#36380 wallet: extend -walletbroadcast to allow initial send only
| Reviewability | Reviews | Agreement | Size | ||||
|---|---|---|---|---|---|---|---|
| #36380 wallet: extend -walletbroadcast to allow initial send only | Ready | 0 -1 | Mild | 41 + 1 tests | |||
|
|
|
|
| |||
Reviewability: ReadyStalePaused Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs. Size: lines added or modified outside tests, then in tests; greener = smaller. | |||||||
Goal
Extends the `-walletbroadcast` configuration option to accept `initialonly` alongside boolean `0` and `1`. Setting `-walletbroadcast=initialonly` allows the wallet to perform initial transaction submission and network broadcast while disabling periodic rebroadcasts and startup mempool resubmission. The default setting remains unchanged at `1` (initial broadcast and periodic rebroadcast).
Problem: Periodic wallet rebroadcasts resend unconfirmed transactions to peers every 12–36 hours and resubmit them on startup, which leaks wallet transaction ownership to the network. Users had no way to turn off these periodic rebroadcasts without disabling wallet transaction broadcasting entirely.
Evidence of importance:
- PR description: "Add a new possible value initialonly which would allow the user to configure the wallet to do the initial broadcast only and not to do the periodic rebroadcasts. No new configuration options and no change in default behavior."
Scope: A compact wallet-only change replacing the internal boolean `fBroadcastTransactions` with a three-state `BroadcastWhen` enum.
Risk of a mistake: low (wallet). A mistake in parsing or checking the broadcast mode could inadvertently suppress transaction broadcast or fail to disable periodic rebroadcasts.
Changed since the previous assessment: Replaced the previous approach of introducing a separate `-walletrebroadcast` option (which defaulted to false) with extending the existing `-walletbroadcast` parameter to accept `initialonly`, keeping default behavior unchanged.
Reviewability
Ready
Nothing known that would invalidate a review now.
Waiting on (from the thread read):
- reviewer: review of the push extending -walletbroadcast to initialonly and preserving default behavior 2026-10-05
- author: response to mzumsande regarding disabling artificial mempool resubmissions 2026-10-01
Agreement
Mild
NACK from achow101 not withdrawn (Disabling rebroadcasts by default has bad effects for the wallet)
Thread notes: The author pushed a rework that retains default rebroadcasting behavior and extends -walletbroadcast rather than introducing a new configuration option, fixing objections from achow101 and vicjuma as well as w0xlt's suggestion.
Objections, suggestions, and questions:
| Reviewer | Type | Harm, request, or question | Status | Must be | Author replied | Quote |
|---|---|---|---|---|---|---|
| w0xlt (contributor) | question, approach | Can wallet rebroadcasting safely be disabled, and if so, why is rebroadcasting needed at all? | answered · author explains why rebroadcasting is useful and why disabling it can be safe | answered | yes | 2026-09-29: 'Can we safely disable wallet re-broadcasting? If so, why do we need re-broadcasting at all?' Status from: 2026-09-30: vasild: 'I think yes. Most users don't need it, but are nevertheless exposed to the privacy leaks it brings even if they never us' |
| w0xlt (contributor) | suggestion, interface | Extend -walletbroadcast with new modes instead of introducing another parameter with a very similar name | fixed · fix pushed · author pushed a change extending -walletbroadcast instead of introducing a new option | answered | yes | 2026-09-29: 'extending `-walletbroadcast` with new modes would be cleaner than introducing another parameter with a very similar name.' Status from: 2026-10-05: vasild: 'don't introduce a new option, instead extend the allowed values of `-walletbroadcast`.' |
| vicjuma (contributor) | objection, interface | Defaulting -walletrebroadcast to false harms convenience for users who expect rebroadcasts without extra setup | fixed · fix pushed · author pushed a change keeping default behavior unmodified | answered | yes | 2026-09-29: 'IMO, I think rebroadcasting outweighs privacy so defaulting to true would be convenient.' Status from: 2026-10-05: vasild: 'Now the default behavior is unmodified.' |
| mzumsande (member) | suggestion, approach | Disable artificial resubmission to mempool as well if rebroadcast is disabled | open | answered | no | 2026-10-01: 'if we disable rebroadcast, we should probably also disable artificial resubmission to mempool' |
| achow101 (member) | objection, correctness | Disabling rebroadcasts by default has bad effects for the wallet | fixed · fix pushed · author pushed a change keeping default behavior unmodified | changed | yes | 2026-10-01: 'Disabling rebroadcasts by default has bad effects for the wallet.' Status from: 2026-10-05: vasild: 'Now the default behavior is unmodified.' |
Participants:
- vicjuma (contributor, objection, 1 statements 2026-09-29 to 2026-09-29): objected to defaulting -walletrebroadcast to false over user convenience concerns
- w0xlt (contributor, question, 1 statements 2026-09-29 to 2026-09-29): asked whether rebroadcasting can safely be disabled and suggested extending -walletbroadcast
- achow101 (member, objection, 2 statements 2026-10-01 to 2026-10-01): Concept NACK; objected that disabling rebroadcasts by default has bad effects for the wallet
- mzumsande (member, neutral, 1 statements 2026-10-01 to 2026-10-01): pointed out that disabling rebroadcasts should also disable artificial mempool resubmissions
Files
2 lines under test/bench/ci.
- src/wallet/wallet.cpp +27/-10
- src/wallet/wallet.h +13/-8
- src/qt/test/wallettests.cpp +1/-1
- src/wallet/init.cpp +1/-1
Card
The short text the ranking pass compares across PRs.
Extends the `-walletbroadcast` configuration option to accept `initialonly` alongside boolean values `0` and `1`. Currently, users cannot disable periodic unconfirmed transaction rebroadcasts (which leak wallet ownership to peers every 12–36 hours) without turning off transaction broadcasting completely. The new value allows initial broadcasts while skipping periodic resends and startup mempool resubmissions, preserving the existing default behavior.
Data
thread read through 2026-10-05 (9 statements), head 155eb27489
labels: Wallet
Categories
Wallet
P3 · new feature (ranking pass: Moved up to sit with the other opt-in rebroadcast-policy options.)
Adds a `-walletbroadcast=initialonly` configuration option to prevent transaction ownership leakage from periodic rebroadcasts. While improving broadcast privacy for privacy-conscious users, the default behavior is unchanged and the addition is reasonably deferrable.
Membership: Matches Wallet label and modifies wallet transaction broadcast configuration in src/wallet/wallet.cpp and src/wallet/wallet.h.
Factors: security/stability 1, bug 0, performance 0, user value 1, leverage 0