4 files changed, 421 insertions, 4 deletions

diff --git a/src/Makefile b/src/Makefile
index b931007..888110f 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -55,7 +55,8 @@ LIBS = -L$(SECP_LIB) -lsecp256k1 \
 HEADERS = headers_core.h headers.h util.h main.h serialize.h uint256.h \
           key.h bignum.h script.h db.h base58.h net.h nostr.h \
           randomx_pow.h btfaddr.h btfchan.h btfrv.h btftunnel.h \
-          selftest.h walletcmd.h wallet_sqlite.h compat.h sockcount.h proxy.h tor.h font_roboto.h
+          selftest.h walletcmd.h wallet_sqlite.h compat.h sockcount.h proxy.h tor.h font_roboto.h \
+          compactblock.h
 
 IMGUI_OBJS = obj/imgui.o obj/imgui_draw.o obj/imgui_tables.o \
              obj/imgui_widgets.o obj/imgui_impl_glfw.o obj/imgui_impl_opengl3.o
@@ -64,7 +65,7 @@ NODE_OBJS = obj/util.o obj/script.o obj/db.o obj/net.o obj/main.o \
             obj/sha.o obj/nostr.o obj/randomx_pow.o \
             obj/btfaddr.o obj/btfchan.o obj/btfrv.o obj/btftunnel.o obj/rpc.o \
             obj/selftest.o obj/bip32.o obj/walletcmd.o obj/wallet_sqlite.o \
-            obj/proxy.o obj/tor.o
+            obj/proxy.o obj/tor.o obj/compactblock.o
 
 GUI_OBJS = obj/gui.o obj/main_gui.o
 
@@ -194,13 +195,28 @@ fuzz-script-smoke: fuzz-script
         ./fuzz-script -runs=128 ../work/fuzz-corpus/script
 
 clean:
-        rm -rf obj obj-node obj-fuzz bitflash bitflash-node fuzz-net-message fuzz-script test_bip32
+        rm -rf obj obj-node obj-fuzz bitflash bitflash-node fuzz-net-message fuzz-script test_bip32 test_compactblock
 
 test_bip32: test_bip32.cpp bip32.cpp bip32.h bip39_english.h
         $(CXX) $(CXXFLAGS) -o $@ test_bip32.cpp bip32.cpp -lssl -lcrypto
 
-tests: test_bip32 bitflash-node
+# Upstream shipped test_compactblock.cpp with no build rule at all, so it was
+# never compiled there. It links the standalone way test_bip32 does: it supplies
+# its own mapTransactions and GetAppDir so main.cpp stays out of the link, and
+# only needs sha.cpp/util.cpp for Hash() and the logging helpers.
+#
+# TEST_LIBS is overridable for the same reason NODE_LIBS is: the pinned dep tree
+# ships libsodium as a static archive only, so a build against it passes
+# TEST_LIBS="... -l:libsodium.a ...".
+TEST_LIBS ?= -lsodium -lssl -lcrypto -lpthread
+
+test_compactblock: test_compactblock.cpp compactblock.cpp compactblock.h $(HEADERS)
+        $(CXX) $(CXXFLAGS) -o $@ test_compactblock.cpp compactblock.cpp sha.cpp util.cpp \
+          $(TEST_LIBS)
+
+tests: test_bip32 test_compactblock bitflash-node
         ./test_bip32
+        ./test_compactblock
         ./bitflash-node -selftest=wallet-keypool
         ./bitflash-node -selftest=wallet-hd
         ./bitflash-node -selftest=wallet-format
diff --git a/src/compactblock.cpp b/src/compactblock.cpp
new file mode 100644
index 0000000..3999ab7
--- /dev/null
+++ b/src/compactblock.cpp
@@ -0,0 +1,155 @@
+// Copyright (c) 2026 Bitflash developers
+// Distributed under the MIT/X11 software license.
+//
+// See compactblock.h.
+
+#include "headers.h"
+#include "compactblock.h"
+#include <sodium.h>
+#include <map>
+
+uint256 CCmpctBlock::HeaderHash() const
+{
+    // Same technique CBlock::GetHash() uses: the header fields are laid out
+    // contiguously and in the same order here as in CBlock, so hashing the
+    // raw member range gives the identical block-identity hash.
+    return Hash(BEGIN(nVersion), END(nNonce));
+}
+
+uint64 ComputeShortTxId(const uint256& hashPrevBlock, uint64 shortIdNonce, const uint256& txid)
+{
+    // Derive a 16-byte SipHash key from (hashPrevBlock, shortIdNonce), so
+    // short IDs are specific to this block: they can't be precomputed
+    // before the block (and its freshly-chosen nonce) exist, and the same
+    // transaction gets a different short ID in every block it appears in
+    // (relevant across reorgs/re-announcements).
+    unsigned char keyMaterial[32 + sizeof(uint64)];
+    memcpy(keyMaterial, BEGIN(hashPrevBlock), 32);
+    memcpy(keyMaterial + 32, &shortIdNonce, sizeof(uint64));
+    uint256 keyHash = Hash((const char*)keyMaterial, (const char*)keyMaterial + sizeof(keyMaterial));
+
+    unsigned char out[crypto_shorthash_BYTES]; // 8 bytes
+    crypto_shorthash(out, (const unsigned char*)BEGIN(txid), 32, (const unsigned char*)BEGIN(keyHash));
+
+    uint64 id = 0;
+    memcpy(&id, out, sizeof(uint64));
+    return id & 0xFFFFFFFFFFFFULL; // low 48 bits -- matches the wire field width
+}
+
+bool BuildCompactBlock(const CBlock& block, CCmpctBlock& out)
+{
+    if (block.vtx.empty())
+        return false; // every real block has at least the coinbase
+
+    out.nVersion      = block.nVersion;
+    out.hashPrevBlock  = block.hashPrevBlock;
+    out.hashMerkleRoot = block.hashMerkleRoot;
+    out.nTime          = block.nTime;
+    out.nBits          = block.nBits;
+    out.nNonce         = block.nNonce;
+
+    unsigned char nonceBytes[sizeof(uint64)];
+    RAND_bytes(nonceBytes, sizeof(nonceBytes));
+    memcpy(&out.shortIdNonce, nonceBytes, sizeof(uint64));
+
+    out.vPrefilledIndex.clear();
+    out.vPrefilledTx.clear();
+    out.vShortTxId.clear();
+
+    // Only the coinbase is prefilled (index 0) -- see file comment in
+    // compactblock.h for why that's enough for this chain's scale.
+    out.vPrefilledIndex.push_back(0);
+    out.vPrefilledTx.push_back(block.vtx[0]);
+
+    for (size_t i = 1; i < block.vtx.size(); i++)
+        out.vShortTxId.push_back(ComputeShortTxId(out.hashPrevBlock, out.shortIdNonce, block.vtx[i].GetHash()));
+
+    return true;
+}
+
+bool TryReconstructBlock(const CCmpctBlock& cmpct, CBlock& outBlock, std::vector<unsigned int>& vMissingIndex)
+{
+    vMissingIndex.clear();
+
+    size_t nTotal = cmpct.vPrefilledIndex.size() + cmpct.vShortTxId.size();
+    if (cmpct.vPrefilledIndex.size() != cmpct.vPrefilledTx.size() || nTotal == 0)
+        return false; // malformed
+
+    outBlock.SetNull();
+    outBlock.nVersion      = cmpct.nVersion;
+    outBlock.hashPrevBlock  = cmpct.hashPrevBlock;
+    outBlock.hashMerkleRoot = cmpct.hashMerkleRoot;
+    outBlock.nTime          = cmpct.nTime;
+    outBlock.nBits          = cmpct.nBits;
+    outBlock.nNonce         = cmpct.nNonce;
+    outBlock.vtx.assign(nTotal, CTransaction());
+
+    std::vector<bool> vFilled(nTotal, false);
+    for (size_t i = 0; i < cmpct.vPrefilledIndex.size(); i++)
+    {
+        unsigned int idx = cmpct.vPrefilledIndex[i];
+        if (idx >= nTotal)
+            return false; // malformed
+        outBlock.vtx[idx] = cmpct.vPrefilledTx[i];
+        vFilled[idx] = true;
+    }
+
+    // Index every mempool tx by its short ID under this block's keying, so
+    // resolving each block position is a map lookup rather than a linear
+    // scan of the mempool per short ID.
+    std::map<uint64, const CTransaction*> mapShortIdToTx;
+    for (std::map<uint256, CTransaction>::const_iterator mi = mapTransactions.begin();
+         mi != mapTransactions.end(); ++mi)
+    {
+        uint64 sid = ComputeShortTxId(cmpct.hashPrevBlock, cmpct.shortIdNonce, mi->first);
+        // A short-ID collision between two distinct mempool transactions is
+        // possible (48 bits, birthday bound ~2^24 mempool entries) though
+        // very unlikely at this chain's scale; on collision, prefer keeping
+        // neither mapped rather than risk resolving to the wrong tx --
+        // that position just falls through to getblocktxn like a genuine
+        // miss, which is always correct, only occasionally not optimal.
+        if (mapShortIdToTx.count(sid))
+            mapShortIdToTx[sid] = NULL;
+        else
+            mapShortIdToTx[sid] = &mi->second;
+    }
+
+    size_t shortIdPos = 0;
+    for (size_t idx = 0; idx < nTotal; idx++)
+    {
+        if (vFilled[idx])
+            continue;
+        if (shortIdPos >= cmpct.vShortTxId.size())
+            return false; // malformed: more unfilled positions than short IDs
+        uint64 sid = cmpct.vShortTxId[shortIdPos++];
+
+        std::map<uint64, const CTransaction*>::const_iterator found = mapShortIdToTx.find(sid);
+        if (found != mapShortIdToTx.end() && found->second != NULL)
+        {
+            outBlock.vtx[idx] = *found->second;
+            vFilled[idx] = true;
+        }
+        else
+        {
+            vMissingIndex.push_back(idx);
+        }
+    }
+
+    return vMissingIndex.empty();
+}
+
+bool FillMissingAndFinish(CBlock& outBlock, const std::vector<unsigned int>& vMissingIndex,
+                           const std::vector<CTransaction>& vTxn)
+{
+    if (vMissingIndex.size() != vTxn.size())
+        return false; // peer didn't answer what was asked
+
+    for (size_t i = 0; i < vMissingIndex.size(); i++)
+    {
+        unsigned int idx = vMissingIndex[i];
+        if (idx >= outBlock.vtx.size())
+            return false; // malformed
+        outBlock.vtx[idx] = vTxn[i];
+    }
+    return true;
+}
diff --git a/src/compactblock.h b/src/compactblock.h
new file mode 100644
index 0000000..745ee3b
--- /dev/null
+++ b/src/compactblock.h
@@ -0,0 +1,113 @@
+// Copyright (c) 2026 Bitflash developers
+// Distributed under the MIT/X11 software license.
+//
+// Compact block relay (BIP152-style). Instead of sending a peer's full set
+// of transactions for a block they're about to receive -- almost all of
+// which they already have in their mempool from normal tx relay -- send a
+// short (48-bit, keyed-hash) ID per transaction instead. A peer that already
+// has every referenced transaction reconstructs the full block locally from
+// its mempool without any of the transaction bytes crossing the wire at
+// all; only genuinely missing transactions (typically just the coinbase)
+// need a follow-up round trip.
+//
+// Compatibility: this is purely additive. A peer that never sends
+// "sendcmpct" is never sent a compact block -- it keeps getting full
+// "block" messages exactly as before (see the getdata handler in
+// main.cpp). Old, unupgraded nodes on the live network are completely
+// unaffected; ProcessMessage's unknown-command handling means they simply
+// never see the new message types. No coordinated network upgrade needed.
+//
+// Deliberately scoped down from full BIP152: no high-bandwidth (unsolicited
+// push) mode, no differential-index encoding for prefilled transactions,
+// only the current chain tip is ever offered in compact form (an old block
+// is unlikely to still overlap much with any peer's current mempool, so the
+// bandwidth win doesn't apply -- full "block" is sent for those, same as
+// today). Only the coinbase is prefilled; every other transaction position
+// carries a short ID.
+
+#ifndef BITFLASH_COMPACTBLOCK_H
+#define BITFLASH_COMPACTBLOCK_H
+
+// Requires CBlock/CTransaction already visible -- #include "headers.h" (or
+// main.h) before this file. Deliberately doesn't include main.h itself:
+// main.h has no include guard (matches this codebase's existing headers, it
+// relies on being pulled in exactly once via headers.h), so a second
+// #include "main.h" here would break every translation unit that already
+// brought it in via headers.h first.
+#include <vector>
+
+// The compact representation of a block: header fields, a per-block nonce
+// (keys the short-ID hash so IDs can't be precomputed/ground across blocks),
+// the coinbase in full, and a 48-bit short ID for every other transaction
+// in block order.
+class CCmpctBlock
+{
+public:
+    // header
+    int          nVersion;
+    uint256      hashPrevBlock;
+    uint256      hashMerkleRoot;
+    unsigned int nTime;
+    unsigned int nBits;
+    unsigned int nNonce;
+
+    // Keys the short-ID hash for this block specifically -- chosen fresh
+    // per block (not reused from nNonce, which is public PoW data an
+    // attacker already knows and could otherwise grind against).
+    uint64 shortIdNonce;
+
+    // Sent in full. In this implementation: always exactly the coinbase,
+    // at index 0.
+    std::vector<unsigned int> vPrefilledIndex;
+    std::vector<CTransaction> vPrefilledTx;
+
+    // One short ID per NON-prefilled transaction, in ascending block-index
+    // order (i.e. the Nth entry here belongs to the Nth block position that
+    // isn't in vPrefilledIndex).
+    std::vector<uint64> vShortTxId;
+
+    IMPLEMENT_SERIALIZE
+    (
+        READWRITE(this->nVersion);
+        nVersion = this->nVersion;
+        READWRITE(hashPrevBlock);
+        READWRITE(hashMerkleRoot);
+        READWRITE(nTime);
+        READWRITE(nBits);
+        READWRITE(nNonce);
+        READWRITE(shortIdNonce);
+        READWRITE(vPrefilledIndex);
+        READWRITE(vPrefilledTx);
+        READWRITE(vShortTxId);
+    )
+
+    uint256 HeaderHash() const;
+};
+
+// Compute the 48-bit short ID for a transaction under a given block's
+// short-ID nonce. Keyed (via the block's hashPrevBlock + shortIdNonce) so
+// IDs from one block can't be precomputed before that block exists, and
+// differ block to block even for the same transaction.
+uint64 ComputeShortTxId(const uint256& hashPrevBlock, uint64 shortIdNonce, const uint256& txid);
+
+// Build the compact form of `block` (which must have vtx[0] as the
+// coinbase, as every block on this chain does).
+bool BuildCompactBlock(const CBlock& block, CCmpctBlock& out);
+
+// Attempt to reconstruct a full block from a received compact block using
+// the local mempool. On full success, returns true and fills `outBlock`.
+// On partial success (some transactions not found locally), returns false
+// and fills `vMissingIndex` with the block-position indices that still need
+// to be requested via "getblocktxn" -- outBlock is left partially built
+// (coinbase and any resolved positions filled; caller must not use it until
+// FillMissingAndFinish completes it).
+bool TryReconstructBlock(const CCmpctBlock& cmpct, CBlock& outBlock, std::vector<unsigned int>& vMissingIndex);
+
+// Complete a partially-reconstructed block (from a prior TryReconstructBlock
+// that returned false) using the transactions received in a "blocktxn"
+// response. vTxn must be in the same order as the indices this node
+// requested via "getblocktxn" for this block.
+bool FillMissingAndFinish(CBlock& outBlock, const std::vector<unsigned int>& vMissingIndex,
+                           const std::vector<CTransaction>& vTxn);
+
+#endif
diff --git a/src/test_compactblock.cpp b/src/test_compactblock.cpp
new file mode 100644
index 0000000..f4b5583
--- /dev/null
+++ b/src/test_compactblock.cpp
@@ -0,0 +1,133 @@
+// Standalone test of compactblock.cpp's core logic: build a compact block,
+// reconstruct it from a simulated mempool, including the missing-tx path.
+// Not wired into the P2P layer -- proves BuildCompactBlock/
+// TryReconstructBlock/FillMissingAndFinish are correct in isolation.
+
+#include "headers.h"
+#include "compactblock.h"
+#include <cstdio>
+#include <cassert>
+
+// main.cpp defines this; we're not linking main.cpp, so define it here.
+map<uint256, CTransaction> mapTransactions;
+string GetAppDir() { return "."; } // util.h's debug-log path helper needs this
+
+static int g_fail = 0;
+#define CHECK(cond, msg) do { \
+    if (cond) printf("  ok   %s\n", msg); \
+    else { printf("  FAIL %s\n", msg); g_fail++; } \
+} while (0)
+
+// Build a syntactically-valid-enough CTransaction that GetHash()s uniquely
+// per `nSeed` -- doesn't need to be consensus-valid, this test only
+// exercises short-ID computation and reconstruction, not script validation.
+static CTransaction MakeTx(int nSeed)
+{
+    CTransaction tx;
+    tx.nVersion = 1;
+    tx.nLockTime = nSeed; // cheapest way to make each tx's serialization (and hash) unique
+    return tx;
+}
+
+int main()
+{
+    // Build a block: coinbase + 20 regular transactions.
+    CBlock block;
+    block.nVersion = 1;
+    block.hashPrevBlock = uint256("0x00000000000000000000000000000000000000000000000000000000000abc");
+    block.nTime = 1234567890;
+    block.nBits = 0x1f0fffff;
+    block.nNonce = 42;
+    block.vtx.push_back(MakeTx(0)); // coinbase
+    for (int i = 1; i <= 20; i++)
+        block.vtx.push_back(MakeTx(i));
+    block.hashMerkleRoot = block.BuildMerkleTree();
+
+    printf("build_and_reconstruct_full_mempool\n");
+    {
+        CCmpctBlock cmpct;
+        CHECK(BuildCompactBlock(block, cmpct), "BuildCompactBlock succeeds");
+        CHECK(cmpct.vPrefilledIndex.size() == 1 && cmpct.vPrefilledIndex[0] == 0, "only the coinbase is prefilled");
+        CHECK(cmpct.vShortTxId.size() == 20, "one short ID per remaining tx");
+
+        // Simulate a peer with every transaction already in its mempool.
+        mapTransactions.clear();
+        for (size_t i = 1; i < block.vtx.size(); i++)
+            mapTransactions[block.vtx[i].GetHash()] = block.vtx[i];
+
+        CBlock rebuilt;
+        vector<unsigned int> vMissing;
+        CHECK(TryReconstructBlock(cmpct, rebuilt, vMissing), "fully reconstructs when mempool has everything");
+        CHECK(vMissing.empty(), "nothing reported missing");
+        CHECK(rebuilt.GetHash() == block.GetHash(), "reconstructed block hash matches original exactly");
+        CHECK(rebuilt.vtx.size() == block.vtx.size(), "same transaction count");
+        bool fAllMatch = true;
+        for (size_t i = 0; i < block.vtx.size(); i++)
+            if (rebuilt.vtx[i].GetHash() != block.vtx[i].GetHash()) fAllMatch = false;
+        CHECK(fAllMatch, "every transaction in the right position");
+    }
+
+    printf("partial_mempool_then_getblocktxn_completes_it\n");
+    {
+        CCmpctBlock cmpct;
+        BuildCompactBlock(block, cmpct);
+
+        // Simulate a peer missing 3 of the 20 non-coinbase transactions.
+        mapTransactions.clear();
+        vector<unsigned int> expectMissing;
+        for (size_t i = 1; i < block.vtx.size(); i++)
+        {
+            if (i == 5 || i == 12 || i == 19) { expectMissing.push_back((unsigned int)i); continue; }
+            mapTransactions[block.vtx[i].GetHash()] = block.vtx[i];
+        }
+
+        CBlock rebuilt;
+        vector<unsigned int> vMissing;
+        CHECK(!TryReconstructBlock(cmpct, rebuilt, vMissing), "reports incomplete when mempool is missing some tx");
+        CHECK(vMissing == expectMissing, "missing indices are exactly the ones not in mempool");
+
+        // Simulate the getblocktxn round trip: peer sends back the missing txs.
+        vector<CTransaction> vTxn;
+        foreach(unsigned int idx, vMissing)
+            vTxn.push_back(block.vtx[idx]);
+
+        CHECK(FillMissingAndFinish(rebuilt, vMissing, vTxn), "FillMissingAndFinish succeeds with matching response");
+        CHECK(rebuilt.GetHash() == block.GetHash(), "block hash matches after filling in the missing tx");
+    }
+
+    printf("mismatched_blocktxn_response_rejected\n");
+    {
+        CCmpctBlock cmpct;
+        BuildCompactBlock(block, cmpct);
+        mapTransactions.clear();
+        mapTransactions[block.vtx[1].GetHash()] = block.vtx[1]; // only one in mempool
+
+        CBlock rebuilt;
+        vector<unsigned int> vMissing;
+        TryReconstructBlock(cmpct, rebuilt, vMissing);
+        CHECK(vMissing.size() == 19, "19 missing when mempool has only 1 of 20");
+
+        vector<CTransaction> vWrongCount;
+        vWrongCount.push_back(block.vtx[2]); // way fewer than vMissing.size()
+        CHECK(!FillMissingAndFinish(rebuilt, vMissing, vWrongCount), "rejects a response with the wrong tx count");
+    }
+
+    printf("different_blocks_give_different_short_ids_for_same_tx\n");
+    {
+        // Same transaction, two different (simulated) blocks -- short IDs
+        // must differ, since they're keyed per-block (hashPrevBlock +
+        // fresh nonce each time), not just derived from the txid alone.
+        CTransaction tx = MakeTx(99);
+        uint256 prevA = uint256("0x1111111111111111111111111111111111111111111111111111111111111111");
+        uint256 prevB = uint256("0x2222222222222222222222222222222222222222222222222222222222222222");
+        uint64 id1 = ComputeShortTxId(prevA, 0xAAAABBBBCCCCDDDDULL, tx.GetHash());
+        uint64 id2 = ComputeShortTxId(prevB, 0xAAAABBBBCCCCDDDDULL, tx.GetHash());
+        uint64 id3 = ComputeShortTxId(prevA, 0x1111222233334444ULL, tx.GetHash());
+        CHECK(id1 != id2, "different hashPrevBlock -> different short ID");
+        CHECK(id1 != id3, "different nonce -> different short ID");
+        CHECK(id1 <= 0xFFFFFFFFFFFFULL, "short ID fits in 48 bits");
+    }
+
+    printf("\n%s (%d failures)\n", g_fail == 0 ? "ALL TESTS PASSED" : "TESTS FAILED", g_fail);
+    return g_fail == 0 ? 0 : 1;
+}