READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

41,191 bytes · SHA-256 74ef235b1b016362… · View upstream ↗

1// Copyright (c) 2022-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#include <consensus/amount.h>
6#include <consensus/validation.h>
7#include <net_processing.h>
8#include <node/eviction.h>
9#include <node/txorphanage.h>
10#include <policy/policy.h>
11#include <primitives/transaction.h>
12#include <script/script.h>
13#include <sync.h>
14#include <test/fuzz/FuzzedDataProvider.h>
15#include <test/fuzz/fuzz.h>
16#include <test/fuzz/util.h>
17#include <test/util/setup_common.h>
18#include <test/util/time.h>
19#include <uint256.h>
20#include <util/check.h>
21#include <util/feefrac.h>
22#include <util/time.h>
23
24#include <algorithm>
25#include <bitset>
26#include <cmath>
27#include <cstdint>
28#include <iostream>
29#include <memory>
30#include <set>
31#include <utility>
32#include <vector>
33
34void initialize_orphanage()
35{
36    static const auto testing_setup = MakeNoLogFileContext();
37}
38
39FUZZ_TARGET(txorphan, .init = initialize_orphanage)
40{
41    SeedRandomStateForTest(SeedRand::ZEROS);
42    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
43    FastRandomContext orphanage_rng{ConsumeUInt256(fuzzed_data_provider)};
44    FakeNodeClock clock{ConsumeTime(fuzzed_data_provider)};
45
46    auto orphanage = node::MakeTxOrphanage();
47    std::vector<COutPoint> outpoints; // Duplicates are tolerated
48    outpoints.reserve(200'000);
49
50    // initial outpoints used to construct transactions later
51    for (uint8_t i = 0; i < 4; i++) {
52        outpoints.emplace_back(Txid::FromUint256(uint256{i}), 0);
53    }
54
55    CTransactionRef ptx_potential_parent = nullptr;
56
57    std::vector<CTransactionRef> tx_history;
58
59    LIMITED_WHILE (outpoints.size() < 200'000 && fuzzed_data_provider.ConsumeBool(), 1000) {
60        // construct transaction
61        const CTransactionRef tx = [&] {
62            CMutableTransaction tx_mut;
63            const auto num_in = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, outpoints.size());
64            const auto num_out = fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(1, 256);
65            // pick outpoints from outpoints as input. We allow input duplicates on purpose, given we are not
66            // running any transaction validation logic before adding transactions to the orphanage
67            tx_mut.vin.reserve(num_in);
68            for (uint32_t i = 0; i < num_in; i++) {
69                auto& prevout = PickValue(fuzzed_data_provider, outpoints);
70                // try making transactions unique by setting a random nSequence, but allow duplicate transactions if they happen
71                tx_mut.vin.emplace_back(prevout, CScript{}, fuzzed_data_provider.ConsumeIntegralInRange<uint32_t>(0, CTxIn::SEQUENCE_FINAL));
72            }
73            // output amount will not affect txorphanage
74            tx_mut.vout.reserve(num_out);
75            for (uint32_t i = 0; i < num_out; i++) {
76                tx_mut.vout.emplace_back(CAmount{0}, CScript{});
77            }
78            auto new_tx = MakeTransactionRef(tx_mut);
79            // add newly constructed outpoints to the coin pool
80            for (uint32_t i = 0; i < num_out; i++) {
81                outpoints.emplace_back(new_tx->GetHash(), i);
82            }
83            return new_tx;
84        }();
85
86        tx_history.push_back(tx);
87
88        const auto wtxid{tx->GetWitnessHash()};
89
90        // Trigger orphanage functions that are called using parents. ptx_potential_parent is a tx we constructed in a
91        // previous loop and potentially the parent of this tx.
92        if (ptx_potential_parent) {
93            // Set up future GetTxToReconsider call.
94            orphanage->AddChildrenToWorkSet(*ptx_potential_parent, orphanage_rng);
95
96            // Check that all txns returned from GetChildrenFrom* are indeed a direct child of this tx.
97            NodeId peer_id = fuzzed_data_provider.ConsumeIntegral<NodeId>();
98            for (const auto& child : orphanage->GetChildrenFromSamePeer(ptx_potential_parent, peer_id)) {
99                assert(std::any_of(child->vin.cbegin(), child->vin.cend(), [&](const auto& input) {
100                    return input.prevout.hash == ptx_potential_parent->GetHash();
101                }));
102            }
103        }
104
105        // trigger orphanage functions
106        LIMITED_WHILE (fuzzed_data_provider.ConsumeBool(), 1000) {
107            NodeId peer_id = fuzzed_data_provider.ConsumeIntegral<NodeId>();
108            const auto total_bytes_start{orphanage->TotalOrphanUsage()};
109            const auto total_peer_bytes_start{orphanage->UsageByPeer(peer_id)};
110            const auto tx_weight{GetTransactionWeight(*tx)};
111
112            CallOneOf(
113                fuzzed_data_provider,
114                [&] {
115                    {
116                        CTransactionRef ref = orphanage->GetTxToReconsider(peer_id);
117                        if (ref) {
118                            Assert(orphanage->HaveTx(ref->GetWitnessHash()));
119                        }
120                    }
121                },
122                [&] {
123                    bool have_tx = orphanage->HaveTx(tx->GetWitnessHash());
124                    bool have_tx_and_peer = orphanage->HaveTxFromPeer(wtxid, peer_id);
125                    // AddTx should return false if tx is too big or already have it
126                    // tx weight is unknown, we only check when tx is already in orphanage
127                    {
128                        bool add_tx = orphanage->AddTx(tx, peer_id);
129                        // have_tx == true -> add_tx == false
130                        Assert(!have_tx || !add_tx);
131                        // have_tx_and_peer == true -> add_tx == false
132                        Assert(!have_tx_and_peer || !add_tx);
133                        // After AddTx, the orphanage may trim itself, so the peer's usage may have gone up or down.
134
135                        if (add_tx) {
136                            Assert(tx_weight <= MAX_STANDARD_TX_WEIGHT);
137                        } else {
138                            // Peer may have been added as an announcer.
139                            if (orphanage->UsageByPeer(peer_id) > total_peer_bytes_start) {
140                                Assert(orphanage->HaveTxFromPeer(wtxid, peer_id));
141                            }
142
143                            // If announcement was added, total bytes does not increase.
144                            // However, if eviction was triggered, the value may decrease.
145                            Assert(orphanage->TotalOrphanUsage() <= total_bytes_start);
146                        }
147                    }
148                    // We are not guaranteed to have_tx after AddTx. There are a few possible reasons:
149                    // - tx itself exceeds the per-peer memory usage limit, so LimitOrphans had to remove it immediately
150                    // - tx itself exceeds the per-peer latency score limit, so LimitOrphans had to remove it immediately
151                    // - the orphanage needed trim and all other announcements from this peer are reconsiderable
152                },
153                [&] {
154                    bool have_tx = orphanage->HaveTx(tx->GetWitnessHash());
155                    bool have_tx_and_peer = orphanage->HaveTxFromPeer(tx->GetWitnessHash(), peer_id);
156                    // AddAnnouncer should return false if tx doesn't exist or we already HaveTxFromPeer.
157                    {
158                        bool added_announcer = orphanage->AddAnnouncer(tx->GetWitnessHash(), peer_id);
159                        // have_tx == false -> added_announcer == false
160                        Assert(have_tx || !added_announcer);
161                        // have_tx_and_peer == true -> added_announcer == false
162                        Assert(!have_tx_and_peer || !added_announcer);
163
164                        // If announcement was added, total bytes does not increase.
165                        // However, if eviction was triggered, the value may decrease.
166                        Assert(orphanage->TotalOrphanUsage() <= total_bytes_start);
167                    }
168                },
169                [&] {
170                    bool have_tx = orphanage->HaveTx(tx->GetWitnessHash());
171                    bool have_tx_and_peer{orphanage->HaveTxFromPeer(wtxid, peer_id)};
172                    // EraseTx should return 0 if m_orphans doesn't have the tx
173                    {
174                        auto bytes_from_peer_before{orphanage->UsageByPeer(peer_id)};
175                        Assert(have_tx == orphanage->EraseTx(tx->GetWitnessHash()));
176                        // After EraseTx, the orphanage may trim itself, so any peer's usage may decrease.
177                        if (!have_tx) {
178                            Assert(orphanage->UsageByPeer(peer_id) == bytes_from_peer_before);
179                        } else if (have_tx_and_peer) {
180                            Assert(orphanage->UsageByPeer(peer_id) <= bytes_from_peer_before - tx_weight);
181                        } else {
182                            Assert(orphanage->UsageByPeer(peer_id) <= bytes_from_peer_before);
183                        }
184                    }
185                    have_tx = orphanage->HaveTx(tx->GetWitnessHash());
186                    have_tx_and_peer = orphanage->HaveTxFromPeer(wtxid, peer_id);
187                    // have_tx should be false and EraseTx should fail
188                    {
189                        Assert(!have_tx && !have_tx_and_peer && !orphanage->EraseTx(wtxid));
190                    }
191                },
192                [&] {
193                    orphanage->EraseForPeer(peer_id);
194                    Assert(!orphanage->HaveTxFromPeer(tx->GetWitnessHash(), peer_id));
195                    Assert(orphanage->UsageByPeer(peer_id) == 0);
196                },
197                [&] {
198                    // Make a block out of txs and then EraseForBlock
199                    CBlock block;
200                    int64_t block_weight{0};
201                    int num_txs = fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(0, 1000);
202                    for (int i{0}; i < num_txs; ++i) {
203                        auto& tx_to_remove = PickValue(fuzzed_data_provider, tx_history);
204                        const auto tx_weight = GetTransactionWeight(*tx_to_remove);
205                        if (block_weight + tx_weight > MAX_BLOCK_WEIGHT) break;
206                        block_weight += tx_weight;
207                        block.vtx.push_back(tx_to_remove);
208                    }
209                    orphanage->EraseForBlock(block);
210                    for (const auto& tx_removed : block.vtx) {
211                        Assert(!orphanage->HaveTx(tx_removed->GetWitnessHash()));
212                        Assert(!orphanage->HaveTxFromPeer(tx_removed->GetWitnessHash(), peer_id));
213                    }
214                }
215            );
216        }
217
218        // Set tx as potential parent to be used for future GetChildren() calls.
219        if (!ptx_potential_parent || fuzzed_data_provider.ConsumeBool()) {
220            ptx_potential_parent = tx;
221        }
222
223        const bool have_tx{orphanage->HaveTx(tx->GetWitnessHash())};
224        const bool get_tx_nonnull{orphanage->GetTx(tx->GetWitnessHash()) != nullptr};
225        Assert(have_tx == get_tx_nonnull);
226    }
227    orphanage->SanityCheck();
228}
229
230FUZZ_TARGET(txorphan_protected, .init = initialize_orphanage)
231{
232    SeedRandomStateForTest(SeedRand::ZEROS);
233    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
234    FastRandomContext orphanage_rng{ConsumeUInt256(fuzzed_data_provider)};
235    FakeNodeClock clock{ConsumeTime(fuzzed_data_provider)};
236
237    // We have num_peers peers. Some subset of them will never exceed their reserved weight or announcement count, and
238    // should therefore never have any orphans evicted.
239    const unsigned int MAX_PEERS = 125;
240    const unsigned int num_peers = fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(1, MAX_PEERS);
241    // Generate a vector of bools for whether each peer is protected from eviction
242    std::bitset<MAX_PEERS> protected_peers;
243    for (unsigned int i = 0; i < num_peers; i++) {
244        protected_peers.set(i, fuzzed_data_provider.ConsumeBool());
245    }
246
247    // Params for orphanage.
248    const unsigned int global_latency_score_limit = fuzzed_data_provider.ConsumeIntegralInRange<unsigned int>(num_peers, 6'000);
249    const int64_t per_peer_weight_reservation = fuzzed_data_provider.ConsumeIntegralInRange<int64_t>(1, 4'040'000);
250    auto orphanage = node::MakeTxOrphanage(global_latency_score_limit, per_peer_weight_reservation);

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.