Use cluster limits instead of ancestor/descendant limits when sanity checking package policy limits
What the developer wrote
Authored by Suhas Daftuar
Use cluster limits instead of ancestor/descendant limits when sanity checking package policy limits
What changed, and why it matters
This commit updates internal compile-time sanity checks for Bitcoin Core's package transaction limits. It replaces checks based on older 'ancestor/descendant' mempool limits with checks based on newer 'cluster' limits. The change is defensive: it ensures that when users submit groups (packages) of related transactions, the configured limits won't accidentally reject transactions that should be acceptable. There is no direct evidence in the commit that this fixes an active security bug or vulnerability.
No urgent action required. Treat as routine policy-maintenance hardening. Reviewers may want to verify that DEFAULT_CLUSTER_LIMIT and DEFAULT_CLUSTER_SIZE_LIMIT_KVB values are appropriate for the intended package behavior, and that the change from >= to <= for weight is intentional and correct.
Security signals we found
Policy consistency hardening: prevents package evaluation limits from being misconfigured relative to mempool cluster limits
Compile-time static_assert only: no runtime behavior change
No memory safety, cryptographic, or consensus bug evident in diff
Evidence from the diff
The patch modifies src/policy/packages.h, changing static_assert compile-time constraints. Previously, MAX_PACKAGE_COUNT and MAX_PACKAGE_WEIGHT were checked against DEFAULT_DESCENDANT_LIMIT, DEFAULT_ANCESTOR_LIMIT, and their size counterparts. Now they are checked against DEFAULT_CLUSTER_LIMIT and DEFAULT_CLUSTER_SIZE_LIMIT_KVB. The direction of the weight check also changed from >= to <=, reflecting that a package’s weight must fit within the cluster size limit. This aligns package policy defaults with the newer cluster-based mempool policy introduced in Bitcoin Core.
Changed components
src/policy/packages.hPackage transaction acceptance policyMempool cluster limit defaultsInspect captured patch +4 / −9
diff --git a/src/policy/packages.h b/src/policy/packages.h
index 5ed7f32a..85081977 100644
--- a/src/policy/packages.h
+++ b/src/policy/packages.h
@@ -24,15 +24,10 @@ static constexpr uint32_t MAX_PACKAGE_COUNT{25};
static constexpr uint32_t MAX_PACKAGE_WEIGHT = 404'000;
static_assert(MAX_PACKAGE_WEIGHT >= MAX_STANDARD_TX_WEIGHT);
-// If a package is to be evaluated, it must be at least as large as the mempool's ancestor/descendant limits,
-// otherwise transactions that would be individually accepted may be rejected in a package erroneously.
-// Since a submitted package must be child-with-parents (all of the transactions are a parent
-// of the child), package limits are ultimately bounded by mempool package limits. Ensure that the
-// defaults reflect this constraint.
-static_assert(DEFAULT_DESCENDANT_LIMIT >= MAX_PACKAGE_COUNT);
-static_assert(DEFAULT_ANCESTOR_LIMIT >= MAX_PACKAGE_COUNT);
-static_assert(MAX_PACKAGE_WEIGHT >= DEFAULT_ANCESTOR_SIZE_LIMIT_KVB * WITNESS_SCALE_FACTOR * 1000);
-static_assert(MAX_PACKAGE_WEIGHT >= DEFAULT_DESCENDANT_SIZE_LIMIT_KVB * WITNESS_SCALE_FACTOR * 1000);
+// Packages are part of a single cluster, so ensure that the package limits are
+// set within the mempool's cluster size limits.
+static_assert(DEFAULT_CLUSTER_LIMIT >= MAX_PACKAGE_COUNT);
+static_assert(MAX_PACKAGE_WEIGHT <= DEFAULT_CLUSTER_SIZE_LIMIT_KVB * WITNESS_SCALE_FACTOR * 1000);
/** A "reason" why a package was invalid. It may be that one or more of the included
* transactions is invalid or the package itself violates our rules.
Why this scored 26/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.