Returning the sats/kvb does not need to round trip through GetFee(1000) since the feerate is already stored as sats/kvb.
Fixes #27913, although this does bring up a larger question of how we should handle such large feerates in fuzzing.
Returning the sats/kvb does not need to round trip through
GetFee(1000) since the feerate is already stored as sats/kvb.
<!--e57a25ab6845829454e8d69fc972939a-->
The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.
<!--021abf342d371248e50ceaed478a90ca-->
See the guideline for information on the review process.
| Type | Reviewers |
|---|---|
| ACK | furszy |
| Concept ACK | dimitaracev, luke-jr |
If your review is incorrectly listed, please react with 👎 to this comment and the bot will ignore it on the next update.
Concept ACK
this does bring up a larger question of how we should handle such large feerates in fuzzing.
I think this particular issue is using the RPC interface, not the fuzzing interface. (Although it was found by fuzzing). Generally, if the RPC (and all other interfaces) had a guard against large values, then the fuzzing interface can also guard the values to the appropriate range. If one interface doesn't have a guard, the fuzzing shouldn't guard either.
utACK
Code ACK 11d65006
although this does bring up a larger question of how we should handle such large feerates in fuzzing.
We use the fee_a × vsize_b > fee_b × vsize_a trick in a bunch of places. On the other hand, fee is calculated from vsize × feerate. So, in fuzzing based on a feerate input, we should limit the feerate to prevent integer overflows with int64_t to max_feerate = int64_t_max / (max_vsize²)?
If we assume that our code does not have to deal with transactions greater than 100_000 vB:
9_223_372_036_854_775_807÷(100_000²) = 922_337_203_685 [ṩ/kvB] ≈ 922_337_203 [ṩ/vB] ≈ 9_223 ₿/kvB
If we assume that our code should be able to handle transactions of up to 1_000_000 vB, we’d restrict ourselves to 1/100 of that, i.e. 9_223_372_036 ṩ/kvB or 9_223_372 ṩ/vB
We use the fee_a × vsize_b > fee_b × vsize_a trick in a bunch of places. On the other hand, fee is calculated from vsize × feerate. So, in fuzzing based on a feerate input, we should limit the feerate to prevent integer overflows with int64_t to max_feerate = int64_t_max / (max_vsize²)?
I'd say no, because the tricks use double, not int64_t, no? Also, this is an rpc interface bug, not a fuzzing bug, see #27914 (comment)
Oh, I meant to reply to the “larger question”. I recently also bumped into an integer overflow when fuzzing coin selection stuff due to feerates being too large, and I figured that the underlying issue was the same.