btc: guard both broadcast_block_with_fallback legs vs throwing sink - #474
Merged
Conversation
A throwing relay_p2p() sink unwound past broadcast_block_with_fallback, bypassing the submitblock RPC fallback entirely and silently dropping a won block -- the exact hole the fallback exists to close, and a violation of the doc-comment contract that a won block is never silent-dropped. Guard both legs: a throwing primary relay is treated as relay-failed and falls through to the submitblock fallback; a throwing last-resort submit_rpc collapses to a definite false so the caller scream path fires instead of an exception escaping the won-block handler. Mirror of the NMC broadcast leg-guard fix (#468). 6 KATs ride the already-allowlisted btc_share_test exe (no build.yml allowlist change, no #137 NOT_BUILT risk).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Guards BOTH legs of
btc::coin::broadcast_block_with_fallbackagainst a throwing sink (mirror of NMC #468).Why (real silent-drop defect)
A throwing
relay_p2p()sink unwound PAST the function, bypassing the submitblock RPC fallback entirely and silently dropping a won block -- the exact P2P-unavailable/relay-failed hole the fallback exists to close, and a violation of the doc-comment promise that a won block is never silent-dropped.Fix
submit_rpc-> collapses to a definitefalseso the callers documented scream / lost-subsidy path fires instead of an exception escaping the won-block handler.Tests
6 KATs in
block_broadcast_guard_test.cpp, riding the already-allowlistedbtc_share_testexe (no build.yml allowlist change, no #137 NOT_BUILT risk). Local: 6/6 pass, full btc_share_test 27/27 green. The throw-guard KATs bite (EXPECT_NO_THROW fails on the pre-fix impl).v36 standardization (bucket 2)
Same un-guarded-leg claim-vs-impl gap exists in DGB/BCH dual-path broadcasters -- a v36-native shared-structure standardization opportunity, flagged for those stewards.