Nodes syncing from zero would accept blocks normally up to ~6000 then
stall permanently with askfor_queue=0 and no new blocks. Root cause: a
broken feedback loop between the header planner and block downloader.
Blocks consume entries from mapHeaderSync (MAX 15000) while getheaders
refills only 2000 at a time; when the cache drains, hashBestHeaderSync
falls to 0 and every refill site is guarded on it being non-zero, so
the pipeline deadlocks with no recovery path.
Recovery paths added:
- ProcessBlock: when the cache is empty during IBD after accepting a
block, broadcast getheaders to all full-node peers. This restarts
the planner at the exact point it dies.
- Stall detection: send getheaders alongside the existing getblocks.
getblocks alone cannot refill the header cache.
- SendMessages: belt-and-suspenders, re-request headers every 30s
while hashBestHeaderSync == 0 in IBD, independent of stall state.
Also fix a secondary issue: GetHeaderSyncDownloadPath walks back from
the tip and breaks on the first TTL-evicted entry. The accumulated
partial tail has a parent that is neither in mapBlockIndex nor
mapHeaderSync, so requesting those blocks would produce orphans.
Discard the partial path on a gap; the recovery paths above will
re-request the missing range.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Two fixes for the header cache exhaustion bug:
1. Block-accepted path: when hashBestHeaderSync==0 and we're still
behind peers during IBD, send getheaders to all peers to refill
the header cache. Previously the refill was gated on
hashBestHeaderSync!=0, creating a dead loop once the cache drained.
2. Stall detection: also send getheaders alongside getblocks when
a stall is detected. Previously only getblocks was sent, which
cannot refill mapHeaderSync or restart the header planner.
Root cause: getheaders returns 2000 headers per batch. Blocks are
consumed from the cache faster than headers are fetched. Once
mapHeaderSync empties, hashBestHeaderSync becomes 0, and the
refill path is never taken again.
See BUG_ANALYSIS_IBD_STALL.md for full details.
Follow-up to #5. Addresses three risks with the apply=true path:
- MoneyRange sanity gate: refuse to persist a recalculated supply that is
negative or above MAX_MONEY (2,222,222 TRI). A walk that produces an
out-of-range figure indicates a bug (orphan contamination, missing
prevout), not real chain state. Prevents corrupting nMoneySupply with
junk values.
- Atomic apply: wrap every per-block WriteBlockIndex in a single
TxnBegin/TxnCommit so a mid-walk failure leaves on-disk state
untouched instead of half-rewritten.
- Single chain walk: cache (valueOut - valueIn) per block during the
dry-run pass and reuse the cached deltas during apply. Previous code
walked the full chain twice, roughly doubling apply runtime on a
2.2M-block chain.
Help text now warns that the RPC holds cs_main for the full walk and
blocks new blocks, wallet ops, and other RPC for the duration.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
Rebuild money supply by walking the active chain from genesis and
summing block valueOut - valueIn, instead of relying only on current
UTXO totals. Optionally persist repaired nMoneySupply values across the
active chain with apply=true.
This helps repair corrupted money-supply tracking after chain/index
incidents and exposes both recalculated chain supply and UTXO supply for
comparison.
- Auto-detect and use ccache as compiler launcher when available
- Add ENABLE_UNITY_BUILD option for jumbo builds (batch size 8)
- Precompile heavy STL/Boost/OpenSSL headers for C++ targets
- Exclude hash9 crypto from unity builds (colliding static symbols)
- Fix RAND_screen() compile error on OpenSSL 3.x (removed API)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- BIP 31 ping/pong with 2-min heartbeat, RTT tracking, 3-miss disconnect
- Reduce max outbound from 16 to 8, add -maxoutbound flag
- Emergency reconnection: 15s re-seed when 0 peers, 30s when 1 peer
- Inactivity timeout reduced from 90min to 10min (dead peer detection)
- Header sync TTL extended from 5min to 15min for Tor latency
- Reserve 2 inbound slots for known seed nodes at capacity
- Enhanced address gossip: hourly rebroadcast, getaddr from all peers
- New getnetworkstability RPC with isolation risk assessment
- getpeerinfo now includes pingtime, blocksdelivered, avglatency
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The extern declaration for the global leveldb::DB *txdb was inside
namespace UtxoSnapshot{}, causing the linker to look for
UtxoSnapshot::txdb instead of the global ::txdb defined in
txdb-leveldb.cpp.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
7 sync/relay optimizations for faster block propagation on Tor-only network:
1. Improved unsolicited block push: track nBestKnownHeight from inv/block
messages instead of static nStartingHeight, so peers that sync up
receive direct block pushes
2. Reduced redundant-request timeout from 20s to 5s for faster failover
3. Pipeline improvement: continuous download window refill after every
accepted block + refill interval reduced from 5000 to 500 blocks
4. Sendheaders (BIP 130-style): negotiate header-based block announcements
to save one round-trip vs inv->getdata->block
5. Compact block relay: send header + prefilled coinbase/coinstake + short
tx IDs. For typical PoS blocks (0-2 txs) this is the complete block
with no follow-up needed. Includes getblocktxn/blocktxn for missing txs
6. Adaptive peer timeouts: use rolling average latency (EMA 7/8) to set
per-peer request and stall timeouts instead of fixed constants
7. Dual-peer requesting during IBD: request each block from two peers
simultaneously, use whichever arrives first
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add UTXO snapshot dump/load system (utxosnapshot.cpp/h) for fast initial sync
- Add dumputxoset RPC command to create snapshots from current chain state
- Add script verification cache (sigcache.h) to skip re-verifying scripts
already validated during mempool acceptance
- Bootstrap: try UTXO snapshot first (fast path), fall back to full bootstrap
- Support manual utxo-snapshot.bin loading on startup
- Tune sync parameters for Tor: increase timeouts, reduce buffer sizes
- Header sync cache: TTL-based eviction instead of full cache clear
- Reduce orphan block limits and script check batch size for lower memory usage
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add Windows Job Object (JOB_OBJECT_LIMIT_KILL_ON_JOB_CLOSE) so Tor
child process is automatically killed when the wallet exits for any
reason (crash, Task Manager, clean shutdown)
- Replace port-reuse "assume running" path with active orphan cleanup:
Windows enumerates and kills tor.exe processes, Linux uses PID file
- Move deep-reorg trust-delta check into Reorganize() so short forks
(<=6 blocks) converge freely while long-range attacks are still blocked
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add checkpoints through block 2,209,000 to lock canonical chain
- Ban peers on incompatible forks (no common blocks after 3 getblocks)
- Auto-checkpoint: finalize blocks at MAX_REORG_DEPTH to prevent deep reorgs
- Require 10% trust delta for side-chain reorgs (first-seen advantage)
- Add gencheckpoints RPC command for easy future checkpoint generation
- Add wallet onion address to hardcoded seed list
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Reduce equal-trust reorg cooldown from 10min to 2min for faster convergence
- Tighten future block drift from 3min to 90sec to shrink competing-block window
- Require 2+ peers before staking (was 1) to prevent isolated fork creation
- Push full blocks directly to peers instead of inv-only (saves 1-2s Tor roundtrip)
- Add periodic 45-second chain-tip sync to detect and resolve silent forks
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Bootstrap server is on clearnet, so bypass Tor SOCKS proxy for faster
downloads. Adds redirect following (301/302/307/308) with safety limits.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Version System:
- Unified version display as v5.8.2 (removed trailing .0)
- Single source of truth in clientversion.h
- Fixed version.cpp to use CLIENT_VERSION_* macros
Staking Improvements:
- Enhanced getstakinginfo with detailed diagnostics
- Shows specific reasons when staking is disabled
- Added wallet lock status, mature coins check, peer count
Performance & Sync:
- Added checkpoint at block 2,200,000 (hash: 0a8d0442...)
- 14 total checkpoints for faster sync
- Enhanced recalculatesupply RPC with safety validation
- Prevents changes > 1M TRI, fixes money supply tracking
Anti-Fork Protection:
- Enhanced reorganize logging with fork details
- Shows old/new tips, fork point, disconnect/connect counts
- Works with existing anti-oscillation and chain re-eval fixes
Recovery Tools (Krystie):
- -reindex flag for full block index rebuild
- recalculatesupply RPC to fix money supply from UTXOs
- SumUtxoValues() helper for UTXO set analysis
All changes are non-consensus and wallet-safe.
Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
Co-Authored-By: Krystie <krystie@cryptographic-triangles.org>
- Add AutoBackupWallet() that copies wallet.dat to wallet.dat.auto.bak
before any DB flush or rewrite
- Call AutoBackupWallet() in ThreadFlushWalletDB() before flushing
- Call AutoBackupWallet() in AppInit2() after loading wallet
- Add suspicious-size check in AppInit2() (warns if wallet.dat < 1KB)
- Declare AutoBackupWallet() in db.h
This protects against wallet corruption during crash by maintaining
an auto-backup that is always at least as recent as the last flush.
- Add mainnet+testnet checkpoints at blocks 2190000, 2200000, 2205000
- Bump MAX_ORPHAN_BLOCKS from 750 to 2000 (prevents fork deadlocks)
- Add MODERNIZATION_ROADMAP.md with prioritized improvement plan
These changes prevent the exact fork deadlock that happened during
the Apr 17-19 incident: post-IBD orphan limit of 750 was too low,
causing nodes to deadlock when divergent blocks arrived.
New RPC commands:
- addnode: add/remove/onetry .onion peers at runtime
- disconnectnode: immediately drop a peer connection
- getchaintips: diagnose chain forks and orphan branches
- invalidateblock: rewind chain past a bad block
- reconsiderblock: re-activate a previously invalidated block
Also includes:
- systemd service files for Linux deployment
- Bootstrap/snapshot guide for OpenClaw nodes
- Upgrade notes from 2026-04-14
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Guard pindexBest and pprev dereferences that segfault during IBD
block serving when chain state is incomplete:
- kernel.cpp: CheckStakeKernelHash null pindexBest during PoS validation
- main.cpp: InvalidChainFound null pprev/pindexBest on rejected blocks
- main.cpp: SetBestChain null pprev in trust calculation
- main.cpp: ProcessBlock orphan handler null pindexBest
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The clearnet fallback host was removed from bootstrap.h in the previous
commit but introdialog.cpp still referenced Bootstrap::FALLBACK_HOST.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Fix moneysupply calculation in FastImportBlockFile and ConnectBlock assumevalid path
- Route bootstrap downloads through Tor SOCKS proxy (no more clearnet leaks)
- Remove hardcoded clearnet fallback IP from bootstrap
- Fix snprintf missing argument in walletmodel.cpp narration key (UB/crash)
- Fix potential null deref from db_strerror() in rpcwallet.cpp
- Filter non-.onion addresses from HTTPS seed list parser
- Add periodic re-seeding when node has 0 outbound peers
- Make clientversion.h single source of truth for version display string
- Remove redundant DISPLAY_VERSION macros from version.h
- Update README: max supply 2,222,222, CMake build instructions, Tor-only config
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Replace FutureDrift(GetAdjustedTime()) with GetTime() + 15min in CheckBlock
and header-sync validation. GetAdjustedTime() incorporates peer-reported
time offsets that vary between Tor nodes, causing the same block to be
accepted by some nodes and rejected by others — the primary cause of
persistent chain forks. AcceptBlock still enforces tight 3-min drift rules
deterministically against the previous block timestamp.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Three fixes for the fork-oscillation problem where same-version nodes
keep disagreeing on the chain tip:
1. Prune setStakeSeen on reorg — disconnected PoS blocks' stake entries
were never removed, blocking acceptance of valid competing blocks
and preventing chain convergence after reorganizations.
2. Remove global nBestHeight from PastDrift/FutureDrift — the no-argument
overloads used the mutable global nBestHeight to decide between 3-min
and 10-min timestamp drift at the V5.4 fork boundary (block 2186941).
Nodes at different heights applied different validation rules to the
same block, causing a permanent consensus split. Now always uses
post-fork 3-min rules since all nodes are well past the fork.
3. Anti-oscillation for equal-trust reorgs — the hash-based tiebreaker
now only fires for shallow forks (parent in main chain). Deep forks
with equal trust no longer trigger reorgs, preventing the Tor-latency-
induced ping-pong where nodes flip between competing chains.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Address validator accepts V3 .onion format (62 chars, base32 + .onion)
- WalletModel::validateAddress() recognizes .onion via ValidateOnionAddress()
- Send coins/messages dialogs resolve .onion to TRI before sending
- Auto-request getwalletaddr from onion peers after version handshake
- Placeholder text updated to "Enter a TRI address or .onion address"
- Shows info dialog if resolution is pending (async connect + resolve)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
New P2P messages allow resolving a peer's .onion address to their TRI
receiving address with cryptographic proof of ownership:
- getwalletaddr: request peer's TRI address
- walletaddr: response with address + compact signature
Resolution cache in CTorV3Manager with 24h expiry and async callbacks.
Signature verification prevents spoofing (peer signs their onion hostname
with their wallet key).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Lit green "V3" label next to staking icon when onion address is active,
dimmed grey when not yet connected. Tooltip: "V3 Tor enabled".
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Remove onion address label from overview page (was cutting into
transaction list area)
- Add it to the left side of the main window status bar instead,
opposite the sync/connection icons
- Add "Show .onion address in status bar" checkbox under Options >
Display (enabled by default)
- Polls every 5 seconds; hidden until the address is available
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
The defensive check `IsPortInUse(hiddenServicePort)` always fails
because port 24112 is the P2P port, which the node binds BEFORE
Tor starts. The check was incorrectly detecting our own listener
as a collision, causing "Tor failed to start" on every launch.
The hidden service is supposed to forward to 127.0.0.1:24112 where
the node is already listening — that's the correct state, not an error.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Rename CTorProcess::GetLastError() and CTorEmbedded::GetLastError() to
GetStartupError() so they don't shadow the Win32 GetLastError() API,
which caused a std::string-to-DWORD conversion error on Windows.
- Qualify the one Win32 call as ::GetLastError() for clarity.
- Pass torError.c_str() to strprintf instead of std::string, fixing
Clang's -Wnon-pod-varargs error on macOS.
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Krystie
sami7777