#36712 fees: prevent divide by zero in CFeeRate

ReviewabilityReviewsAgreementSize
#36712 ismaelsadeeq fees: prevent divide by zero in CFeeRateReady2Positive7 + 5 tests
  • Prevent a node crash caused by division by zero when fee calculations encounter a zero-sized fee rate
  • Ensure zero-sized fee rates safely return zero instead of crashing the node
  • Ready to review
  • General support without stated reasons and no open objections
  • Concept approval without stated reasons (darosior)
  • Support without stated reasons (polespinasa, pablomartin4btc)
  • Support with an inline test formatting nit (maflcko)
  • 7 lines added or modified outside tests
  • 5 lines added or modified in tests
  • 1 lines removed in total
  • 3 files, 1 commits
Mempool and policy#5 of 14
P2 · bug fix
  • P2 because it fixes an unhandled division-by-zero crash during fee rate operations
  • It prevents arithmetic crashes but has no evidence of an external remote denial of service vector
Reviewability: ReadyStalePaused
Agreement: StrongPositivePositive w/ caveatsNeutralMildDisputedBlockedCrickets
Reviews: current code-review ACKs, then (+stale ACKs) and -NACKs; greener = more ACKs.
Size: lines added or modified outside tests, then in tests; greener = smaller.

Goal

Prevents a division-by-zero crash when calling CFeeRate::GetFeePerK() on a zero-sized fee rate. If the fee rate is empty, GetFeePerK() now returns zero instead of evaluating fees down to 1000 vbytes, matching the behavior of GetFee().

Problem: Constructing a CFeeRate with zero size causes subsequent calls to GetFeePerK() or CFeeRate::operator+= to unconditionally call EvaluateFeeDown(1000), resulting in a division by zero that crashes the node.

Evidence of importance:

  • A CFeeRate with size 0 GetFeePerK() and CFeeRate+= evaluated EvaluateFeeDown(1000) unconditionally, dividing by that zero size and crashing (PR description)
  • This was reported by Jacob F Cudney (aragondragon) (PR description)

Risk of a mistake: medium (mempool_policy). Incorrect return values or logic errors in CFeeRate could corrupt fee calculations or comparisons across mempool policy and wallet operations.

Reviewability

Ready

Nothing known that would invalidate a review now.

Waiting on (from the thread read):

  • nothing

Agreement

Positive

support without stated reasons, no open objection (darosior, polespinasa, maflcko, pablomartin4btc)

Thread notes: Initial record. maflcko approved with a test grouping and newline nit (rc:4426094942), which is a style preference rather than a blocking claim. pablomartin4btc, darosior, and polespinasa also supported. / Initial record. Multiple reviewers support the change with ACKs and a Concept ACK; maflcko posted an inline style nit on test grouping alongside approval.

Objections, suggestions, and questions: none recorded.

Support:

  • darosior (member) (Concept ACK, 2026-10-30): (no reason given) [not substantive]
  • polespinasa (member) (ACK, 2026-10-30): (no reason given) [not substantive]
  • maflcko (member) (2026-10-30): lgtm [not substantive]
  • pablomartin4btc (member) (ACK, 2026-10-30): (no reason given) [not substantive]

Participants:

  • darosior (member, support, 1 statements 2026-10-30 to 2026-10-30): Concept ACK
  • maflcko (member, support, 2 statements 2026-10-30 to 2026-10-30): approved with lgtm and a test formatting nit
  • pablomartin4btc (member, support, 1 statements 2026-10-30 to 2026-10-30): ACKed commit 40647a2
  • polespinasa (member, support, 1 statements 2026-10-30 to 2026-10-30): ACKed commit 40647a2

Files

5 lines under test/bench/ci.

  • src/policy/feerate.cpp +6/-0
  • src/test/amount_tests.cpp +5/-0
  • src/policy/feerate.h +1/-1

Card

The short text the ranking pass compares across PRs.

Prevents an unhandled division-by-zero crash in CFeeRate when calling GetFeePerK() on a zero-sized rate. An empty fee rate now returns zero instead of dividing by zero in EvaluateFeeDown(1000), matching the behavior of GetFee(). This also fixes crashes when using operator+= on empty fee rates and adds unit test coverage. Reported by Jacob F Cudney.

Data

dossier JSON · extract JSON · model ledger, generated 2026-11-01T01:16, confidence high, input hash da54e3fb55a4ab04
thread read through 2026-10-30 (6 statements), head 40647a2057
labels: TX fees and policy

Categories

Mempool and policy

P2 · bug fix

Prevents a node crash caused by division by zero when CFeeRate::GetFeePerK() or operator+= is invoked on a zero-sized fee rate. While it resolves an unhandled arithmetic fault, there is no evidence of an external remote denial-of-service vector elevating it to category-critical.

Membership: Matches the 'TX fees and policy' label and directly modifies policy fee rate calculation in src/policy/feerate.{cpp,h}.

Factors: security/stability 2, bug 2, performance 0, user value 0, leverage 0