#36503 rpc: reject AssumeUTXO rollback without tip data
| Reviewability | Reviews | Agreement | Size | ||||
|---|---|---|---|---|---|---|---|
| #36503 rpc: reject AssumeUTXO rollback without tip data | Waiting on author | 0 | Strong | 1 + 18 tests | |||
|
|
|
|
| |||
Reviewability: ReadyStalePaused Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs. Size: lines added or modified outside tests, then in tests; greener = smaller. | |||||||
Goal
Replaces the manual block-availability check in `dumptxoutset` with `GetPruneHeight`. This ensures that pruned nodes running on an assumeutxo snapshot reject rollback requests with an RPC error when required block or undo data is missing at or below the tip, rather than hitting an assertion failure.
Problem: When a pruned node loads an assumeutxo snapshot, the active tip may lack block data or undo data. Calling `dumptxoutset` with a `rollback` parameter on such a node causes an assertion failure that crashes the daemon.
Evidence of importance:
- PR description: 'Loading a UTXO snapshot on a pruned node can leave the active tip without block or undo data. Attempting a rollback with dumptxoutset then triggers an assertion and terminates the node.'
- Commit bef6e5abaa adds functional tests in feature_assumeutxo.py confirming the node crashed on rollback attempts without tip block or undo data before being restarted.
Risk of a mistake: low (rpc_api). A flaw in the prune height check could reject legitimate dumptxoutset rollback requests or allow an invalid rollback to proceed to an assertion failure.
Changed since the previous assessment: None; the implementation and scope match the earlier version.
Reviewability
Paused · Waiting on author
Open objections from musaHaruna with no author reply for 20 days; review would repeat what has been asked.
Waiting on (from the thread read):
- author: author reply to musaHaruna's questions and suggestions on boundary checks and non-pruned nodes 2026-10-12
- author: author reply to musaHaruna's questions and suggestion regarding non-pruned nodes and boundary comparison 2026-10-12
Agreement
Strong
substantive support, no open objection (musaHaruna)
Thread notes: Initial record. musaHaruna gave a Concept ACK along with suggestions and questions regarding boundary condition strictness and extending checks to non-pruned nodes. / Initial record for PR 36503. musaHaruna gave a Concept ACK with detailed questions and suggestions regarding scope and boundary logic.
Objections, suggestions, and questions:
| Reviewer | Type | Harm, request, or question | Status | Must be | Author replied | Quote |
|---|---|---|---|---|---|---|
| musaHaruna (contributor) | suggestion, scope | Extend the early block/undo data availability check to non-pruned nodes to avoid copying the UTXO set before failing rollback | open | answered | no | 2026-10-12: 'Should the early availability check also cover non-pruned nodes? They can load a snapshot without having the historical block or undo data.' |
| musaHaruna (contributor) | suggestion, interface | Generalize the error message to state required block or undo data is unavailable rather than pruned | open | answered | no | 2026-10-12: 'Would a more general error message describe these cases better? Specifically, changing: Could not roll back to requested height since necessary block data is already pruned. to: Could not roll back to requested height because required block or undo data is unavailable.' |
| musaHaruna (contributor) | suggestion, correctness | Compare the missing-data boundary against target height using > instead of >= to avoid rejecting valid rollbacks to the target height | open | answered | no | 2026-10-12: 'Could the boundary eventually compare the highest missing-data height against the target using `>` instead of `>=`? The loop in `CreateRolledBackUTXOSnapshot` uses: `while (block_index->nHeight > target->nHeight)`' |
Support:
- musaHaruna (contributor) (Concept ACK, 2026-10-12) [both: CreateRolledBackUTXOSnapshot, GetFirstBlock, GetPruneHeight]: The fix looks straightforward and contained: `GetPruneHeight` handles missing data at the tip before calling `GetFirstBlock`, allowing the RPC to return an error instead of hitting the assertion.
Participants:
- musaHaruna (contributor, support, 1 statements 2026-10-12 to 2026-10-12): Concept ACK; asked about extending the early check to non-pruned nodes, updating the error message, and using > instead of >= for the target height check
Files
18 lines under test/bench/ci.
- test/functional/feature_assumeutxo.py +18/-0
- src/rpc/blockchain.cpp +1/-3
Card
The short text the ranking pass compares across PRs.
Prevents a node crash when calling dumptxoutset with rollback on a pruned node that loaded an assumeutxo snapshot. In that state, the active tip can lack block or undo data, causing the rollback routine to hit an assertion failure and terminate bitcoind. The PR replaces the existing prune check with GetPruneHeight so the RPC returns an error instead of crashing. Functional tests are added to verify error handling across different snapshot tip states.
Data
thread read through 2026-10-12 (1 statements), head 3cb70c28f5
labels: RPC/REST/ZMQ
Categories
RPC / REST / ZMQ
P2 · bug fix
Fixes an assertion failure that crashes the daemon when invoking `dumptxoutset` with rollback on a pruned assumeutxo node. Returning a standard RPC error instead of terminating the process prevents a severe reliability failure during snapshot rollback.
Membership: Matches RPC/REST/ZMQ label and modifies RPC implementation in src/rpc/blockchain.cpp
Factors: security/stability 2, bug 2, performance 0, user value 1, leverage 0