and validates parent-child relay under adversarial conditions, unblocking follow-up hole fixes in #36506.", "evidence": [ "Commit 65b48ba1f1: 'If that announcer disconnects or is evicted first, the orphan is never retried, and re-announcements by the other announcers don't fetch it again since it is already held. This keeps e.g. a CPFP child of a parent that pays for itself out of the mempool until the orphan is evicted, and an announcer can cause it on purpose.'", "PR description: 'With that flag turned off, the target finds this bug on master from an empty corpus in under an hour on one core; an earlier version found it first (https://github.com/bitcoin/bitcoin/pull/36371#issuecomment-5937814761).'" ], "scope_notes": "The PR contains a small 20-line logic fix in src/node/txorphanage.cpp along with a large (~570-line) new fuzz harness in src/test/fuzz/p2p_1p1c_liveness.cpp.", "changed_since_previous": "Rebased and marked as the base for follow-up PR #36506.", "thread": { "last_event_at": "2026-10-25T07:48:54Z", "events": 5, "head_sha": "65b48ba1f1f4c6c04a0d1bea9f7774091ec4e130", "schema_floor": 2, "schema": 2 }, "waiting_on": [ { "at": null, "id": "", "on": "nothing", "url": null, "what": "no pending items" } ], "risk": { "level": "medium", "touches": [ "p2p" ], "why": "A flaw in orphan reconsideration or peer work set assignment could stall orphan transaction processing or corrupt TxOrphanage multi-index state." }, "discussion": { "author_status": "last statement processed 2026-10-25", "open_concerns": [], "resolved_concerns": [] }, "reviewability": { "state": "Ready", "label": "Ready", "reason": "Nothing known that would invalidate a review now." }, "agreement": { "state": "Strong", "summary": "Strong: substantive support, no open objection (fametrano)", "reason": "Added Tested ACK from fametrano with extensive reproduction testing and code analysis.", "evidence": [ "w0xlt: Concept ACK \u2014 no reason given", "fametrano: Tested ACK \u2014 Reproduced the orphan disconnect hole end-to-end and confirmed this PR fixes it, verified iterator validity during announcement handover, and ran unit and fuzz test suites" ], "objections": [], "support": [ { "reviewer": "w0xlt", "reason": "no reason given", "substantive": false, "verdict": "Concept ACK", "id": "c:6050349567", "url": "https://github.com/bitcoin/bitcoin/pull/36437#issuecomment-6050349567", "at": "2026-10-08", "association": "CONTRIBUTOR", "evidence": "none", "areas": [] }, { "reviewer": "fametrano", "reason": "Reproduced the orphan disconnect hole end-to-end and confirmed this PR fixes it, verified iterator validity during announcement handover, and ran unit and fuzz test suites", "substantive": true, "verdict": "Tested ACK", "id": "c:6395056559", "url": "https://github.com/bitcoin/bitcoin/pull/36437#issuecomment-6395056559", "at": "2026-10-25", "association": "CONTRIBUTOR", "evidence": "both", "areas": [ "EraseForPeer", "EraseTxInternal", "LimitOrphans", "Erase", "peer_worksets", "p2p_1p1c_liveness", "txorphanage_sim" ] } ], "participants": [ { "login": "w0xlt", "stance": "support", "note": "Concept ACK without detailed rationale", "association": "CONTRIBUTOR", "comments": 1, "first": "2026-10-08", "last": "2026-10-08" }, { "login": "fametrano", "stance": "support", "note": "Tested ACK with reproduction test case and iterator safety review", "association": "CONTRIBUTOR", "comments": 1, "first": "2026-10-25", "last": "2026-10-25" } ], "derivation": "substantive support, no open objection (fametrano)", "model_state": null, "corrections": [], "notes": "Added Tested ACK from fametrano with extensive reproduction testing and code analysis." }, "dependencies": { "depends_on": [], "enables": [ "#36506" ] }, "categories": [ { "name": "mempool", "member": false, "evidence": "TxOrphanage is transaction relay machinery in net_processing rather than mempool policy or mempool data structures.", "band": "Unranked", "reason_tag": "bug fix", "score": 0.0, "factors": { "bug_severity": 2, "leverage": 1, "performance": 0, "security_stability": 2, "user_value": 1 }, "rationale": "Orphan handling and peer reconsideration are P2P transaction relay concerns, not mempool acceptance rules or mempool internal storage." }, { "name": "p2p", "member": true, "evidence": "Touches TxOrphanage in net_processing to prevent dropped orphan reconsiderations when peers disconnect, and adds a P2P liveness fuzz harness.", "band": "P1", "reason_tag": "bug fix", "score": 0.78, "factors": { "bug_severity": 2, "leverage": 1, "performance": 0, "security_stability": 2, "user_value": 1 }, "rationale": "Fixes an exploitable relay liveness hole where orphans stuck awaiting reconsideration are abandoned if an announcer disconnects. As commit e974d21b4e notes, this allows an announcer to deliberately keep CPFP child transactions out of the mempool until the orphan expires." }, { "name": "tests", "member": true, "evidence": "Adds a new 568-line end-to-end fuzzing harness (src/test/fuzz/p2p_1p1c_liveness.cpp) and updates fuzz build configuration in src/test/fuzz/CMakeLists.txt.", "band": "P2", "reason_tag": "test coverage", "score": 0.65, "factors": { "bug_severity": 2, "leverage": 1, "performance": 0, "security_stability": 1, "user_value": 1 }, "rationale": "The PR introduces an end-to-end P2P fuzz harness (p2p_1p1c_liveness) that drives PeerManager with real messages and validation to verify 1p1c relay invariants under adversarial conditions. The description highlights that the target covers high-risk P2P message handling paths and catches realistic regressions, noting that it 'finds this bug on master from an empty corpus in under an hour on one core' while also enabling #36506." }, { "name": "utils", "member": false, "evidence": "Does not touch shared utilities, serialization, crypto, logging, or common libraries.", "band": "Unranked", "reason_tag": "cleanup", "score": 0.0, "factors": { "bug_severity": 2, "leverage": 1, "performance": 0, "security_stability": 2, "user_value": 1 }, "rationale": "Matched utils candidates only via incidental keywords; no utility code is altered." } ], "confidence": "high", "uncertainties": [], "needs": [] }, "cost_usd": 0.0, "source": { "record": "2026-10-26T01:21:48+00:00", "code": "2026-10-13T01:25:40+00:00", "judgments": 4 } }