The lightwalletd server controls the compact ciphertext length, the
block, prev-block and tx hash lengths, and (through the chain) the full
txs' epks. Each of these could wedge or poison a sync:
- try_sapling_compact_note_decryption asserts a 52-byte ciphertext. A
shorter (or full 580-byte) one panicked a pool job in
scan_output_internal while the original sender stayed alive, so the
collector waited forever with sync_lock, txs.write() and a wallet read
guard held.
- scan_taddress_txids kept its own sender alive too: one panicking
t-address job (scan_full_tx) left crx.iter().take(n) blocked forever.
- CompactBlock::hash()/prev_hash() assert 32 bytes when no header is
sent, and every vtx hash is copied into a [u8; 32], one of them under
txs.write(): a 31-byte tx hash poisoned the wallet for good, and a bad
hash in the block's txid list panicked after the witnesses had moved.
- scan_full_tx and scan_full_mempool_tx unwrapped as_prime_order() on
the epk. Consensus rejects only a small-order epk, so a mixed-order
one can be mined: an own tx then failed every sync, and the mempool
receiver thread died silently.
Changes:
- append_leaf(node: Node, ..) commits a leaf to the existing, block and
new witnesses and the tree; the epk-error path, the new
short-ciphertext path and the normal path all use it (a
behaviour-neutral extraction).
- A compact ciphertext under 52 bytes is skipped with its cmu still
committed; a longer one is truncated to 52 bytes, which is exact (the
compact plaintext is those bytes and the cmu re-check validates it).
- Each decryption job catches a panic and sends exactly one message;
drop(tx) after the dispatch, and the collector logs a vanished or
panicked job and treats the output as not ours.
- scan_taddress_txids runs through the private seam
scan_taddress_txids_with(job): catch_unwind per job, drop(ctx), and a
count check, so a dead job is an error, never a hang or a silent
partial success.
- scan_block_with_pool checks the block, prev-block and vtx hash lengths
right after the parse and returns Err(-1), as for an unparsable block,
before any change (Err(height) would refetch the same block forever
under sync_lock).
- scan_full_tx and scan_full_mempool_tx skip an output whose epk is not
in the prime-order subgroup (one check per output, used by every
decryption and the outgoing recovery).
- The mempool receiver thread catches a panic of scan_full_mempool_tx.
Flagged behaviour changes:
- a compact ciphertext under 52 bytes is skipped (its cmu is still
committed); one over 52 bytes is truncated;
- pool-job panics are reported (logged; the output is treated as not
ours, which a rescan repairs) instead of hanging the sync;
- bad hash lengths return Err(-1) before any change;
- outputs with a non-prime-order epk are skipped;
- the mempool thread survives a bad tx.
Wallet format v9 is unchanged; no ABI or symbol change. Honest data
takes the same path as before (an old-vs-new run over generated honest
chains is byte-identical).
Tests (each on its own thread under a 15 s watchdog):
0/51/52/53/580-byte ciphertexts in one block on the inline and deferred
witness paths (the 51-byte notes are skipped, the 53- and 580-byte notes
are found, the tree and every witness match the reference); a 31-byte tx
hash, an empty block hash, a 31-byte prev hash and a 33-byte foreign tx
hash each return Err(-1) with the txs lock usable and
last_scanned_height, trees and witnesses unchanged; a mixed-order epk in
scan_full_tx and scan_full_mempool_tx does not panic and decrypts
nothing while the real epk still decrypts; a t-address job panicking for
1 of 3 addresses is an Err. The oracle generator gains short
(0..=51-byte) and full (580-byte) ciphertext outputs without an extra
random draw, so each seed keeps its sequence of blocks, values and
keys.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
DanSandClaude Opus 5.5
a5db2e9a3d