What the developer wrote
Authored by Boris Nagaev
rpc: decode block proposals strictly
What changed, and why it matters
This commit changes how submitted block proposals are decoded in the Bitcoin RPC server. It switches from a loose block parser to a stricter one that validates the block more thoroughly before accepting it. The likely goal is to prevent malformed or invalid block proposals from being processed further, which could otherwise cause incorrect behavior or resource waste.
Treat as a hardening improvement. Review btcutil.NewBlockFromBytes to confirm what additional validation it performs, and verify that no edge cases allow bypass of the stricter checks. No immediate emergency action is indicated from the diff alone.
Security signals we found
Stricter input validation on externally supplied block data
Change from manual deserialization to higher-level validated helper
Potential mitigation of malformed block proposal handling
Evidence from the diff
The patch replaces a direct call to wire.MsgBlock.Deserialize() followed by btcutil.NewBlock() with a single call to btcutil.NewBlockFromBytes(). The new helper performs stricter deserialization/validation of the raw block bytes. This affects the handleGetBlockTemplateProposal RPC handler, which miners use to submit proposed blocks via getblocktemplate(mode=’proposal’).
Changed components
rpcserver.gohandleGetBlockTemplateProposalgetblocktemplate proposal RPCInspect captured patch +2 / −3
diff --git a/rpcserver.go b/rpcserver.go
index 7decabd..fb5f066 100644
--- a/rpcserver.go
+++ b/rpcserver.go
@@ -2141,14 +2141,13 @@ func handleGetBlockTemplateProposal(s *rpcServer, request *btcjson.TemplateReque
"hexadecimal string (not %q)", hexData),
}
}
- var msgBlock wire.MsgBlock
- if err := msgBlock.Deserialize(bytes.NewReader(dataBytes)); err != nil {
+ block, err := btcutil.NewBlockFromBytes(dataBytes)
+ if err != nil {
return nil, &btcjson.RPCError{
Code: btcjson.ErrRPCDeserialization,
Message: "Block decode failed: " + err.Error(),
}
}
- block := btcutil.NewBlock(&msgBlock)
// Ensure the block is building from the expected previous block.
expectedPrevHash := s.cfg.Chain.BestSnapshot().Hash
Why this scored 45/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.