READ THE CODE

Inside Bitcoin

The code behind the network, with room to understand it.

Stable release v32.1bitcoin/bitcoin · f0de87f04062 ↗3,020 source files · 47.5 MB stored on the server440 file guides

Release published 2026-10-28 · Snapshot fetched 2026-11-01. Latest stable release at fetch time; development branches and Git history are excluded. Only the selected code window and visible folders load here.

9,623 bytes · SHA-256 b084871b1f90e1ad… · View upstream ↗

1// Copyright (c) 2021-present The Bitcoin Core developers
2// Distributed under the MIT software license, see the accompanying
3// file COPYING or http://www.opensource.org/licenses/mit-license.php.
4
5#include <chain.h>
6#include <chainparams.h>
7#include <coins.h>
8#include <consensus/consensus.h>
9#include <consensus/validation.h>
10#include <kernel/coinstats.h>
11#include <node/blockstorage.h>
12#include <node/utxo_snapshot.h>
13#include <primitives/block.h>
14#include <primitives/transaction.h>
15#include <serialize.h>
16#include <span.h>
17#include <streams.h>
18#include <sync.h>
19#include <test/fuzz/FuzzedDataProvider.h>
20#include <test/fuzz/fuzz.h>
21#include <test/fuzz/util.h>
22#include <test/util/mining.h>
23#include <test/util/setup_common.h>
24#include <test/util/time.h>
25#include <uint256.h>
26#include <util/check.h>
27#include <util/fs.h>
28#include <util/result.h>
29#include <util/time.h>
30#include <validation.h>
31
32#include <cstdint>
33#include <functional>
34#include <ios>
35#include <memory>
36#include <optional>
37#include <vector>
38
39using node::SnapshotMetadata;
40
41namespace {
42
43const std::vector<std::shared_ptr<CBlock>>* g_chain;
44TestingSetup* g_setup{nullptr};
45
46/** Sanity check the assumeutxo values hardcoded in chainparams for the fuzz target. */
47void sanity_check_snapshot()
48{
49    Assert(g_chain && g_setup == nullptr);
50
51    // Create a temporary chainstate manager to connect the chain to.
52    const auto tmp_setup{MakeNoLogFileContext<TestingSetup>(ChainType::REGTEST, TestOpts{.setup_net = false})};
53    const auto& node{tmp_setup->m_node};
54    for (auto& block: *g_chain) {
55        ProcessBlock(node, block);
56    }
57
58    // Connect the chain to the tmp chainman and sanity check the chainparams snapshot values.
59    LOCK(cs_main);
60    auto& cs{node.chainman->ActiveChainstate()};
61    cs.ForceFlushStateToDisk(/*wipe_cache=*/false);
62    const auto stats{*Assert(kernel::ComputeUTXOStats(kernel::CoinStatsHashType::HASH_SERIALIZED, cs.CoinsDB(), node.chainman->m_blockman))};
63    const auto cp_au_data{*Assert(node.chainman->GetParams().AssumeutxoForHeight(2 * COINBASE_MATURITY))};
64    Assert(stats.nHeight == cp_au_data.height);
65    Assert(stats.nTransactions + 1 == cp_au_data.m_chain_tx_count); // +1 for the genesis tx.
66    Assert(stats.hashBlock == cp_au_data.blockhash);
67    Assert(AssumeutxoHash{stats.hashSerialized} == cp_au_data.hash_serialized);
68}
69
70template <bool INVALID>
71void initialize_chain()
72{
73    const auto params{CreateChainParams(ArgsManager{}, ChainType::REGTEST)};
74    static const auto chain{CreateBlockChain(2 * COINBASE_MATURITY, *params)};
75    g_chain = &chain;
76    FakeNodeClock node_clock{chain.back()->Time()};
77
78    // Make sure we can generate a valid snapshot.
79    sanity_check_snapshot();
80
81    static const auto setup{
82        MakeNoLogFileContext<TestingSetup>(ChainType::REGTEST,
83                                           TestOpts{
84                                               .setup_net = false,
85                                               .setup_validation_interface = false,
86                                               .min_validation_cache = true,
87                                           }),
88    };
89    if constexpr (INVALID) {
90        auto& chainman{*setup->m_node.chainman};
91        for (const auto& block : chain) {
92            BlockValidationState dummy;
93            bool processed{chainman.ProcessNewBlockHeaders({{*block}}, true, dummy)};
94            Assert(processed);
95            const auto* index{WITH_LOCK(::cs_main, return chainman.m_blockman.LookupBlockIndex(block->GetHash()))};
96            Assert(index);
97        }
98    }
99    g_setup = setup.get();
100}
101
102template <bool INVALID>
103void utxo_snapshot_fuzz(FuzzBufferType buffer)
104{
105    SeedRandomStateForTest(SeedRand::ZEROS);
106    FuzzedDataProvider fuzzed_data_provider(buffer.data(), buffer.size());
107    FakeNodeClock node_clock{ConsumeTime(fuzzed_data_provider, /*min=*/1296688602)}; // regtest genesis block timestamp
108    auto& setup{*g_setup};
109    bool dirty_chainman{false}; // Reuse the global chainman, but reset it when it is dirty
110    auto& chainman{*setup.m_node.chainman};
111
112    const auto snapshot_path = gArgs.GetDataDirNet() / "fuzzed_snapshot.dat";
113
114    Assert(!chainman.ActiveChainstate().m_from_snapshot_blockhash);
115
116    {
117        AutoFile outfile{fsbridge::fopen(snapshot_path, "wb")};
118        // Metadata
119        if (fuzzed_data_provider.ConsumeBool()) {
120            std::vector<uint8_t> metadata{ConsumeRandomLengthByteVector(fuzzed_data_provider)};
121            outfile << std::span{metadata};
122        } else {
123            auto msg_start = chainman.GetParams().MessageStart();
124            int base_blockheight{fuzzed_data_provider.ConsumeIntegralInRange<int>(1, 2 * COINBASE_MATURITY)};
125            uint256 base_blockhash{g_chain->at(base_blockheight - 1)->GetHash()};
126            uint64_t m_coins_count{fuzzed_data_provider.ConsumeIntegralInRange<uint64_t>(1, 3 * COINBASE_MATURITY)};
127            SnapshotMetadata metadata{msg_start, base_blockhash, m_coins_count};
128            outfile << metadata;
129        }
130        // Coins
131        if (fuzzed_data_provider.ConsumeBool()) {
132            std::vector<uint8_t> file_data{ConsumeRandomLengthByteVector(fuzzed_data_provider)};
133            outfile << std::span{file_data};
134        } else {
135            int height{1};
136            for (const auto& block : *g_chain) {
137                auto coinbase{block->vtx.at(0)};
138                outfile << coinbase->GetHash();
139                WriteCompactSize(outfile, 1); // number of coins for the hash
140                WriteCompactSize(outfile, 0); // index of coin
141                outfile << Coin(coinbase->vout[0], height, /*fCoinBaseIn=*/true);
142                height++;
143            }
144        }
145        if constexpr (INVALID) {
146            // Append an invalid coin to ensure invalidity. This error will be
147            // detected late in PopulateAndValidateSnapshot, and allows the
148            // INVALID fuzz target to reach more potential code coverage.
149            const auto& coinbase{g_chain->back()->vtx.back()};
150            outfile << coinbase->GetHash();
151            WriteCompactSize(outfile, 1);   // number of coins for the hash
152            WriteCompactSize(outfile, 999); // index of coin
153            outfile << Coin{coinbase->vout[0], /*nHeightIn=*/999, /*fCoinBaseIn=*/false};
154        }
155        assert(outfile.fclose() == 0);
156    }
157
158    const auto ActivateFuzzedSnapshot{[&] {
159        AutoFile infile{fsbridge::fopen(snapshot_path, "rb")};
160        auto msg_start = chainman.GetParams().MessageStart();
161        SnapshotMetadata metadata{msg_start};
162        try {
163            infile >> metadata;
164        } catch (const std::ios_base::failure&) {
165            return false;
166        }
167        return !!chainman.ActivateSnapshot(infile, metadata, /*in_memory=*/true);
168    }};
169
170    if (fuzzed_data_provider.ConsumeBool()) {
171        // Consume the bool, but skip the code for the INVALID fuzz target
172        if constexpr (!INVALID) {
173            for (const auto& block : *g_chain) {
174                BlockValidationState dummy;
175                bool processed{chainman.ProcessNewBlockHeaders({{*block}}, true, dummy)};
176                Assert(processed);
177                const auto* index{WITH_LOCK(::cs_main, return chainman.m_blockman.LookupBlockIndex(block->GetHash()))};
178                Assert(index);
179            }
180            dirty_chainman = true;
181        }
182    }
183
184    if (ActivateFuzzedSnapshot()) {
185        LOCK(::cs_main);
186        Assert(!chainman.ActiveChainstate().m_from_snapshot_blockhash->IsNull());
187        const auto& coinscache{chainman.ActiveChainstate().CoinsTip()};
188        for (const auto& block : *g_chain) {
189            Assert(coinscache.HaveCoin(COutPoint{block->vtx.at(0)->GetHash(), 0}));
190            const auto* index{chainman.m_blockman.LookupBlockIndex(block->GetHash())};
191            Assert(index);
192            Assert(index->nTx == 0);
193            if (index->nHeight == chainman.ActiveChainstate().SnapshotBase()->nHeight) {
194                auto params{chainman.GetParams().AssumeutxoForHeight(index->nHeight)};
195                Assert(params.has_value());
196                Assert(params.value().m_chain_tx_count == index->m_chain_tx_count);
197            } else {
198                Assert(index->m_chain_tx_count == 0);
199            }
200        }
201        Assert(g_chain->size() == coinscache.GetCacheSize());
202        dirty_chainman = true;
203    } else {
204        Assert(!chainman.ActiveChainstate().m_from_snapshot_blockhash);
205    }
206    // Snapshot should refuse to load a second time regardless of validity
207    Assert(!ActivateFuzzedSnapshot());
208    if constexpr (INVALID) {
209        // Activating the snapshot, or any other action that makes the chainman
210        // "dirty" can and must not happen for the INVALID fuzz target
211        Assert(!dirty_chainman);
212    }
213    if (dirty_chainman) {
214        setup.m_node.chainman.reset();
215        setup.m_make_chainman();
216        setup.LoadVerifyActivateChainstate();
217    }
218}
219
220// There are two fuzz targets:
221//
222// The target 'utxo_snapshot', which allows valid snapshots, but is slow,
223// because it has to reset the chainstate manager on almost all fuzz inputs.
224// Otherwise, a dirty header tree or dirty chainstate could leak from one fuzz
225// input execution into the next, which makes execution non-deterministic.
226//
227// The target 'utxo_snapshot_invalid', which is fast and does not require any
228// expensive state to be reset.
229FUZZ_TARGET(utxo_snapshot /*valid*/, .init = initialize_chain<false>) { utxo_snapshot_fuzz<false>(buffer); }
230FUZZ_TARGET(utxo_snapshot_invalid, .init = initialize_chain<true>) { utxo_snapshot_fuzz<true>(buffer); }
231
232} // namespace
233

src/wallet/receive.cpp

src/wallet/coinselection.cpp

src/consensus/validation.h

src/primitives/transaction.cpp

src/script/descriptor.cpp

src/bitcoin-cli.cpp

src/rpc/blockchain.cpp

src/rpc/rawtransaction.cpp

src/init.cpp

src/crypto/sha256.cpp

src/consensus/merkle.h

src/consensus/tx_check.h

src/consensus/tx_verify.h

src/policy/feerate.h

src/policy/feerate.cpp

src/primitives/transaction_identifier.h

src/chainparamsbase.h

src/chainparamsbase.cpp

src/util/moneystr.cpp

src/crypto/ripemd160.h

src/crypto/sha1.h

src/crypto/sha512.h

src/crypto/hmac_sha256.h

src/crypto/hmac_sha512.h

src/crypto/hmac_sha256.cpp

src/crypto/hmac_sha512.cpp

src/crypto/hkdf_sha256_32.h

src/crypto/hkdf_sha256_32.cpp

src/support/cleanse.h

src/support/cleanse.cpp

src/crypto/siphash.cpp

src/crypto/muhash.h

src/crypto/chacha20.h

src/crypto/poly1305.h

src/crypto/chacha20poly1305.h

src/crypto/chacha20poly1305.cpp

src/util/chaintype.cpp

src/util/obfuscation.h

src/util/byte_units.h

src/util/overflow.h

src/blockencodings.cpp

src/net_permissions.cpp

src/policy/packages.cpp

src/policy/rbf.cpp

src/policy/truc_policy.cpp

src/policy/ephemeral_policy.cpp

src/policy/settings.cpp

src/policy/policy.cpp

src/node/transaction.cpp

src/node/coin.cpp

src/rpc/client.cpp

src/rpc/external_signer.cpp

src/rpc/request.cpp

src/rpc/server_util.cpp

src/rpc/fees.cpp

src/rpc/output_script.cpp

src/rpc/rawtransaction_util.cpp

src/rpc/rawtransaction_util.h

src/rpc/register.h

src/rpc/request.h

src/rpc/server_util.h

src/rpc/protocol.h

src/rpc/server.h

src/rpc/signmessage.cpp

src/rpc/txoutproof.cpp

src/rpc/util.cpp

src/rpc/util.h

src/wallet/rpc/addresses.cpp

src/wallet/rpc/backup.cpp

src/wallet/rpc/coins.cpp

src/wallet/rpc/encrypt.cpp

src/wallet/rpc/signmessage.cpp

src/wallet/rpc/util.cpp

src/wallet/rpc/util.h

src/wallet/coincontrol.cpp

src/wallet/coincontrol.h

src/wallet/context.cpp

src/wallet/context.h

src/wallet/crypter.cpp

src/wallet/crypter.h

src/wallet/db.cpp

src/wallet/export.cpp

src/wallet/external_signer_scriptpubkeyman.cpp

src/wallet/rpc/spend.cpp

src/wallet/rpc/transactions.cpp

src/wallet/rpc/wallet.cpp

src/wallet/feebumper.cpp

src/wallet/feebumper.h

src/index/base.h

src/index/base.cpp

src/index/txindex.h

src/index/txindex.cpp

src/index/txindex_key.h

src/index/txospenderindex.h

src/index/txospenderindex.cpp

src/index/blockfilterindex.h

src/index/blockfilterindex.cpp

src/index/coinstatsindex.h

src/index/coinstatsindex.cpp

src/index/db_key.h

src/index/disktxpos.h

src/kernel/chain.cpp

src/kernel/chain.h

src/kernel/checks.cpp

src/kernel/checks.h

src/kernel/context.cpp

src/kernel/context.h

src/kernel/cs_main.cpp

src/kernel/cs_main.h

src/kernel/disconnected_transactions.cpp

src/kernel/disconnected_transactions.h

src/kernel/mempool_removal_reason.cpp

src/kernel/mempool_removal_reason.h

src/kernel/coinstats.cpp

src/kernel/coinstats.h

src/kernel/chainparams.cpp

src/kernel/chainparams.h

src/wallet/sqlite.cpp

src/wallet/sqlite.h

src/wallet/transaction.cpp

src/wallet/transaction.h

src/wallet/dump.cpp

src/wallet/dump.h

src/wallet/init.cpp

src/wallet/walletutil.cpp

src/wallet/walletutil.h

src/wallet/wallettool.cpp

src/wallet/wallettool.h

src/wallet/export.h

src/wallet/migrate.cpp

src/wallet/migrate.h

src/wallet/db.h

src/wallet/walletdb.cpp

src/wallet/interfaces.cpp

src/wallet/scriptpubkeyman.cpp

src/wallet/scriptpubkeyman.h

src/kernel/bitcoinkernel.cpp

src/kernel/bitcoinkernel.h

src/kernel/bitcoinkernel_wrapper.h

src/node/chainstate.cpp

src/node/chainstate.h

src/node/blockstorage.cpp

src/node/blockstorage.h

src/node/mempool_persist.cpp

src/node/mempool_persist.h

src/node/utxo_snapshot.cpp

src/node/utxo_snapshot.h

src/node/kernel_notifications.cpp

src/node/kernel_notifications.h

src/node/blockmanager_args.cpp

src/kernel/blockmanager_opts.h

src/util/expected.cpp

src/policy/settings.h

src/util/types.h

src/kernel/messagestartchars.h

src/kernel/warning.h

src/util/exception.h

src/common/license_info.h

src/node/coins_view_args.h

src/node/database_args.h

src/util/batchpriority.h

src/util/ui_change_type.h

src/node/coins_view_args.cpp

src/node/peerman_args.h

src/util/serfloat.h

src/node/blockmanager_args.h

src/node/database_args.cpp

src/util/overloaded.h

src/interfaces/types.h

src/node/chainstatemanager_args.h

src/node/minisketchwrapper.h

src/util/macros.h

src/util/syserror.h

src/common/run_command.h

src/util/bytevectorhash.cpp

src/node/mempool_persist_args.cpp

src/util/exec.h

src/util/rbf.h

src/crypto/hex_base.h

src/node/mempool_persist_args.h

src/interfaces/echo.h

src/util/any.h

src/util/batchpriority.cpp

src/util/threadnames.h

src/node/coin.h

src/node/mempool_args.h

src/util/asmap.h

src/util/bytevectorhash.h

src/node/context.cpp

src/util/insert.h

src/util/readwritefile.h

src/node/peerman_args.cpp

src/node/interface_ui.cpp

src/interfaces/handler.h

src/node/mining_args.h

src/util/hasher.cpp

src/common/init.h

src/kernel/mempool_limits.h

src/common/system.h

src/crypto/sha3.h

src/util/threadinterrupt.cpp

src/node/protocol_version.h

src/util/exception.cpp

src/common/messages.h

src/node/connection_types.cpp

src/util/bip32.h

src/common/license_info.cpp

src/util/stdmutex.h

src/common/run_command.cpp

src/util/check.cpp

src/util/golombrice.h

src/node/types.h

src/node/timeoffsets.h

src/util/readwritefile.cpp

src/util/fastrange.h

src/util/signalinterrupt.h

src/util/task_runner.h

src/util/syserror.cpp

src/common/interfaces.cpp

src/common/types.h

src/util/threadinterrupt.h

src/kernel/chainstatemanager_opts.h

src/node/psbt.h

src/policy/ephemeral_policy.h

src/util/trace.h

src/common/url.cpp

src/kernel/mempool_options.h

src/util/serfloat.cpp

src/kernel/notifications_interface.h

src/node/timeoffsets.cpp

src/node/warnings.cpp

src/util/hash_type.h

src/crypto/hex_base.cpp

src/node/eviction.h

src/util/tokenbucket.h

src/crypto/aes.h

src/common/pcp.h

src/util/feefrac.cpp

src/node/transaction.h

src/util/threadnames.cpp

src/common/signmessage.h

src/util/exec.cpp

src/util/signalinterrupt.cpp

src/clientversion.cpp

src/common/signmessage.cpp

src/compat/assumptions.h

src/compat/byteswap.h

src/deploymentinfo.cpp

src/deploymentinfo.h

src/deploymentstatus.cpp

src/deploymentstatus.h

src/dummywallet.cpp

src/external_signer.h

src/init/bitcoin-gui.cpp

src/init/bitcoin-node.cpp

src/init/bitcoin-qt.cpp

src/init/bitcoin-wallet.cpp

src/init/bitcoind.cpp

src/init/common.h

src/interfaces/init.h

src/interfaces/ipc.h

src/key_io.h

src/logging/categories.h

src/logging/timer.h

src/mapport.h

src/musig.h

src/net_permissions.h

src/netgroup.h

src/netmessagemaker.h

src/node/chainstatemanager_args.cpp

src/node/connection_types.h

src/node/context.h

src/node/interface_ui.h

src/node/mempool_args.cpp

src/node/mining_args.cpp

src/node/minisketchwrapper.cpp

src/node/txreconciliation.h

src/policy/fees/estimator_args.cpp

src/policy/fees/estimator_args.h

src/policy/fees/estimator_man.cpp

src/policy/fees/estimator_man.h

src/policy/packages.h

src/policy/rbf.h

src/policy/truc_policy.h

src/pow.h

src/primitives/block.cpp

src/randomenv.h

src/rest.h

src/script/keyorigin.h

src/script/parsing.cpp

src/script/parsing.h

src/script/script_error.h

src/script/sigcache.cpp

src/script/sigcache.h

src/script/solver.h

src/script/verify_flags.h

src/semaphore_grant.h

src/signet.h

src/span.h

src/support/allocators/secure.h

src/support/allocators/zeroafterfree.h

src/util/tokenpipe.cpp

src/util/translation.h

src/util/vector.h

src/versionbits.h

src/versionbits_impl.h

src/wallet/external_signer_scriptpubkeyman.h

src/wallet/fees.h

src/wallet/load.h

src/wallet/receive.h

src/wallet/rpc/wallet.h

src/wallet/types.h

src/walletinitinterface.h

src/zmq/zmqabstractnotifier.cpp

Independent explanations by MyBitcoinExplorer. Not affiliated with or endorsed by Bitcoin Core. Guides are educational and do not replace the source or its tests.

Bitcoin Core source © its contributors, distributed under the MIT license. Original notices and bundled third-party licenses are retained in the source tree.