| Age | Commit message (Collapse) | Author |
|---|
|
The segfault in issue #5 was a format string: `%I64d` is MSVC-only,
glibc parses it as the GNU `I` flag with a width of 64 and an `int`
conversion, the vararg run desynchronises, and the following `%s`
dereferences an integer. It killed the node mid-sync at the first
block carrying a real transaction, deterministically.
GCC can catch this. It never got the chance, for two reasons that
had to be fixed together:
- `-w` sat in both makefiles and suppressed every diagnostic. It
cannot be narrowed; it wins over any -W or -Werror= that follows,
so it had to go. The four -Wno- entries replacing it are the
categories this 2009-era tree actually produces (measured: 248
deprecated-declarations, 157 write-strings, 18 narrowing, 1
unused-result), silenced by name instead of wholesale.
- Even with -Wformat on, nothing was checked. GCC only inspects
format strings for functions it knows are printf-like, and every
format string here goes through strprintf, error, my_snprintf, or
OutputDebugStringF -- `printf` itself is #defined to the last of
those. None carried a format attribute, so the entire tree was
invisible to the check. They are annotated now.
Annotating surfaced 77 warnings across 17 distinct sites, all fixed
here. Most were size_t or int64 passed to %d, harmless on x86-64 but
wrong. Two were not cosmetic:
- CBlockIndex::ToString printed pprev/pnext with %08x, truncating
both pointers to 32 bits, so the two fields that line exists to
show were unreliable on every 64-bit build.
- CInv::GetCommand threw "type=% unknown type", where the % ate the
space as a flag and the u as its conversion. The message read
"type= 3nknown type".
PRId64 is now one spelling for every target. Its MSVCRT branch was
what produced "I64d" in the first place, it is pointless against UCRT
which takes the C99 forms, the rest of the tree already prints int64
with %lld on Windows, and its only user (i64tostr) is dead code.
Collapsing it lets both builds share the gnu_printf archetype --
ms_printf would reject %zu, which this tree uses and UCRT supports,
while waving through the %I64d that crashes.
Verified on both platforms: clean build, and reintroducing the
issue #5 specifier now fails compilation rather than shipping.
main.h:410:50: error: unknown conversion type character 'I' in format
main.h:410:70: error: format '%s' expects argument of type 'char*',
but argument 3 has type 'long long int'
That second line is the crash itself, caught at build time.
Runtime checked on both: node syncs past the block from issue #5, and
the repaired log lines read correctly --
before: CTxOut(nValue= 50.%08I64d, scriptPubKey=(null))
after: CTxOut(nValue=50.00000000, scriptPubKey=0xE1C7EF3E706002)
Four '_WIN32_WINNT redefined' warnings remain on Windows. Silencing
them means letting a system header pick the Windows API level instead
of this tree, which is a separate decision from format checking.
|
|
nMineMode defaults to MINE_RELAY (0) and ParseStartupArguments() never changed
it, so a node started with /gen would spawn ThreadBitcoinMiner, enter
BitcoinMiner(), hit
if (nMineMode == MINE_RELAY)
return true;
and return before doing any work. The node then ran indefinitely looking
completely healthy -- it synced, it held peers, it reported no errors -- while
earning nothing. Nothing in the log said otherwise; the only hint was
`nMineMode = 0` in a startup line that reads like a status echo.
This affects every headless miner, because the GUI is the only other way to
select a mining mode.
/gen now implies MINE_SOLO unless /operator or /participant asked for something
else. Verify with `nMineMode = 1` at startup.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
|
ByteReverse(word32) in src/sha.h uses the x86 `bswap` instruction via inline
asm, guarded only by `#if defined(__GNUC__)`. GCC and Clang define __GNUC__ on
every architecture they target, so on aarch64 the guard passes and the
assembler then rejects the instruction:
Error: unknown mnemonic `bswap' -- `bswap %eax'
This makes the tree fail to build on any ARM64 host -- Apple Silicon, ARM
servers, a Raspberry Pi -- at a point far from anything the user did.
Narrow the guard to the architectures where the instruction exists. The
portable C fallback directly below is then used everywhere else; it was
already there and already correct.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
|
.gitignore ignores *.dat and wallet.dat, but the node also writes three files
in its data directory that are not .dat and are just as sensitive:
btf_enc.key this node's .btf service key -- its network identity
nostr.key the Nostr key its descriptors are signed with
walletrpc.token bearer token authorising spends over the wallet API
A node run with its data directory inside a working tree -- which is the
obvious thing to do while developing -- leaves all three untracked but
committable, and `git add -A` takes them. Losing btf_enc.key means losing your
address; publishing walletrpc.token hands over the wallet to anyone who can
reach the port.
Also ignore key backup archives and stray .patch/.rej/.orig files.
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
|
|
Seeds (#36), headless node (#37), README (#35), wallet crash fix (#38).
|
|
Berkeley DB throws when it cannot open a file written by
another platform's build (e.g. BDB 5.3 wallet read by 6.2).
Nothing on the call path caught these, so the exception
unwound into std::terminate -- surfacing on Windows as
STATUS_STACK_BUFFER_OVERRUN (0xC0000409) with no useful
message.
Three layers of defense:
1. main_gui.cpp: try/catch around LoadBlockIndex() and
LoadWallet(), printing the reason and exiting cleanly.
2. db.cpp LoadWallet: try/catch around the record-reading
loop (Satoshi's 2009 TODO), tracking the last record type
so the error message says what it choked on.
3. db.cpp cleanup paths: every dbenv.close(), pdb->close(),
txn_checkpoint() and log_archive() wrapped in try/catch
so the environment teardown after a failed open does not
throw a second exception into std::terminate.
Tested: cross-platform wallet (Linux BDB 5.3 → Windows 6.2)
now prints a clear message and exits with code 1, wallet
left untouched.
Closes #34
Co-authored-by: Claude Opus 4.6 <noreply@anthropic.com>
|
|
The GUI build requires libGL at load time even when started with -nogui. The
dynamic loader resolves every dependency before main() runs, so the flag arrives
far too late -- on a clean server the binary dies with
error while loading shared libraries: libGL.so.1: cannot open shared object file
and nothing suggests it would otherwise have worked. A server is where a node
most naturally lives, so this is the deployment that mattered most and the one
that failed. The AppImage additionally needs FUSE, which minimal servers lack.
Bundling libGL into the AppImage would be the wrong fix: GL has to come from the
host's driver stack, and shipping our own breaks machines that have a real GPU.
So: a second binary, built from the same node objects without ImGui, GLFW or
OpenGL. `make linux-node` produces bitflash-node-<version>-x86_64, 2.5 MB
stripped, with no graphics or FUSE dependency at all. `make linux` now builds it
alongside the AppImage. Anyone wanting a window keeps using the AppImage.
Two small moves were needed. MainFrameRepaint is called from main.cpp and
net.cpp but defined in gui.cpp, so headless.cpp provides an empty one rather
than putting ifdefs at six call sites. DateTimeStr also lived in gui.cpp while
main.cpp logs block times with it -- nothing about formatting a date is GUI
work, so it moved to util.cpp and both builds share one definition.
Verified on Debian 13:
ldd bitflash-node | grep -iE 'libGL|glfw|X11' -> nothing
ldd bitflash | grep -iE 'libGL|glfw' -> libglfw.so.3, libGL.so.1, libGLdispatch.so.0
and at runtime, from an empty datadir:
btfseed: reached ygffz37...btf via 90.156.222.107:8434
rendezvous: registered at 90.156.222.107:8434, waiting for a dial
self-resolve OK (meeting_node=90.156.222.107:8434)
btfpeers: kept 15 of 15 descriptor(s)
first block at ~30s, 3182 blocks accepted, synced to the tip
The GUI builds on Linux and Windows were rebuilt and are unaffected.
|
|
* net: compiled-in bootstrap seeds, so a first run does not need a relay
A node with no cache has only the Nostr relays. If they are down, blocked or
slow, a first run has no way into the network at all -- and that is the one
moment a user has no patience for. Seeds are the floor under that.
A seed entry is an address and an encryption key. Deliberately no meeting node:
the rendezvous relay pairs on the service's public key, and a `.btf` address is
that key, so a client can find a seed by trying the known relays in turn.
Recording which relay a seed was on would rot the moment it failed over, which
is exactly the failure this project spent weeks chasing -- advertising a
rendezvous somebody is not registered at.
Seeds carry no authority. They serve the same signed, self-certifying
descriptors as any peer, so a hostile seed can stall a bootstrap but cannot
forge a peer or feed a false chain.
The compiled list is empty. Which nodes become permanent public bootstrap
targets is a decision for whoever runs the network, not a default, and it is
close to irreversible once binaries are distributed. Empty is valid: discovery
falls back to Nostr exactly as before. /btfseed=ADDRESS:ENCHEX (repeatable)
appends at runtime, for testing and for private networks.
Tested against the live network, clean datadir, no cache, three seeds carrying
no meeting node:
btfpeers: no cache yet, falling back to seeds
btfseed: trying 3 seed(s) across 3 relay(s)
btfseed: reached q5jxyzn...btf via 90.156.222.107:8434
btfseed: 3 seed(s) answered
* net: add the Almaty bootstrap node to the seed list
Dedicated node, no wallet balance, no mining, running beside the rendezvous
relay on the same host. It exists only to answer a first dial.
Fresh datadir, no flags, compiled list only:
btfpeers: no cache yet, falling back to seeds
btfseed: trying 1 seed(s) across 3 relay(s)
btfseed: reached ygffz37...btf via 90.156.222.107:8434
btfseed: 1 seed(s) answered
btfpeers: kept 2 of 2 descriptor(s)
5.2 seconds from nothing to a peer, against 36s for a cold start that had to go
through the relays. The seed then handed over two more peers by exchange, which
the cache keeps for next time.
|
|
The privacy paragraph said "your IP is never exposed to other nodes", which is
close enough to true to be relied on and not true enough to deserve it. A peer
reached over .btf genuinely does not learn your IP -- there is no IP-based
dialling left. But the rendezvous relay sees it by construction, and the node
still listens on 8433, so anyone who already knows the address can connect
directly. All three are now stated, along with the line that this is
unlinkability between peers rather than anonymity against an observer.
Also stale or missing:
- Quick start named 1.1.0 files, four releases back. Now points at the release
page and shows how to verify SHA256SUMS.
- Nothing said upgrades matter. 1.2.1 and 1.2.2 both changed consensus, so an
old node ends up on a different chain with no warning. Said so, with where the
data directory lives and why not to delete it.
- Discovery was described as Nostr only. The cache and peer exchange landed in
1.2.3; all four layers are now listed, with the 36s -> 2s restart figure.
- The glance table said "halving on schedule", which hides the number people
actually want: same 210,000 blocks as Bitcoin, but ~292 days instead of four
years. Added retarget window, coinbase maturity, sigops cap and P2P port too.
- /port, /datadir and /debug were undocumented, as was the fact that /gen does
not persist across restarts.
|
|
Everything since 1.2.2 is about nodes being able to find and reach each other,
which is the problem this project actually had:
#30 rendezvous registration and waiting split apart. Registering used to
block until somebody dialled, so a node could not advertise a meeting
node until it had already been reached at one. This is the root cause
of the flaky connectivity, not dead relays or stale descriptors.
#26 a node no longer advertises a rendezvous it is not registered at
#25 .btf peers that answered are remembered and dialled first (36.3s -> 2.1s)
#32 peers exchange signed descriptors, so discovery survives a relay outage
#29 debug.log stopped dropping lines under concurrency
#28 /port, so two nodes can share a machine
|
|
Discovery has depended entirely on the Nostr relays. Two connected nodes never
told each other who else existed, so a relay outage left a running network
unable to grow, and a node that found one stale peer had no way to learn there
was anything better. The old `addr` gossip went out with the IRC seed.
Peers now trade signed descriptors over a new "btfpeers" message: our own
first, then peers that actually answered us. The receiver checks each Schnorr
signature against the key the `.btf` address decodes to, so the sender is
trusted for nothing -- forging an entry needs somebody else's secret key. That
leaves flooding with self-generated keys, which the per-message caps and the
"peers that answered" ordering are there to blunt.
Unknown commands are ignored (main.cpp), so nodes without this just drop the
message; nothing here is a protocol break.
The cache from the peer-cache change now keeps each peer's descriptor verbatim
alongside the parsed fields, because that signature is what makes a peer
relayable. Entries without one -- resolved through Nostr, or written before
this -- stay dialable, just not passed on. A dial never clears a descriptor
already on file.
|
|
A node could not become reachable. RvServiceRegister connected, sent its
'S'+pubkey header, and then blocked reading the relay's 0x01 byte -- which the
relay only writes when a client pairs with the service. So the call did not
return when the node was registered; it returned when somebody had already
dialled it.
ThreadBtfAccept called BtfSetActiveRelay after that. The result is a deadlock:
- to be dialled, a node must publish a descriptor naming its meeting node
- to publish, BtfActiveRelay() must be set
- it is only set once somebody has dialled
Before #26 this was masked. BtfActiveRelay() fell back to
vBtfMeetingRelays[0], so a node always published something, and ThreadBtfAccept
picks its relay at random -- so it worked whenever the two happened to match,
roughly one time in the number of relays. That is the flakiness this project has
been chasing: not a bad relay, an advertisement that usually named the wrong one.
#26 removed the fallback, which was right on its own terms and turned an
unreliable heuristic into a reliable deadlock. This is the other half of that
change and they belong together.
RvServiceRegister now returns as soon as the relay has the service listed.
RvServiceWaitPaired does the blocking read. ThreadBtfAccept registers, advertises,
then waits. RvClientConnect is untouched -- a dialer blocking until it is paired
is correct.
Registration failure also had no log line at all, which is why this stayed
invisible: a node that never registered looked identical to one waiting quietly
for a peer. There are now lines for registering, failing over, and being dropped.
Verified: a fresh node reports `registered at 90.156.222.107:8434, waiting for a
dial` and then self-resolves with `meeting_node=90.156.222.107:8434` -- the relay
it is actually on. Two nodes on one machine reach each other.
|
|
OutputDebugStringF resolved its path lazily with no lock:
static string strDebugFile;
if (strDebugFile.empty()) { ... strDebugFile = dir + "\\" + "debug.log"; }
FILE* fileout = fopen(strDebugFile.c_str(), "a");
if (fileout) { ... }
One thread could read that string while another was still assigning to it, and
at startup three threads log within milliseconds of each other. When it raced,
fopen received a torn path, returned NULL, and the `if (fileout)` dropped the
line with no error anywhere. Several threads calling fopen on the same file at
once had no protection either.
Measured over six runs, counting first-statement printfs that are unconditional
and must appear every time:
ThreadBtfAccept started 4/6
ThreadNostrSeed started 5/6
btfpeers: (cached peers) 2/6
Over eight runs after the change, all three are 8/8.
This matters beyond tidiness. A missing line was read as a thread that never
started, and a real investigation was spent on it. Any reasoning of the form
"it is not in the log, so it did not happen" was unsound against this build.
Path resolution and the write now share one critical section. The rest of the
function already had its own for the OutputDebugString accumulation path; only
the file half was unguarded.
|
|
net.cpp has described nListenPort as "tunable via /port" since it was written:
unsigned short nListenPort = DEFAULT_PORT; // local P2P port (tunable via /port)
Nothing ever parsed the option. The port was fixed at 8433, so a second node
could not start on a machine already running one -- StartNode fails the bind and
the node comes up with no networking at all. That makes local multi-node testing
impossible, which is how this was found: a two-node test could not be run.
Sets addrLocalHost.port alongside nListenPort, or the node announces a port it
never bound. An out-of-range value is rejected with a message and the default
kept, rather than silently wrapping through the unsigned short cast.
|
|
PR #25 was opened, reviewed and approved as a single-file change to net.cpp:
the .btf peer cache, +169/-0. I then pushed peer exchange and a /port option
onto that same branch while the PR was open, which silently widened it to six
files. The merge carried all of it in.
Nothing about the peer exchange had been validated. Its two-node test never
completed -- node B could not dial node A at all -- so what landed on main is
unproven network protocol code that no one agreed to take.
This restores main to what #25 actually described. The peer cache stays, with
its runtime numbers (36.3s to 2.1s to first peer). #26 stays. What comes out:
- the "btfpeers" message, both directions
- BtfPexCollect / BtfPexAccept and the per-message caps
- CNode::nLastPexRecv
- the `desc` field on the cached peer record
- BtfLocalDescriptor / BtfSecpContext
- /port
Peer exchange returns as its own pull request once its test passes. The /port
option is worth having on its own -- two nodes cannot share a machine without
it, which is what blocked the test -- and should go up separately rather than
ride along again.
Release v1.2.2 is unaffected: it was built from ba2de82, before either merge.
|
|
* net: remember .btf peers that answered, and dial them first on start
Discovery depends entirely on the Nostr relays. A node that has been up
for hours knows exactly which peers respond, and throws all of it away on
exit; the next start reaches for the relays again and walks the same
descriptor list, of which roughly 96% is dead. That is what makes a
restart take minutes before the first tunnel opens -- measured today at
about seven.
Every peer that completes a tunnel is now written to btfpeers.json with
its meeting node and encryption key, which is everything needed to redial
it. On start a thread tries those before the relays have answered
anything, stopping once eight are connected. Entries older than a week
are dropped, and the file holds at most fifty.
Cache only: nothing here changes how a first-ever run bootstraps, and a
missing or corrupt file just falls through to relay discovery.
* net: exchange signed .btf descriptors between peers
Discovery has depended entirely on the Nostr relays. Two connected nodes never
told each other who else existed, so a relay outage left a running network
unable to grow, and a node that found one stale peer had no way to learn there
was anything better. The old `addr` gossip went out with the IRC seed.
Peers now trade signed descriptors over a new "btfpeers" message: our own
first, then peers that actually answered us. The receiver checks each Schnorr
signature against the key the `.btf` address decodes to, so the sender is
trusted for nothing -- forging an entry needs somebody else's secret key. That
leaves flooding with self-generated keys, which the per-message caps and the
"peers that answered" ordering are there to blunt.
Unknown commands are ignored (main.cpp), so nodes without this just drop the
message; nothing here is a protocol break.
The cache from the peer-cache change now keeps each peer's descriptor verbatim
alongside the parsed fields, because that signature is what makes a peer
relayable. Entries without one -- resolved through Nostr, or written before
this -- stay dialable, just not passed on. A dial never clears a descriptor
already on file.
* main_gui: implement /port, which net.cpp already documented
net.cpp has said nListenPort is "tunable via /port" since it was written, but
nothing ever parsed the option. Two nodes could not share a machine, which is
exactly what testing peer exchange needs. Sets addrLocalHost.port too, so we
do not advertise a port we never bound.
|
|
BtfActiveRelay() fell back to vBtfMeetingRelays[0] whenever registration had
not completed yet. ThreadNostrSeed and ThreadBtfAccept start in parallel
(net.cpp), so at boot that fallback was exactly what PublishDescriptor wrote
into the descriptor -- including the one-time self-test, which publishes to
every relay in the list. Peers reading it dialed a rendezvous this node was
never registered at, and whenever the first seed happened to be down
(92.246.128.180 was, for part of today) every one of those dials was wasted.
BtfActiveRelay() now returns only the relay ThreadBtfAccept confirmed, and
PublishDescriptor skips publishing until there is one. The seed loop
republishes on every pass, so the only cost is the delay until registration
succeeds; the self-test waits up to 60s for it so it still measures the
publish/resolve chain instead of losing the race against it.
Also fix the WebSocket handshake reader. On headers past the cap it did a
bare break, leaving the socket parked in the middle of the header block --
and since the status line had already been read, the " 101 " check still
passed, so the caller got a "connected" socket whose next bytes were
leftover HTTP that the frame parser then read as garbage frames. It now
errors out instead, and the cap is 8192 because relays behind Cloudflare
send large header blocks.
|
|
|
|
MAX_SIZE bounds a block's bytes, not what it costs to check. Every
OP_CHECKSIG is an elliptic-curve verification, and blocks may be 32 MB
here, so one packed with signature operations takes every node minutes of
CPU to reject -- while at this chain's difficulty it stays cheap to mine.
There was no counter at all.
CheckBlock now sums signature operations across the block and rejects
past 20000, the figure Bitcoin settled on. OP_CHECKMULTISIG counts as 20
since it may verify that many.
Consensus change. Real blocks here carry one or two operations each --
coinbase pay-to-pubkey and standard pay-to-pubkey-hash spends -- so the
ceiling is four orders of magnitude above anything in the chain, but it
still needs verifying against the full history before merge.
|
|
Everything an unauthenticated socket can reach in the pool server, in one
pass.
A line that never ends. RecvLine appended to the per-miner buffer and
looked for a newline; a peer that sends bytes and no newline grew that
buffer for as long as it kept writing, before authorizing or subscribing.
Capped at 64 KB, which drops the miner.
No limit on connections. Every accepted socket became a Miner with its
own buffer and nothing bounded the list. Capped at 1000.
Malformed requests crashed the node, not just the pool. ThreadRPCServer
has no exception handler, so anything thrown from line handling reached
the top of the thread and terminated the process. Three ways in, all
valid JSON that parses cleanly:
[1,2,3] -- value() on a non-object throws
{"method": 1} -- value() with the wrong type throws
submit with params [1,2,3] -- get<std::string>() on a number throws
mining.authorize had the subtler shape of the same thing: it tested
p.size() without testing p.is_array(), and indexing a json object with a
number throws while size() happily returns its key count.
Each is now rejected on its own terms, and the call is wrapped so a throw
drops that miner instead of the node.
|
|
The node connects to public Nostr relays it does not run, and the
WebSocket reader trusted them completely.
A frame's payload length is read from the wire -- up to 64 bits when the
extended form is used -- and passed straight to string::resize(). One
frame header claiming 2^40 bytes is enough to make the node allocate
until it dies. Reassembly across continuation frames had no ceiling
either, so the same result was reachable with small frames. Frames are
now capped at 1 MiB and a reassembled message at 4 MiB; the frame cap
also keeps the length inside the int that ReadN takes, which a 64-bit
value would otherwise have narrowed, possibly to a negative.
Six message loops then did:
if (!j.is_array() || j.empty()) continue;
string type = j[0].get<string>();
j[0] was never checked to be a string, so a relay answering with [1]
threw an uncaught json::type_error and took the thread down. Same shape
as the descriptor bug fixed in #12, in six more places.
Nothing here is consensus -- this is the relay-facing edge only.
|
|
A transaction naming a parent the node does not have is never validated,
just stored in mapOrphanTransactions -- and there was no ceiling. Sending
them costs a peer nothing: no proof of work, no valid signature, no fee,
and the node keeps every one. Any peer could grow that map until the node
died of memory exhaustion.
Cap at 100, evicting at random rather than in map order so an attacker
cannot keep its own orphans resident by choosing hashes that sort low.
Local policy, not consensus -- no effect on block or transaction
validity.
|
|
The vector unserializer grows in 5 MB steps so a bogus length cannot make
it allocate more than has actually been received. The string one resized
straight to whatever ReadCompactSize returned, and ReadCompactSize has no
ceiling -- nine bytes on the wire can name four gigabytes.
Not reachable from the network today: the only string on a serialized
type is CWalletTx::mapValue, and RelayMessage casts to CTransaction
before sending, so it never leaves disk. This is a guard against the next
network message that carries a string -- Bitcoin's own version message
carries strSubVer -- rather than a fix for a live hole.
|
|
It reads:
Save BEFORE moving to exec queue: if we crash between the save and
SendMoney, LoadPendingPayouts re-queues them from the exec-queue
section of the file.
There is no exec-queue section. SavePendingPayouts serialises
gPendingPayouts and nothing else, and a matured payout is erased from it
and written out before ever reaching the queue, which lives only in
memory. Crash in between and those miners are never paid, with no record
they were owed anything.
Only the comment changes here. The behaviour needs idempotent payment --
record the txid, look for it in the wallet on restart -- because simply
persisting the queue and re-running it would double-pay anyone already
sent to, which is the worse failure.
|
|
|
|
* script: fix OP_RETURN spend bypass, disable unbounded opcodes
OP_RETURN let anyone spend anyone else's outputs.
VerifySignature evaluates scriptSig and scriptPubKey as one concatenated
script. OP_RETURN was implemented as 'pc = pend', which jumps past
everything that follows, and EvalScript ends with
CastToBool(stack.back()). So a scriptSig of <OP_TRUE OP_RETURN> skipped
the entire scriptPubKey -- OP_CHECKSIG included -- and the final check
read the attacker's own OP_TRUE. No signature required, any output
spendable. This is the 0.1.0 behaviour Bitcoin fixed in 0.3.5.
OP_RETURN now fails the script outright.
Also disables the opcodes Bitcoin removed for being unbounded, and caps
pushed elements at 520 bytes:
OP_CAT grows a stack element with no limit -- <x> OP_DUP OP_CAT
repeated doubles it each time, so a script that fits in a transaction
exhausts memory on every node that validates it. OP_LSHIFT shifts by
an attacker-supplied amount with no ceiling, same effect. There were
no element, stack or opcode-count limits of any kind.
Nothing on this chain uses these opcodes -- all outputs are standard
pay-to-pubkey-hash or coinbase pay-to-pubkey -- so no existing
transaction changes validity.
* main: reject blocks containing a duplicate transaction (CVE-2012-2459)
BuildMerkleTree duplicates the trailing hash whenever a tree level has
an odd width. Appending a copy of the last transaction therefore
produces a block whose merkle root -- and whose block hash -- match a
legitimate block exactly.
A node handed the forgery rejects it (the duplicated inputs are already
spent) and remembers that hash as bad. When the genuine block arrives
carrying the same hash, it is refused too, and the node stops following
the real chain.
CheckBlock now rejects any block that carries the same transaction
twice, which is what the mutation requires.
* main: halve the subsidy on the block's height, not the node's tip
GetBlockValue derived the halving from nBestHeight -- the validating
node's own chain tip -- rather than from the height of the block being
valued. The subsidy a block may pay is a property of that block, so
reading it off local state makes validity depend on how far the node has
synced: across a halving boundary a node still catching up would allow
50 BTF where a synced node allows 25, and the two would follow different
chains. Reorgs have the same problem in miniature.
Harmless today (every node computes nHeight/210000 == 0 at height ~2400)
and it changes no existing block's validity, but it splits the network
at height 210000.
The height is now passed in explicitly: pindex->nHeight when connecting,
tip + 1 when mining or building pool work.
|
|
The #9 merge commit staged everything in the working tree, which pulled
in the packaged Bitflash-1.1.0-windows/ directory -- 11 MB of runtime
DLLs that every clone now carries for no reason. Remove them from the
index and extend .gitignore so the packaging output can't be committed
again.
|
|
The AppImage step converts src/rc/bitcoin.ico with PIL, but python3-pil
was never in deps-apt, so 'make linux' failed at packaging on a clean
Debian install -- the AppImage the README points Linux users at could
not actually be produced by following the documented steps.
Version bump only renames the produced artefacts; no rebuild needed.
|
|
* Add Linux GUI installer via Wine
* Fix launcher creation and add BTF_RELAY env var support
* Pool server, Linux GUI, unified binary, README update
* Root Makefile: make linux / make windows, cleaner README
* Remove headless.cpp
* Fix XPM color count mismatch causing toolbar image errors on Linux
* XPM icons: same code on Windows and Linux, no ifdefs around image loading
* Fix GTK icon crash and Linux printf format
* btfrv: 10s socket timeout on relay connects
* Faster peer discovery: more dials per pass, shorter backoff and sleep
* Parallel btf peer connections
* Fix GetMyExternalIP - was disabled, now uses modern IP echo services
* Fix tunnel disconnect on idle and restore external IP detection
* Filter stale Nostr descriptors
* Sort peers by freshness, fresh first
* Pool: add .btf Stratum listener — miners connect via rendezvous, no port forwarding needed
* btf pool: self-replacing listeners, one per relay, no queuing between miners
* Mining modes: solo/operator/participant — pool server on-demand, participant Stratum client
* Status bar: show external IP and .btf address
* README: clean rewrite, concept-first, minimal
* make linux produces AppImage
* make linux produces AppImage
* Pool dashboard: connect instructions, tabs, share bars
* Perf fixes: GetMyExternalIP threaded, btf listener counted
* Perf fixes: GetMyExternalIP threaded, btf listener counted
* Fix pool payouts: defer until coinbase maturity
* Pool: clean mode switching, IP warning
* Pool: clean mode switching
* Fix gPoolRunning: remove static
* AppImage: use real icon from bitcoin.ico
* Fix exit crash; Mining menu
* Fix exit crash; Mining menu
* Fix exit crash; Mining menu
* Fix exit crash; Mining menu
* Fix exit crash; Mining menu
* Windows build: use mingw32-make
* Windows build: simpler make invocation
* Add deps-windows target
* Windows build fixes
* Windows build fixes
* Windows makefile: fix obj dir
* Windows: output to repo root
* Windows: bundle DLLs into zip
* Replace wxWidgets with ImGui+GLFW: same build on Linux and Windows
* Fix %I64d that slipped back through rebase (main.h, net.h)
* MinGW: add _mkdir shim for non-MSVC Windows; fix %I64d
* Fix gPoolRunning extern outside ifndef _WIN32
* Remove -lboost_system: boost is header-only in this codebase
* Status bar: copy buttons for IP and .btf address
* Windows: add app icon via windres, strip wx stuff from rc file
* Clean GUI: single Options menu item, bigger font, better spacing, cleaner options dialog; update README
* GUI: embed Roboto font at 16px for clear readability on all platforms
* Windows: windres depends on obj dir target
* Fix balance hidden off-screen: put on own line below address bar
* Windows: inline mkdir in every rule, remove dir target that confused make
* Windows: move all target to top so it's the default rule
* Fix pool server not starting: always start when operator selected, re-sync dialog state on open
* Write debug.log to data directory (AppData/Roaming/Bitflash on Windows)
* Participant miner: use wallet address as username so payouts go to wallet
* Add .gitattributes to lock LF line endings, prevent CRLF drift
* Refactor pool mining to btf-only transport
* Persist pool settings and startup wiring
* Prune stale peers and expose pool queries
* Fix build regressions and add CLI mode/arg parity
* Fix rpc miner stats declaration order
* Centralize pool runtime extern declarations
* Separate operator/participant dashboards and restore peer stats
* Add live telemetry strip and clearer per-mode runtime metrics
* Reduce mining dashboard clutter and remove manual pool entry
* Count only authorized pool miners
* Seed initial pool job on startup
* Use a real share target for pool work
* Switch pool accounting to round-based shares
* Fix nostr pool announcer stats call sites
* Fix pool stats definition order
* Improve pool worker status display
* Add mutex include for participant status
* Replace ImClamp in dashboard layout
* Clarify participant work status
* Log participant status transitions
* Reduce peer discovery log noise
* Add participant status badge
* Track participant auth acknowledgements
* Log and validate pool job delivery
* Stop persisting mining mode/pool settings across restarts
LoadWallet() runs after CLI flags are parsed in main_gui.cpp, and was
restoring nMineMode/strParticipantPool/strPoolName/strPoolDashboardUrl/
dPoolFeePercent/fGenerateBitcoins from wallet.dat every time, silently
overwriting whatever was just set on the command line or in the current
Options session -- no error, no log line. This is why pool name/address
could show correctly in the UI but stay stale in the logs (UI held the
in-memory value just set; logs eventually reflected whatever LoadWallet
clobbered it back to), and why mode changed behavior across restarts.
Mode/pool config is now decided fresh every launch: CLI flags if given,
otherwise the compiled-in default. Nothing is written back to wallet.dat
for these settings anymore, so there's nothing left to go stale or fight
over load order.
* Add explicit Relay mode as the new startup default
4th mining mode: node runs/syncs, never mines, no pool server -- an
explicit option instead of an implicit side-effect of 'Solo + never
click Start Mining'. Now the compiled-in default (was Solo).
- main.h: MINE_RELAY = 0, renumbered other modes (nothing compares
nMineMode against raw integers elsewhere, verified).
- main.cpp: default nMineMode = MINE_RELAY; BitcoinMiner() early-returns
for Relay, mirroring the existing Participant-mode guard.
- gui.cpp: added Relay radio button, status label, and telemetry-strip
text. Start/Stop Mining button is hidden for Relay (meaningless -- it
never mines by definition); OK forces fGenerateBitcoins off if you
switch into Relay while previously mining.
* Announce pool changes immediately instead of waiting up to 60s
ThreadBtfPoolAnnouncer re-read strPoolName/dPoolFeePercent/etc live, but
only once per iteration of its 60s sleep loop, so a pool name/fee change
in Options could take up to a minute to reach other nodes.
- nostr.h/.cpp: add gAnnounceNow flag; the announcer's sleep loop now
wakes early and publishes immediately when it's set, then clears it.
- gui.cpp: Options OK handler sets gAnnounceNow when operator pool
settings actually changed (name/dashboard/fee/mode), so a saved
change is announced right away instead of on the next tick.
* Give each pool miner a distinct extranonce2 so jobs no longer overlap
mining.notify previously broadcast one identical 80-byte header (baked
from a single server-side extraNonce) to every connected miner, so any
two miners on the same job searched the exact same nNonce space instead
of disjoint ranges.
Each Miner connection is now assigned a unique extranonce2 on connect.
BuildMinerBlock() takes the shared job template and appends that miner's
extranonce2 to the coinbase scriptSig, recomputing the merkle root, so
every miner gets its own header variant of the same job. mining.submit
validates and, on a full block, assembles the block using that same
miner-specific variant (via m->extranonce2), not the shared template.
No client-side protocol change needed: main.cpp's participant miner
already just takes whatever header bytes mining.notify hands it and
submits (jobId, nonce) back, so it works unmodified against per-miner
headers.
Still simplified vs standard Stratum (no coinb1/coinb2/merkle-branch
wire split, no mining.extranonce.subscribe reply payload) since this
protocol was already a custom simplification pre-existing this fix.
Syntax-checked with g++ -fsyntax-only (full link needs secp256k1/
RandomX/GLFW not present in this sandbox).
* Fix debug.log never being written on the real Windows build
printf-to-debug.log routing was gated on:
#if defined(_WINDOWS) || !defined(_WIN32)
_WINDOWS is only ever defined by the legacy, unused MSVC makefile.vc.
The actual Windows build (makefile.mingw) never defines it, and _WIN32
IS defined there (mingw builtin), so on real Windows this condition was
always false || false = false. printf() fell through to plain libc
printf (stdout only), so debug.log was never created, and output was
only visible if the process happened to be run attached to a console.
OutputDebugStringF() was already platform-safe internally (always
writes debug.log; only echoes to console when not on Windows), so the
outer condition was pure dead weight. Made the routing unconditional.
* Reduce base UI font size one more step (16px -> 14px)
* Remove Start/Stop Mining button; mining state follows selected mode
The button let a user configure a pool then click a separate toggle,
creating states where the button's label/action didn't match what the
selected mode actually needed. OK now starts/stops the miner thread
itself based on nMineMode: Relay clears fGenerateBitcoins, the other
three modes set it and spawn ThreadBitcoinMiner if it isn't already
running (guarded by vfThreadRunning[3]).
* Fix participant miner stuck waiting for notify after buffered multi-line recv
Root cause of the operator/participant pairing successfully but no work
ever flowing: PoolParticipantMiner()'s receive loop only pulled one line
out of the socket per select() wakeup. The server sends the authorize
reply, mining.set_difficulty, and mining.notify back-to-back on the same
connection, and these often land in a single TCP segment — one recv()
inside StratumRecvLine() buffers all three lines into 'buf', but only the
first was extracted and processed. The remaining lines (frequently
mining.notify itself) sat in 'buf' indefinitely, because select() only
reports readability of the OS socket, not whether our own buffer still
holds unprocessed complete lines — and the server had nothing further to
send once the initial burst was over, so select() never fired again.
Fix: drain any complete line already sitting in 'buf' first; only fall
back to select()+recv() when 'buf' has no complete line left.
* Fix mining.submit rejecting every share due to wrong param-count check
Server required params.size() >= 4 for mining.submit, but the client
only ever sends 3: [username, jobId, nonceHex] (indices 0-2, matching
what the handler actually reads: p[1]=jobId, p[2]=nonceHex). Every
submission was bounced with 'bad params' before its nonce was ever
checked against the job, producing an endless share-sent/share-rejected
loop with no other visible cause. Likely a leftover from the standard
5-field Stratum mining.submit shape, which this simplified 3-field
protocol never matched. Threshold corrected to size() >= 3.
* Fix mining.submit rejecting legitimate shares that weren't also winning blocks
Pool share difficulty is intentionally ~256x easier than full network
difficulty (MakeShareTarget() shifts the block target left 8 bits), so
miners are expected to submit many shares per actual block found. But
the handler replied to the miner based on ProcessBlock()/CheckBlock()
success — validation against the much harder network target — rather
than on whether the share met pool difficulty. Every legitimate share
that wasn't also a winning block (the vast majority, by design) failed
CheckBlock()'s nBits check and got reported to the miner as rejected.
Now: reply(true) as soon as a submission clears pool-share difficulty.
Only if it ALSO clears full network difficulty (job.target, not
job.shareTarget) does it get submitted as a block — with no second
reply sent, since the share was already acknowledged.
* Fix dead-peer dial priority: freshness sort was undone by full shuffle
ConnectDiscoveredBtfPeers sorted candidates newest-first, then immediately
shuffled the whole list, making the freshness sort a no-op — every pass was
fully random. Meanwhile g_btfPeerFails was tracked but never used to
prioritize, so a peer that had failed 20 times in a row got equal footing
with an untried or previously-successful peer; the only effect was backoff,
capped at 15 minutes, so dead descriptors cycled back into the dial pool
constantly.
- Track successful connections (g_btfPeerEverConnected) and use it, plus
fail history, to order candidates in tiers: known-good, then untried,
then known-bad (worst offenders last). Freshness order is preserved
within each tier instead of being discarded.
- Raise the backoff cap for chronic failures (6+ in a row) from 15 minutes
to 6 hours, so descriptors that are clearly dead stop consuming dial
budget every pass while still getting retried eventually.
* Batch-resolve .btf descriptors to stop hammering public relays during dial passes
Root cause of 'stuck at 1 peer' despite good peer discovery: each parallel
dial thread in ConnectDiscoveredBtfPeers called ConnectNodeBtf, which itself
walked all configured relays (relay.damus.io, nos.lol, relay.nostr.band,
relay.snort.social) to resolve that one peer's descriptor. With up to
BTF_DIALS_PER_PASS (12) threads dialing at once, a single pass could fire up
to 12 * nNostrRelays near-simultaneous fresh connections at the same handful
of public relays -- easily enough to trip rate limits or get handshakes
refused (exactly what the logs showed: 'handshake refused by relay.damus.io',
repeated connect failures to relay.nostr.band / relay.snort.social). Peers
that were genuinely reachable looked dead simply because their descriptor
couldn't be fetched under that load, and then got penalized as known-bad by
the dial-priority tiering from the previous fix.
- Add BtfResolveMany: resolves every still-unresolved candidate's descriptor
in a single Nostr REQ per relay (multiple authors in one filter), instead
of one relay connection per candidate. A 12-candidate pass now costs at
most a few relay round-trips total instead of dozens.
- Add ConnectNodeBtfResolved / ConnectNodeBtfTail (net.cpp): given an
already-resolved descriptor, dial straight to the peer's rendezvous node
with zero further relay contact. ConnectDiscoveredBtfPeers now batch-
resolves all candidates up front, then fans out tunnel-only connect
threads in parallel -- no thundering herd against the relays.
- Candidates that fail to resolve are recorded as a failure immediately
(same backoff/fail-count bookkeeping as before) instead of spawning a
thread with nothing to dial.
* Stop reconnecting to relays constantly: pool one persistent connection per relay
Real root cause of the ongoing 'handshake refused' / 'connect failed' spam
and peer count stuck at 0-1: every relay-touching operation (startup self-
test, per-pass seeding, batch descriptor resolve, pool announce, pool query)
opened its own brand-new CWebSocket every single time it ran. Two independent
threads (ThreadNostrSeed and ThreadBtfPoolAnnouncer) each reconnect from
scratch on their own ~60s cycle, so a node could fire well over a dozen
fresh TCP+TLS+WS handshakes at the same 4 public relays inside any given
minute. Public relays -- relay.damus.io especially -- rate-limit new
connections per source IP fairly aggressively, so this node was effectively
DoS-ing itself: peers were genuinely reachable, but their descriptors
couldn't be fetched because the relay had already started refusing this
node's own repeated reconnects.
- Add a small per-relay connection pool (g_relayPool) and an RAII
CRelayLease that reuses a relay's live socket across calls instead of
reconnecting every time, only reconnecting when a socket actually drops
or was never established.
- Route every relay call site through it: the startup self-test, the
self-test loop, SeedFromRelay, BtfResolve, BtfResolveMany,
BtfPublishPoolAnnouncement, BtfQueryPoolAnnouncement.
- Only log 'connected to <relay>' on an actual fresh (re)connect, not on
every pass that's just reusing an already-live socket, so the log
reflects what's really happening instead of implying constant churn.
This cuts fresh relay connections from several per minute down to
essentially one per relay for the life of the process (until a relay
actually drops the connection), which should make the rate-limit-driven
refusals go away and let descriptor resolution -- and therefore dialing --
actually succeed at the rate the peer list implies it should.
* Fix wallet crash on rejected send; remove legacy IP-based peer discovery
- SendMoney() no longer throws when a committed tx is rejected by
AcceptTransaction() (e.g. raced input already spent). It now unwinds
the wallet state via RollbackTransactionSpent() and returns false,
which the GUI already handles as 'Transaction failed.'
- Removed the dead IP-based peer discovery/connect path now that
discovery is entirely Nostr/.btf: CAddrDB/addr.dat, mapAddresses,
AddAddress, ConnectNode(CAddress), FindNode(CAddress), ConnectSocket
(SOCKS4 proxy helper), addrProxy, ThreadOpenConnections/2 class-C
dialer and its thread spawn, the addr/getaddr P2P handlers, and the
dead vAddrToSend/setAddrKnown fields on CNode.
- Deleted irc.cpp/irc.h (already-disabled legacy seed code) and
scrubbed references from headers_core.h and all four makefiles.
* Raise peer connection target and add dial diversity; fix IPv4-only relay connect
- BTF_TARGET_CONN: 8 -> 24. With ~100 known .btf peers, average degree
needs only to exceed ln(N)~=4.6 for the network to stay connected
with overwhelming probability (Erdos-Renyi); 24 is a healthy margin.
- ConnectDiscoveredBtfPeers now splits each pass's dial budget ~70/30
between the existing reliability-tiered order and a random sample
from the full fresh peer pool. Pure reliability bias means every
node converges on the same 'known good' hub set, which correlates
peer sets across the network -- a relay outage then drops the same
edges everywhere at once instead of independent ones. The random
slice keeps a floor of uncorrelated edges.
- CWebSocket::Connect (relay websocket) now resolves with AF_UNSPEC
and tries every returned address (IPv6 or IPv4) in turn instead of
hard-failing on AF_INET-only resolution, which was one plausible
cause of the relay.nostr.band:443 connect failures (CDN-fronted
relays increasingly rate-limit/filter the v4 path).
* Remove accidentally committed build binary; ignore src/bitflash
* Fix pool participants getting stuck after the first job
JobWatcherFn only rebuilt/broadcast a new Stratum job when a new block
arrived on this node or no job existed yet. Once a job was built after
startup, gHaveJob stayed true forever unless *this* node found the
block, so with no new block (slow interval, or this node just not
seeing one) every connected miner sat hashing the exact same job --
stale timestamp, stale mempool snapshot -- indefinitely. From the
miner's side that's indistinguishable from being stuck: it worked at
connect (gets the one-time job sent on authorize) and then nothing
ever arrives again.
Added a 60s periodic refresh so the job (and therefore mining.notify)
gets rebroadcast on a timer too, same as a normal stratum pool, not
only on new-block/no-job events.
* Diversify Nostr discovery relay list
Went from 4 relays to 7, and reduced Cloudflare concentration: previously
2 of 4 (damus.io, snort.social) sat behind the same CDN, so a Cloudflare-
side issue could take out half the list even though they're nominally
independent relays. Kept damus.io (most established) as the one CF-fronted
entry and filled the rest with different hosts (nos.lol, nostr.band on
Hetzner, nostr21.com, offchain.pub, nostr.mom, primal.net) so peer
discovery doesn't have a single shared upstream as a point of failure.
7 relays is within the commonly recommended 5-10 range for redundancy.
* Fix data race in RebuildJob: chain-state reads weren't holding cs_main
pindexBest, nBestHeight, GetNextWorkRequired() and GetMedianTimePast()
were all read without cs_main. A block being accepted concurrently by
the P2P thread could interleave with this: pindexPrev captured from the
old best block, but nBestHeight already bumped to the new one by the
time job.height is computed, or pindexBest reassigned mid-read. That
mismatch would make QueuePayouts() schedule a payout for the wrong
maturity height for whatever block gets found against that job.
Wrapped the whole chain-state snapshot in one CRITICAL_BLOCK(cs_main),
consistent with how the rest of the codebase touches this state.
* add operator fee
* Add categorized, burst-collapsing logging for pool/worker/payout flow
debug.log was growing unboundedly because every printf() call wrote
unconditionally, so loops that log once per item (discovered peers,
connect attempts) produced a near-identical line per address with no
cap. Add LogPrint(category, ...): a drop-in printf replacement that
tags each call with a subsystem (pool/worker/payout/net/nostr) and
collapses repeated calls from the same call site into one line per
3s window plus a '(xN similar in 3s)' summary, so log growth is
bounded by elapsed time instead of event count.
Wire it through the whole pool -> work -> payout pipeline (rpc.cpp
operator side, main.cpp participant/worker side, net.cpp/nostr.cpp
peer & relay discovery), and along the way fix several previously
*silent* failure points that produced exactly the reported symptom
(worker stuck asking for work, nothing logged):
- Relay listener registration failing: no log at all, so a pool with
every relay down looked identical to a healthy idle pool.
- No relays configured: silent infinite 5s retry loop.
- Initial job seed failing at pool startup: silent.
- JobWatcher: added a stuck-job watchdog that, after 15s with no
job available, logs a specific diagnosis (no chain tip yet vs.
RebuildJob() failing) instead of retrying forever in silence.
- QueuePayouts(): a block found with zero recorded shares queued no
payout and logged nothing.
- FlushMaturePayouts(): an unparseable payout address was skipped
with no log.
- Participant miner: the 'waiting for pool notify' stall was only
ever shown as a transient GUI status string, never written to
debug.log. Now logs on a 15s cadence while stalled, and after 120s
proactively drops the tunnel so the existing reconnect-in-10s loop
gets a fresh attempt instead of hanging indefinitely.
- Participant miner: share rejections were only a transient GUI
status string; now logged with the pool's rejection reason.
All edited files verified with g++ -fsyntax-only (gnu++14).
* Fix two bugs causing worker stuck + log bloat
1. Worker stuck asking for work (main.cpp):
The participant miner checked msg["result"].is_boolean() to detect
the mining.subscribe acknowledgement (id==1), but the pool sends
an array ([[["mining.notify",sid],sid,4]]) as per Stratum spec,
not a boolean. is_boolean() always returned false, so gotSubscribeAck
was never set true. This didn't directly block authorize (id==2 path
is independent), but it did mean the status never advanced through
"subscribed", leaving the progress logging misleading. More
importantly, the same wrong assumption meant any pool that also
gated job dispatch on a prior subscribe confirmation would leave the
worker stuck forever with no diagnosis.
Fix: accept any non-null result for id==1 (the array is the
session/extranonce info; its contents don't matter for our use case).
2. Log bloat from ProcessMessages (main.cpp):
ProcessMessages() used a bare printf() which fired unconditionally
for every P2P message received -- the bulk of debug.log was this one
line repeating thousands of times. Convert to LogPrint("net", ...)
so it is gated behind fDebug (off by default) and burst-collapsed
by the dedup introduced in the previous commit.
* Fix log bloat, em-dashes, dead code, status bar, Connected/Detected peers
Log bloat:
- Gate all per-message/per-block/per-loop printf in main.cpp, net.h,
net.cpp behind LogAcceptsCategory("net") -- only visible with -debug.
This includes: received:/sending: hex dumps, got inventory, askfor,
getblocks, getdata, received block, AddToWallet, RelayWalletTransactions,
ProcessMessage FAILED, mining loop N-transactions line, retarget block,
socket recv/send errors. AddToBlockIndex new best and ProcessBlock
ACCEPTED intentionally left always-on (one line per block).
- PoolParticipantMiner: status -> now LogPrint(worker) not printf.
Em-dashes:
- Replace all UTF-8 em-dashes (0xE2 0x80 0x94) with ASCII '--' in
every source file (rpc.cpp, gui.cpp, main.cpp, main_gui.cpp, net.cpp,
nostr.cpp, util.cpp, btfrv.cpp, db.cpp, db.h, main.h, headers.h,
headers_core.h, util.h). 40 occurrences across 14 files.
Dead code:
- Remove unused gJobSeq atomic from rpc.cpp (written, never read).
- Fix minerReward: was computed but payout loop used blockReward directly
(operator fee was advertised but never deducted). Now payout correctly
uses minerReward = blockReward * (1 - feeFrac).
Status bar / peers:
- Add GetDiscoveredPeerCount() to nostr.cpp/nostr.h (reads g_btfPeers
size under cs_btfPeers).
- Replace scrollable inline status text with DrawStatusBar(): a separate
ImGui overlay window pinned to bottom of screen (NoScrollbar,
NoBringToDisplayFront). Labels changed from 'Peers N' to
'Connected peers: N Detected peers: N'.
* Rewrite gui.cpp: proper fixed status bar, scrollable content child
Layout architecture:
- DrawMainWindow() covers the full display width, height minus STATUS_BAR_H
(22px). NoScrollbar + NoScrollWithMouse on the outer window so the
chrome (menu, address/balance strip, telemetry strip, separators) never
scrolls.
- A BeginChild("##scroll") fills the remaining height after the fixed
chrome, sized to GetContentRegionAvail().y -- which is already the space
between the cursor and the bottom of the outer window. All mode-specific
content (transaction table, participant pool list, operator workers/payouts)
lives inside this child. Content that overflows gets a scrollbar; nothing
bleeds past the outer window edge.
- DrawStatusBar() is a separate overlay window pinned to the bottom 22px,
drawn last so it is always on top. NoBringToDisplayFront is NOT used here
-- drawing last is sufficient and avoids interaction issues with dialogs.
- Status bar background is fully opaque (not alpha-blended) so it never
shows content behind it.
Labels and content:
- 'Peers N' replaced with 'Connected peers: N Detected peers: N'
using GetDiscoveredPeerCount().
- Mining indicator: '* Mode' instead of the 'filled circle' Unicode glyph
that renders as boxes on some Linux font configs.
- FmtAge used consistently; 'blocks deep' shortened to 'N deep' in tx list.
- Options dialog: em-dashes removed from RadioButton labels (ASCII '--').
- Removed usedY dead variable (GetCursorPosY() result was unused).
* Fix blocking bugs, dead code, pool/participant flow correctness
Bugs fixed:
StratumRecvLine blocking (main.cpp):
The participant miner's recv loop called recv() with no timeout after
select() said the socket was readable. If the server sent a partial
line (split across two TCP segments), the second recv() would block
indefinitely waiting for the rest -- the classic 'stuck asking for
work' hang even though the pool was alive and had sent data.
Fix: single non-blocking recv() pass (MSG_DONTWAIT on Linux,
FIONREAD+recv on Windows). If no complete line is in the buffer yet,
return false; the outer select() loop retries when more data arrives.
BroadcastJob holding mutex during send() (rpc.cpp):
BroadcastJob() held gMinersMutex across all SendLine() calls.
send() can block if a slow miner's TCP receive buffer is full.
With the mutex held, MinerThreadFn could not acquire it to remove a
disconnecting miner, causing a deadlock-adjacent stall: broadcast
blocked on slow miner, disconnect blocked on broadcast, new jobs
not delivered. Fix: snapshot {fd, authorised, address, extranonce2}
under the mutex, release it, then send to each fd outside the lock.
Dead code removed (rpc.cpp):
- gRpcUser, gRpcPassword: defined, never read or set by anything.
- dHashesPerSec, nHPSTimerStart: leftover Bitcoin 0.1 stubs, unused.
- IsInitialBlockDownload(): stub that returned pindexBest==NULL,
never called anywhere in this codebase.
- struct Share: declared with three fields, never instantiated.
- Duplicate comment block before payout section.
Other cleanup (main.cpp):
- STUCK_NO_JOB_TIMEOUT_SECS moved from inside the loop body to file
scope (was 'static const' inside a loop -- correct but confusing).
- pblock->print() in solo miner gated behind LogAcceptsCategory("net")
-- was unconditionally dumping a full block to stdout on every solve.
- ERROR in BitcoinMiner printf converted to LogPrint("net").
* Pool/participant: fix recv blocking, BroadcastJob mutex, listener spawn, escaped em-dash
main.cpp -- StratumRecvLine rewrite:
The previous version called recv() in a while loop -- if select() said
the socket was readable but only a partial line had arrived, the second
recv() call would block indefinitely waiting for the rest of the line.
This was the root cause of the recurring stuck-worker bug.
Rewrite: single non-blocking recv (MSG_DONTWAIT on Linux, FIONREAD+recv
on Windows). If no complete newline is in the buffer yet, return false
immediately; the outer 50ms select() loop retries when more data arrives.
This means the hash loop always stays responsive regardless of network
fragmentation.
rpc.cpp -- BroadcastJob mutex held across send():
BroadcastJob held gMinersMutex for the entire duration of sending jobs
to all connected miners. send() can block if a slow miner's TCP buffer
is full. With the mutex held, MinerThreadFn could not acquire it to
clean up a disconnecting miner, stalling the whole broadcast.
Fix: snapshot {fd, authorised, address, extranonce2} under the mutex,
release it, then send to each fd without holding any lock.
rpc.cpp -- LaunchThread failure not handled in BtfStratumAcceptOneFn:
The replacement listener thread was launched via LaunchThread() which
wraps _beginthread() but discarded the return value. If _beginthread
fails (thread limit, OOM), the listener count stayed at 1 with no thread
behind it -- that relay would get no new listener until the 30s outer
loop in BtfStratumAcceptFn fired. Fix: call _beginthread() directly,
check the return value, decrement and log on failure.
rpc.cpp -- escaped em-dash in log string:
BtfStratumAcceptFn had a literal \xe2\x80\x94 in a LogPrint format
string that survived the em-dash sweep (it was source-encoded, not a
UTF-8 byte in the file). Replaced with '--'.
* Rewrite pool server: single event loop, no per-miner threads
Replace the old architecture (one thread per connected miner + separate
JobWatcher thread + BtfStratumAcceptFn thread with listener count tracking)
with a clean two-layer design:
Accept layer (one thread per relay, AcceptOneFn):
Each relay gets exactly one persistent thread. It loops: calls blocking
RvServiceRegister (waits for a miner to knock), then BtfServiceWrap
(echan handshake), then pushes the finished plain socket to a small
lock-protected queue, then loops immediately to accept the next miner.
No listener count tracking. No replacement thread spawning. No races
around spawn failure. The relay always has exactly one pending accept.
Event loop (PoolEventLoop, runs on the ThreadRPCServer thread):
Single thread owns all connected miner sockets. Each tick:
1. Drain the accept queue -- pick up any newly-connected miners.
2. Check for a new block -- rebuild job and broadcast if so.
3. No-job watchdog -- log and retry if job is missing too long.
4. Periodic job refresh -- restamp nTime every 60s.
5. select() over all miner fds with 50ms timeout.
6. For each readable fd: non-blocking RecvLine, drain all complete
lines, dispatch each to HandleLine, collect dead fds.
7. Refresh GUI stats snapshot every 2s.
Because the event loop is the only writer to gMiners, no mutex is needed
on the miner list. The only mutexes remaining are:
- gStatsMutex: guards the GUI-visible snapshot (StatsSnapshot,
gWorkerStats, gPayoutViews) written by the event loop and read by
GUI threads via GetPoolOperatorStats/GetPoolWorkerStats/GetPendingPayouts.
- gReadyMutex: guards the accept queue between AcceptOneFn threads
and the event loop.
Other improvements in this rewrite:
- gPendingPayouts is event-loop-only (no mutex needed).
- Round share tracking lives in the event loop (roundShareCount map +
roundShareTotal counter) -- zeroed on block found, no per-miner stat
mutex needed mid-round.
- QueuePayouts takes the share snapshot as a parameter instead of
reaching into gMinerStats under a separate mutex.
- BroadcastJob no longer snapshots miners to avoid a mutex -- it runs
directly in the event loop with exclusive access to gMiners.
- AcceptOneFn backs off 30s on relay registration failure instead of
returning -- one relay going down doesn't kill the accept thread.
- No goto. No per-thread dynamic allocation for listener contexts on
each accepted connection.
* Thorough logging and correctness fixes across the full pool/participant flow
Every failure point in the operator->miner->payout chain now logs exactly
what broke, with enough context to diagnose without a debugger.
Operator side (rpc.cpp):
RebuildJob: logs 'no chain tip (pindexBest is null)' on failure instead
of silently returning false.
HandleLine:
- JSON parse errors logged with the raw line (first 80 chars)
- subscribe: logs fd and session id
- authorize: logs address, worker, and whether the address is valid
- submit: logs stale-job case with submitted vs current job id;
logs high-hash with actual hash and target values;
logs valid shares with nonce and running session count;
logs BLOCK CANDIDATE separately from BLOCK ACCEPTED/REJECTED so
a ProcessBlock failure is unambiguous
- unknown method logged (reveals miner software quirks)
- reply() logs send failures with method name
QueuePayouts: logs total payout amount, miner count, fee applied, and
how many miners were below dust threshold.
FlushMaturePayouts: logs 'insufficient funds or wallet locked?' on
SendMoney failure instead of just 'FAILED'.
BroadcastJob: logs job id and miner count on every broadcast.
Event loop: logs when each new miner socket enters the loop; logs
disconnect with session and round share counts.
No-job watchdog: RebuildJob retried every 5s (not every 50ms tick),
eliminating cs_main hammering when there is no chain tip.
AcceptLoopFn: re-polls BtfAllRelays every 60s so relays discovered
after startup are picked up; logs each new relay thread spawned.
AcceptOneFn: logs relay name on start/stop; logs BtfServiceWrap
(echan handshake) failure separately from RvServiceRegister failure.
RecvLine: disconnected out-param distinguishes 'socket closed' from
'no complete line yet', preventing incorrect disconnection on partial recv.
Participant side (main.cpp):
StratumRecvLine: same disconnected out-param fix as RecvLine in rpc.cpp.
Previously a false return could mean either 'disconnect' or 'no data yet',
causing spurious reconnects when a partial line arrived.
PoolParticipantMiner rewritten with step-by-step logging:
Step 1 resolve: logs specific failure (no descriptor vs bad format)
Step 2 tunnel: logs relay and failure reason
Step 3 address: warns explicitly if payout address cannot be determined
Step 4 subscribe/authorize: logs each send and each response
Step 5 RandomX: logs VM mode
Step 6 main loop:
- malformed mining.notify (wrong param count or short header/target)
logged with sizes instead of silently ignored
- authorize rejected: logs reason, does not disconnect (some pools
reject bad addresses but still send work)
- share accepted/rejected: logs share id and rejection reason
- unknown server method logged
- pool disconnect logged with handshake state at that moment
(gotSubscribeAck, gotAuthorizeAck, haveJob) so you know exactly
how far the connection got
- nonce space exhausted logged (was silent before)
- on exit: logs total hashes, shares sent, shares accepted
* Fix build error: ImGuiWindowFlags_NoBringToDisplayFront -> NoBringToFrontOnFocus
NoBringToDisplayFront does not exist in this version of ImGui (v1.89.x).
The correct flag is ImGuiWindowFlags_NoBringToFrontOnFocus (bit 13).
Used in two places: ##statusbar and ##main windows.
Also remove dead variable usedY (GetCursorPosY() result assigned but
never read) and replace the confusing 'ImGuiWindowFlags_NoScrollbar * 0'
expression (evaluates to 0 but looks like a mistake) with a plain 0 in
the BeginChild call.
* Remove duplicate status logging from SetParticipantMiningStatus
Every transition in PoolParticipantMiner already has a direct LogPrint
with full context (addresses, job ids, nonces, error reasons). The
LogPrint inside SetParticipantMiningStatus was firing on top of those,
producing redundant 'PoolParticipantMiner: status -> ...' lines after
every meaningful log entry. SetParticipantMiningStatus now just updates
the GUI string silently.
* Implement vardiff: stable share rate instead of fixed difficulty
Previously the pool set shareTarget = blockTarget >> 8 for every miner
forever. This meant at low network difficulty a fast miner found shares
every few nonces (dozens per second), while at high difficulty a slow
miner might go hours without one -- both are bad for fair payout
accounting and pool stability.
Pool (rpc.cpp):
Per-miner difficulty that adjusts to target one share every 15 seconds.
After every 5 shares, check actual seconds/share vs target. If the
ratio is off by more than 50% (VARDIFF_RETARGET_RATIO), recompute:
new_difficulty = current_difficulty / (actual_secs_per_share / target)
i.e. shares coming too fast -> difficulty goes up; too slow -> down.
Only apply if the change exceeds 10% to avoid jitter.
Difficulty is bounded to [0.001, 1e12].
Each miner gets their own shareTarget derived from their difficulty via
ShareTargetFromDifficulty(), which maps Stratum difficulty to a uint256
target using the Bitcoin difficulty-1 base (0x1d00ffff compact).
New difficulty is sent to the miner via mining.set_difficulty.
Participant (main.cpp):
Apply the received difficulty value from mining.set_difficulty.
Previously the handler was a no-op ('acknowledge only'); now it parses
the difficulty double and logs the change. The share target used for
comparison comes from the pool's mining.notify p[3] field, which the
pool updates after each vardiff adjustment -- this is the standard
approach and matches how cpuminer, xmrig etc. handle it.
With vardiff, share rate is roughly constant regardless of miner speed
or network difficulty. Payouts are proportional to shares submitted,
so each miner's payout accurately reflects their CPU contribution.
* Fix share target mismatch: pool rejected shares it should have accepted
Root cause: the pool put job.shareTarget (from blockTarget<<8, a fixed
per-job value) into mining.notify p[3], but checked m->shareTarget
(from ShareTargetFromDifficulty, the vardiff value) on submit. With
difficulty=1.0, ShareTargetFromDifficulty gives a much HARDER target
than blockTarget<<8, so shares that the participant thought were valid
(passed the easier notify target) were rejected by the pool (failed the
harder difficulty-1 target).
Fix: MakeNotifyParams now takes the per-miner shareTarget as an explicit
parameter. SendJob passes m->shareTarget. Both sides -- the participant
reading p[3] and HandleLine checking m->shareTarget on submit -- now use
exactly the same value. Single source of truth.
Cleanup:
- Remove shareTarget field from StratumJob (was only set, never read
after the MakeNotifyParams call was fixed).
- Remove MakeShareTarget() function (was only used to populate that
now-dead field).
- Participant set_difficulty log: 'initial' vs 'updated' instead of
'unchanged' (first connect sends 1.0 which matches the default 1.0,
so it was misleadingly logged as 'unchanged').
* Fix double broadcast, correct block reward calculation, improve payout log
Double broadcast (event loop vs HandleLine):
When a pool miner finds a block, HandleLine calls RebuildJob() +
BroadcastJob(true) immediately. The event loop then detects
nBestHeight changed (step 2) and was calling RebuildJob() +
BroadcastJob(true) again -- miners received duplicate job broadcasts.
Fix: step 2 now checks gHaveJob before rebuilding. If HandleLine
already built and broadcast a job for this height (gHaveJob=true),
step 2 just logs 'job already broadcast by submit handler' and skips.
If the block came from an external peer (not our miner), gHaveJob is
false and step 2 handles it as before.
Block reward calculation in QueuePayouts:
Was calling CBlock().GetBlockValue(0) on an empty block object.
GetBlockValue uses nBestHeight globally, which by the time QueuePayouts
runs has already been incremented to the height AFTER the found block.
Fix: compute subsidy directly as '50 COIN >> (blockHeight / 210000)'
using the actual found height. At current scale this makes no difference
(same subsidy for thousands of blocks) but is now correct by construction.
Payout log now shows:
- Full block subsidy
- Miner share after fee
- Operator fee amount in BTF (not just percentage)
- Number of recipients, maturity height, dust-filtered count
Example: '[payout] block 2096: subsidy 50.00 BTF, miners get 49.00
(fee 2.00% = 1.00 to operator), 3 recipients, matures height 2196'
* Fix 6 bugs found in full flow re-read
Bug 1 -- Double broadcast (re-applied fix that was lost):
When HandleLine accepted a block it called RebuildJob()+BroadcastJob(true).
The event loop then detected nBestHeight changed and did it again. Miners
received two back-to-back mining.notify clean=true, wasting their work.
Fix: step 2 of event loop checks gHaveJob before rebuilding. If HandleLine
already built a fresh job (gHaveJob=true), step 2 just logs and skips.
Bug 3 -- Disconnect log showed global totals, not session totals:
gParticipantSharesSent/Accepted accumulate since node start, not since the
last connect. Added sessionSharesSent/sessionSharesAccepted local counters
that reset each time PoolParticipantMiner() is called.
Bug 4 -- Dead function ParticipantShareTargetFromDiff (main.cpp):
Defined but never called anywhere. Removed.
Bug 5 -- Invalid-address miner shares silently burned:
If a miner authorized with an invalid address, their share of the block
reward was neither paid out nor logged -- it just vanished. QueuePayouts
now validates addresses up front, logs the forfeited amount explicitly
('X BTF forfeited (bad address)'), and excludes those entries so the
payout log is accurate.
Bug 6 -- SendMoney called from event loop (stalls miner I/O):
FlushMaturePayouts called SendMoney which takes cs_main. If the P2P
thread held cs_main (processing a block), the event loop would stall
for seconds, causing all connected miners to time out waiting for
responses. Fix: FlushMaturePayouts now only moves matured entries to
gPayoutExecQueue (fast, no locks except a brief mutex). A new
PayoutThreadFn thread drains the queue and calls SendMoney
independently, so the event loop is never blocked by wallet I/O.
Bug 7 -- Dead goto + dead HandleLine return-false path:
HandleLine always returns true; the goto next_miner path was never
reached. Removed goto and simplified the select drain loop.
* Fix share-target scale mismatch and dead pool hashrate reporting
- ShareTargetFromDifficulty() based Stratum difficulty 1 on Bitcoin's
SHA256 diff-1 constant (0x1d00ffff, ~2^32 hashes/share) instead of
this chain's actual PoW floor (bnProofOfWorkLimit = ~uint256(0)>>12,
~2^12 hashes/share). That's a ~2^20 (~1,048,576x) mismatch: at the
supposedly-easy difficulty of 1.0, workers were being asked for
shares roughly a million times harder than the chain's own easiest
target. Vardiff never gets a chance to correct this because it only
retargets after real shares come in, and none were coming in. Fixed
by basing the diff-1 reference on bnProofOfWorkLimit instead.
- Pool hashrate was never computed anywhere despite the data (per-miner
difficulty + share timing) being available: ThreadBtfPoolAnnouncer in
nostr.cpp hardcoded ann.hashRate = 0.0, PoolWorkerStatView had no
hashrate field, and the GUI workers table had no column for it.
Added an EWMA hashrate estimate per miner (updated on each accepted
share from expected-hashes-at-difficulty / time-since-last-share),
threaded it through GetPoolOperatorStats/GetPoolWorkerStats, the pool
announcement payload, and the GUI (new Hashrate column + totals in
the telemetry line).
Verified: full clean build via src/Makefile (secp256k1 + RandomX deps
built from source, g++ 13, all four touched files compile and link).
* Remove stale wxWidgets-era build files and orphaned assets
These predate the ImGui/GLFW migration (83af065) and are dead weight:
- src/makefile.linux, build-linux.sh: superseded by src/Makefile +
root Makefile (make linux). The old ones reference obj/uibase.o and
obj/ui.o, which don't exist -- they never worked post-migration.
- src/makefile.vc: MSVC build for the old wx UI (obj\ui.obj,
obj\uibase.obj, obj\irc.obj) -- irc.cpp doesn't even exist anymore,
and nothing invokes this makefile. Windows builds go through
makefile.mingw via the root Makefile's target.
- src/ui.rc, src/uiproject.fbp: wxFormBuilder project/resource files
for the old wx UI. The current Windows resource file is bitflash.rc.
- src/rc/{addressbook,send}*.bmp, check.ico, bitcoin_bc_original.ico:
icons used only by the old wx UI. bitcoin.ico (used by bitflash.rc)
is kept.
Verified nothing includes uibase.h/ui.h/irc.h anywhere, and did a full
clean rebuild afterward (secp256k1 + RandomX from source, src/Makefile)
to confirm removal doesn't break the real build.
* Mine with RandomX fast (2GB dataset) mode instead of light mode forever
RandomXInitDataset() was fully implemented and ready to switch mining
into fast mode, but nothing ever called it -- not in PoolParticipantMiner()
(pool worker), not in the solo BitcoinMiner() loop. RandomXCreateMinerVM()
falls back to light mode whenever the dataset isn't built, so every miner,
participant or solo, has always been hashing in light/cache-only mode.
Light mode exists for cheap single-hash verification (which is why the
pool's own share verification correctly stays on it) -- it recomputes
dataset items on the fly for every hash, which is dramatically slower
than fast mode's direct dataset lookups. Combined with the share-target
scale bug fixed in e87a905, this compounds into exactly the symptom
reported: a participant sitting there hashing for many minutes per share
instead of the vardiff-targeted ~15s, even after the target fix landed.
Fix: build the ~2GB dataset once (multi-threaded, sized to
hardware_concurrency) before mining starts, in both the participant and
solo paths, so RandomXCreateMinerVM() actually gets to use fast mode.
Verified: full clean rebuild via src/Makefile.
* Add vardiff stall watchdog: force difficulty down on zero shares, not just share count
ShareTargetFromDifficulty already fixed the diff-1 scale mismatch (chain
floor vs Bitcoin's SHA256 diff-1), so difficulty 1 correctly means ~4096
expected hashes on this chain, not ~2^32. That part was already correct.
But the normal vardiff retarget in HandleLine only runs after
VARDIFF_SHARES_PER_CHECK (5) shares arrive. A miner that never finds even
one share -- e.g. stuck in RandomX light/cache mode instead of the fast
2GB dataset, or just slower hardware than the target assumes -- never
reaches that check, so it can sit at its initial/current difficulty
indefinitely with vardiff having no samples to act on.
Add a time-based fallback in PoolEventLoop: if a miner's vardiff window
has been open for VARDIFF_STALL_SECS (90s, 6x the 15s target) with zero
shares, force difficulty down by VARDIFF_STALL_CUT (4x) regardless of
share count, and re-notify via mining.set_difficulty. Once a miner is
already at VARDIFF_MIN, log it plainly as a hashrate/connectivity issue
instead of a difficulty issue, so it's not confused with the same-looking
but different problem this was actually fixed for before.
* Fix PrintException rethrow killing the whole node on any transient exception
The uploaded participant log shows the real bug behind the mining stalls:
the node process itself was dying and restarting from scratch every
minute or two ('UNKNOWN EXCEPTION ... in ThreadMessageHandler()' /
'ThreadSocketHandler()'), wiping the RandomX dataset/cache and losing all
progress toward a share -- not a difficulty problem.
Every background thread (ThreadMessageHandler, ThreadSocketHandler,
ThreadBtfConnect, the Nostr helpers) wraps its real work in a
'try { Foo2() } catch(...) { log, sleep 5s, loop again }' self-healing
retry pattern specifically so one bad exception doesn't take the whole
node down. But PrintException(), called from inside every one of those
catch blocks, ended with 'if (!fShutdown) throw;' -- re-throwing the just-
caught exception during ordinary operation. Nothing above the retry loop
catches it, so it escapes the thread and std::terminate()s the entire
process on the very first transient error (a flaky relay connect, a
malformed message, whatever). The comment's intent (suppress noise while
already shutting down) was inverted from what the surrounding retry loops
actually need.
Removed the rethrow. Threads now log the exception and let their own
retry loop handle it, as designed.
* Push a fresh job immediately after any difficulty change, not just on next broadcast
mining.set_difficulty alone doesn't change what the worker actually hashes
against -- the participant only reads its share target from
mining.notify's params[3] (see main.cpp's mining.notify handler); the
set_difficulty message just updates a locally-logged currentDifficulty
value. So both the normal vardiff retarget (in HandleLine, on 5 shares)
and the new stall watchdog were updating m->shareTarget and telling the
worker about the new difficulty, but the worker kept hashing against its
old target until the next natural job broadcast -- a new block, or the
60s trickle refresh. That could delay any difficulty correction by up to
a minute for no reason.
Call SendJob(m, false) right after each set_difficulty send so the
updated shareTarget reaches the worker in the very next tick instead of
waiting on the next unrelated broadcast.
* Build RandomX dataset before stratum handshake, not after
Worker was sending mining.subscribe/authorize, then blocking for the
duration of the synchronous ~2GB RandomX dataset build, and only then
reading the socket. The pool's replies (subscribe ack, authorize ack,
set_difficulty, first job) sat unread in the OS receive buffer for that
entire window -- nothing was lost, but with the build taking anywhere
from seconds to a couple minutes depending on core count, the worker
looked and logged as permanently stuck on 'waiting for pool response'
when it just wasn't listening yet.
Move the dataset build ahead of the subscribe/authorize sends so the
socket is actively being read the moment the pool replies. Also add
missing RandomXDestroyMinerVM cleanup on the two early-return paths
that now happen after VM creation.
* Reset round shares on externally-found blocks, not just our own
Round shares were only cleared in HandleLine() after our own miner's
block got accepted. When the chain height advanced because someone
else found the block, the main loop rebuilt the job but left
roundShareCount/roundShareTotal/Miner::roundShares untouched, so they
kept accumulating across rounds instead of resetting.
* Show pool hashrate in participant view; show immature coinbase value with maturity countdown
* Persist pending payouts to disk -- survive operator restarts
* Fix log escapes, stall timeout 90->45s, save-before-exec ordering, Immature tx status
* Sort transactions by nTimeReceived not chain median time -- new txs always on top
* Sort txs by chain depth not nTimeReceived -- survives resync, unconfirmed always first
* Fix orphan block false-positive payout; meaningful tx status instead of raw depth
* Show Orphaned status in red for orphaned coinbases; distinguish from genuinely unconfirmed
---------
Co-authored-by: Vic-Nas <nasci.victorio@gmail.com>
Co-authored-by: Bitflash Pool Dev <pool@bitflash>
Co-authored-by: Victorio Nascimento <155357371+Vic-Nas@users.noreply.github.com>
Co-authored-by: Claude <claude@anthropic.com>
|
|
VerifyDescriptor() parses descriptors received from untrusted peers over
Nostr relays. Only json::parse() was guarded; the field extractions
(get<std::string>, get<uint64_t>) ran unguarded, so a descriptor with a
wrong-typed field (e.g. a numeric "pubkey") threw an uncaught
nlohmann::json::type_error -- a remotely triggerable crash vector.
Validate each field's type up front and wrap the whole parse in try/catch
so any malformed descriptor is rejected (return false), never thrown.
|
|
RunGUI() silently returned 1 and the process exited via StopNode() when
glfwInit or glfwCreateWindow failed, which reads like a crash. On machines
without OpenGL 3.3 core (RDP sessions, VMs, old GPUs) the window never
appeared with no explanation. Print an actionable message pointing to
driver update / software OpenGL (Mesa) / running headless with -nogui.
|
|
|
|
* Add Linux GUI installer via Wine
* Fix launcher creation and add BTF_RELAY env var support
* Pool server, Linux GUI, unified binary, README update
* Root Makefile: make linux / make windows, cleaner README
* Remove headless.cpp
* Fix XPM color count mismatch causing toolbar image errors on Linux
* XPM icons: same code on Windows and Linux, no ifdefs around image loading
* Fix GTK icon crash and Linux printf format
* btfrv: 10s socket timeout on relay connects
* Faster peer discovery: more dials per pass, shorter backoff and sleep
* Parallel btf peer connections
* Fix GetMyExternalIP - was disabled, now uses modern IP echo services
* Fix tunnel disconnect on idle and restore external IP detection
* Filter stale Nostr descriptors
* Sort peers by freshness, fresh first
* Pool: add .btf Stratum listener — miners connect via rendezvous, no port forwarding needed
* btf pool: self-replacing listeners, one per relay, no queuing between miners
* Mining modes: solo/operator/participant — pool server on-demand, participant Stratum client
* Status bar: show external IP and .btf address
* README: clean rewrite, concept-first, minimal
* make linux produces AppImage
* make linux produces AppImage
* Pool dashboard: connect instructions, tabs, share bars
* Perf fixes: GetMyExternalIP threaded, btf listener counted
* Perf fixes: GetMyExternalIP threaded, btf listener counted
* Fix pool payouts: defer until coinbase maturity
* Pool: clean mode switching, IP warning
* Pool: clean mode switching
* Fix gPoolRunning: remove static
* AppImage: use real icon from bitcoin.ico
* Fix exit crash; Mining menu
* Fix exit crash; Mining menu
* Fix exit crash; Mining menu
* Fix exit crash; Mining menu
* Fix exit crash; Mining menu
* Windows build: use mingw32-make
* Windows build: simpler make invocation
* Add deps-windows target
* Windows build fixes
* Windows build fixes
* Windows makefile: fix obj dir
* Windows: output to repo root
* Windows: bundle DLLs into zip
* Replace wxWidgets with ImGui+GLFW: same build on Linux and Windows
* Fix %I64d that slipped back through rebase (main.h, net.h)
* MinGW: add _mkdir shim for non-MSVC Windows; fix %I64d
* Fix gPoolRunning extern outside ifndef _WIN32
* Remove -lboost_system: boost is header-only in this codebase
* Status bar: copy buttons for IP and .btf address
* Windows: add app icon via windres, strip wx stuff from rc file
* Clean GUI: single Options menu item, bigger font, better spacing, cleaner options dialog; update README
* GUI: embed Roboto font at 16px for clear readability on all platforms
* Windows: windres depends on obj dir target
* Fix balance hidden off-screen: put on own line below address bar
* Windows: inline mkdir in every rule, remove dir target that confused make
* Windows: move all target to top so it's the default rule
* Fix pool server not starting: always start when operator selected, re-sync dialog state on open
* Write debug.log to data directory (AppData/Roaming/Bitflash on Windows)
* Participant miner: use wallet address as username so payouts go to wallet
* Add .gitattributes to lock LF line endings, prevent CRLF drift
* Refactor pool mining to btf-only transport
* Persist pool settings and startup wiring
* Prune stale peers and expose pool queries
* Fix build regressions and add CLI mode/arg parity
* Fix rpc miner stats declaration order
* Centralize pool runtime extern declarations
* Separate operator/participant dashboards and restore peer stats
* Add live telemetry strip and clearer per-mode runtime metrics
* Reduce mining dashboard clutter and remove manual pool entry
* Count only authorized pool miners
* Seed initial pool job on startup
* Use a real share target for pool work
* Switch pool accounting to round-based shares
* Fix nostr pool announcer stats call sites
* Fix pool stats definition order
* Improve pool worker status display
* Add mutex include for participant status
* Replace ImClamp in dashboard layout
* Clarify participant work status
* Log participant status transitions
* Reduce peer discovery log noise
* Add participant status badge
* Track participant auth acknowledgements
* Log and validate pool job delivery
---------
Co-authored-by: Bitflash Pool Dev <pool@bitflash>
|
|
|
|
|
|
|
|
Relay operators announce their relay with -announcerelay=host:port; every node
discovers announced relays (kind 38502) and adds them to its failover list, so
volunteer relays join with no maintainer edit or approval. Anti-spam cap +
validation; relays are trustless (echan makes a bad relay unable to read/MITM).
README: automatic relay-volunteer guide, 'don't let the network die' section.
|
|
|
|
Seed list of 3 geographically-spread relays (Sao Paulo, New Jersey, Almaty);
nodes register at the first reachable one and fail over if it is attacked or
goes down, so no single relay IP is a point of failure. Relay installer now
applies iptables connection rate-limits to soak up single-source floods.
|
|
Satoshi's bitcoin-0.1.0 reborn with RandomX CPU proof of work, anonymous .btf
addressing over Nostr with CGNAT rendezvous, automatic peer discovery, a
headless Linux node, and Windows GUI wallet. Fair launch, no premine, 21M cap.
|