wallet: add default-on auto-shield-coinbase; drain miner coinbase into a z-addr

On this ac_private=1 chain miners accumulate one transparent coinbase UTXO per block (the only transparent output the chain permits). It had to be shielded manually via z_shieldcoinbase, and left unshielded it is the sole persistent metadata leak on the chain and the source of miner UTXO-fragmentation send failures. Add AsyncRPCOperation_autoshieldcoinbase: a periodic, default-on wallet op driven from CWallet::ChainTip alongside sweep/consolidation, draining matured coinbase into a wallet-owned Sapling z-address in size-bounded batches. - Enqueue-only driver (RunAutoShieldCoinbase): takes only cs_wallet in the notify context; all gathering runs on the async worker under LOCK2(cs_main, cs_wallet). - Dedicated op (not a reuse of z_shieldcoinbase) so it never toggles mining. - Default-ON but conditional: silent no-op on -disablewallet, external -mineraddress, non-mining, or locked wallets (explicit IsLocked() guard). - Destination is reuse-then-create; -autoshieldaddress override is spend-key-validated at init so funds cannot be stranded. - Sweep-model bookkeeping: advances nextAutoShield and clears the running flag on every terminal state; an op-id guard stops a stale op clobbering scheduler state; a self-guard stops cancel/re-enqueue churn. - Sietch-padded output shape matches manual z_shieldcoinbase txns. Config: -autoshield (default true), -autoshieldinterval, -autoshieldaddress, -autoshieldfee (range-validated), -autoshieldminutxos. Incorporates fixes from an 8-angle code review: CAmount fee type with init-time range validation, op-id-guarded flag bookkeeping, driver self-guard, and a tipHeight-consistent NU-activation guard. Note: the fConsolidationRunning / nextConsolidation consolidation-scheduler wedge is a pre-existing bug, left for a separate change. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-08-21 02:06:09 -05:00
parent 1c3523aac1
commit 2ebbbc777c
6 changed files with 522 additions and 0 deletions
@@ -489,6 +489,12 @@ std::string HelpMessage(HelpMessageMode mode)
    strUsage += HelpMessageOpt("-zsweepexternal", _("Enable sweeping to an external wallet (default false)"));
    strUsage += HelpMessageOpt("-zsweepexclude", _("Addresses to exclude from sweeping (default none)"));

+    strUsage += HelpMessageOpt("-autoshield", _("Automatically shield matured coinbase (mining rewards) into a wallet z-address (default: true). No-op when not mining or wallet is locked."));
+    strUsage += HelpMessageOpt("-autoshieldinterval", strprintf(_("Block interval between automatic coinbase-shielding rounds (default: %i, min 5)"), 25));
+    strUsage += HelpMessageOpt("-autoshieldaddress=<zaddr>", _("Destination Sapling z-address for auto-shielded coinbase (default: reuse or create a wallet z-address). Must be spendable by this wallet."));
+    strUsage += HelpMessageOpt("-autoshieldfee", strprintf(_("Fee in puposhis for automatic coinbase-shielding transactions (default: %i)"), 10000));
+    strUsage += HelpMessageOpt("-autoshieldminutxos", strprintf(_("Only auto-shield once at least this many matured coinbase UTXOs exist (default: %i)"), 1));
+
    strUsage += HelpMessageOpt("-deletetx", _("Enable Old Transaction Deletion"));
    strUsage += HelpMessageOpt("-deleteinterval", strprintf(_("Delete transaction every <n> blocks during inital block download (default: %i)"), DEFAULT_TX_DELETE_INTERVAL));
    strUsage += HelpMessageOpt("-keeptxnum", strprintf(_("Keep the last <n> transactions (default: %i)"), DEFAULT_TX_RETENTION_LASTTX));
@@ -2451,6 +2457,55 @@ bool AppInit2(boost::thread_group& threadGroup, CScheduler& scheduler)
            }
        }

+        //Set Automatic Coinbase Shielding (default ON, conditional: self-guards
+        //on nodes where it cannot act - no owned coinbase, external mineraddress,
+        //or locked wallet). Closes the transparent-coinbase leak for miners.
+        pwalletMain->fAutoShieldEnabled = GetBoolArg("-autoshield", true);
+        if (pwalletMain->fAutoShieldEnabled) {
+            int autoShieldInterval = GetArg("-autoshieldinterval", 25);
+            if (autoShieldInterval < 5) {
+                fprintf(stderr,"%s: Invalid autoshield interval of %d < 5, setting to default of 25\n", __func__, autoShieldInterval);
+                autoShieldInterval = 25;
+            }
+            pwalletMain->autoShieldInterval = autoShieldInterval;
+            pwalletMain->nextAutoShield     = pwalletMain->autoShieldInterval + chainActive.Height();
+
+            // Validate the fee: floor it above the relay minimum and cap it to
+            // guard against a fat-finger (e.g. -autoshieldfee=5000000000) that
+            // would otherwise build an over-fee or malformed shield tx that
+            // fails mempool admission every round.
+            CAmount autoShieldFee = GetArg("-autoshieldfee", 10000);
+            const CAmount AUTOSHIELD_MIN_FEE = 1000;      // comfortably above minRelayTxFee for a small tx
+            const CAmount AUTOSHIELD_MAX_FEE = 10000000;  // 0.1 DRGX; no sane autoshield fee exceeds this
+            if (autoShieldFee < AUTOSHIELD_MIN_FEE || autoShieldFee > AUTOSHIELD_MAX_FEE) {
+                fprintf(stderr,"%s: -autoshieldfee=%lld out of range [%lld,%lld], using default 10000\n",
+                        __func__, (long long)autoShieldFee, (long long)AUTOSHIELD_MIN_FEE, (long long)AUTOSHIELD_MAX_FEE);
+                autoShieldFee = 10000;
+            }
+            pwalletMain->autoShieldFee      = autoShieldFee;
+            pwalletMain->autoShieldMinUtxos = GetArg("-autoshieldminutxos", 1);
+            if (pwalletMain->autoShieldMinUtxos < 1) {
+                pwalletMain->autoShieldMinUtxos = 1;
+            }
+            LogPrintf("%s: autoshield enabled, nextAutoShield=%d interval=%d\n", __func__, pwalletMain->nextAutoShield, pwalletMain->autoShieldInterval);
+
+            //Optional explicit destination z-address. Must be a Sapling zaddr the
+            //wallet can spend, else the shielded coinbase would be unrecoverable.
+            std::string autoShieldAddress = GetArg("-autoshieldaddress", "");
+            if (!autoShieldAddress.empty()) {
+                auto zdest = DecodePaymentAddress(autoShieldAddress);
+                if (!IsValidPaymentAddress(zdest) ||
+                    boost::get<libzcash::SaplingPaymentAddress>(&zdest) == nullptr) {
+                    return InitError("Invalid -autoshieldaddress: must be a Sapling z-address");
+                }
+                auto hasSpendingKey = boost::apply_visitor(HaveSpendingKeyForPaymentAddress(pwalletMain), zdest);
+                if (!hasSpendingKey) {
+                    return InitError("Wallet must hold the spending key of -autoshieldaddress (else shielded coinbase would be unrecoverable)");
+                }
+                pwalletMain->autoShieldAddress = autoShieldAddress;
+            }
+        }
+
        //Set Transaction Deletion Options
        fTxDeleteEnabled = GetBoolArg("-deletetx", false);
        fTxConflictDeleteEnabled = GetBoolArg("-deleteconflicttx", true);