validation: bound snapshot cache growth by bytes, not coin count #36633

pull fametrano wants to merge 1 commits into bitcoin:master from fametrano:snapshot-cache-bytes changing 2 files +50 −5

fametrano commented at 10:05 PM on October 23, 2026: none

Loading a snapshot checks the coins cache against -dbcache only every 120000 coins. A coin can carry a script of up to 10000 bytes. A snapshot file made of such coins can push the cache about 1.2 GB past -dbcache between two checks.

I added a check once the cache has grown by 4 MiB since the last one, and kept the 120000-coin check. Typical coins reach the 4 MiB bound about every 30000 coins. The added cost is negligible. Between checks the cache can still exceed -dbcache by about 4 MiB. I added a case to feature_assumeutxo.py that loads 2000 coins with 10000-byte scripts under -dbcache=4. It fails without the change and passes with it. The coins and validation unit tests pass.

This is one of several PRs from a large audit of Bitcoin Core that I did with the help of LLM tools. The audit produced its evidence all at once, which is why the PRs arrive together. I understand each change fully and will answer review questions myself.

validation: bound snapshot cache growth by bytes, not coin count

PopulateAndValidateSnapshot checks the coins cache against -dbcache
only every 120000 coins. That interval assumes small coins. A coin can
carry a script of up to 10000 bytes (MAX_SCRIPT_SIZE), so a snapshot
file made of such coins lets the cache grow by about 1.2 GB between two
checks, whatever -dbcache is. The file is only rejected at the end,
when the UTXO set hash does not match.

Also check the cache once its memory usage has grown by 4 MiB since the
last check. Typical coins reach this bound about every 30000 coins, so
the check runs more often for them too. Reading the usage is a few
additions, so the cost is negligible.

Add a functional test that loads 2000 coins with 10000-byte scripts
under -dbcache=4. Without the change the cache is never checked and the
test fails. With it the cache is flushed within 5 MiB of its limit.

9bfcb7c15d

DrahtBot added the label Validation on Oct 23, 2026
DrahtBot commented at 10:05 PM on October 23, 2026: contributor


The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.



External sites
- Code coverage & benchmarks: https://corecheck.dev/bitcoin/bitcoin/pulls/36633
- Ralph review <img src=https://review.fish.foo/assets/bitcoin/bitcoin/36633.png alt="Ralph review status"> https://git.fish.foo/bitcoin/bitcoin/pulls/36633#author-ralph


Reviews

See the guideline and AI policy for information on the review process. A summary of reviews will appear here.



Conflicts

Reviewers, this pull request conflicts with the following ones:
- #36603 <img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/36603.svg"> (Improve loadtxoutset performance by ajtowns)
- #36598 <img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/36598.svg"> ([Demo] validation: remove AssumeUTXO by l0rinc)
- #36500 <img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/36500.svg"> (AssumeUTXO: reject duplicate coins and empty snapshot groups by l0rinc)
- #36346 <img src="https://drahtbot.space/ack_count/bitcoin/bitcoin/36346.svg"> (validation: don't accept txs to the mempool while loading a snapshot by 0xShadowX)
If you consider this pull request important, please also help to review the conflicting pull requests. Ideally, start with the one that should be merged first.
sedited commented at 10:45 AM on October 26, 2026: contributor

Since this is for loading snapshots that we produce ourselves, I think we can tweak any memory-miscalculation once we run into a case where it becomes relevant.
sedited closed this on Oct 26, 2026

Contributors

Labels

validation: bound snapshot cache growth by bytes, not coin count #36633

External sites

Reviews

Conflicts