10 files changed, 69 insertions, 787 deletions

diff --git a/src/Makefile b/src/Makefile
index 3577dd6..171afe0 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -48,14 +48,14 @@ LIBS = -L$(SECP_LIB) -lsecp256k1 \
 # binary. Nothing crashed here, and nothing would say so if it had.
 HEADERS = headers_core.h headers.h util.h main.h serialize.h uint256.h \
           key.h bignum.h script.h db.h base58.h net.h nostr.h \
-          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h market.h \
+          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h \
           selftest.h walletcmd.h compat.h sockcount.h font_roboto.h
 
 IMGUI_OBJS = obj/imgui.o obj/imgui_draw.o obj/imgui_tables.o \
              obj/imgui_widgets.o obj/imgui_impl_glfw.o obj/imgui_impl_opengl3.o
 
 NODE_OBJS = obj/util.o obj/script.o obj/db.o obj/net.o obj/main.o \
-            obj/market.o obj/sha.o obj/nostr.o obj/randomx_pow.o \
+            obj/sha.o obj/nostr.o obj/randomx_pow.o \
             obj/btfaddr.o obj/btfchan.o obj/btfrv.o obj/btftunnel.o obj/rpc.o \
             obj/selftest.o obj/bip32.o obj/walletcmd.o
 
diff --git a/src/db.cpp b/src/db.cpp
index c8642e9..6f9461b 100644
--- a/src/db.cpp
+++ b/src/db.cpp
@@ -598,20 +598,12 @@ bool CTxDB::LoadBlockIndex()
 
 
 //
-// CReviewDB
+// CReviewDB is gone with the "review" handler. Its write path was
+// read-whole-vector / append-one / write-whole-vector, driven straight from an
+// unauthenticated peer, which is quadratic disk on an unbounded record.
+// Existing reviews.dat files are simply left alone and never opened.
 //
 
-bool CReviewDB::ReadReviews(uint256 hash, vector<CReview>& vReviews)
-{
-    vReviews.size(); // msvc workaround, just need to do anything with vReviews
-    return Read(make_pair(string("reviews"), hash), vReviews);
-}
-
-bool CReviewDB::WriteReviews(uint256 hash, const vector<CReview>& vReviews)
-{
-    return Write(make_pair(string("reviews"), hash), vReviews);
-}
-
 
 
 
diff --git a/src/db.h b/src/db.h
index 4fb5cfd..37a252f 100644
--- a/src/db.h
+++ b/src/db.h
@@ -8,8 +8,6 @@ class CTxIndex;
 class CDiskBlockIndex;
 class CDiskTxPos;
 class COutPoint;
-class CUser;
-class CReview;
 class CAddress;
 class CWalletTx;
 
@@ -314,27 +312,6 @@ public:
 
 
 
-class CReviewDB : public CDB
-{
-public:
-    CReviewDB(const char* pszMode="r+", bool fTxn=false) : CDB("reviews.dat", pszMode, fTxn) { }
-private:
-    CReviewDB(const CReviewDB&);
-    void operator=(const CReviewDB&);
-public:
-    bool ReadUser(uint256 hash, CUser& user)
-    {
-        return Read(make_pair(string("user"), hash), user);
-    }
-
-    bool WriteUser(uint256 hash, const CUser& user)
-    {
-        return Write(make_pair(string("user"), hash), user);
-    }
-
-    bool ReadReviews(uint256 hash, vector<CReview>& vReviews);
-    bool WriteReviews(uint256 hash, const vector<CReview>& vReviews);
-};
 
 
 
diff --git a/src/headers_core.h b/src/headers_core.h
index 6c0c602..6a60b52 100644
--- a/src/headers_core.h
+++ b/src/headers_core.h
@@ -66,7 +66,6 @@ inline typename std::common_type<T1,T2>::type max(const T1& a, const T2& b)
 #include "nostr.h"
 #include "randomx_pow.h"
 #include "main.h"
-#include "market.h"
 
 // GUI callback -- implemented in gui.cpp (or as no-op in headless builds)
 void MainFrameRepaint();
diff --git a/src/main.cpp b/src/main.cpp
index 62068d2..efff96c 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -2782,9 +2782,10 @@ bool AlreadyHave(CTxDB& txdb, const CInv& inv)
     {
     case MSG_TX:        return mapTransactions.count(inv.hash) || txdb.ContainsTx(inv.hash);
     case MSG_BLOCK:     return mapBlockIndex.count(inv.hash) || mapOrphanBlocks.count(inv.hash);
-    case MSG_REVIEW:    return true;
-    case MSG_PRODUCT:   return mapProducts.count(inv.hash);
     }
+    // MSG_REVIEW / MSG_PRODUCT / MSG_TABLE are the 2009 marketplace inventory
+    // types. Nothing announces or serves them any more (see ProcessMessage),
+    // so they fall through to the default and are never requested.
     // Don't know what it is, just say we already got one
     return true;
 }
@@ -2942,7 +2943,6 @@ bool ProcessMessages(CNode* pfrom)
 
 bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
 {
-    static map<unsigned int, vector<unsigned char> > mapReuseKey;
     if (LogAcceptsCategory("net")) { printf("received: %-12s (%d bytes)  ", strCommand.c_str(), (int)vRecv.size()); for (int i = 0; i < min(vRecv.size(), (unsigned int)25); i++) printf("%02x ", vRecv[i] & 0xff); printf("\n"); }
     if (nDropMessagesTest > 0 && GetRand(nDropMessagesTest) == 0)
     {
@@ -3181,22 +3181,18 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
     }
 
 
-    else if (strCommand == "review")
-    {
-        CDataStream vMsg(vRecv);
-        CReview review;
-        vRecv >> review;
-
-        CInv inv(MSG_REVIEW, review.GetHash());
-        pfrom->AddInventoryKnown(inv);
-
-        if (review.AcceptReview())
-        {
-            // Relay the original message as-is in case it's a higher version than we know how to parse
-            RelayMessage(inv, vMsg);
-            mapAlreadyAskedFor.erase(inv);
-        }
-    }
+    // "review" used to be handled here. It took a CReview off the wire from an
+    // unauthenticated peer, checked a signature the sender had made with a key
+    // of its own choosing -- which proves possession of that key and authorises
+    // nothing -- and then appended the message to reviews.dat by reading the
+    // whole vector for the target hash, pushing one entry, and writing all of
+    // it back. That is quadratic disk for a stream an attacker controls, on a
+    // record whose mapValue is an unbounded map<string,string> read straight
+    // from the socket, followed by AddAtomsAndPropagate walking a link graph
+    // the same peer supplied, and finally RelayMessage forwarding it to every
+    // other node. Unbounded remote disk growth with network amplification and
+    // no authorisation anywhere in the path. The marketplace it belonged to has
+    // not existed since 2009; the handler is gone rather than bounded.
 
 
     else if (strCommand == "block")
@@ -3229,65 +3225,28 @@ bool ProcessMessage(CNode* pfrom, string strCommand, CDataStream& vRecv)
     }
 
 
-    else if (strCommand == "checkorder")
-    {
-        uint256 hashReply;
-        CWalletTx order;
-        vRecv >> hashReply >> order;
-
-        /// we have a chance to check the order here
-
-        // Keep giving the same key to the same ip until they use it
-        if (!mapReuseKey.count(pfrom->addr.ip))
-            mapReuseKey[pfrom->addr.ip] = GenerateNewKey();
-
-        // Send back approval of order and pubkey to use
-        CScript scriptPubKey;
-        scriptPubKey << mapReuseKey[pfrom->addr.ip] << OP_CHECKSIG;
-        pfrom->PushMessage("reply", hashReply, (int)0, scriptPubKey);
-    }
-
-
-    else if (strCommand == "submitorder")
-    {
-        uint256 hashReply;
-        CWalletTx wtxNew;
-        vRecv >> hashReply >> wtxNew;
-
-        // Broadcast
-        if (!wtxNew.AcceptWalletTransaction())
-        {
-            pfrom->PushMessage("reply", hashReply, (int)1);
-            return error("submitorder AcceptWalletTransaction() failed, returning error 1");
-        }
-        wtxNew.fTimeReceivedIsTxTime = true;
-        AddToWallet(wtxNew);
-        wtxNew.RelayWalletTransaction();
-        mapReuseKey.erase(pfrom->addr.ip);
-
-        // Send back confirmation
-        pfrom->PushMessage("reply", hashReply, (int)0);
-    }
-
-
-    else if (strCommand == "reply")
-    {
-        uint256 hashReply;
-        vRecv >> hashReply;
-
-        CRequestTracker tracker;
-        CRITICAL_BLOCK(pfrom->cs_mapRequests)
-        {
-            map<uint256, CRequestTracker>::iterator mi = pfrom->mapRequests.find(hashReply);
-            if (mi != pfrom->mapRequests.end())
-            {
-                tracker = (*mi).second;
-                pfrom->mapRequests.erase(mi);
-            }
-        }
-        if (!tracker.IsNull())
-            tracker.fn(tracker.param1, vRecv);
-    }
+    // "checkorder", "submitorder" and "reply" -- the 2009 buy-from-a-merchant
+    // exchange -- used to be handled here. All three are gone.
+    //
+    // "checkorder" called GenerateNewKey() for any peer that asked, which is
+    // AddKey() and a wallet.dat write, and handed the pubkey back. The comment
+    // said "keep giving the same key to the same ip until they use it", and on
+    // a 2009 network of routable IPs that held. It does not hold here: every
+    // inbound peer arrives through a rendezvous tunnel and is tagged with
+    // BtfMarkerAddr() over three random bytes (net.cpp), so addr.ip is freshly
+    // random per connection and the cache never hits. Reconnect in a loop and
+    // the node mints a key per connection -- unbounded wallet growth, unbounded
+    // growth of the static map that held them, and every one of those keys
+    // missing from every backup taken beforehand, which for this pre-BIP32
+    // wallet is how coins are lost.
+    //
+    // "submitorder" took a CWalletTx from an unauthenticated peer and, if it
+    // was merely a valid transaction, AddToWallet()'d it. Valid is not the same
+    // as ours: any peer could write chosen transactions into wallet.dat.
+    //
+    // "reply" dispatched to a CRequestTracker callback. Nothing in this tree
+    // has ever called PushRequest, so mapRequests was permanently empty and the
+    // handler could only ever be a parser for hostile input.
 
 
     else if (strCommand == "ping")
diff --git a/src/makefile.mingw b/src/makefile.mingw
index e076c49..72f8bbf 100644
--- a/src/makefile.mingw
+++ b/src/makefile.mingw
@@ -40,7 +40,7 @@ IMGUI_OBJS = obj/imgui.o obj/imgui_draw.o obj/imgui_tables.o \
              obj/imgui_widgets.o obj/imgui_impl_glfw.o obj/imgui_impl_opengl3.o
 
 NODE_OBJS = obj/util.o obj/script.o obj/db.o obj/net.o obj/main.o \
-            obj/market.o obj/sha.o obj/nostr.o obj/randomx_pow.o \
+            obj/sha.o obj/nostr.o obj/randomx_pow.o \
             obj/btfaddr.o obj/btfchan.o obj/btfrv.o obj/btftunnel.o obj/rpc.o \
             obj/selftest.o obj/bip32.o obj/walletcmd.o
 
@@ -55,7 +55,7 @@ GUI_OBJS = obj/gui.o obj/main_gui.o obj/bitflash_res.o
 # binary. Nothing crashed here, and nothing would say so if it had.
 HEADERS = headers_core.h headers.h util.h main.h serialize.h uint256.h \
           key.h bignum.h script.h db.h base58.h net.h nostr.h \
-          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h market.h \
+          randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h \
           selftest.h walletcmd.h sockcount.h compat.h font_roboto.h
 
 all: bitflash.exe
diff --git a/src/market.cpp b/src/market.cpp
deleted file mode 100644
index e5d34f4..0000000
--- a/src/market.cpp
+++ /dev/null
@@ -1,264 +0,0 @@
-// Copyright (c) 2009 Satoshi Nakamoto
-// Distributed under the MIT/X11 software license, see the accompanying
-// file license.txt or http://www.opensource.org/licenses/mit-license.php.
-
-#include "headers.h"
-
-
-
-
-
-
-
-
-
-
-//
-// Global state variables
-//
-
-//// later figure out how these are persisted
-map<uint256, CProduct> mapMyProducts;
-
-
-
-
-map<uint256, CProduct> mapProducts;
-CCriticalSection cs_mapProducts;
-
-bool AdvertInsert(const CProduct& product)
-{
-    uint256 hash = product.GetHash();
-    bool fNew = false;
-    bool fUpdated = false;
-
-    CRITICAL_BLOCK(cs_mapProducts)
-    {
-        // Insert or find existing product
-        pair<map<uint256, CProduct>::iterator, bool> item = mapProducts.insert(make_pair(hash, product));
-        CProduct* pproduct = &(*(item.first)).second;
-        fNew = item.second;
-
-        // Update if newer
-        if (product.nSequence > pproduct->nSequence)
-        {
-            *pproduct = product;
-            fUpdated = true;
-        }
-    }
-
-    //if (fNew)
-    //    NotifyProductAdded(hash);
-    //else if (fUpdated)
-    //    NotifyProductUpdated(hash);
-
-    return (fNew || fUpdated);
-}
-
-void AdvertErase(const CProduct& product)
-{
-    uint256 hash = product.GetHash();
-    CRITICAL_BLOCK(cs_mapProducts)
-        mapProducts.erase(hash);
-    //NotifyProductDeleted(hash);
-}
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-template<typename T>
-unsigned int Union(T& v1, T& v2)
-{
-    // v1 = v1 union v2
-    // v1 and v2 must be sorted
-    // returns the number of elements added to v1
-
-    ///// need to check that this is equivalent, then delete this comment
-    //vector<unsigned short> vUnion(v1.size() + v2.size());
-    //vUnion.erase(set_union(v1.begin(), v1.end(),
-    //                       v2.begin(), v2.end(),
-    //                       vUnion.begin()),
-    //             vUnion.end());
-
-    T vUnion;
-    vUnion.reserve(v1.size() + v2.size());
-    set_union(v1.begin(), v1.end(),
-              v2.begin(), v2.end(),
-              back_inserter(vUnion));
-    unsigned int nAdded = vUnion.size() - v1.size();
-    if (nAdded > 0)
-        v1 = vUnion;
-    return nAdded;
-}
-
-void CUser::AddAtom(unsigned short nAtom, bool fOrigin)
-{
-    // Ignore duplicates
-    if (binary_search(vAtomsIn.begin(), vAtomsIn.end(), nAtom) ||
-        find(vAtomsNew.begin(), vAtomsNew.end(), nAtom) != vAtomsNew.end())
-        return;
-
-    //// instead of zero atom, should change to free atom that propagates,
-    //// limited to lower than a certain value like 5 so conflicts quickly
-    // The zero atom never propagates,
-    // new atoms always propagate through the user that created them
-    if (nAtom == 0 || fOrigin)
-    {
-        vector<unsigned short> vTmp(1, nAtom);
-        Union(vAtomsIn, vTmp);
-        if (fOrigin)
-            vAtomsOut.push_back(nAtom);
-        return;
-    }
-
-    vAtomsNew.push_back(nAtom);
-
-    if (vAtomsNew.size() >= nFlowthroughRate || vAtomsOut.empty())
-    {
-        // Select atom to flow through to vAtomsOut
-        vAtomsOut.push_back(vAtomsNew[GetRand(vAtomsNew.size())]);
-
-        // Merge vAtomsNew into vAtomsIn
-        sort(vAtomsNew.begin(), vAtomsNew.end());
-        Union(vAtomsIn, vAtomsNew);
-        vAtomsNew.clear();
-    }
-}
-
-bool AddAtomsAndPropagate(uint256 hashUserStart, const vector<unsigned short>& vAtoms, bool fOrigin)
-{
-    CReviewDB reviewdb;
-    map<uint256, vector<unsigned short> > pmapPropagate[2];
-    pmapPropagate[0][hashUserStart] = vAtoms;
-
-    for (int side = 0; !pmapPropagate[side].empty(); side = 1 - side)
-    {
-        map<uint256, vector<unsigned short> >& mapFrom = pmapPropagate[side];
-        map<uint256, vector<unsigned short> >& mapTo = pmapPropagate[1 - side];
-
-        for (map<uint256, vector<unsigned short> >::iterator mi = mapFrom.begin(); mi != mapFrom.end(); ++mi)
-        {
-            const uint256& hashUser = (*mi).first;
-            const vector<unsigned short>& vReceived = (*mi).second;
-
-            ///// this would be a lot easier on the database if it put the new atom at the beginning of the list,
-            ///// so the change would be right next to the vector size.
-
-            // Read user
-            CUser user;
-            reviewdb.ReadUser(hashUser, user);
-            unsigned int nIn = user.vAtomsIn.size();
-            unsigned int nNew = user.vAtomsNew.size();
-            unsigned int nOut = user.vAtomsOut.size();
-
-            // Add atoms received
-            foreach(unsigned short nAtom, vReceived)
-                user.AddAtom(nAtom, fOrigin);
-            fOrigin = false;
-
-            // Don't bother writing to disk if no changes
-            if (user.vAtomsIn.size() == nIn && user.vAtomsNew.size() == nNew)
-                continue;
-
-            // Propagate
-            if (user.vAtomsOut.size() > nOut)
-                foreach(const uint256& hash, user.vLinksOut)
-                    mapTo[hash].insert(mapTo[hash].end(), user.vAtomsOut.begin() + nOut, user.vAtomsOut.end());
-
-            // Write back
-            if (!reviewdb.WriteUser(hashUser, user))
-                return false;
-        }
-        mapFrom.clear();
-    }
-    return true;
-}
-
-
-
-
-
-
-bool CReview::AcceptReview()
-{
-    // Timestamp
-    nTime = GetTime();
-
-    // Check signature
-    if (!CKey::Verify(vchPubKeyFrom, GetSigHash(), vchSig))
-        return false;
-
-    CReviewDB reviewdb;
-
-    // Add review text to recipient
-    vector<CReview> vReviews;
-    reviewdb.ReadReviews(hashTo, vReviews);
-    vReviews.push_back(*this);
-    if (!reviewdb.WriteReviews(hashTo, vReviews))
-        return false;
-
-    // Add link from sender
-    CUser user;
-    uint256 hashFrom = Hash(vchPubKeyFrom.begin(), vchPubKeyFrom.end());
-    reviewdb.ReadUser(hashFrom, user);
-    user.vLinksOut.push_back(hashTo);
-    if (!reviewdb.WriteUser(hashFrom, user))
-        return false;
-
-    reviewdb.Close();
-
-    // Propagate atoms to recipient
-    vector<unsigned short> vZeroAtom(1, 0);
-    if (!AddAtomsAndPropagate(hashTo, user.vAtomsOut.size() ? user.vAtomsOut : vZeroAtom, false))
-        return false;
-
-    return true;
-}
-
-
-
-
-
-bool CProduct::CheckSignature()
-{
-    return (CKey::Verify(vchPubKeyFrom, GetSigHash(), vchSig));
-}
-
-bool CProduct::CheckProduct()
-{
-    if (!CheckSignature())
-        return false;
-
-    // Make sure it's a summary product
-    if (!mapDetails.empty() || !vOrderForm.empty())
-        return false;
-
-    // Look up seller's atom count
-    CReviewDB reviewdb("r");
-    CUser user;
-    reviewdb.ReadUser(GetUserHash(), user);
-    nAtoms = user.GetAtomCount();
-    reviewdb.Close();
-
-    ////// delme, this is now done by AdvertInsert
-    //// Store to memory
-    //CRITICAL_BLOCK(cs_mapProducts)
-    //    mapProducts[GetHash()] = *this;
-
-    return true;
-}
diff --git a/src/market.h b/src/market.h
deleted file mode 100644
index b5c8b3b..0000000
--- a/src/market.h
+++ /dev/null
@@ -1,182 +0,0 @@
-// Copyright (c) 2009 Satoshi Nakamoto
-// Distributed under the MIT/X11 software license, see the accompanying
-// file license.txt or http://www.opensource.org/licenses/mit-license.php.
-
-class CUser;
-class CReview;
-class CProduct;
-
-static const unsigned int nFlowthroughRate = 2;
-
-
-
-
-bool AdvertInsert(const CProduct& product);
-void AdvertErase(const CProduct& product);
-bool AddAtomsAndPropagate(uint256 hashUserStart, const vector<unsigned short>& vAtoms, bool fOrigin);
-
-
-
-
-
-
-
-
-class CUser
-{
-public:
-    vector<unsigned short> vAtomsIn;
-    vector<unsigned short> vAtomsNew;
-    vector<unsigned short> vAtomsOut;
-    vector<uint256> vLinksOut;
-
-    CUser()
-    {
-    }
-
-    IMPLEMENT_SERIALIZE
-    (
-        if (!(nType & SER_GETHASH))
-            READWRITE(nVersion);
-        READWRITE(vAtomsIn);
-        READWRITE(vAtomsNew);
-        READWRITE(vAtomsOut);
-        READWRITE(vLinksOut);
-    )
-
-    void SetNull()
-    {
-        vAtomsIn.clear();
-        vAtomsNew.clear();
-        vAtomsOut.clear();
-        vLinksOut.clear();
-    }
-
-    uint256 GetHash() const { return SerializeHash(*this); }
-
-
-    int GetAtomCount() const
-    {
-        return (vAtomsIn.size() + vAtomsNew.size());
-    }
-
-    void AddAtom(unsigned short nAtom, bool fOrigin);
-};
-
-
-
-
-
-
-
-class CReview
-{
-public:
-    int nVersion;
-    uint256 hashTo;
-    map<string, string> mapValue;
-    vector<unsigned char> vchPubKeyFrom;
-    vector<unsigned char> vchSig;
-
-    // memory only
-    unsigned int nTime;
-    int nAtoms;
-
-
-    CReview()
-    {
-        nVersion = 1;
-        hashTo = 0;
-        nTime = 0;
-        nAtoms = 0;
-    }
-
-    IMPLEMENT_SERIALIZE
-    (
-        READWRITE(this->nVersion);
-        nVersion = this->nVersion;
-        if (!(nType & SER_DISK))
-            READWRITE(hashTo);
-        READWRITE(mapValue);
-        READWRITE(vchPubKeyFrom);
-        if (!(nType & SER_GETHASH))
-            READWRITE(vchSig);
-    )
-
-    uint256 GetHash() const { return SerializeHash(*this); }
-    uint256 GetSigHash() const { return SerializeHash(*this, SER_GETHASH|SER_SKIPSIG); }
-    uint256 GetUserHash() const { return Hash(vchPubKeyFrom.begin(), vchPubKeyFrom.end()); }
-
-
-    bool AcceptReview();
-};
-
-
-
-
-
-
-
-class CProduct
-{
-public:
-    int nVersion;
-    CAddress addr;
-    map<string, string> mapValue;
-    map<string, string> mapDetails;
-    vector<pair<string, string> > vOrderForm;
-    unsigned int nSequence;
-    vector<unsigned char> vchPubKeyFrom;
-    vector<unsigned char> vchSig;
-
-    // disk only
-    int nAtoms;
-
-    // memory only
-    set<unsigned int> setSources;
-
-    CProduct()
-    {
-        nVersion = 1;
-        nAtoms = 0;
-        nSequence = 0;
-    }
-
-    IMPLEMENT_SERIALIZE
-    (
-        READWRITE(this->nVersion);
-        nVersion = this->nVersion;
-        READWRITE(addr);
-        READWRITE(mapValue);
-        if (!(nType & SER_GETHASH))
-        {
-            READWRITE(mapDetails);
-            READWRITE(vOrderForm);
-            READWRITE(nSequence);
-        }
-        READWRITE(vchPubKeyFrom);
-        if (!(nType & SER_GETHASH))
-            READWRITE(vchSig);
-        if (nType & SER_DISK)
-            READWRITE(nAtoms);
-    )
-
-    uint256 GetHash() const { return SerializeHash(*this); }
-    uint256 GetSigHash() const { return SerializeHash(*this, SER_GETHASH|SER_SKIPSIG); }
-    uint256 GetUserHash() const { return Hash(vchPubKeyFrom.begin(), vchPubKeyFrom.end()); }
-
-
-    bool CheckSignature();
-    bool CheckProduct();
-};
-
-
-
-
-
-
-
-
-extern map<uint256, CProduct> mapProducts;
-extern CCriticalSection cs_mapProducts;
-extern map<uint256, CProduct> mapMyProducts;
diff --git a/src/net.cpp b/src/net.cpp
index 72a7fda..e08f6f7 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -444,28 +444,9 @@ bool GetMyExternalIP(unsigned int& ipRet)
 
 
 
-void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1)
-{
-    // If the dialog might get closed before the reply comes back,
-    // call this in the destructor so it doesn't get called after it's deleted.
-    CRITICAL_BLOCK(cs_vNodes)
-    {
-        foreach(CNode* pnode, vNodes)
-        {
-            CRITICAL_BLOCK(pnode->cs_mapRequests)
-            {
-                for (map<uint256, CRequestTracker>::iterator mi = pnode->mapRequests.begin(); mi != pnode->mapRequests.end();)
-                {
-                    CRequestTracker& tracker = (*mi).second;
-                    if (tracker.fn == fn && tracker.param1 == param1)
-                        pnode->mapRequests.erase(mi++);
-                    else
-                        mi++;
-                }
-            }
-        }
-    }
-}
+// AbandonRequests() lived here, sweeping CNode::mapRequests for a callback a
+// closing dialog had registered. Nothing ever registered one and nothing ever
+// called this, so it went with CRequestTracker.
 
 
 
@@ -473,25 +454,10 @@ void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1)
 
 
 
-//
-// Subscription methods for the broadcast and subscription system.
-// Channel numbers are message numbers, i.e. MSG_TABLE and MSG_PRODUCT.
-//
-// The subscription system uses a meet-in-the-middle strategy.
-// With 100,000 nodes, if senders broadcast to 1000 random nodes and receivers
-// subscribe to 1000 random nodes, 99.995% (1 - 0.99^1000) of messages will get through.
-//
-
-bool AnySubscribed(unsigned int nChannel)
-{
-    if (pnodeLocalHost->IsSubscribed(nChannel))
-        return true;
-    CRITICAL_BLOCK(cs_vNodes)
-        foreach(CNode* pnode, vNodes)
-            if (pnode->IsSubscribed(nChannel))
-                return true;
-    return false;
-}
+// The broadcast/subscribe channel system (AnySubscribed, CNode::IsSubscribed,
+// Subscribe, CancelSubscribe) stood here. Its channels were MSG_TABLE and
+// MSG_PRODUCT, there was never an inbound handler for "subscribe",
+// "sub-cancel", "publish" or "pub-cancel", and the objects it carried are gone.
 
 void CNode::PushGetBlocks(CBlockIndex* pindexBegin, uint256 hashEnd)
 {
@@ -504,55 +470,6 @@ void CNode::PushGetBlocks(CBlockIndex* pindexBegin, uint256 hashEnd)
     PushMessage("getblocks", CBlockLocator(pindexBegin), hashEnd);
 }
 
-bool CNode::IsSubscribed(unsigned int nChannel)
-{
-    if (nChannel >= vfSubscribe.size())
-        return false;
-    return vfSubscribe[nChannel];
-}
-
-void CNode::Subscribe(unsigned int nChannel, unsigned int nHops)
-{
-    if (nChannel >= vfSubscribe.size())
-        return;
-
-    if (!AnySubscribed(nChannel))
-    {
-        // Relay subscribe
-        CRITICAL_BLOCK(cs_vNodes)
-            foreach(CNode* pnode, vNodes)
-                if (pnode != this)
-                    pnode->PushMessage("subscribe", nChannel, nHops);
-    }
-
-    vfSubscribe[nChannel] = true;
-}
-
-void CNode::CancelSubscribe(unsigned int nChannel)
-{
-    if (nChannel >= vfSubscribe.size())
-        return;
-
-    // Prevent from relaying cancel if wasn't subscribed
-    if (!vfSubscribe[nChannel])
-        return;
-    vfSubscribe[nChannel] = false;
-
-    if (!AnySubscribed(nChannel))
-    {
-        // Relay subscription cancel
-        CRITICAL_BLOCK(cs_vNodes)
-            foreach(CNode* pnode, vNodes)
-                if (pnode != this)
-                    pnode->PushMessage("sub-cancel", nChannel);
-
-        // Clear memory, no longer subscribed
-        if (nChannel == MSG_PRODUCT)
-            CRITICAL_BLOCK(cs_mapProducts)
-                mapProducts.clear();
-    }
-}
-
 
 
 
@@ -1215,17 +1132,6 @@ void CNode::Disconnect()
     BtfCloseSocket(hSocket);
     hSocket = INVALID_SOCKET;
 
-    // All of a nodes broadcasts and subscriptions are automatically torn down
-    // when it goes down, so a node has to stay up to keep its broadcast going.
-
-    CRITICAL_BLOCK(cs_mapProducts)
-        for (map<uint256, CProduct>::iterator mi = mapProducts.begin(); mi != mapProducts.end();)
-            AdvertRemoveSource(this, MSG_PRODUCT, 0, (*(mi++)).second);
-
-    // Cancel subscriptions
-    for (unsigned int nChannel = 0; nChannel < vfSubscribe.size(); nChannel++)
-        if (vfSubscribe[nChannel])
-            CancelSubscribe(nChannel);
 }
 
 
@@ -1350,7 +1256,6 @@ void ThreadSocketHandler2(void* parg)
                     bool fDelete = false;
                     TRY_CRITICAL_BLOCK(pnode->cs_vSend)
                      TRY_CRITICAL_BLOCK(pnode->cs_vRecv)
-                      TRY_CRITICAL_BLOCK(pnode->cs_mapRequests)
                        TRY_CRITICAL_BLOCK(pnode->cs_inventory)
                         fDelete = true;
                     if (fDelete)
diff --git a/src/net.h b/src/net.h
index 0317676..8b0245a 100644
--- a/src/net.h
+++ b/src/net.h
@@ -5,7 +5,6 @@
 class CMessageHeader;
 class CAddress;
 class CInv;
-class CRequestTracker;
 class CNode;
 // Defined in main.h, which is included after this file. Only ever used here as
 // a pointer, so the forward declaration is enough.
@@ -14,7 +13,6 @@ class CBlockIndex;
 
 
 static const unsigned short DEFAULT_PORT = htons(8433);
-static const unsigned int PUBLISH_HOPS = 5;
 enum
 {
     NODE_NETWORK = (1 << 0),
@@ -214,8 +212,6 @@ void BtfChurnNoteHandshakeTimeout(const string& strBtfAddr, const string& strMee
 void BtfPexCollect(std::vector<std::string>& vDescOut);
 // Verify descriptors a peer sent and remember the good ones. Returns how many.
 int  BtfPexAccept(const std::vector<std::string>& vDesc);
-void AbandonRequests(void (*fn)(void*, CDataStream&), void* param1);
-bool AnySubscribed(unsigned int nChannel);
 void ThreadBitcoinMiner(void* parg);
 // Starts MinerThreadCount() miners; returns how many came up.
 int  StartMinerThreads();
@@ -489,13 +485,19 @@ public:
 
 
 
+// MSG_REVIEW, MSG_PRODUCT and MSG_TABLE no longer have a handler, a producer
+// or a store -- the marketplace they belonged to is gone. They stay in the
+// enum, and their names stay in ppszTypeName below, because CInv serialises
+// `type` as a plain integer: dropping them would renumber nothing today but
+// would make it tempting to renumber later, and MSG_TX and MSG_BLOCK are wire
+// values shared with every other node. Reserved, never emitted, never served.
 enum
 {
     MSG_TX = 1,
     MSG_BLOCK,
-    MSG_REVIEW,
-    MSG_PRODUCT,
-    MSG_TABLE,
+    MSG_REVIEW,     // reserved, dead
+    MSG_PRODUCT,    // reserved, dead
+    MSG_TABLE,      // reserved, dead
 };
 
 static const char* ppszTypeName[] =
@@ -582,23 +584,9 @@ public:
 
 
 
-class CRequestTracker
-{
-public:
-    void (*fn)(void*, CDataStream&);
-    void* param1;
-
-    explicit CRequestTracker(void (*fnIn)(void*, CDataStream&)=NULL, void* param1In=NULL)
-    {
-        fn = fnIn;
-        param1 = param1In;
-    }
-
-    bool IsNull()
-    {
-        return fn == NULL;
-    }
-};
+// CRequestTracker and the PushRequest/"reply" round trip lived here. Nothing
+// in this tree ever called PushRequest, so the table was always empty and the
+// "reply" handler was pure inbound parser. Both removed.
 
 
 
@@ -644,9 +632,6 @@ protected:
 public:
     int64 nReleaseTime;
     int64 nDisconnectSince;
-    map<uint256, CRequestTracker> mapRequests;
-    CCriticalSection cs_mapRequests;
-
     // inventory based relay
     set<CInv> setInventoryKnown;
     set<CInv> setInventoryKnown2;
@@ -654,9 +639,6 @@ public:
     CCriticalSection cs_inventory;
     multimap<int64, CInv> mapAskFor;
 
-    // publish and subscription
-    vector<char> vfSubscribe;
-
     // Last "btfpeers" we accepted from this node, to rate-limit the exchange.
     int64 nLastPexRecv;
 
@@ -723,7 +705,6 @@ public:
         strBtfAddr.clear();
         strBtfMeeting.clear();
         nStartingHeight = -1;
-        vfSubscribe.assign(256, false);
 
         // Push a version message
         /// when NTP implemented, change to just nTime = GetAdjustedTime()
@@ -1002,49 +983,6 @@ public:
     }
 
 
-    void PushRequest(const char* pszCommand,
-                     void (*fn)(void*, CDataStream&), void* param1)
-    {
-        uint256 hashReply;
-        RAND_bytes((unsigned char*)&hashReply, sizeof(hashReply));
-
-        CRITICAL_BLOCK(cs_mapRequests)
-            mapRequests[hashReply] = CRequestTracker(fn, param1);
-
-        PushMessage(pszCommand, hashReply);
-    }
-
-    template<typename T1>
-    void PushRequest(const char* pszCommand, const T1& a1,
-                     void (*fn)(void*, CDataStream&), void* param1)
-    {
-        uint256 hashReply;
-        RAND_bytes((unsigned char*)&hashReply, sizeof(hashReply));
-
-        CRITICAL_BLOCK(cs_mapRequests)
-            mapRequests[hashReply] = CRequestTracker(fn, param1);
-
-        PushMessage(pszCommand, hashReply, a1);
-    }
-
-    template<typename T1, typename T2>
-    void PushRequest(const char* pszCommand, const T1& a1, const T2& a2,
-                     void (*fn)(void*, CDataStream&), void* param1)
-    {
-        uint256 hashReply;
-        RAND_bytes((unsigned char*)&hashReply, sizeof(hashReply));
-
-        CRITICAL_BLOCK(cs_mapRequests)
-            mapRequests[hashReply] = CRequestTracker(fn, param1);
-
-        PushMessage(pszCommand, hashReply, a1, a2);
-    }
-
-
-
-    bool IsSubscribed(unsigned int nChannel);
-    void Subscribe(unsigned int nChannel, unsigned int nHops=0);
-    void CancelSubscribe(unsigned int nChannel);
     void Disconnect();
 };
 
@@ -1101,50 +1039,8 @@ inline void RelayMessage<>(const CInv& inv, const CDataStream& ss)
 
 
 
-//
-// Templates for the publish and subscription system.
-// The object being published as T& obj needs to have:
-//   a set<unsigned int> setSources member
-//   specializations of AdvertInsert and AdvertErase
-// Currently implemented for CTable and CProduct.
-//
-
-template<typename T>
-void AdvertStartPublish(CNode* pfrom, unsigned int nChannel, unsigned int nHops, T& obj)
-{
-    // Add to sources
-    obj.setSources.insert(pfrom->addr.ip);
-
-    if (!AdvertInsert(obj))
-        return;
-
-    // Relay
-    CRITICAL_BLOCK(cs_vNodes)
-        foreach(CNode* pnode, vNodes)
-            if (pnode != pfrom && (nHops < PUBLISH_HOPS || pnode->IsSubscribed(nChannel)))
-                pnode->PushMessage("publish", nChannel, nHops, obj);
-}
-
-template<typename T>
-void AdvertStopPublish(CNode* pfrom, unsigned int nChannel, unsigned int nHops, T& obj)
-{
-    uint256 hash = obj.GetHash();
-
-    CRITICAL_BLOCK(cs_vNodes)
-        foreach(CNode* pnode, vNodes)
-            if (pnode != pfrom && (nHops < PUBLISH_HOPS || pnode->IsSubscribed(nChannel)))
-                pnode->PushMessage("pub-cancel", nChannel, nHops, hash);
-
-    AdvertErase(obj);
-}
-
-template<typename T>
-void AdvertRemoveSource(CNode* pfrom, unsigned int nChannel, unsigned int nHops, T& obj)
-{
-    // Remove a source
-    obj.setSources.erase(pfrom->addr.ip);
-
-    // If no longer supported by any sources, cancel it
-    if (obj.setSources.empty())
-        AdvertStopPublish(pfrom, nChannel, nHops, obj);
-}
+// The publish/subscribe advert templates that used to close this file
+// (AdvertStartPublish / AdvertStopPublish / AdvertRemoveSource) are gone along
+// with the marketplace objects they carried. Nothing ever handled an inbound
+// "publish" or "pub-cancel", so the machinery only ever pushed; what it pushed
+// was CProduct, which no longer exists.