DragonX/ObsidianDragon
1
1
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 10 Wiki Activity

fix(migrate): require a reorg-safe sweep depth + re-verify before adopt; make the wallet.dat swap crash-safe

Browse Source 
Resilience audit, migrate-to-seed (the sweep RPC is byte-identical — see below):
- Adopt was enabled at >= 1 confirmation and never re-read state before stopping the daemon, so a 1-block
  reorg after the swap could un-mine the sweep and strand the funds in the .bak. Adopt now needs a
  reorg-safe depth (>= 10, matching the History "confirmed" threshold), and the button runs
  verifyThenAdoptSeedWallet(): a read-only gettransaction(confs) + z_gettotalbalance minconf 0 (includes
  unconfirmed, fixing the old minconf-1 "no funds" gate) immediately before the daemon stop, refusing while
  syncing or if any read fails. The remainder re-sweep still shows once mined (>=1).
- The wallet.dat swap was rename(legacy->bak) then non-atomic copy(new->wallet.dat): a hard kill left
  wallet.dat missing or half-written. New order: probe the new file is a BDB wallet; stage a size-verified
  copy beside wallet.dat; COPY (never overwrite) the legacy wallet to the timestamped .bak and verify it;
  then ONE atomic fs::rename of the staged file over wallet.dat. At every instant wallet.dat is the whole
  old or whole new wallet, and a verified .bak exists before the replace. On any failure only our scratch
  files are removed; the user's wallet is untouched.

Byte-identical: z_mergetoaddress (beginSweepToSeedWallet, ["ANY_TADDR","ANY_ZADDR"], amounts, fee, recipient,
memo) and beginAdoptSeedWallet's disconnect/vault-removal/stop/rescan/restart logic are unchanged; only the
adopt gating, two new read-only RPCs, presentation, and the file-move safety change. Pure tests:
sweepConfsAreReorgSafe + adoptReverifyPasses.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
DanS
2026-10-19 15:22:17 -05:00
co-authored by Claude Opus 4.8
parent 6f369376ec
commit 0cb1df3bfe
6 changed files with 150 additions and 17 deletions
Download Patch File Download Diff File Expand all files Collapse all files
src/data/seed_migration_resume.h
+20
View File
@@ -42,4 +42,24 @@ inline MigrationResume decideSeedMigrationResume(bool pending,
// wallet.dat on an unconfirmed sweep. (fund-safety: audit)
inline bool sweepGateMayAdoptEmptyWallet(bool sweepSubmitted) { return !sweepSubmitted; }
// Reorg-safe depth before the adopt swap is enabled. Matches the History "confirmed" threshold
// (>= 10, data/transaction_history_store_policy.h): a 1-block reorg must not be able to un-mine the
// sweep after wallet.dat has been moved aside, which would strand the funds in the .bak.
inline constexpr int kSweepAdoptMinConfs = 10;
inline bool sweepConfsAreReorgSafe(int confs) { return confs >= kSweepAdoptMinConfs; }
// Final pre-stop re-verification, run on fresh RPC reads immediately before the daemon is stopped.
// needSweepTx : a sweep txid exists, so its confirmations must be reorg-safe (false = genuinely
// empty wallet, no sweep ever submitted).
// confs : fresh gettransaction confirmations (negative = conflicted).
// balanceMinconf0 : fresh z_gettotalbalance with minconf 0 (INCLUDES unconfirmed), < 0 = unknown.
// syncing : the node is still catching up, so balance reads are not trustworthy.
inline bool adoptReverifyPasses(bool needSweepTx, int confs, double balanceMinconf0,
bool syncing, double dust)
{
if (syncing) return false;
if (needSweepTx && !sweepConfsAreReorgSafe(confs)) return false;
return balanceMinconf0 >= 0.0 && balanceMinconf0 <= dust;
}
} // namespace dragonx