v1.4.3

v1.4.3 - security hardening for confidential transactions, proof of work and the wallet

Upgrade recommended for every node operator, pool and exchange. There is no
chain split: the single new consensus rule (confidential nonce whitelist)
activates at nBanPathAHeight, which is already behind us on the live network.

Security fixes

1. Confidential-transaction nonce whitelist (tx_verify). Above nBanPathAHeight
   an input is only accepted with a null nonce or the modern 0x03 / 0x04
   confidential nonces; the legacy Path A form (0x02) is rejected. Operators
   that still need Path A for recovery can start the node with -ctlegacy. The
   reject string stays "bad-ct-legacy-nonce" so existing tooling keeps
   working. Consensus tightening: nodes older than v1.4.3 still accept these
   transactions, so upgrade before the height is enforced on your network.
2. Etchash pre-check now runs full proof-of-work verification
   (POW_VERIFY_FULL) inside HasValidProofOfWork, so a header can no longer
   pass the cheap pre-check without a complete Etchash evaluation.
3. Range-proof deserialization is capped at MAX_RANGEPROOF_SIZE in
   CTxOut::Unserialize, bounding attacker-controlled allocations per output.

Wallet fixes
4. A blinded output that fails to unblind is now logged instead of silently
counted as zero, which used to make balances look smaller than reality.
5. Fee estimation is blind-first: the transaction is blinded, measured, then
the fee is settled on the funding output. This fixes "Change output too
small to cover CT fee overhead" on dust-sized change and corrects the
range-proof / commitment size model (33-byte commitments, 2-byte proof
header, per-input nValue accounting).

Tests

• blind_tests pins EstimatedRangeProofSize / EstimatedBlindedOutputDelta
  against genuinely signed proofs for values 0..MAX_MONEY.
• wallet_confidential.py functional test passes.
• wallet_tests reads the block reward from GetBlockSubsidy() instead of
  assuming Bitcoin's 50 COIN.

Assets

• Linux and Windows node binaries, GUI AppImage
• SHA256SUMS.txt plus the detached signature SHA256SUMS.txt.asc
  (key fingerprint 934D 5BC9 5DD4 B3AC FEF5 21B9 5476 3350 1FE4 B8EE)