From 3bbfb50ef85feeddad936eb1fe8cce232410b8a6 Mon Sep 17 00:00:00 2001 From: Bitflash Date: Fri, 31 Jul 2026 08:53:27 -0300 Subject: db: verify the tail of the chain on startup and back out of a bad tip (#61) A node that accepted blocks its current rules would reject -- because it was running an older build, or because the tip it landed on was never valid -- had no way to notice. It kept the branch, kept building on it, and kept mining coins the rest of the network throws away. The only cure was deleting blk*.dat by hand, which requires knowing something is wrong. A node here once mined a 323-block fork for five days that way. On load, walk back from the tip running CheckBlock on each block. If one fails, move the best chain back to its parent, disconnect what came after, and let the node re-download from peers. Satoshi added this after the block 74638 incident for the same reason: so it would not have needed anyone to delete files. Only the last 288 blocks are checked by default -- about ten hours at a two-minute target -- because every check costs a RandomX hash. /checkblocks=N changes it, 0 does the whole chain. The repair deliberately runs in LoadBlockIndex() in main.cpp rather than in CTxDB::LoadBlockIndex where the detection happens. CTxDB::LoadBlockIndex walks the index with a cursor it never closes, so it still holds read locks when it returns, and a write transaction opened alongside it waits on them forever. That is measured, not guessed: the first version came up, printed the diagnosis, and hung with nothing in any log. Closing that cursor is a separate fix worth making on its own. A failed rollback reports and starts anyway. Refusing to start would leave the operator with no node to read the message from. What this catches is what CheckBlock catches: proof of work, merkle root, duplicate transactions, sigops, timestamps. It does not re-verify signatures or spends, which would mean rebuilding the transaction index. Verified by forcing a block at tip-5 to fail: the node reported the bad block, moved back six, stayed up, and re-synced past its old tip. Without the forced failure it verifies 288 and says so. --- src/main_gui.cpp | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'src/main_gui.cpp') diff --git a/src/main_gui.cpp b/src/main_gui.cpp index 852ad4d..99bcb6f 100644 --- a/src/main_gui.cpp +++ b/src/main_gui.cpp @@ -54,6 +54,7 @@ static void PrintUsage() printf(" /participant=POOL_BTF_ADDRESS\n"); printf(" /solomine\n"); printf(" /genproclimit=N (mining threads; 0 or absent = every core but one)\n"); + printf(" /checkblocks=N (blocks re-verified at startup, default 288, 0 = all)\n"); printf("\n"); printf("Pool operator announcement:\n"); printf(" /poolname=NAME\n"); @@ -101,6 +102,10 @@ static void ParseStartupArguments(int argc, char* argv[]) if (arg(argc,argv,"/solomine") || arg(argc,argv,"-solomine")) fSoloMineTest = true; + string strCheckBlocks = argval2(argc, argv, "/checkblocks", "-checkblocks"); + if (!strCheckBlocks.empty()) + nCheckBlocksOnLoad = atoi(strCheckBlocks.c_str()); + // /genproclimit=N -- threads to hash with. 0 or absent means automatic, // which is every core but one. Named after Bitcoin's own option so it reads // familiarly to anyone who has run one of these before. -- cgit v1.2.3