1 files changed, 30 insertions, 7 deletions

diff --git a/src/rpc.cpp b/src/rpc.cpp
index ae94289..8a0d112 100644
--- a/src/rpc.cpp
+++ b/src/rpc.cpp
@@ -143,17 +143,40 @@ static bool RebuildJob()
             return false;
         }
 
-        // Don't issue jobs until the chain is synced: mining against a stale
-        // tip produces blocks the network will orphan, and payout entries
-        // that can never be paid (their coinbases never exist on the main
-        // chain). Require at least one peer and a fresh tip.
+        // Don't issue jobs while we are behind the network: mining against a
+        // stale tip produces blocks the network will orphan, and payout
+        // entries that can never be paid (their coinbases never exist on the
+        // main chain). Require at least one peer, and require that no peer
+        // claims a longer chain than ours.
         if (vNodes.empty()) {
             LogPrint("pool", "RebuildJob: no peers yet -- not issuing jobs\n");
             return false;
         }
-        if (GetAdjustedTime() - (int64)pindexBest->nTime > 30*60) {
-            LogPrint("pool", "RebuildJob: tip is %llds old -- still syncing, not issuing jobs\n",
-                     (long long)(GetAdjustedTime() - (int64)pindexBest->nTime));
+        // This used to compare the tip's timestamp against 30 minutes, which
+        // was wrong in both directions and cost real money.
+        //
+        // It cannot tell "we are not synced" from "the network is slow". A
+        // pool mining its own fork keeps its tip timestamp fresh forever, so
+        // the check passed for the whole of heights 3966-4085 -- 120
+        // consecutive blocks, every one of them orphaned, 5890.50 BTF of
+        // payouts voided. Then, once the pool stopped finding blocks, the
+        // same check refused to issue jobs against a tip that was perfectly
+        // valid and was the network's own best, and the pool -- roughly 90%
+        // of the hashrate -- could not restart the chain it was the majority
+        // of. Stale tip, so no jobs; no jobs, so the tip stays stale.
+        //
+        // The height peers announce in their version message answers the
+        // question the age check was only guessing at. Median, so one peer
+        // claiming an absurd height cannot stall us, and one block of slack
+        // to match WarnIfBehind, because somebody is always mid-relay. A
+        // peer that predates the announcement reports -1 and is ignored; if
+        // nobody has told us anything we mine our best chain, which is what
+        // the node would do without a pool attached.
+        int nPeerHeight = GetPeerMedianHeight();
+        if (nPeerHeight >= 0 && nBestHeight < nPeerHeight - 1) {
+            LogPrint("pool", "RebuildJob: %d blocks behind the network "
+                             "(height %d, peers report %d) -- not issuing jobs\n",
+                     nPeerHeight - nBestHeight, nBestHeight, nPeerHeight);
             return false;
         }