txdb: reject undecodable first coin cursor key #35654

pull l0rinc wants to merge 1 commits into bitcoin:master from l0rinc:l0rinc/txdb-malformed-first-coin-cursor-key changing 2 files +22 −6

l0rinc commented at 1:36 AM on July 4, 2026: contributor

Problem: CCoinsViewDB::Cursor() already handles the case where Seek(DB_COIN) finds no coin record, but could still accept an undecodable first coin key as a valid cursor position. CCoinsViewDBCursor::Next() already invalidates the cursor for the same decode failure later in iteration, so initial cursor setup has a small correctness mismatch.

Fix: Make initial cursor setup match Next(): keep the cached key invalid unless the first key decodes successfully.

Fixes #35172, with credit to the issue author and previous attempts #35191 and #35248.
DrahtBot added the label UTXO Db and Indexes on Jul 4, 2026
DrahtBot commented at 1:36 AM on July 4, 2026: contributor


The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



Code Coverage & Benchmarks

For details see: https://corecheck.dev/bitcoin/bitcoin/pulls/35654.



Reviews

See the guideline for information on the review process. A summary of reviews will appear here.



Conflicts

Reviewers, this pull request conflicts with the following ones:
- #34320 (coins: delegate CCoinsViewDB::HaveCoin to GetCoin by l0rinc)
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.
sedited commented at 3:08 PM on July 4, 2026: contributor

Quoting myself from the issue: If the chainstate is corrupted to the point that the condition described here is reached, I'm not sure if the check introduced here actually improves the situation for the running node. Commit https://github.com/bitcoin/bitcoin/commit/822755a424d0abfa408dc34313f4aca4b816f54f also explicitly works around the "no valid first entry" scenario.

The reasons stated here (crc collisions, and fork tools) also don't seem very compelling to me. If this is really something worthwhile, maybe just frame it as a correctness improvement and getting rid of a weird albeit harmless edge case?

txdb: reject malformed first coin cursor key

`CCoinsViewDB::Cursor()` already handles an empty coin keyspace after `Seek(DB_COIN)`, but could still accept an undecodable first coin key as a valid cursor position.
`CCoinsViewDBCursor::Next()` invalidates the cursor for the same decode failure later in iteration, so the warmup path had a small malformed-chainstate consistency gap.

Make initial cursor setup match `Next()`: keep the cached key invalid unless the first key decodes successfully.
Add a unit test that writes a valid `Coin` under a malformed `DB_COIN` key and checks the cursor is invalid.

Co-authored-by: Shuvam Pandey <i@shuvamp.com.np>
Co-authored-by: Arthur Ariel Sabintsev <arthur@sabintsev.com>
Co-authored-by: CruzMolina <7537712+CruzMolina@users.noreply.github.com>

3837d9192a

l0rinc renamed this:
~~txdb: reject malformed first coin cursor key~~
txdb: reject undecodable first coin cursor key
on Jul 6, 2026
l0rinc force-pushed on Jul 6, 2026
l0rinc commented at 4:46 AM on July 6, 2026: contributor

maybe just frame it as a correctness improvement and getting rid of a weird albeit harmless edge case

Adjusted the code comment, commit message, PR description and title - let me know if this is what you meant

Contributors

Labels

Linked (view graph)

#35172 txdb: Cursor warmup accepts malformed first coin key #35191 txdb: handle malformed first coin cursor key #35248 txdb: handle malformed first coin cursor key

txdb: reject undecodable first coin cursor key #35654

Code Coverage & Benchmarks

Reviews

Conflicts