net: stop serving the 2009 marketplace to anonymous peers

Four inherited handlers took attacker-controlled input and wrote to disk
with nothing authorising it. None of them had a caller left anywhere in
the tree, so all four were reachable only from the outside.

checkorder called GenerateNewKey() -- AddKey(), a wallet.dat write -- for
any peer that asked, and handed back the pubkey. Its comment claims the
cache keeps one key per ip, and on a 2009 network of routable addresses
it did. Not here: inbound peers arrive through a rendezvous tunnel and
are tagged by BtfMarkerAddr() over three random bytes, so addr.ip is
fresh every connection and the cache never hits. Reconnect in a loop and
the node mints a key per connection, none of them in any backup taken
beforehand, which for a pre-BIP32 wallet is how coins go missing. The map
holding them was static and never trimmed.

submitorder AddToWallet()'d a CWalletTx from any peer that sent one. It
had to be a valid transaction; it did not have to be ours.

review checked a signature the sender made with its own key, which proves
possession and authorises nothing, then appended to reviews.dat by
reading the whole vector, pushing one entry and writing it all back --
quadratic disk on an unbounded map<string,string> off the socket -- then
walked a link graph the same peer supplied and relayed the message to
every other node.

reply dispatched into CRequestTracker. Nothing ever called PushRequest,
so the table was permanently empty and the handler was a parser and
nothing else.

Removed with the subsystem behind them: market.cpp, CProduct, CReview,
CUser, CReviewDB, the advert publish templates and the subscribe channel
machinery, none of which had an inbound handler either. MSG_REVIEW,
MSG_PRODUCT and MSG_TABLE stay in the inv enum, unserved: CInv puts type
on the wire as an integer and MSG_TX and MSG_BLOCK are shared with every
other node.

Unknown commands are already ignored for extensibility, so peers still
running these lose nothing but an answer they never asked for. Verified
by a clean build of bitflash-node.

(cherry picked from commit ad9c393866c007a115f32d70a9017ce91066a7d1)

10 files changed, 69 insertions, 787 deletions

diff --git a/src/Makefile b/src/Makefile
index 3577dd6..171afe0 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -48,14 +48,14 @@ LIBS = -L$(SECP_LIB) -lsecp256k1 \
 # binary. Nothing crashed here, and nothing would say so if it had.
 HEADERS = headers_core.h headers.h util.h main.h serialize.h uint256.h \
           key.h bignum.h script.h db.h base58.h net.h nostr.h \
-          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h market.h \
+          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h \
           selftest.h walletcmd.h compat.h sockcount.h font_roboto.h
 
 IMGUI_OBJS = obj/imgui.o obj/imgui_draw.o obj/imgui_tables.o \
              obj/imgui_widgets.o obj/imgui_impl_glfw.o obj/imgui_impl_opengl3.o
 
 NODE_OBJS = obj/util.o obj/script.o obj/db.o obj/net.o obj/main.o \
-            obj/market.o obj/sha.o obj/nostr.o obj/randomx_pow.o \
+            obj/sha.o obj/nostr.o obj/randomx_pow.o \
             obj/btfaddr.o obj/btfchan.o obj/btfrv.o obj/btftunnel.o obj/rpc.o \
             obj/selftest.o obj/bip32.o obj/walletcmd.o
 
diff --git a/src/db.cpp b/src/db.cpp
index c8642e9..6f9461b 100644
--- a/src/db.cpp
+++ b/src/db.cpp
@@ -598,20 +598,12 @@ bool CTxDB::LoadBlockIndex()
 
 
 //
-// CReviewDB
+// CReviewDB is gone with the "review" handler. Its write path was
+// read-whole-vector / append-one / write-whole-vector, driven straight from an
+// unauthenticated peer, which is quadratic disk on an unbounded record.
+// Existing reviews.dat files are simply left alone and never opened.
 //
 
-bool CReviewDB::ReadReviews(uint256 hash, vector<CReview>& vReviews)
-{
-    vReviews.size(); // msvc workaround, just need to do anything with vReviews
-    return Read(make_pair(string("reviews"), hash), vReviews);
-}
-
-bool CReviewDB::WriteReviews(uint256 hash, const vector<CReview>& vReviews)
-{
-    return Write(make_pair(string("reviews"), hash), vReviews);
-}
-
 
 
 
diff --git a/src/db.h b/src/db.h
index 4fb5cfd..37a252f 100644
--- a/src/db.h
+++ b/src/db.h
@@ -8,8 +8,6 @@ class CTxIndex;
 class CDiskBlockIndex;
 class CDiskTxPos;
 class COutPoint;
-class CUser;
-class CReview;
 class CAddress;
 class CWalletTx;
 
@@ -314,27 +312,6 @@ public:
 
 
 
-class CReviewDB : public CDB
-{
-public:
-    CReviewDB(const char* pszMode="r+", bool fTxn=false) : CDB("reviews.dat", pszMode, fTxn) { }
-private:
-    CReviewDB(const CReviewDB&);
-    void operator=(const CReviewDB&);
-public:
-    bool ReadUser(uint256 hash, CUser& user)
-    {
-        return Read(make_pair(string("user"), hash), user);
-    }
-
-    bool WriteUser(uint256 hash, const CUser& user)
-    {
-        return Write(make_pair(string("user"), hash), user);
-    }
-
-    bool ReadReviews(uint256 hash, vector<CReview>& vReviews);
-    bool WriteReviews(uint256 hash, const vector<CReview>& vReviews);
-};
 
 
 
diff --git a/src/headers_core.h b/src/headers_core.h
index 6c0c602..6a60b52 100644
--- a/src/headers_core.h
+++ b/src/headers_core.h
@@ -66,7 +66,6 @@ inline typename std::common_type<T1,T2>::type max(const T1& a, const T2& b)
 #include "nostr.h"
 #include "randomx_pow.h"
 #include "main.h"
-#include "market.h"
 
 // GUI callback -- implemented in gui.cpp (or as no-op in headless builds)
 void MainFrameRepaint();
diff --git a/src/main.cpp b/src/main.cpp
index 62068d2..efff96c 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -2782,9 +2782,10 @@ bool AlreadyHave(CTxDB& txdb, const CInv& inv)
     {
     case MSG_TX:        return mapTransactions.count(inv.hash) || txdb.ContainsTx(inv.hash);
     case MSG_BLOCK:     return mapBlockIndex.count(inv.hash) || mapOrphanBlocks.count(inv.hash);
-    case MSG_REVIEW:    return true;
-    case MSG_PRODUCT:   return mapProducts.count(inv.hash);
     }
+    // MSG_REVIEW / MSG_PRODUCT / MSG_TABLE are the 2009 marketplace inventory
+    // types. Nothing announces or serves them any more (see ProcessMessage),
+    // so they fall through to the default and are never requested.
     // Don't know what it is, just say we already got one
     return true;
 }
@@ -2942,7 +2943,6 @@ bool ProcessMessages(CNode* pfrom)
 
 bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
 {
-    static map<unsigned int, vector<unsigned char> > mapReuseKey;
     if (LogAcceptsCategory("net")) { printf("received: %-12s (%d bytes)  ", strCommand.c_str(), (int)vRecv.size()); for (int i = 0; i < min(vRecv.size(), (unsigned int)25); i++) printf("%02x ", vRecv[i] & 0xff); printf("\n"); }
     if (nDropMessagesTest > 0 && GetRand(nDropMessagesTest) == 0)
     {
@@ -3181,22 +3181,18 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
     }
 
 
-    else if (strCommand == "review")
-    {
-        CDataStream vMsg(vRecv);
-        CReview review;
-        vRecv >> review;
-
-        CInv inv(MSG_REVIEW, review.GetHash());
-        pfrom->AddInventoryKnown(inv);
-
-        if (review.AcceptReview())
-        {
-            // Relay the original message as-is in case it's a higher version than we know how to parse
-            RelayMessage(inv, vMsg);
-            mapAlreadyAskedFor.erase(inv);
-        }
-    }
+    // "review" used to be handled here. It took a CReview off the wire from an
+    // unauthenticated peer, checked a signature the sender had made with a key
+    // of its own choosing -- which proves possession of that key and authorises
+    // nothing -- and then appended the message to reviews.dat by reading the
+    // whole vector for the target hash, pushing one entry, and writing all of
+    // it back. That is quadratic disk for a stream an attacker controls, on a
+    // record whose mapValue is an unbounded map<string,string> read straight
+    // from the socket, followed by AddAtomsAndPropagate walking a link graph
+    // the same peer supplied, and finally RelayMessage forwarding it to every
+    // other node. Unbounded remote disk growth with network amplification and
+    // no authorisation anywhere in the path. The marketplace it belonged to has
+    // not existed since 2009; the handler is gone rather than bounded.
 
 
     else if (strCommand == "block")
@@ -3229,65 +3225,28 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
     }
 
 
-    else if (strCommand == "checkorder")
-    {
-        uint256 hashReply;
-        CWalletTx order;
-        vRecv >> hashReply >> order;
-
-        /// we have a chance to check the order here
-
-        // Keep giving the same key to the same ip until they use it
-        if (!mapReuseKey.count(pfrom->addr.ip))
-            mapReuseKey[pfrom->addr.ip] = GenerateNewKey();
-
-        // Send back approval of order and pubkey to use
-        CScript scriptPubKey;
-        scriptPubKey << mapReuseKey[pfrom->addr.ip] << OP_CHECKSIG;
-        pfrom->PushMessage("reply", hashReply, (int)0, scriptPubKey);
-    }
-
-
-    else if (strCommand == "submitorder")
-    {
-        uint256 hashReply;
-        CWalletTx wtxNew;
-        vRecv >> hashReply >> wtxNew;
-
-        // Broadcast
-        if (!wtxNew.AcceptWalletTransaction())
-        {
-            pfrom->PushMessage("reply", hashReply, (int)1);
-            return error("submitorder AcceptWalletTransaction() failed, returning error 1");
-        }
-        wtxNew.fTimeReceivedIsTxTime = true;
-        AddToWallet(wtxNew);
-        wtxNew.RelayWalletTransaction();
-        mapReuseKey.erase(pfrom->addr.ip);
-
-        // Send back confirmation
-        pfrom->PushMessage("reply", hashReply, (int)0);
-    }
-
-
-    else if (strCommand == "reply")
-    {
-        uint256 hashReply;
-        vRecv >> hashReply;
-
-        CRequestTracker tracker;
-        CRITICAL_BLOCK(pfrom->cs_mapRequests)
-        {
-            map<uint256, CRequestTracker>::iterator mi = pfrom->mapRequests.find(hashReply);
-            if (mi != pfrom->mapRequests.end())
-            {
-                tracker = (*mi).second;
-                pfrom->mapRequests.erase(mi);
-            }
-        }
-        if (!tracker.IsNull())
-            tracker.fn(tracker.param1, vRecv);
-    }
+    // "checkorder", "submitorder" and "reply" -- the 2009 buy-from-a-merchant
+    // exchange -- used to be handled here. All three are gone.
+    //
+    // "checkorder" called GenerateNewKey() for any peer that asked, which is
+    // AddKey() and a wallet.dat write, and handed the pubkey back. The comment
+    // said "keep giving the same key to the same ip until they use it", and on
+    // a 2009 network of routable IPs that held. It does not hold here: every
+    // inbound peer arrives through a rendezvous tunnel and is tagged with
+    // BtfMarkerAddr() over three random bytes (net.cpp), so addr.ip is freshly
+    // random per connection and the cache never hits. Reconnect in a loop and
+    // the node mints a key per connection -- unbounded wallet growth, unbounded
+    // growth of the static map that held them, and every one of those keys
+    // missing from every backup taken beforehand, which for this pre-BIP32
+    // wallet is how coins are lost.
+    //
+    // "submitorder" took a CWalletTx from an unauthenticated peer and, if it
+    // was merely a valid transaction, AddToWallet()'d it. Valid is not the same
+    // as ours: any peer could write chosen transactions into wallet.dat.
+    //
+    // "reply" dispatched to a CRequestTracker callback. Nothing in this tree
+    // has ever called PushRequest, so mapRequests was permanently empty and the
+    // handler could only ever be a parser for hostile input.
 
 
     else if (strCommand == "ping")
diff --git a/src/makefile.mingw b/src/makefile.mingw
index e076c49..72f8bbf 100644
--- a/src/makefile.mingw
+++ b/src/makefile.mingw
@@ -40,7 +40,7 @@ IMGUI_OBJS = obj/imgui.o obj/imgui_draw.o obj/imgui_tables.o \
              obj/imgui_widgets.o obj/imgui_impl_glfw.o obj/imgui_impl_opengl3.o
 
 NODE_OBJS = obj/util.o obj/script.o obj/db.o obj/net.o obj/main.o \
-            obj/market.o obj/sha.o obj/nostr.o obj/randomx_pow.o \
+            obj/sha.o obj/nostr.o obj/randomx_pow.o \
             obj/btfaddr.o obj/btfchan.o obj/btfrv.o obj/btftunnel.o obj/rpc.o \
             obj/selftest.o obj/bip32.o obj/walletcmd.o
 
@@ -55,7 +55,7 @@ GUI_OBJS = obj/gui.o obj/main_gui.o obj/bitflash_res.o
 # binary. Nothing crashed here, and nothing would say so if it had.
 HEADERS = headers_core.h headers.h util.h main.h serialize.h uint256.h \
           key.h bignum.h script.h db.h base58.h net.h nostr.h \
-          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h market.h \
+          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h \
           selftest.h walletcmd.h sockcount.h compat.h font_roboto.h
 
 all: bitflash.exe
diff --git a/src/market.cpp b/src/market.cpp
deleted file mode 100644
index e5d34f4..0000000
--- a/src/market.cpp
+++ /dev/null
@@ -1,264 +0,0 @@
-// Copyright (c) 2009 Satoshi Nakamoto
-// Distributed under the MIT/X11 software license, see the accompanying
-// file license.txt or http://www.opensource.org/licenses/mit-license.php.
-
-#include "headers.h"
-
-
-
-
-
-
-
-
-
-
-//
-// Global state variables
-//
-
-//// later figure out how these are persisted
-map<uint256, CProduct> mapMyProducts;
-
-
-
-
-map<uint256, CProduct> mapProducts;
-CCriticalSection cs_mapProducts;
-
-bool AdvertInsert(const CProduct& product)
-{
-    uint256 hash = product.GetHash();
-    bool fNew = false;
-    bool fUpdated = false;
-
-    CRITICAL_BLOCK(cs_mapProducts)
-    {
-        // Insert or find existing product
-        pair<map<uint256, CProduct>::iterator, bool> item = mapProducts.insert(make_pair(hash, product));
-        CProduct* pproduct = &(*(item.first)).second;
-        fNew = item.second;
-
-        // Update if newer
-        if (product.nSequence > pproduct->nSequence)
-        {
-            *pproduct = product;
-            fUpdated = true;
-        }
-    }
-
-    //if (fNew)
-    //    NotifyProductAdded(hash);
-    //else if (fUpdated)
-    //    NotifyProductUpdated(hash);
-
-    return (fNew || fUpdated);
-}
-
-void AdvertErase(const CProduct& product)
-{
-    uint256 hash = product.GetHash();
-    CRITICAL_BLOCK(cs_mapProducts)
-        mapProducts.erase(hash);
-    //NotifyProductDeleted(hash);
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-template<typename T>
-unsigned int Union(T& v1, T& v2)
-{
-    // v1 = v1 union v2
-    // v1 and v2 must be sorted
-    // returns the number of elements added to v1
-
-    ///// need to check that this is equivalent, then delete this comment
-    //vector<unsigned short> vUnion(v1.size() + v2.size());
-    //vUnion.erase(set_union(v1.begin(), v1.end(),
-    //                       v2.begin(), v2.end(),
-    //                       vUnion.begin()),
-    //             vUnion.end());
-
-    T vUnion;
-    vUnion.reserve(v1.size() + v2.size());
-    set_union(v1.begin(), v1.end(),
-              v2.begin(), v2.end(),
-              back_inserter(vUnion));
-    unsigned int nAdded = vUnion.size() - v1.size();
-    if (nAdded > 0)
-        v1 = vUnion;
-    return nAdded;
-}
-
-void CUser::AddAtom(unsigned short nAtom, bool fOrigin)
-{
-    // Ignore duplicates
-    if (binary_search(vAtomsIn.begin(), vAtomsIn.end(), nAtom) ||
-        find(vAtomsNew.begin(), vAtomsNew.end(), nAtom) != vAtomsNew.end())
-        return;
-
-    //// instead of zero atom, should change to free atom that propagates,
-    //// limited to lower than a certain value like 5 so conflicts quickly
-    // The zero atom never propagates,
-    // new atoms always propagate through the user that created them
-    if (nAtom == 0 || fOrigin)
-    {
-        vector<unsigned short> vTmp(1, nAtom);
-        Union(vAtomsIn, vTmp);
-        if (fOrigin)
-            vAtomsOut.push_back(nAtom);
-        return;
-    }
-
-    vAtomsNew.push_back(nAtom);
-
-    if (vAtomsNew.size() >= nFlowthroughRate || vAtomsOut.empty())
-    {
-        // Select atom to flow through to vAtomsOut
-        vAtomsOut.push_back(vAtomsNew[GetRand(vAtomsNew.size())]);
-
-        // Merge vAtomsNew into vAtomsIn
-        sort(vAtomsNew.begin(), vAtomsNew.end());
-        Union(vAtomsIn, vAtomsNew);
-        vAtomsNew.clear();
-    }
-}
-
-bool AddAtomsAndPropagate(uint256 hashUserStart, const vector<unsigned short>& vAtoms, bool fOrigin)
-{
-    CReviewDB reviewdb;
-    map<uint256, vector<unsigned short> > pmapPropagate[2];
-    pmapPropagate[0][hashUserStart] = vAtoms;
-
-    for (int side = 0; !pmapPropagate[side].empty(); side = 1 - side)
-    {
-        map<uint256, vector<unsigned short> >& mapFrom = pmapPropagate[side];
-        map<uint256, vector<unsigned short> >& mapTo = pmapPropagate[1 - side];
-
-        for (map<uint256, vector<unsigned short> >::iterator mi = mapFrom.begin(); mi != mapFrom.end(); ++mi)
-        {
-            const uint256& hashUser = (*mi).first;
-            const vector<unsigned short>& vReceived = (*mi).second;
-
-            ///// this would be a lot easier on the database if it put the new atom at the beginning of the list,
-            ///// so the change would be right next to the vector size.
-
-            // Read user
-            CUser user;
-            reviewdb.ReadUser(hashUser, user);
-            unsigned int nIn = user.vAtomsIn.size();
-            unsigned int nNew = user.vAtomsNew.size();
-            unsigned int nOut = user.vAtomsOut.size();
-
-            // Add atoms received
-            foreach(unsigned short nAtom, vReceived)
-                user.AddAtom(nAtom, fOrigin);
-            fOrigin = false;
-
-            // Don't bother writing to disk if no changes
-            if (user.vAtomsIn.size() == nIn && user.vAtomsNew.size() == nNew)
-                continue;
-
-            // Propagate
-            if (user.vAtomsOut.size() > nOut)
-                foreach(const uint256& hash, user.vLinksOut)
-                    mapTo[hash].insert(mapTo[hash].end(), user.vAtomsOut.begin() + nOut, user.vAtomsOut.end());
-
-            // Write back
-            if (!reviewdb.WriteUser(hashUser, user))
-                return false;
-        }
-        mapFrom.clear();
-    }
-    return true;
-}
-
-
-
-
-
-
-bool CReview::AcceptReview()
-{
-    // Timestamp
-    nTime = GetTime();
-
-    // Check signature
-    if (!CKey::Verify(vchPubKeyFrom, GetSigHash(), vchSig))
-        return false;
-
-    CReviewDB reviewdb;
-
-    // Add review text to recipient
-    vector<CReview> vReviews;
-    reviewdb.ReadReviews(hashTo, vReviews);
-    vReviews.push_back(*this);
-    if (!reviewdb.WriteReviews(hashTo, vReviews))
-        return false;
-
-    // Add link from sender
-    CUser user;
-    uint256 hashFrom = Hash(vchPubKeyFrom.begin(), vchPubKeyFrom.end());
-    reviewdb.ReadUser(hashFrom, user);
-    user.vLinksOut.push_back(hashTo);
-    if (!reviewdb.WriteUser(hashFrom, user))
-        return false;
-
-    reviewdb.Close();
-
-    // Propagate atoms to recipient
-    vector<unsigned short> vZeroAtom(1, 0);
-    if (!AddAtomsAndPropagate(hashTo, user.vAtomsOut.size() ? user.vAtomsOut : vZeroAtom, false))
-        return false;
-
-    return true;
-}
-
-
-
-
-
-bool CProduct::CheckSignature()
-{
-    return (CKey::Verify(vchPubKeyFrom, GetSigHash(), vchSig));
-}
-
-bool CProduct::CheckProduct()
-{
-    if (!CheckSignature())
-        return false;
-
-    // Make sure it's a summary product
-    if (!mapDetails.empty() || !vOrderForm.empty())
-        return false;
-
-    // Look up seller's atom count
-    CReviewDB reviewdb("r");
-    CUser user;
-    reviewdb.ReadUser(GetUserHash(), user);
-    nAtoms = user.GetAtomCount();
-    reviewdb.Close();
-
-    ////// delme, this is now done by AdvertInsert
-    //// Store to memory
-    //CRITICAL_BLOCK(cs_mapProducts)
-    //    mapProducts[GetHash()] = *this;
-
-    return true;
-}
diff --git a/src/market.h b/src/market.h
deleted file mode 100644
index b5c8b3b..0000000
--- a/src/market.h
+++ /dev/null
@@ -1,182 +0,0 @@
-// Copyright (c) 2009 Satoshi Nakamoto
-// Distributed under the MIT/X11 software license, see the accompanying
-// file license.txt or http://www.opensource.org/licenses/mit-license.php.
-
-class CUser;
-class CReview;
-class CProduct;
-
-static const unsigned int nFlowthroughRate = 2;
-
-
-
-
-bool AdvertInsert(const CProduct& product);
-void AdvertErase(const CProduct& product);
-bool AddAtomsAndPropagate(uint256 hashUserStart, const vector<unsigned short>& vAtoms, bool fOrigin);
-
-
-
-
-
-
-
-
-class CUser
-{
-public:
-    vector<unsigned short> vAtomsIn;
-    vector<unsigned short> vAtomsNew;
-    vector<unsigned short> vAtomsOut;
-    vector<uint256> vLinksOut;
-
-    CUser()
-    {
-    }
-
-    IMPLEMENT_SERIALIZE
-    (
-        if (!(nType & SER_GETHASH))
-            READWRITE(nVersion);
-        READWRITE(vAtomsIn);
-        READWRITE(vAtomsNew);
-        READWRITE(vAtomsOut);
-        READWRITE(vLinksOut);
-    )
-
-    void SetNull()
-    {
-        vAtomsIn.clear();
-        vAtomsNew.clear();
-        vAtomsOut.clear();
-        vLinksOut.clear();
-    }
-
-    uint256 GetHash() const { return SerializeHash(*this); }
-
-
-    int GetAtomCount() const
-    {
-        return (vAtomsIn.size() + vAtomsNew.size());
-    }
-
-    void AddAtom(unsigned short nAtom, bool fOrigin);
-};
-
-
-
-
-
-
-
-class CReview
-{
-public:
-    int nVersion;
-    uint256 hashTo;
-    map<string, string> mapValue;
-    vector<unsigned char> vchPubKeyFrom;
-    vector<unsigned char> vchSig;
-
-    // memory only
-    unsigned int nTime;
-    int nAtoms;
-
-
-    CReview()
-    {
-        nVersion = 1;
-        hashTo = 0;
-        nTime = 0;
-        nAtoms = 0;
-    }
-
-    IMPLEMENT_SERIALIZE
-    (
-        READWRITE(this->nVersion);
-        nVersion = this->nVersion;
-        if (!(nType & SER_DISK))
-            READWRITE(hashTo);
-        READWRITE(mapValue);
-        READWRITE(vchPubKeyFrom);
-        if (!(nType & SER_GETHASH))
-            READWRITE(vchSig);
-    )
-
-    uint256 GetHash() const { return SerializeHash(*this); }
-    uint256 GetSigHash() const { return SerializeHash(*this, SER_GETHASH|SER_SKIPSIG); }
-    uint256 GetUserHash() const { return Hash(vchPubKeyFrom.begin(), vchPubKeyFrom.end()); }
-
-
-    bool AcceptReview();
-};
-
-
-
-
-
-
-
-class CProduct
-{
-public:
-    int nVersion;
-    CAddress addr;
-    map<string, string> mapValue;
-    map<string, string> mapDetails;
-    vector<pair<string, string> > vOrderForm;
-    unsigned int nSequence;
-    vector<unsigned char> vchPubKeyFrom;
-    vector<unsigned char> vchSig;
-
-    // disk only
-    int nAtoms;
-
-    // memory only
-    set<unsigned int> setSources;
-
-    CProduct()
-    {
-        nVersion = 1;
-        nAtoms = 0;
-        nSequence = 0;
-    }
-
-    IMPLEMENT_SERIALIZE
-    (
-        READWRITE(this->nVersion);
-        nVersion = this->nVersion;
-        READWRITE(addr);
-        READWRITE(mapValue);
-        if (!(nType & SER_GETHASH))
-        {
-            READWRITE(mapDetails);
-            READWRITE(vOrderForm);
-            READWRITE(nSequence);
-        }
-        READWRITE(vchPubKeyFrom);
-        if (!(nType & SER_GETHASH))
-            READWRITE(vchSig);
-        if (nType & SER_DISK)
-            READWRITE(nAtoms);
-    )
-
-    uint256 GetHash() const { return SerializeHash(*this); }
-    uint256 GetSigHash() const { return SerializeHash(*this, SER_GETHASH|SER_SKIPSIG); }
-    uint256 GetUserHash() const { return Hash(vchPubKeyFrom.begin(), vchPubKeyFrom.end()); }
-
-
-    bool CheckSignature();
-    bool CheckProduct();
-};
-
-
-
-
-
-
-
-
-extern map<uint256, CProduct> mapProducts;
-extern CCriticalSection cs_mapProducts;
-extern map<uint256, CProduct> mapMyProducts;
diff --git a/src/net.cpp b/src/net.cpp
index 72a7fda..e08f6f7 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -444,28 +444,9 @@ bool GetMyExternalIP(unsigned int& ipRet)
 
 
 
-void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1)
-{
-    // If the dialog might get closed before the reply comes back,
-    // call this in the destructor so it doesn't get called after it's deleted.
-    CRITICAL_BLOCK(cs_vNodes)
-    {
-        foreach(CNode* pnode, vNodes)
-        {
-            CRITICAL_BLOCK(pnode->cs_mapRequests)
-            {
-                for (map<uint256, CRequestTracker>::iterator mi = pnode->mapRequests.begin(); mi != pnode->mapRequests.end();)
-                {
-                    CRequestTracker& tracker = (*mi).second;
-                    if (tracker.fn == fn && tracker.param1 == param1)
-                        pnode->mapRequests.erase(mi++);
-                    else
-                        mi++;
-                }
-            }
-        }
-    }
-}
+// AbandonRequests() lived here, sweeping CNode::mapRequests for a callback a
+// closing dialog had registered. Nothing ever registered one and nothing ever
+// called this, so it went with CRequestTracker.
 
 
 
@@ -473,25 +454,10 @@ void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1)
 
 
 
-//
-// Subscription methods for the broadcast and subscription system.
-// Channel numbers are message numbers, i.e. MSG_TABLE and MSG_PRODUCT.
-//
-// The subscription system uses a meet-in-the-middle strategy.
-// With 100,000 nodes, if senders broadcast to 1000 random nodes and receivers
-// subscribe to 1000 random nodes, 99.995% (1 - 0.99^1000) of messages will get through.
-//
-
-bool AnySubscribed(unsigned int nChannel)
-{
-    if (pnodeLocalHost->IsSubscribed(nChannel))
-        return true;
-    CRITICAL_BLOCK(cs_vNodes)
-        foreach(CNode* pnode, vNodes)
-            if (pnode->IsSubscribed(nChannel))
-                return true;
-    return false;
-}
+// The broadcast/subscribe channel system (AnySubscribed, CNode::IsSubscribed,
+// Subscribe, CancelSubscribe) stood here. Its channels were MSG_TABLE and
+// MSG_PRODUCT, there was never an inbound handler for "subscribe",
+// "sub-cancel", "publish" or "pub-cancel", and the objects it carried are gone.
 
 void CNode::PushGetBlocks(CBlockIndex* pindexBegin, uint256 hashEnd)
 {
@@ -504,55 +470,6 @@ void CNode::PushGetBlocks(CBlockIndex* pindexBegin, uint256 hashEnd)
     PushMessage("getblocks", CBlockLocator(pindexBegin), hashEnd);
 }
 
-bool CNode::IsSubscribed(unsigned int nChannel)
-{
-    if (nChannel >= vfSubscribe.size())
-        return false;
-    return vfSubscribe[nChannel];
-}
-
-void CNode::Subscribe(unsigned int nChannel, unsigned int nHops)
-{
-    if (nChannel >= vfSubscribe.size())
-        return;
-
-    if (!AnySubscribed(nChannel))
-    {
-        // Relay subscribe
-        CRITICAL_BLOCK(cs_vNodes)
-            foreach(CNode* pnode, vNodes)
-                if (pnode != this)
-                    pnode->PushMessage("subscribe", nChannel, nHops);
-    }
-
-    vfSubscribe[nChannel] = true;
-}
-
-void CNode::CancelSubscribe(unsigned int nChannel)
-{
-    if (nChannel >= vfSubscribe.size())
-        return;
-
-    // Prevent from relaying cancel if wasn't subscribed
-    if (!vfSubscribe[nChannel])
-        return;
-    vfSubscribe[nChannel] = false;
-
-    if (!AnySubscribed(nChannel))
-    {
-        // Relay subscription cancel
-        CRITICAL_BLOCK(cs_vNodes)
-            foreach(CNode* pnode, vNodes)
-                if (pnode != this)
-                    pnode->PushMessage("sub-cancel", nChannel);
-
-        // Clear memory, no longer subscribed
-        if (nChannel == MSG_PRODUCT)
-            CRITICAL_BLOCK(cs_mapProducts)
-                mapProducts.clear();
-    }
-}
-
 
 
 
@@ -1215,17 +1132,6 @@ void CNode::Disconnect()
     BtfCloseSocket(hSocket);
     hSocket = INVALID_SOCKET;
 
-    // All of a nodes broadcasts and subscriptions are automatically torn down
-    // when it goes down, so a node has to stay up to keep its broadcast going.
-
-    CRITICAL_BLOCK(cs_mapProducts)
-        for (map<uint256, CProduct>::iterator mi = mapProducts.begin(); mi != mapProducts.end();)
-            AdvertRemoveSource(this, MSG_PRODUCT, 0, (*(mi++)).second);
-
-    // Cancel subscriptions
-    for (unsigned int nChannel = 0; nChannel < vfSubscribe.size(); nChannel++)
-        if (vfSubscribe[nChannel])
-            CancelSubscribe(nChannel);
 }
 
 
@@ -1350,7 +1256,6 @@ void ThreadSocketHandler2(void* parg)
                     bool fDelete = false;
                     TRY_CRITICAL_BLOCK(pnode->cs_vSend)
                      TRY_CRITICAL_BLOCK(pnode->cs_vRecv)
-                      TRY_CRITICAL_BLOCK(pnode->cs_mapRequests)
                        TRY_CRITICAL_BLOCK(pnode->cs_inventory)
                         fDelete = true;
                     if (fDelete)
diff --git a/src/net.h b/src/net.h
index 0317676..8b0245a 100644
--- a/src/net.h
+++ b/src/net.h
@@ -5,7 +5,6 @@
 class CMessageHeader;
 class CAddress;
 class CInv;
-class CRequestTracker;
 class CNode;
 // Defined in main.h, which is included after this file. Only ever used here as
 // a pointer, so the forward declaration is enough.
@@ -14,7 +13,6 @@ class CBlockIndex;
 
 
 static const unsigned short DEFAULT_PORT = htons(8433);
-static const unsigned int PUBLISH_HOPS = 5;
 enum
 {
     NODE_NETWORK = (1 << 0),
@@ -214,8 +212,6 @@ void BtfChurnNoteHandshakeTimeout(const string& strBtfAddr, const string& strMee
 void BtfPexCollect(std::vector<std::string>& vDescOut);
 // Verify descriptors a peer sent and remember the good ones. Returns how many.
 int  BtfPexAccept(const std::vector<std::string>& vDesc);
-void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1);
-bool AnySubscribed(unsigned int nChannel);
 void ThreadBitcoinMiner(void* parg);
 // Starts MinerThreadCount() miners; returns how many came up.
 int  StartMinerThreads();
@@ -489,13 +485,19 @@ public:
 
 
 
+// MSG_REVIEW, MSG_PRODUCT and MSG_TABLE no longer have a handler, a producer
+// or a store -- the marketplace they belonged to is gone. They stay in the
+// enum, and their names stay in ppszTypeName below, because CInv serialises
+// `type` as a plain integer: dropping them would renumber nothing today but
+// would make it tempting to renumber later, and MSG_TX and MSG_BLOCK are wire
+// values shared with every other node. Reserved, never emitted, never served.
 enum
 {
     MSG_TX = 1,
     MSG_BLOCK,
-    MSG_REVIEW,
-    MSG_PRODUCT,
-    MSG_TABLE,
+    MSG_REVIEW,     // reserved, dead
+    MSG_PRODUCT,    // reserved, dead
+    MSG_TABLE,      // reserved, dead
 };
 
 static const char* ppszTypeName[] =
@@ -582,23 +584,9 @@ public:
 
 
 
-class CRequestTracker
-{
-public:
-    void (*fn)(void*, CDataStream&);
-    void* param1;
-
-    explicit CRequestTracker(void (*fnIn)(void*, CDataStream&)=NULL, void* param1In=NULL)
-    {
-        fn = fnIn;
-        param1 = param1In;
-    }
-
-    bool IsNull()
-    {
-        return fn == NULL;
-    }
-};
+// CRequestTracker and the PushRequest/"reply" round trip lived here. Nothing
+// in this tree ever called PushRequest, so the table was always empty and the
+// "reply" handler was pure inbound parser. Both removed.
 
 
 
@@ -644,9 +632,6 @@ protected:
 public:
     int64 nReleaseTime;
     int64 nDisconnectSince;
-    map<uint256, CRequestTracker> mapRequests;
-    CCriticalSection cs_mapRequests;
-
     // inventory based relay
     set<CInv> setInventoryKnown;
     set<CInv> setInventoryKnown2;
@@ -654,9 +639,6 @@ public:
     CCriticalSection cs_inventory;
     multimap<int64, CInv> mapAskFor;
 
-    // publish and subscription
-    vector<char> vfSubscribe;
-
     // Last "btfpeers" we accepted from this node, to rate-limit the exchange.
     int64 nLastPexRecv;
 
@@ -723,7 +705,6 @@ public:
         strBtfAddr.clear();
         strBtfMeeting.clear();
         nStartingHeight = -1;
-        vfSubscribe.assign(256, false);
 
         // Push a version message
         /// when NTP implemented, change to just nTime = GetAdjustedTime()
@@ -1002,49 +983,6 @@ public:
     }
 
 
-    void PushRequest(const char* pszCommand,
-                     void (*fn)(void*, CDataStream&), void* param1)
-    {
-        uint256 hashReply;
-        RAND_bytes((unsigned char*)&hashReply, sizeof(hashReply));
-
-        CRITICAL_BLOCK(cs_mapRequests)
-            mapRequests[hashReply] = CRequestTracker(fn, param1);
-
-        PushMessage(pszCommand, hashReply);
-    }
-
-    template<typename T1>
-    void PushRequest(const char* pszCommand, const T1& a1,
-                     void (*fn)(void*, CDataStream&), void* param1)
-    {
-        uint256 hashReply;
-        RAND_bytes((unsigned char*)&hashReply, sizeof(hashReply));
-
-        CRITICAL_BLOCK(cs_mapRequests)
-            mapRequests[hashReply] = CRequestTracker(fn, param1);
-
-        PushMessage(pszCommand, hashReply, a1);
-    }
-
-    template<typename T1, typename T2>
-    void PushRequest(const char* pszCommand, const T1& a1, const T2& a2,
-                     void (*fn)(void*, CDataStream&), void* param1)
-    {
-        uint256 hashReply;
-        RAND_bytes((unsigned char*)&hashReply, sizeof(hashReply));
-
-        CRITICAL_BLOCK(cs_mapRequests)
-            mapRequests[hashReply] = CRequestTracker(fn, param1);
-
-        PushMessage(pszCommand, hashReply, a1, a2);
-    }
-
-
-
-    bool IsSubscribed(unsigned int nChannel);
-    void Subscribe(unsigned int nChannel, unsigned int nHops=0);
-    void CancelSubscribe(unsigned int nChannel);
     void Disconnect();
 };
 
@@ -1101,50 +1039,8 @@ inline void RelayMessage<>(const CInv& inv, const CDataStream& ss)
 
 
 
-//
-// Templates for the publish and subscription system.
-// The object being published as T& obj needs to have:
-//   a set<unsigned int> setSources member
-//   specializations of AdvertInsert and AdvertErase
-// Currently implemented for CTable and CProduct.
-//
-
-template<typename T>
-void AdvertStartPublish(CNode* pfrom, unsigned int nChannel, unsigned int nHops, T& obj)
-{
-    // Add to sources
-    obj.setSources.insert(pfrom->addr.ip);
-
-    if (!AdvertInsert(obj))
-        return;
-
-    // Relay
-    CRITICAL_BLOCK(cs_vNodes)
-        foreach(CNode* pnode, vNodes)
-            if (pnode != pfrom && (nHops < PUBLISH_HOPS || pnode->IsSubscribed(nChannel)))
-                pnode->PushMessage("publish", nChannel, nHops, obj);
-}
-
-template<typename T>
-void AdvertStopPublish(CNode* pfrom, unsigned int nChannel, unsigned int nHops, T& obj)
-{
-    uint256 hash = obj.GetHash();
-
-    CRITICAL_BLOCK(cs_vNodes)
-        foreach(CNode* pnode, vNodes)
-            if (pnode != pfrom && (nHops < PUBLISH_HOPS || pnode->IsSubscribed(nChannel)))
-                pnode->PushMessage("pub-cancel", nChannel, nHops, hash);
-
-    AdvertErase(obj);
-}
-
-template<typename T>
-void AdvertRemoveSource(CNode* pfrom, unsigned int nChannel, unsigned int nHops, T& obj)
-{
-    // Remove a source
-    obj.setSources.erase(pfrom->addr.ip);
-
-    // If no longer supported by any sources, cancel it
-    if (obj.setSources.empty())
-        AdvertStopPublish(pfrom, nChannel, nHops, obj);
-}
+// The publish/subscribe advert templates that used to close this file
+// (AdvertStartPublish / AdvertStopPublish / AdvertRemoveSource) are gone along
+// with the marketplace objects they carried. Nothing ever handled an inbound
+// "publish" or "pub-cancel", so the machinery only ever pushed; what it pushed
+// was CProduct, which no longer exists.