Skip to content

Reject invalid RTM coinbase dev rewards#38

Merged
MoneroOcean merged 1 commit into
masterfrom
codex/find-usage-of-validatecoinbasedevreward
Jun 3, 2026
Merged

Reject invalid RTM coinbase dev rewards#38
MoneroOcean merged 1 commit into
masterfrom
codex/find-usage-of-validatecoinbasedevreward

Conversation

@MoneroOcean
Copy link
Copy Markdown
Owner

Motivation

  • Fix a fail-open validation path where malformed rpcData.coinbasedevreward could be skipped as an output but its value would still inflate the pool payout and change the coinbase transaction version.
  • Ensure daemon-supplied dev-reward data is treated as trusted-only after explicit validation so miners are not given invalid block templates that waste work.

Description

  • Add hasValidCoinbaseDevReward(rpcData) which uses validateCoinbaseDevReward() and throws on malformed dev-reward objects instead of silently returning false.
  • Change generateTransactionOutputs() to accept a hasDevReward flag and only add coinbasedevreward.value into reward accounting when the dev reward has been validated.
  • Use the validated hasDevReward state for coinbase transaction version selection so the version matches the actual emitted outputs.
  • Add a regression test in tests/test.js asserting that a malformed coinbasedevreward.scriptpubkey causes RtmBlockTemplate() to throw (Invalid coinbase dev reward).

Testing

  • Ran a targeted RTM validation smoke test with dependency stubs (simulating absent, valid, and malformed coinbasedevreward) and the stubbed tests passed (valid/absent succeed, malformed throws as expected).
  • Ran git diff --check to ensure no whitespace/patch issues and it passed.
  • Attempted npm test but it was blocked by the environment/registry returning 403 Forbidden while fetching dependencies so full test suite could not be executed.
  • Attempted node --test --test-reporter=spec tests/test.js but it failed in this environment due to the missing native addon build artifact (../build/Release/blocktemplate), so the full test run could not complete.

Codex Task

@MoneroOcean MoneroOcean merged commit d596bd5 into master Jun 3, 2026
3 checks passed
@MoneroOcean MoneroOcean deleted the codex/find-usage-of-validatecoinbasedevreward branch June 3, 2026 18:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant