From b1178f9eb149a9b9620c347c89e8013967339b72 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 02:14:38 +0000
Subject: [PATCH 01/51] fix(llmq): judge every sig-share sender by its own
 verified shares

CSigSharesManager::ProcessPendingSigShares let a peer's sig shares be
stored without their own signature check by two routes.

1. Message-id aliasing. Shares were batch-verified with
   CBLSBatchVerifier<NodeId, SigShareKey>. The verifier stores messages
   in a std::map keyed by message id, and SigShareKey (signHash,
   quorumMember) does not include the signature or the sender. QSIGSHARE
   is accepted from any peer, so two peers can push shares with the same
   key in one batch; the second PushMessage is then a silent no-op and
   that peer's messagesBySource entry points at the first peer's message:

   - forged share first: the batch fails, the per-source fallback
     re-checks the forged share for both peers, and the honest sender
     lands in badSources and is banned;
   - honest share first: the batch passes on the honest signature, the
     forged share is never checked, and ProcessPendingSigShares can store
     it.

   Key batch entries by (NodeId, SigShareKey) so every sender is judged by
   its own signature. pendingIncomingSigShares already deduplicates by
   SigShareKey per node, so for a single sender, and for distinct keys
   across senders, the new keys map one-to-one onto the old ones and the
   batch is unchanged; the only difference is that a key pushed by
   several peers now produces one entry per peer instead of an aliased
   one. The verifier itself is unchanged and its other users (ISLOCK,
   recovered sigs) keep their ids, which already cover the signature.

2. Malformed-share break. A share whose lazy signature fails to
   deserialize called BanNode() and stopped pushing that peer's shares,
   but did not add the peer to badSources. The post-verification loop
   therefore still passed all of that peer's shares, the malformed one
   and every never-pushed one after it, to ProcessPendingSigShares, which
   stored them and filled their member slots so the honest shares were
   later dropped as already known. Record the peer in badSources instead,
   as develop does; the post-verification loop then bans it and skips its
   shares.

Test: sig_share_batch_verifier_judges_each_sender_by_its_own_share pushes
the same key from two peers in both orders, plus a same-share relay by
two honest peers, through PushSigShareToBatchVerifier and checks
badSources. With the pre-fix keying (SigShareKey only) the honest-first
row yields no bad sources and the attacker-first row yields both peers.
Route 2 is not unit-tested: it lives inside ProcessPendingSigShares,
which needs a full CSigSharesManager with a quorum and peer manager; it
was verified by inspection against the develop fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/llmq/signing_shares.cpp   | 12 +++++++---
 src/llmq/signing_shares.h     |  9 ++++++++
 src/test/llmq_utils_tests.cpp | 43 +++++++++++++++++++++++++++++++++++
 3 files changed, 61 insertions(+), 3 deletions(-)

diff --git a/src/llmq/signing_shares.cpp b/src/llmq/signing_shares.cpp
index 6537f9975d36..f6038e9148e8 100644
--- a/src/llmq/signing_shares.cpp
+++ b/src/llmq/signing_shares.cpp
@@ -71,6 +71,12 @@ void CSigShare::UpdateKey()
     key.second = quorumMember;
 }
 
+void PushSigShareToBatchVerifier(SigShareBatchVerifier& batchVerifier, NodeId from, const CSigShare& sigShare,
+                                 const CBLSSignature& sig, const CBLSPublicKey& pubKeyShare)
+{
+    batchVerifier.PushMessage(from, {from, sigShare.GetKey()}, sigShare.GetSignHash(), sig, pubKeyShare);
+}
+
 std::string CSigSesAnn::ToString() const
 {
     return strprintf("sessionId=%d, llmqType=%d, quorumHash=%s, id=%s, msgHash=%s",
@@ -809,7 +815,7 @@ bool CSigSharesManager::ProcessPendingSigShares()
 
     // It's ok to perform insecure batched verification here as we verify against the quorum public key shares,
     // which are not craftable by individual entities, making the rogue public key attack impossible
-    CBLSBatchVerifier<NodeId, SigShareKey> batchVerifier(false, true);
+    SigShareBatchVerifier batchVerifier(false, true);
 
     cxxtimer::Timer prepareTimer(true);
     size_t verifyCount = 0;
@@ -825,7 +831,7 @@ bool CSigSharesManager::ProcessPendingSigShares()
             // we didn't check this earlier because we use a lazy BLS signature and tried to avoid doing the expensive
             // deserialization in the message thread
             if (!sig.IsValid()) {
-                BanNode(nodeId);
+                batchVerifier.badSources.emplace(nodeId);
                 // don't process any additional shares from this node
                 break;
             }
@@ -840,7 +846,7 @@ bool CSigSharesManager::ProcessPendingSigShares()
                 assert(false);
             }
 
-            batchVerifier.PushMessage(nodeId, sigShare.GetKey(), sigShare.GetSignHash(), sig, pubKeyShare);
+            PushSigShareToBatchVerifier(batchVerifier, nodeId, sigShare, sig, pubKeyShare);
             verifyCount++;
         }
     }
diff --git a/src/llmq/signing_shares.h b/src/llmq/signing_shares.h
index 873f93384b42..b693100c4744 100644
--- a/src/llmq/signing_shares.h
+++ b/src/llmq/signing_shares.h
@@ -6,6 +6,7 @@
 #define BITCOIN_LLMQ_SIGNING_SHARES_H
 
 #include <bls/bls.h>
+#include <bls/bls_batchverifier.h>
 #include <ctpl_stl.h>
 #include <evo/types.h>
 #include <llmq/signhash.h>
@@ -91,6 +92,14 @@ class CSigShare : virtual public CSigBase
     }
 };
 
+// Batch entries are keyed by sender as well as SigShareKey. QSIGSHARE is accepted from any peer, so two peers can
+// push the same key; with a sender-less key the second push would alias the first entry, letting one peer's share be
+// judged in place of the other's (banning an honest sender, or never checking a forged share).
+using SigShareBatchVerifier = CBLSBatchVerifier<NodeId, std::pair<NodeId, SigShareKey>>;
+
+void PushSigShareToBatchVerifier(SigShareBatchVerifier& batchVerifier, NodeId from, const CSigShare& sigShare,
+                                 const CBLSSignature& sig, const CBLSPublicKey& pubKeyShare);
+
 // Nodes will first announce a signing session with a sessionId to be used in all future P2P messages related to that
 // session. We locally keep track of the mapping for each node. We also assign new sessionIds for outgoing sessions
 // and send QSIGSESANN messages appropriately. All values except the max value for uint32_t are valid as sessionId
diff --git a/src/test/llmq_utils_tests.cpp b/src/test/llmq_utils_tests.cpp
index a3f80e5aa1f9..1eb066fc5bd1 100644
--- a/src/test/llmq_utils_tests.cpp
+++ b/src/test/llmq_utils_tests.cpp
@@ -5,6 +5,7 @@
 #include <test/util/llmq_tests.h>
 #include <test/util/setup_common.h>
 
+#include <bls/bls.h>
 #include <consensus/params.h>
 #include <llmq/net_signing.h>
 #include <llmq/params.h>
@@ -18,6 +19,7 @@
 
 #include <map>
 #include <set>
+#include <vector>
 
 using namespace llmq;
 using namespace llmq::testutils;
@@ -173,6 +175,47 @@ BOOST_AUTO_TEST_CASE(pending_sig_shares_session_removal_updates_count)
     BOOST_CHECK_EQUAL(node_state.pendingIncomingSigShares.Size(), 1U);
 }
 
+BOOST_AUTO_TEST_CASE(sig_share_batch_verifier_judges_each_sender_by_its_own_share)
+{
+    const bool legacy_scheme{bls::bls_legacy_scheme.load()};
+    const CSigShare sig_share{MakeSigShare(1)};
+
+    CBLSSecretKey sk_share;
+    sk_share.MakeNewKey();
+    const CBLSPublicKey pk_share{sk_share.GetPublicKey()};
+    const CBLSSignature valid_sig{sk_share.Sign(sig_share.GetSignHash(), legacy_scheme)};
+
+    CBLSSecretKey sk_forger;
+    sk_forger.MakeNewKey();
+    const CBLSSignature forged_sig{sk_forger.Sign(sig_share.GetSignHash(), legacy_scheme)};
+
+    constexpr NodeId honest{1};
+    constexpr NodeId attacker{2};
+    constexpr NodeId other_honest{3};
+
+    struct Push {
+        NodeId from;
+        CBLSSignature sig;
+    };
+    const std::vector<std::pair<std::vector<Push>, std::set<NodeId>>> cases{
+        // Honest share first: the forged copy of the same key must still be checked, not shadowed.
+        {{{honest, valid_sig}, {attacker, forged_sig}}, {attacker}},
+        // Forged share first: the honest sender must be judged by its own share, not the attacker's.
+        {{{attacker, forged_sig}, {honest, valid_sig}}, {attacker}},
+        // The same valid share relayed by two peers is not misbehavior.
+        {{{honest, valid_sig}, {other_honest, valid_sig}}, {}},
+    };
+
+    for (const auto& [pushes, expected_bad_sources] : cases) {
+        SigShareBatchVerifier verifier(/*_secureVerification=*/false, /*_perMessageFallback=*/true);
+        for (const auto& push : pushes) {
+            PushSigShareToBatchVerifier(verifier, push.from, sig_share, push.sig, pk_share);
+        }
+        verifier.Verify();
+        BOOST_CHECK(verifier.badSources == expected_bad_sources);
+    }
+}
+
 BOOST_AUTO_TEST_CASE(batched_sig_shares_rejects_oversized_inner_vector)
 {
     CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};

From 07494dd628a996debc772f11d96cbff68d56928f Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 28 Oct 2026 22:47:22 +0000
Subject: [PATCH 02/51] fix(consensus): reject negative transaction nVersion
 after DIP3

A tx version word in 0x8000-0xFFFF is read into int16 nVersion as negative and
sign-extends on re-serialization to type 0xFFFF, so a node fed the miner's
original wire bytes accepts a block that every relayed/compact/IBD/reindex copy
rejects -> permanent consensus split. Reject negative nVersion in
ContextualCheckTransaction once DIP3 is active (consensus-enforced for mempool
and block connection), and route version/type word packing through a single
PackVersionAndType() helper. Valid-tx txids are unchanged (no fork); no
activation height needed. Backport of knst fix-signed-nversion.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/primitives/transaction.h    | 11 +++++++++--
 src/script/interpreter.cpp      |  2 +-
 src/test/sighash_tests.cpp      |  2 +-
 src/test/transaction_tests.cpp  | 20 +++++++++++++++++++
 src/test/txvalidation_tests.cpp | 34 +++++++++++++++++++++++++++++++++
 src/validation.cpp              |  5 +++++
 6 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/src/primitives/transaction.h b/src/primitives/transaction.h
index b45e81fa6e88..206d8562656c 100644
--- a/src/primitives/transaction.h
+++ b/src/primitives/transaction.h
@@ -205,6 +205,13 @@ class CTxOut
 
 struct CMutableTransaction;
 
+/** nVersion and nType share one 32-bit wire field. nVersion fills the low half as raw bits:
+ *  sign-extending a negative nVersion would overwrite nType. */
+constexpr int32_t PackVersionAndType(int16_t nVersion, uint16_t nType)
+{
+    return static_cast<int32_t>(static_cast<uint16_t>(nVersion) | (static_cast<uint32_t>(nType) << 16));
+}
+
 /** The basic transaction that is broadcasted on the network and contained in
  * blocks.  A transaction can contain multiple inputs and outputs.
  */
@@ -241,7 +248,7 @@ class CTransaction
 
     template <typename Stream>
     inline void Serialize(Stream& s) const {
-        int32_t n32bitVersion = this->nVersion | (this->nType << 16);
+        int32_t n32bitVersion = PackVersionAndType(this->nVersion, this->nType);
         s << n32bitVersion;
         s << vin;
         s << vout;
@@ -320,7 +327,7 @@ struct CMutableTransaction
     SERIALIZE_METHODS(CMutableTransaction, obj)
     {
         int32_t n32bitVersion;
-        SER_WRITE(obj, n32bitVersion = obj.nVersion | (obj.nType << 16));
+        SER_WRITE(obj, n32bitVersion = PackVersionAndType(obj.nVersion, obj.nType));
         READWRITE(n32bitVersion);
         SER_READ(obj, obj.nVersion = (int16_t) (n32bitVersion & 0xffff));
         SER_READ(obj, obj.nType = (uint16_t) ((n32bitVersion >> 16) & 0xffff));
diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index 4dc0b7e63ec8..1dac934c232f 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1420,7 +1420,7 @@ class CTransactionSignatureSerializer
     template<typename S>
     void Serialize(S &s) const {
         // Serialize nVersion
-        int32_t n32bitVersion = txTo.nVersion | (txTo.nType << 16);
+        int32_t n32bitVersion = PackVersionAndType(txTo.nVersion, txTo.nType);
         ::Serialize(s, n32bitVersion);
         // Serialize vin
         unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
diff --git a/src/test/sighash_tests.cpp b/src/test/sighash_tests.cpp
index f1d8e6d0ad90..62625c9fc121 100644
--- a/src/test/sighash_tests.cpp
+++ b/src/test/sighash_tests.cpp
@@ -89,7 +89,7 @@ void static RandomScript(CScript &script) {
 
 void static RandomTransaction(CMutableTransaction &tx, bool fSingle)
 {
-    tx.nVersion = int(InsecureRandRange(2)) + 1;
+    tx.nVersion = static_cast<int16_t>(InsecureRandBits(16));
     tx.vin.clear();
     tx.vout.clear();
     tx.nLockTime = (InsecureRandBool()) ? InsecureRand32() : 0;
diff --git a/src/test/transaction_tests.cpp b/src/test/transaction_tests.cpp
index 6e117ad5117b..fc8601b15220 100644
--- a/src/test/transaction_tests.cpp
+++ b/src/test/transaction_tests.cpp
@@ -329,6 +329,26 @@ BOOST_AUTO_TEST_CASE(basic_transaction_tests)
     BOOST_CHECK_MESSAGE(!CheckTransaction(CTransaction(tx), state) || !state.IsValid(), "Transaction with duplicate txins should be invalid.");
 }
 
+BOOST_AUTO_TEST_CASE(tx_version_type_roundtrip)
+{
+    // nVersion and nType share one 32-bit wire field; a negative nVersion must not sign-extend over nType
+    for (const auto& [version, type] : std::vector<std::pair<int16_t, uint16_t>>{{-1, TRANSACTION_NORMAL}, {-1, 0xffff}}) {
+        CMutableTransaction tx;
+        tx.nVersion = version;
+        tx.nType = type;
+        CDataStream mutable_stream(SER_NETWORK, PROTOCOL_VERSION);
+        mutable_stream << tx;
+        CDataStream stream(SER_NETWORK, PROTOCOL_VERSION);
+        stream << CTransaction(tx);
+        BOOST_CHECK_EQUAL(HexStr(stream), HexStr(mutable_stream));
+
+        CMutableTransaction tx_read;
+        stream >> tx_read;
+        BOOST_CHECK_EQUAL(tx_read.nVersion, version);
+        BOOST_CHECK_EQUAL(tx_read.nType, type);
+    }
+}
+
 BOOST_AUTO_TEST_CASE(test_Get)
 {
     FillableSigningProvider keystore;
diff --git a/src/test/txvalidation_tests.cpp b/src/test/txvalidation_tests.cpp
index 36042431f85c..5941e2a75619 100644
--- a/src/test/txvalidation_tests.cpp
+++ b/src/test/txvalidation_tests.cpp
@@ -8,6 +8,8 @@
 #include <policy/policy.h>
 #include <primitives/transaction.h>
 #include <script/script.h>
+#include <script/sign.h>
+#include <script/signingprovider.h>
 #include <script/standard.h>
 #include <test/util/setup_common.h>
 #include <validation.h>
@@ -20,6 +22,11 @@ struct TestChain100NoDIP0001Setup : public TestChain100Setup {
         : TestChain100Setup{CBaseChainParams::REGTEST, {"-testactivationheight=dip0001@2000"}} {}
 };
 
+struct TestChain100DIP3Setup : public TestChain100Setup {
+    TestChain100DIP3Setup()
+        : TestChain100Setup{CBaseChainParams::REGTEST, {"-dip3params=101:500"}} {}
+};
+
 
 BOOST_AUTO_TEST_SUITE(txvalidation_tests)
 
@@ -55,4 +62,31 @@ BOOST_FIXTURE_TEST_CASE(tx_mempool_reject_coinbase, TestChain100Setup)
     BOOST_CHECK_EQUAL(result.m_state.GetRejectReason(), "coinbase");
     BOOST_CHECK(result.m_state.GetResult() == TxValidationResult::TX_CONSENSUS);
 }
+
+/**
+ * Ensure that a negative nVersion is rejected by the mempool and in a block.
+ */
+BOOST_FIXTURE_TEST_CASE(tx_reject_negative_version, TestChain100DIP3Setup)
+{
+    const CScript scriptPubKey = CScript() << ToByteVector(coinbaseKey.GetPubKey()) << OP_CHECKSIG;
+    CMutableTransaction tx;
+    tx.nVersion = -1;
+    tx.vin.emplace_back(COutPoint{m_coinbase_txns[0]->GetHash(), 0});
+    tx.vout.emplace_back(1 * COIN, scriptPubKey);
+    FillableSigningProvider keystore;
+    keystore.AddKey(coinbaseKey);
+    BOOST_REQUIRE(SignSignature(keystore, *m_coinbase_txns[0], tx, 0, SIGHASH_ALL));
+
+    {
+        LOCK(cs_main);
+        const MempoolAcceptResult result = m_node.chainman->ProcessTransaction(MakeTransactionRef(tx));
+        BOOST_CHECK(result.m_result_type == MempoolAcceptResult::ResultType::INVALID);
+        BOOST_CHECK_EQUAL(result.m_state.GetRejectReason(), "bad-txns-version");
+    }
+
+    const int height{WITH_LOCK(cs_main, return m_node.chainman->ActiveChain().Height())};
+    const auto block = std::make_shared<CBlock>(CreateBlock({tx}, scriptPubKey, m_node.chainman->ActiveChainstate()));
+    BOOST_CHECK(!m_node.chainman->ProcessNewBlock(block, /*force_processing=*/true, /*new_block=*/nullptr));
+    BOOST_CHECK_EQUAL(WITH_LOCK(cs_main, return m_node.chainman->ActiveChain().Height()), height);
+}
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/validation.cpp b/src/validation.cpp
index 0a577003054d..12be0fe8bb76 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -339,6 +339,11 @@ static bool ContextualCheckTransaction(const CTransaction& tx, TxValidationState
         } else if (tx.nType != TRANSACTION_NORMAL) {
             return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-txns-type");
         }
+        // Releases that sign-extended nVersion over nType re-serialized a negative nVersion with nType 0xffff,
+        // so a block carrying one was accepted only by the peers that received the miner's own bytes
+        if (tx.nVersion < 0) {
+            return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-txns-version");
+        }
     }
 
     // Size limits

From 8351db9f1445e500547847e77c657a062bf6f6be Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 28 Oct 2026 22:59:12 +0000
Subject: [PATCH 03/51] fix(llmq): reject invalid decrypted DKG shares before
 aggregation

A quorum member could send a contribution whose decrypted secret-key share is
invalid (e.g. all-zero). It was stored unchecked and later reached
CBLSSecretKey::AggregateInsecure, whose assert(IsValid()) aborts the whole
dashd process on every honest member of the quorum each DKG - a remote
liveness attack on IS/ChainLock/Platform quorums by one member.

Reject an invalid decrypted share at intake (treat as a complaint, like the
undecryptable-share path), reject it on the QDATA recovery path, and make the
secret-key aggregator short-circuit to an invalid aggregate on any invalid
operand so peer-influenced data never reaches the assert (callers already
treat an invalid aggregate as a verification failure, not an abort).

Adds a regtest-only contribution-invalid DKG sim-error and a regression case
in feature_llmq_dkgerrors.py that aborts stock dashd and passes with the fix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/active/dkgsession.cpp                 |  8 ++++++++
 src/active/quorums.cpp                    |  7 +++++--
 src/bls/bls_worker.cpp                    |  6 ++++++
 src/llmq/dkgsession.cpp                   |  7 +++++++
 src/llmq/dkgsession.h                     |  2 ++
 test/functional/feature_llmq_dkgerrors.py | 13 +++++++++++++
 6 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/src/active/dkgsession.cpp b/src/active/dkgsession.cpp
index 15eb449ece7f..5f542539e048 100644
--- a/src/active/dkgsession.cpp
+++ b/src/active/dkgsession.cpp
@@ -90,6 +90,14 @@ void ActiveDKGSession::SendContributions(CDKGPendingMessages& pendingMessages, P
             skContrib.MakeNewKey();
         }
 
+        if (i != myIdx && ShouldSimulateError(DKGError::type::CONTRIBUTION_INVALID)) {
+            // Deliver a share that decrypts to an all-zero (structurally invalid)
+            // CBLSSecretKey on the recipient. Used to exercise the DKG intake's
+            // handling of a peer-supplied invalid contribution share.
+            logger.Batch("sending invalid (zero) share to %s", m->dmn->proTxHash.ToString());
+            skContrib = CBLSSecretKey{};
+        }
+
         if (!qc.contributions->Encrypt(i, m->dmn->pdmnState->pubKeyOperator.Get(), skContrib, PROTOCOL_VERSION)) {
             logger.Batch("failed to encrypt contribution for %s", m->dmn->proTxHash.ToString());
             return;
diff --git a/src/active/quorums.cpp b/src/active/quorums.cpp
index 9103207612b9..b86694109148 100644
--- a/src/active/quorums.cpp
+++ b/src/active/quorums.cpp
@@ -161,8 +161,11 @@ MessageProcessingResult QuorumParticipant::ProcessContribQDATA(CNode& pfrom, CDa
         std::vector<CBLSSecretKey> vecSecretKeys;
         vecSecretKeys.resize(vecEncrypted.size());
         for (const auto i : irange::range(vecEncrypted.size())) {
-            if (!m_mn_activeman.Decrypt(vecEncrypted[i], memberIdx, vecSecretKeys[i], PROTOCOL_VERSION)) {
-                return MisbehavingError{10, "failed to decrypt"};
+            if (!m_mn_activeman.Decrypt(vecEncrypted[i], memberIdx, vecSecretKeys[i], PROTOCOL_VERSION) ||
+                !vecSecretKeys[i].IsValid()) {
+                // Reject an undecryptable or structurally-invalid (e.g. all-zero) share before
+                // it reaches AggregateSecretKeys()/AggregateInsecure(), which asserts validity.
+                return MisbehavingError{10, "invalid contribution share"};
             }
         }
 
diff --git a/src/bls/bls_worker.cpp b/src/bls/bls_worker.cpp
index 62762ebd2a91..15ec3b589562 100644
--- a/src/bls/bls_worker.cpp
+++ b/src/bls/bls_worker.cpp
@@ -300,8 +300,14 @@ struct Aggregator : public std::enable_shared_from_this<Aggregator<T>> {
     template <typename TP>
     T SyncAggregate(Span<TP> vec, size_t start, size_t count)
     {
+        // Defence in depth: AggregateInsecure() asserts that every operand is valid, so
+        // peer-influenced data (e.g. a decrypted contribution share) must never reach it
+        // while invalid. Short-circuit to an invalid aggregate instead; callers already
+        // treat an invalid result as an aggregation failure rather than aborting.
         T result = *vec[start];
+        if (!result.IsValid()) return {};
         for (size_t j = 1; j < count; j++) {
+            if (!vec[start + j]->IsValid()) return {};
             result.AggregateInsecure(*vec[start + j]);
         }
         return result;
diff --git a/src/llmq/dkgsession.cpp b/src/llmq/dkgsession.cpp
index 85ae65b40d4e..4c8c21d2b20a 100644
--- a/src/llmq/dkgsession.cpp
+++ b/src/llmq/dkgsession.cpp
@@ -263,6 +263,13 @@ std::optional<CInv> CDKGSession::ReceiveMessage(const CDKGContribution& qc)
     if (!MaybeDecrypt(*qc.contributions, *myIdx, skContribution, PROTOCOL_VERSION)) {
         logger.Batch("contribution from %s could not be decrypted", member->dmn->proTxHash.ToString());
         complain = true;
+    } else if (!skContribution.IsValid()) {
+        // A decryptable but structurally-invalid (e.g. all-zero) share must never be
+        // retained: it later reaches CBLSSecretKey::AggregateInsecure() in the batched
+        // contribution verification, whose assert(IsValid()) would abort an honest node.
+        // Treat it as a bad contribution and complain.
+        logger.Batch("contribution from %s decrypted to an invalid share", member->dmn->proTxHash.ToString());
+        complain = true;
     } else if (member->idx != myIdx && ShouldSimulateError(DKGError::type::COMPLAIN_LIE)) {
         logger.Batch("lying/complaining for %s", member->dmn->proTxHash.ToString());
         complain = true;
diff --git a/src/llmq/dkgsession.h b/src/llmq/dkgsession.h
index c7f507537c9c..7a7e85660378 100644
--- a/src/llmq/dkgsession.h
+++ b/src/llmq/dkgsession.h
@@ -72,6 +72,7 @@ class DKGError {
         CONTRIBUTION_LIE,
         JUSTIFY_OMIT,
         JUSTIFY_LIE,
+        CONTRIBUTION_INVALID,
         _COUNT
     };
     static constexpr DKGError::type from_string(std::string_view in) {
@@ -82,6 +83,7 @@ class DKGError {
         if (in == "contribution-lie") return CONTRIBUTION_LIE;
         if (in == "justify-lie") return JUSTIFY_LIE;
         if (in == "justify-omit") return JUSTIFY_OMIT;
+        if (in == "contribution-invalid") return CONTRIBUTION_INVALID;
         return _COUNT;
     }
 };
diff --git a/test/functional/feature_llmq_dkgerrors.py b/test/functional/feature_llmq_dkgerrors.py
index 90f7a812fadd..17409aee3dc6 100755
--- a/test/functional/feature_llmq_dkgerrors.py
+++ b/test/functional/feature_llmq_dkgerrors.py
@@ -50,6 +50,19 @@ def run_test(self):
         qh = self.mine_quorum(expected_contributions=3, expected_complaints=2, expected_justifications=1, mninfos_valid=mninfos_valid)
         self.assert_member_valid(qh, self.mninfo[0].proTxHash, True)
 
+        self.log.info("Lets deliver a structurally-invalid (all-zero) contribution share but provide a correct justification")
+        # Regression test for the DKG abort via an invalid decrypted contribution share:
+        # before the intake gate rejected it, the share reached CBLSSecretKey::AggregateInsecure()
+        # in the batched verification and its assert aborted every honest recipient (SIGABRT).
+        # With the gate the invalid share is treated like a bad contribution: recipients complain,
+        # the sender justifies with its real shares, and the member remains valid - no crash.
+        # contribution-lie stays enabled from the previous case; contribution-invalid overrides it
+        # with an all-zero (structurally invalid) share, which is the EMBARGO-8 trigger.
+        self.mninfo[0].get_node(self).quorum('dkgsimerror', 'contribution-invalid', '100')
+        qh = self.mine_quorum(expected_contributions=3, expected_complaints=2, expected_justifications=1, mninfos_valid=mninfos_valid)
+        self.assert_member_valid(qh, self.mninfo[0].proTxHash, True)
+        self.mninfo[0].get_node(self).quorum('dkgsimerror', 'contribution-invalid', '0')
+
         self.log.info("Lets lie in the contribution and then omit the justification")
         self.mninfo[0].get_node(self).quorum('dkgsimerror', 'justify-omit', '100')
         qh = self.mine_quorum(expected_contributions=3, expected_complaints=2, mninfos_valid=mninfos_valid)

From 808b105bd55b68d0181f25793e3a0b3799a67ae5 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 1 Aug 2026 19:16:54 -0500
Subject: [PATCH 04/51] Merge #7486: fix: guard VerifyContributionShares
 against an empty verification-vector set
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

6cc098eeaba5eca343e395fcb7a9285c01938a8c test: tie contribution-share test to the named batch size (UdjinM6)
fa6bb20a0b08d6b15e9dcfbfe87d274407e08e51 refactor: name the contribution-verify batch size (UdjinM6)
0614ade5442ca8ecb18f5a4c99a13ebd27da3664 refactor: document the empty-member guard as defence in depth (UdjinM6)
2d1d08d03d9b6ff43e461851712bc7d4c3acfb0e test: prove VerifyContributionShares acceptance is unchanged (pasta)
0ddd478d45077111385db9120acf917b33daed47 fix: guard VerifyContributionShares against empty vvecs (pasta)
9f907e02bd64dd102accc5fd25dfb328e23663de test: regression for VerifyContributionShares empty vvecs (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `CBLSWorker::AsyncVerifyContributionShares()` terminates the node when handed an empty
  verification-vector set.

  The path is degenerate rather than obviously wrong, which is why it survives review:

  - `VerifyVerificationVectors()` returns `true` for an empty span — its loop body never runs.
  - `ContributionVerifier::Start()` then schedules zero work (`batchCount == 0` when aggregated,
    or a zero-length one-by-one batch when not).
  - Nothing ever invokes `doneCallback`. No scheduled lambda captured `shared_from_this()`, so
    the `ContributionVerifier` is released as soon as `Start()` returns, the promise held by the
    future-based wrapper is destroyed without `set_value()`, and `.get()` throws
    `std::future_error(broken_promise)`.

  The DKG phase handler in `net_dkg.cpp` only catches `AbortPhaseException`, so that throw
  propagates out of the phase-handler thread and `std::terminate` aborts the node.

  ### Reachability

  `ActiveDKGSession::VerifyPendingContributions()` is the only caller that can produce an empty
  input. It early-returns on `pendingContributionVerifications.empty()`, but then filters the
  pending set by `m->bad || m->weComplain`. If every pending member was marked bad between
  enqueue and flush — a duplicate contribution triggering `MarkBadMember()` is the way in — the
  filtered `vvecs` is empty while the pre-filter check passed.

  Getting there is hard, and the constraints are worth spelling out so the severity is not
  over-estimated:

  - **An attacker can only mark its own masternodes bad.** Message signatures are batch-verified
    (`BatchVerifyMessageSigs`) before `ReceiveMessage()` runs, so the duplicate contribution that
    triggers `MarkBadMember()` must be validly signed by that member's own operator key. Honest
    members cannot be poisoned into the bad set.
  - **Our own contribution is always in the pending list.** `EnqueueOwn()` feeds the local
    contribution through the same `ReceiveMessage()` path at the start of the contribute phase,
    and we never mark ourselves bad. The filtered set can therefore only be empty if the
    32-entry flush inside `ReceiveMessage()` already cleared our own entry — i.e. the node must
    have accepted at least 33 contributions.
  - That rules out every quorum smaller than 33 outright: all test/devnet params and
    `llmq_25_67` cannot reach this code path at all. Only sizes 50/60/100/400 are candidates,
    and there an attacker additionally has to place its members entirely in the post-flush tail
    (`N - t ≡ 0 mod 32` → 18/50, 28/60, 4/100, 16/400 members) while winning an ordering race
    against state it cannot directly observe.
  - The 32-entry flush path cannot produce the empty case by itself: each member enqueues at
    most once, and the flush fires synchronously on the 32nd enqueue, so the just-enqueued
    member is never bad at that instant. Only the `VerifyAndComplain()` call can observe an
    all-bad pending set.

  The practical reading: this is defensive hardening of a crash path, not a readily exploitable
  DoS. It is still a `std::terminate` reachable from network input, the guard costs three lines,
  and the same degenerate input will bite the next caller that shows up.

  Note that the reachability constraints above are also why no existing test caught this — the
  functional-test quorums are far too small to ever flush the pending set.

  ## What was done?

  Two commits, at two layers:

  1. **`CBLSWorker::AsyncVerifyContributionShares()`** short-circuits on empty input and
     invokes `doneCallback` with an empty result. This mirrors the empty-input handling that
     `AsyncBuildQuorumVerificationVector()` and `AsyncAggregateHelper()` already have, so the
     worker API is now consistent about degenerate input.

  2. **`ActiveDKGSession::VerifyPendingContributions()`** skips the worker call entirely when
     the post-filter member set is empty, rather than relying on the guard above. This avoids a
     pointless async round-trip and keeps the call site correct on its own terms.

  The first commit is the fix; the second is defence in depth.

  ## How Has This Been Tested?

  Unit tests in `src/test/bls_tests.cpp`:

  - `bls_verify_contribution_shares_empty_vvecs_tests` — without the fix this fails with
    `std::future_error: The associated promise has been destructed prior to the associated
    state becoming ready.`, the exact production failure. With the fix it returns an empty
    result on both the aggregated and non-aggregated paths.
  - `bls_verify_contribution_shares_honest_tests` — asserts that acceptance behaviour for
    non-empty input is unchanged, so the guard cannot mask a real verification failure. The
    quorum size (10) is deliberately larger than `ContributionVerifier`'s batch size of 8, so
    corrupting one share in the first batch must fail that batch, fall back to per-contribution
    verification, blame exactly the corrupted index, and leave the second batch accepted
    wholesale. That property previously had no coverage under `make check` at all — only
    `src/bench/bls_dkg.cpp` exercised it, and benches do not run in CI.

  Full `bls_tests` suite passes. Built and run on macOS/arm64 against current `develop`.

  ## Breaking Changes

  None. The change only affects an input shape that previously terminated the process.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

ACKs for top commit:
  UdjinM6:
    utACK 6cc098eeaba5eca343e395fcb7a9285c01938a8c

Tree-SHA512: e6a316c60fc26566482e61298b9db45b72a03f92582e0909a1548667bf0438b7ab8d9f9997ef6c6d903d52dd27541cd684d16ecc08431bf2b933078b1c74ae4a

v23.1.x adaptation: the added bls_tests use CBLSWorker::Start() and
irange::range() instead of the develop-only Start(int) worker-count
overload and util::irange(); the fix itself is unchanged.

(cherry picked from commit 433789e79d0fd9aba37ff58e7b56a597d4d81045)
---
 src/active/dkgsession.cpp |  11 ++++
 src/bls/bls_worker.cpp    |   9 ++-
 src/bls/bls_worker.h      |   3 +
 src/test/bls_tests.cpp    | 129 ++++++++++++++++++++++++++++++++++++++
 4 files changed, 151 insertions(+), 1 deletion(-)

diff --git a/src/active/dkgsession.cpp b/src/active/dkgsession.cpp
index 15eb449ece7f..35439143cf7a 100644
--- a/src/active/dkgsession.cpp
+++ b/src/active/dkgsession.cpp
@@ -144,6 +144,17 @@ void ActiveDKGSession::VerifyPendingContributions()
         dkgManager.WriteEncryptedContributions(params.type, m_quorum_base_block_index, m->dmn->proTxHash, *vecEncryptedContributions[idx]);
     }
 
+    // Defence in depth: every pending member may have been marked bad (e.g. a
+    // double contribution) after it was enqueued, which the pre-filter check
+    // above cannot catch. AsyncVerifyContributionShares guards empty input too,
+    // but keep the call site correct on its own terms - this path terminated the
+    // node before that guard existed.
+    if (memberIndexes.empty()) {
+        logger.Batch("all %d pending contributions were from bad or complained-about members, nothing to verify", pendingContributionVerifications.size());
+        pendingContributionVerifications.clear();
+        return;
+    }
+
     auto result = blsWorker.VerifyContributionShares(myId, vvecs, skContributions);
     if (result.size() != memberIndexes.size()) {
         logger.Batch("VerifyContributionShares returned result of size %d but size %d was expected, something is wrong", result.size(), memberIndexes.size());
diff --git a/src/bls/bls_worker.cpp b/src/bls/bls_worker.cpp
index 62762ebd2a91..e36f72e7ccc4 100644
--- a/src/bls/bls_worker.cpp
+++ b/src/bls/bls_worker.cpp
@@ -682,6 +682,13 @@ CBLSPublicKey CBLSWorker::BuildPubKeyShare(const BLSVerificationVectorPtr& vvec,
 void CBLSWorker::AsyncVerifyContributionShares(const CBLSId& forId, Span<BLSVerificationVectorPtr> vvecs, Span<CBLSSecretKey> skShares,
                                                bool parallel, bool aggregated, std::function<void(const std::vector<bool>&)> doneCallback)
 {
+    // Empty input never schedules any work, so doneCallback would never fire and the
+    // future-based wrappers would throw broken_promise. Mirror the empty-input
+    // short-circuit in AsyncBuildQuorumVerificationVector / AsyncAggregateHelper.
+    if (vvecs.empty()) {
+        doneCallback(std::vector<bool>{});
+        return;
+    }
     if (!forId.IsValid() || !VerifyVerificationVectors(vvecs)) {
         std::vector<bool> result;
         result.assign(vvecs.size(), false);
@@ -689,7 +696,7 @@ void CBLSWorker::AsyncVerifyContributionShares(const CBLSId& forId, Span<BLSVeri
         return;
     }
 
-    auto verifier = std::make_shared<ContributionVerifier>(forId, vvecs, skShares, 8, parallel, aggregated, workerPool, std::move(doneCallback));
+    auto verifier = std::make_shared<ContributionVerifier>(forId, vvecs, skShares, CONTRIBUTION_VERIFY_BATCH_SIZE, parallel, aggregated, workerPool, std::move(doneCallback));
     verifier->Start();
 }
 
diff --git a/src/bls/bls_worker.h b/src/bls/bls_worker.h
index a5ba5d37bbb4..cc1b0d75d5f2 100644
--- a/src/bls/bls_worker.h
+++ b/src/bls/bls_worker.h
@@ -98,6 +98,9 @@ class CBLSWorker
     // Calculate public key share from public key vector and id. Not parallelized
     static CBLSPublicKey BuildPubKeyShare(const BLSVerificationVectorPtr& vvec, const CBLSId& id);
 
+    // Number of contributions aggregated into one batch by AsyncVerifyContributionShares
+    static constexpr size_t CONTRIBUTION_VERIFY_BATCH_SIZE{8};
+
     // The following functions verify multiple verification vectors and contributions for the same id
     // This is parallelized by performing batched verification. The verification vectors and the contributions of
     // a batch are aggregated (in parallel, see AsyncBuildQuorumVerificationVector and AsyncBuildSecretKeyShare). The
diff --git a/src/test/bls_tests.cpp b/src/test/bls_tests.cpp
index 08b05a6332fb..7b824db073ae 100644
--- a/src/test/bls_tests.cpp
+++ b/src/test/bls_tests.cpp
@@ -509,6 +509,135 @@ BOOST_AUTO_TEST_CASE(bls_verify_contribution_share_null_vvec_tests)
     FuncVerifyContributionShareNullVvec(false);
 }
 
+// Regression: an empty verification-vector set schedules no work at all, so
+// before the guard nothing ever invoked doneCallback and .get() threw
+// std::future_error(broken_promise). In production that throw escapes
+// VerifyPendingContributions on the DKG phase-handler thread, which only catches
+// AbortPhaseException, and std::terminate aborts dashd.
+// Contract: return an empty result vector, on both the aggregated and the
+// one-by-one path.
+void FuncVerifyContributionSharesEmptyVvecs(const bool legacy_scheme)
+{
+    bls::bls_legacy_scheme.store(legacy_scheme);
+
+    CBLSWorker worker;
+    worker.Start();
+
+    const CBLSId id{uint256::ONE};
+    BOOST_REQUIRE(id.IsValid());
+
+    std::vector<BLSVerificationVectorPtr> vvecs; // empty
+    std::vector<CBLSSecretKey> skShares;         // empty
+
+    // Must return gracefully (empty result) instead of destroying the promise.
+    const auto result = worker.VerifyContributionShares(id, vvecs, skShares);
+    BOOST_CHECK(result.empty());
+
+    const auto result_no_agg = worker.VerifyContributionShares(id, vvecs, skShares,
+                                                               /*parallel=*/true,
+                                                               /*aggregated=*/false);
+    BOOST_CHECK(result_no_agg.empty());
+
+    worker.Stop();
+}
+
+BOOST_AUTO_TEST_CASE(bls_verify_contribution_shares_empty_vvecs_tests)
+{
+    FuncVerifyContributionSharesEmptyVvecs(true);
+    FuncVerifyContributionSharesEmptyVvecs(false);
+}
+
+// Positive control for the empty-input guard: it must not change which
+// contributions are accepted. Accepting an invalid share would corrupt the
+// recovered quorum key; rejecting an honest one would stall DKG. This property
+// was previously only covered by src/bench/bls_dkg.cpp, which does not run under
+// `make check`.
+//
+// QUORUM_SIZE exceeds CONTRIBUTION_VERIFY_BATCH_SIZE so the aggregated path
+// builds more than one batch. Corrupting a share in the first batch must then
+// fail that batch, fall back to per-contribution verification, blame exactly the
+// corrupted index, and leave the second batch accepted wholesale - an invalid
+// share must never be masked by the valid shares it is aggregated with.
+void FuncVerifyContributionSharesHonest(const bool legacy_scheme)
+{
+    bls::bls_legacy_scheme.store(legacy_scheme);
+
+    constexpr size_t QUORUM_SIZE{CBLSWorker::CONTRIBUTION_VERIFY_BATCH_SIZE + 2};
+    constexpr int THRESHOLD{6};
+
+    CBLSWorker worker;
+    worker.Start();
+
+    std::vector<CBLSId> ids;
+    ids.reserve(QUORUM_SIZE);
+    for (const size_t i : irange::range(QUORUM_SIZE)) {
+        uint256 id;
+        WriteLE64(id.begin(), i + 1);
+        ids.emplace_back(id);
+    }
+
+    // Every member runs GenerateContributions and broadcasts its vvec; member i's
+    // share for us (member 0) is skShares[i][0].
+    std::vector<BLSVerificationVectorPtr> vvecs;
+    std::vector<CBLSSecretKey> skContributions;
+    vvecs.reserve(QUORUM_SIZE);
+    skContributions.reserve(QUORUM_SIZE);
+    for ([[maybe_unused]] const size_t i : irange::range(QUORUM_SIZE)) {
+        BLSVerificationVectorPtr vvec;
+        std::vector<CBLSSecretKey> skShares;
+        BOOST_REQUIRE(worker.GenerateContributions(THRESHOLD, ids, vvec, skShares));
+        BOOST_REQUIRE(vvec != nullptr);
+        BOOST_REQUIRE_EQUAL(vvec->size(), size_t(THRESHOLD));
+        BOOST_REQUIRE_EQUAL(skShares.size(), QUORUM_SIZE);
+        vvecs.emplace_back(std::move(vvec));
+        skContributions.emplace_back(skShares[0]); // the share addressed to ids[0]
+    }
+
+    const CBLSId& myId = ids[0];
+
+    // 1. All-honest input must be accepted in full, on both code paths.
+    for (const bool aggregated : {true, false}) {
+        const auto result = worker.VerifyContributionShares(myId, vvecs, skContributions,
+                                                            /*parallel=*/true, aggregated);
+        BOOST_REQUIRE_EQUAL(result.size(), QUORUM_SIZE);
+        for (const size_t i : irange::range(QUORUM_SIZE)) {
+            BOOST_CHECK_MESSAGE(result[i], "honest contribution " << i << " rejected (aggregated="
+                                                                  << aggregated << ")");
+        }
+    }
+
+    // 2. Corrupt one share and expect exactly that index to be blamed, nobody else.
+    //    With aggregated=true the corrupted index sits in the first batch, so that
+    //    batch must fail and fall back to per-contribution verification while the
+    //    second batch stays accepted wholesale. With aggregated=false there is a
+    //    single batch verified one-by-one, so only the blame-exactness holds.
+    constexpr size_t BAD_IDX{3};
+    static_assert(BAD_IDX < CBLSWorker::CONTRIBUTION_VERIFY_BATCH_SIZE,
+                  "corrupted index must land in the first batch");
+    auto corrupted = skContributions;
+    corrupted[BAD_IDX].MakeNewKey(); // valid key, wrong value -> pk mismatch
+
+    for (const bool aggregated : {true, false}) {
+        const auto result = worker.VerifyContributionShares(myId, vvecs, corrupted,
+                                                            /*parallel=*/true, aggregated);
+        BOOST_REQUIRE_EQUAL(result.size(), QUORUM_SIZE);
+        for (const size_t i : irange::range(QUORUM_SIZE)) {
+            const bool expected{i != BAD_IDX};
+            BOOST_CHECK_MESSAGE(result[i] == expected,
+                                "index " << i << " expected " << expected << " got " << result[i]
+                                         << " (aggregated=" << aggregated << ")");
+        }
+    }
+
+    worker.Stop();
+}
+
+BOOST_AUTO_TEST_CASE(bls_verify_contribution_shares_honest_tests)
+{
+    FuncVerifyContributionSharesHonest(true);
+    FuncVerifyContributionSharesHonest(false);
+}
+
 // A dummy BLS object that satisfies the minimal interface expected by CBLSLazyWrapper.
 class DummyBLS
 {

From 120b5db0e8b60c889edca08e088bc843bd4b4ace Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 05:08:39 +0000
Subject: [PATCH 05/51] fix(llmq): verify DKG contributions individually when a
 batch vvec check fails

A coefficient point shared between two members' verification vectors made the
batched VerifyVerificationVectors check fail the entire batch, marking every other
honest member's contribution in that batch invalid and complaining about them - a
denial of service against those members' participation in the DKG, since the only
check the batched path adds over the per-member check already run in PreVerifyMessage
is cross-member duplicate detection. Fall back to verifying each contribution against
its own verification vector: a member fails only if its own share is inconsistent with
its own vvec, so a member that placed a colliding coefficient is caught on its own and
the honest members it collided with are unaffected. The quorum-vvec build path stays
strict.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 src/bls/bls_worker.cpp | 34 ++++++++++++++++++++++--
 src/test/bls_tests.cpp | 59 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 91 insertions(+), 2 deletions(-)

diff --git a/src/bls/bls_worker.cpp b/src/bls/bls_worker.cpp
index e36f72e7ccc4..4d9cfc770ad2 100644
--- a/src/bls/bls_worker.cpp
+++ b/src/bls/bls_worker.cpp
@@ -5,6 +5,7 @@
 #include <bls/bls_worker.h>
 #include <hash.h>
 
+#include <logging.h>
 #include <util/ranges.h>
 #include <util/system.h>
 
@@ -682,6 +683,13 @@ CBLSPublicKey CBLSWorker::BuildPubKeyShare(const BLSVerificationVectorPtr& vvec,
 void CBLSWorker::AsyncVerifyContributionShares(const CBLSId& forId, Span<BLSVerificationVectorPtr> vvecs, Span<CBLSSecretKey> skShares,
                                                bool parallel, bool aggregated, std::function<void(const std::vector<bool>&)> doneCallback)
 {
+    if (!forId.IsValid()) {
+        std::vector<bool> result;
+        result.assign(vvecs.size(), false);
+        doneCallback(result);
+        return;
+    }
+
     // Empty input never schedules any work, so doneCallback would never fire and the
     // future-based wrappers would throw broken_promise. Mirror the empty-input
     // short-circuit in AsyncBuildQuorumVerificationVector / AsyncAggregateHelper.
@@ -689,9 +697,31 @@ void CBLSWorker::AsyncVerifyContributionShares(const CBLSId& forId, Span<BLSVeri
         doneCallback(std::vector<bool>{});
         return;
     }
-    if (!forId.IsValid() || !VerifyVerificationVectors(vvecs)) {
+
+    if (!VerifyVerificationVectors(vvecs)) {
+        // A batch-level verification-vector problem must not fail the whole batch. The
+        // only thing the batched VerifyVerificationVectors adds over the per-member
+        // VerifyVerificationVector check already run in PreVerifyMessage is detecting a
+        // coefficient point shared between two members' vvecs. Failing the whole batch on
+        // that lets one member, by placing a coefficient that collides with another
+        // member's, force every other honest member in the same verification batch to be
+        // marked invalid and complained about - a denial of service against their
+        // participation in the DKG. Instead, verify each contribution on its own: a member
+        // fails only if its own share is inconsistent with its own vvec, so a member that
+        // placed a colliding coefficient is caught on its own while the honest members it
+        // collided with verify normally.
+        LogPrint(BCLog::LLMQ_DKG, "CBLSWorker::%s -- batch verification-vector check failed; verifying %d contributions individually\n",
+                  __func__, vvecs.size());
+        std::vector<std::future<bool>> futures;
+        futures.reserve(vvecs.size());
+        for (size_t i = 0; i < vvecs.size(); i++) {
+            futures.emplace_back(AsyncVerifyContributionShare(forId, vvecs[i], skShares[i]));
+        }
         std::vector<bool> result;
-        result.assign(vvecs.size(), false);
+        result.reserve(vvecs.size());
+        for (auto& f : futures) {
+            result.push_back(f.get());
+        }
         doneCallback(result);
         return;
     }
diff --git a/src/test/bls_tests.cpp b/src/test/bls_tests.cpp
index 7b824db073ae..d448fa7e7a4c 100644
--- a/src/test/bls_tests.cpp
+++ b/src/test/bls_tests.cpp
@@ -6,6 +6,7 @@
 #include <bls/bls_batchverifier.h>
 #include <bls/bls_worker.h>
 #include <clientversion.h>
+#include <crypto/common.h>
 #include <random.h>
 #include <streams.h>
 #include <util/irange.h>
@@ -638,6 +639,64 @@ BOOST_AUTO_TEST_CASE(bls_verify_contribution_shares_honest_tests)
     FuncVerifyContributionSharesHonest(false);
 }
 
+// A duplicate coefficient point between two members' verification vectors must not fail the
+// other members' contributions. CBLSWorker::VerifyContributionShares() batches the members'
+// vvecs, and the batched VerifyVerificationVectors() check rejects a coefficient shared
+// between two vvecs. Failing the whole batch on that let one member, by copying another
+// member's coefficient into its own vvec, mark every honest member in the batch invalid.
+// The fix verifies each contribution against its own vvec, so only the member whose share no
+// longer matches its own vvec fails. Regression: on the old all-or-nothing code every entry
+// came back false, so the honest members verifying true is what distinguishes fixed from broken.
+void FuncVerifyContributionSharesDuplicateCoefficient(const bool legacy_scheme)
+{
+    bls::bls_legacy_scheme.store(legacy_scheme);
+
+    CBLSWorker worker;
+    worker.Start();
+
+    const int threshold = 2;
+    std::vector<CBLSId> ids;
+    for (int i = 0; i < 4; i++) {
+        uint256 id;
+        WriteLE64(id.begin(), i + 1);
+        ids.emplace_back(id);
+    }
+
+    // Three dealers each generate a verification vector and their secret-key shares to each id.
+    std::vector<BLSVerificationVectorPtr> vvecs(3);
+    std::vector<std::vector<CBLSSecretKey>> skShares(3);
+    for (int d = 0; d < 3; d++) {
+        BOOST_REQUIRE(worker.GenerateContributions(threshold, ids, vvecs[d], skShares[d]));
+    }
+
+    // Receiver R collects each dealer's share to it.
+    const size_t R = 0;
+    const CBLSId& recvId = ids[R];
+    std::vector<CBLSSecretKey> recvShares{skShares[0][R], skShares[1][R], skShares[2][R]};
+
+    // All honest: every contribution verifies.
+    std::vector<bool> ok = worker.VerifyContributionShares(recvId, vvecs, recvShares);
+    BOOST_REQUIRE_EQUAL(ok.size(), 3U);
+    BOOST_CHECK(ok[0] && ok[1] && ok[2]);
+
+    // Dealer 0 copies dealer 1's leading coefficient into its own vvec (a cross-member
+    // duplicate) without touching its share, making the batch vvec check fail.
+    vvecs[0]->at(0) = vvecs[1]->at(0);
+    std::vector<bool> res = worker.VerifyContributionShares(recvId, vvecs, recvShares);
+    BOOST_REQUIRE_EQUAL(res.size(), 3U);
+    BOOST_CHECK(!res[0]);  // the member that planted the duplicate is caught alone
+    BOOST_CHECK(res[1]);   // the honest member whose coefficient was copied is unaffected
+    BOOST_CHECK(res[2]);   // the other honest member is unaffected
+
+    worker.Stop();
+}
+
+BOOST_AUTO_TEST_CASE(bls_verify_contribution_shares_duplicate_coefficient_tests)
+{
+    FuncVerifyContributionSharesDuplicateCoefficient(true);
+    FuncVerifyContributionSharesDuplicateCoefficient(false);
+}
+
 // A dummy BLS object that satisfies the minimal interface expected by CBLSLazyWrapper.
 class DummyBLS
 {

From 2aa3a87275f50e243f938e73b74b213610b87304 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 02:35:06 +0000
Subject: [PATCH 06/51] fix(rpc): don't dereference a missing netInfo when
 decoding provider payloads

A ProRegTx or ProUpServTx payload with an unknown version stops
deserializing right after nVersion and leaves netInfo null. Such a
payload is still returned by GetTxPayload, so decoding a transaction
carrying it (decoderawtransaction, getrawtransaction verbose) reached
the JSON writer, which dereferenced netInfo for the "service" field.

Report "service" and "addresses" only when netInfo is present, in all
four provider JSON writers (ProRegTx, ProUpServTx, MN state, SML
entry). Payloads with a known version always carry a netInfo, so their
output is unchanged.

Not a backport: develop guards the same accesses differently (behind
-deprecatedrpc=service, with CHECK_NONFATAL), which does not apply to
v23.1.x. The unit test builds both payload types with version 0 and
0xffff, decodes them through TxToUniv and checks that the payload
object is emitted without the network fields.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/evo/core_write.cpp         | 22 ++++++++++++++--------
 src/test/evo_netinfo_tests.cpp | 33 +++++++++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 8 deletions(-)

diff --git a/src/evo/core_write.cpp b/src/evo/core_write.cpp
index b3e414d7c779..8c4930be8c7a 100644
--- a/src/evo/core_write.cpp
+++ b/src/evo/core_write.cpp
@@ -73,6 +73,16 @@ const std::map<std::string, RPCResult> RPCRESULT_MAP{{
     RESULT_MAP_ENTRY("votingAddress", RPCResult::Type::STR, "Dash address used for voting"),
 }};
 #undef RESULT_MAP_ENTRY
+
+/** A provider payload of unknown version stops deserializing before its netInfo, and such a payload can
+ *  be decoded from user-supplied hex (decoderawtransaction), so report the network fields only if present. */
+template <typename Obj>
+void PushNetInfoFields(UniValue& obj, const Obj& netinfo_holder, MnType type)
+{
+    if (!netinfo_holder.netInfo) return;
+    obj.pushKV("service", netinfo_holder.netInfo->GetPrimary().ToStringAddrPort());
+    obj.pushKV("addresses", GetNetInfoWithLegacyFields(netinfo_holder, type));
+}
 } // anonymous namespace
 
 RPCResult GetRpcResult(const std::string& key, bool optional, const std::string& override_name)
@@ -221,8 +231,7 @@ UniValue CDeterministicMNState::ToJson(MnType nType) const
 {
     UniValue obj(UniValue::VOBJ);
     obj.pushKV("version", nVersion);
-    obj.pushKV("service", netInfo->GetPrimary().ToStringAddrPort());
-    obj.pushKV("addresses", GetNetInfoWithLegacyFields(*this, nType));
+    PushNetInfoFields(obj, *this, nType);
     obj.pushKV("registeredHeight", nRegisteredHeight);
     obj.pushKV("lastPaidHeight", nLastPaidHeight);
     obj.pushKV("consecutivePayments", nConsecutivePayments);
@@ -304,8 +313,7 @@ UniValue CProRegTx::ToJson() const
     ret.pushKV("type", ToUnderlying(nType));
     ret.pushKV("collateralHash", collateralOutpoint.hash.ToString());
     ret.pushKV("collateralIndex", collateralOutpoint.n);
-    ret.pushKV("service", netInfo->GetPrimary().ToStringAddrPort());
-    ret.pushKV("addresses", GetNetInfoWithLegacyFields(*this, nType));
+    PushNetInfoFields(ret, *this, nType);
     ret.pushKV("ownerAddress", EncodeDestination(PKHash(keyIDOwner)));
     ret.pushKV("votingAddress", EncodeDestination(PKHash(keyIDVoting)));
     if (CTxDestination dest; ExtractDestination(scriptPayout, dest)) {
@@ -393,8 +401,7 @@ UniValue CProUpServTx::ToJson() const
     ret.pushKV("version", nVersion);
     ret.pushKV("type", ToUnderlying(nType));
     ret.pushKV("proTxHash", proTxHash.ToString());
-    ret.pushKV("service", netInfo->GetPrimary().ToStringAddrPort());
-    ret.pushKV("addresses", GetNetInfoWithLegacyFields(*this, nType));
+    PushNetInfoFields(ret, *this, nType);
     if (CTxDestination dest; ExtractDestination(scriptOperatorPayout, dest)) {
         ret.pushKV("operatorPayoutAddress", EncodeDestination(dest));
     }
@@ -527,8 +534,7 @@ UniValue CSimplifiedMNListEntry::ToJson(bool extended) const
     obj.pushKV("nType", ToUnderlying(nType));
     obj.pushKV("proRegTxHash", proRegTxHash.ToString());
     obj.pushKV("confirmedHash", confirmedHash.ToString());
-    obj.pushKV("service", netInfo->GetPrimary().ToStringAddrPort());
-    obj.pushKV("addresses", GetNetInfoWithLegacyFields(*this, nType));
+    PushNetInfoFields(obj, *this, nType);
     obj.pushKV("pubKeyOperator", pubKeyOperator.ToString());
     obj.pushKV("votingAddress", EncodeDestination(PKHash(keyIDVoting)));
     obj.pushKV("isValid", isValid);
diff --git a/src/test/evo_netinfo_tests.cpp b/src/test/evo_netinfo_tests.cpp
index a1df594c820b..23694ebc4454 100644
--- a/src/test/evo_netinfo_tests.cpp
+++ b/src/test/evo_netinfo_tests.cpp
@@ -6,7 +6,10 @@
 
 #include <chainparams.h>
 #include <clientversion.h>
+#include <core_io.h>
 #include <evo/netinfo.h>
+#include <evo/providertx.h>
+#include <primitives/transaction.h>
 #include <netbase.h>
 #include <streams.h>
 #include <util/pointer.h>
@@ -14,6 +17,10 @@
 
 #include <boost/test/unit_test.hpp>
 
+#include <limits>
+
+#include <univalue.h>
+
 BOOST_FIXTURE_TEST_SUITE(evo_netinfo_tests, BasicTestingSetup)
 
 struct TestEntry {
@@ -496,4 +503,30 @@ BOOST_AUTO_TEST_CASE(domainport_rules)
     }
 }
 
+
+// A provider payload of unknown version stops deserializing before its netInfo. Decoding such a
+// transaction (decoderawtransaction, getrawtransaction verbose) must not dereference the missing netInfo.
+BOOST_AUTO_TEST_CASE(decode_provider_payload_without_netinfo)
+{
+    for (const auto& [tx_type, payload_key] : {std::pair{TRANSACTION_PROVIDER_REGISTER, "proRegTx"},
+                                               std::pair{TRANSACTION_PROVIDER_UPDATE_SERVICE, "proUpServTx"}}) {
+        for (const uint16_t version : {uint16_t{0}, std::numeric_limits<uint16_t>::max()}) {
+            CMutableTransaction mtx;
+            mtx.nVersion = 3;
+            mtx.nType = tx_type;
+            CDataStream payload{SER_NETWORK, PROTOCOL_VERSION};
+            payload << version;
+            mtx.vExtraPayload.assign(UCharCast(payload.data()), UCharCast(payload.data() + payload.size()));
+
+            UniValue entry{UniValue::VOBJ};
+            TxToUniv(CTransaction{mtx}, /*block_hash=*/uint256{}, entry);
+            const UniValue& decoded{entry.find_value(payload_key)};
+            BOOST_REQUIRE(decoded.isObject());
+            BOOST_CHECK_EQUAL(decoded.find_value("version").getInt<int>(), version);
+            BOOST_CHECK(decoded.find_value("service").isNull());
+            BOOST_CHECK(decoded.find_value("addresses").isNull());
+        }
+    }
+}
+
 BOOST_AUTO_TEST_SUITE_END()

From 7fc0edbc5315774c65a226540f00a59515ad4675 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 05:32:46 +0000
Subject: [PATCH 07/51] doc(rpc): mark provider payload network fields optional
 in the help

A ProRegTx or ProUpServTx payload of unknown version is decoded without
"service" and "addresses" since the previous commit, so document both
as optional for those two payloads. MN state and SML entries always
carry a netInfo and keep them required.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/evo/core_write.cpp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/src/evo/core_write.cpp b/src/evo/core_write.cpp
index 8c4930be8c7a..f07a1b0ffc4e 100644
--- a/src/evo/core_write.cpp
+++ b/src/evo/core_write.cpp
@@ -292,8 +292,8 @@ RPCResult CProRegTx::GetJsonHelp(const std::string& key, bool optional)
         GetRpcResult("type"),
         GetRpcResult("collateralHash"),
         GetRpcResult("collateralIndex"),
-        GetRpcResult("service"),
-        GetRpcResult("addresses"),
+        GetRpcResult("service", /*optional=*/true),
+        GetRpcResult("addresses", /*optional=*/true),
         GetRpcResult("ownerAddress"),
         GetRpcResult("votingAddress"),
         GetRpcResult("payoutAddress", /*optional=*/true),
@@ -385,8 +385,8 @@ RPCResult CProUpServTx::GetJsonHelp(const std::string& key, bool optional)
         GetRpcResult("version"),
         GetRpcResult("type"),
         GetRpcResult("proTxHash"),
-        GetRpcResult("service"),
-        GetRpcResult("addresses"),
+        GetRpcResult("service", /*optional=*/true),
+        GetRpcResult("addresses", /*optional=*/true),
         GetRpcResult("operatorPayoutAddress", /*optional=*/true),
         GetRpcResult("platformNodeID", /*optional=*/true),
         GetRpcResult("platformP2PPort", /*optional=*/true),

From 33ec74e4fb85b0861e42f47a09a0908df097a877 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 05:33:59 +0000
Subject: [PATCH 08/51] fix(governance): cap the orphan parent objects
 re-requested per tick

Every 5 minutes NetGovernance re-requests the parent object of every
cached orphan vote from every connected peer. The orphan cache holds up
to a million votes, and after the previous commit an orphan vote still
only needs a valid masternode signature, which one masternode key can
produce for any number of invented parent hashes. Each such hash turns
into one MNGOVERNANCESYNC per peer per tick, so a single key could make
every node queue a send-buffer backlog proportional to (orphans x peers).

Return at most MAX_ORPHAN_OBJECT_REQUESTS (100) orphan parent hashes per
call, sampled at random so that ground parent hashes cannot pin which
ones get requested. 100 comfortably exceeds the number of governance
objects a synced node can legitimately be missing at once; the rest are
still picked on later ticks until the orphans expire, and the objects
themselves are also fetched through normal governance sync.

Not a backport: no equivalent bound exists on develop. The unit test
checks the returned set is complete up to the cap and exactly the cap
(distinct, all real orphan parents) beyond it, using a test-only
AddOrphanVoteForTesting helper next to AddGovernanceObjectForTesting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/governance/governance.cpp     | 16 +++++++++++++++
 src/governance/governance.h       |  9 +++++++-
 src/test/governance_inv_tests.cpp | 34 +++++++++++++++++++++++++++++++
 3 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/src/governance/governance.cpp b/src/governance/governance.cpp
index 4017f9c62ae1..a584aa8b2ef0 100644
--- a/src/governance/governance.cpp
+++ b/src/governance/governance.cpp
@@ -17,6 +17,7 @@
 #include <masternode/sync.h>
 #include <node/interface_ui.h>
 #include <protocol.h>
+#include <random.h>
 #include <shutdown.h>
 #include <spork.h>
 #include <timedata.h>
@@ -373,6 +374,15 @@ void CGovernanceManager::AddGovernanceObjectForTesting(const CGovernanceObject&
     mapObjects.emplace(govobj.GetHash(), std::make_shared<CGovernanceObject>(govobj));
 }
 
+void CGovernanceManager::AddOrphanVoteForTesting(const CGovernanceVote& vote)
+{
+    AssertLockNotHeld(cs_store);
+    LOCK(cs_store);
+    cmmapOrphanVotes.Insert(vote.GetParentHash(),
+                            vote_time_pair_t(vote, count_seconds(GetTime<std::chrono::seconds>() +
+                                                                 GOVERNANCE_ORPHAN_EXPIRATION_TIME)));
+}
+
 void CGovernanceManager::CheckAndRemove()
 {
     AssertLockNotHeld(cs_store);
@@ -1116,6 +1126,12 @@ std::vector<uint256> CGovernanceManager::GetOrphanVoteObjectHashes()
         }
     }
 
+    // A random subset, so that parent hashes ground to sort first cannot pin which ones are requested
+    if (vecHashesFiltered.size() > MAX_ORPHAN_OBJECT_REQUESTS) {
+        Shuffle(vecHashesFiltered.begin(), vecHashesFiltered.end(), FastRandomContext());
+        vecHashesFiltered.resize(MAX_ORPHAN_OBJECT_REQUESTS);
+    }
+
     return vecHashesFiltered;
 }
 
diff --git a/src/governance/governance.h b/src/governance/governance.h
index bef662c1de49..dc0a4bd7fd0f 100644
--- a/src/governance/governance.h
+++ b/src/governance/governance.h
@@ -332,6 +332,8 @@ class CGovernanceManager : public GovernanceStore, public GovernanceSignerParent
      *  running collateral or chain validation. */
     void AddGovernanceObjectForTesting(const CGovernanceObject& govobj)
         EXCLUSIVE_LOCKS_REQUIRED(!cs_store);
+    /** Test-only helper: caches a vote as an orphan of its parent without validating it. */
+    void AddOrphanVoteForTesting(const CGovernanceVote& vote) EXCLUSIVE_LOCKS_REQUIRED(!cs_store);
 
     // Superblocks
     bool GetSuperblockPayments(const CDeterministicMNList& tip_mn_list, int nBlockHeight,
@@ -374,7 +376,12 @@ class CGovernanceManager : public GovernanceStore, public GovernanceSignerParent
     // Used by NetGovernance
     std::vector<CInv> FetchRelayInventory() EXCLUSIVE_LOCKS_REQUIRED(!cs_relay);
     void CheckAndRemove() EXCLUSIVE_LOCKS_REQUIRED(!cs_store);
-    /** Get hashes of governance objects for which we have orphan votes. Also cleans up expired orphans. */
+    /** Upper bound on the orphan parent hashes GetOrphanVoteObjectHashes() returns per call. Each one is
+     *  re-requested from every peer, and one masternode key can sign votes for any number of invented
+     *  parent hashes. */
+    static constexpr size_t MAX_ORPHAN_OBJECT_REQUESTS{100};
+    /** Get hashes of governance objects for which we have orphan votes, at most
+     *  MAX_ORPHAN_OBJECT_REQUESTS of them chosen at random. Also cleans up expired orphans. */
     [[nodiscard]] std::vector<uint256> GetOrphanVoteObjectHashes() EXCLUSIVE_LOCKS_REQUIRED(!cs_store);
     std::pair<std::vector<uint256>, std::vector<uint256>> FetchGovernanceObjectVotes(
         size_t peers_per_hash_max, int64_t now, std::map<uint256, std::map<CService, int64_t>>& map_asked_recently) const
diff --git a/src/test/governance_inv_tests.cpp b/src/test/governance_inv_tests.cpp
index d55c428e937a..5a9831ecf012 100644
--- a/src/test/governance_inv_tests.cpp
+++ b/src/test/governance_inv_tests.cpp
@@ -26,9 +26,11 @@
 
 #include <boost/test/unit_test.hpp>
 
+#include <algorithm>
 #include <atomic>
 #include <chrono>
 #include <memory>
+#include <set>
 #include <thread>
 #include <vector>
 
@@ -494,4 +496,36 @@ BOOST_AUTO_TEST_CASE(governance_vote_authorization_survives_unsynced_drop)
     chainstate.ResetIbd();
 }
 
+
+// Every orphan parent hash is re-requested from every peer on each governance tick, and one
+// masternode key can sign votes for any number of invented parents, so the hashes requested per tick
+// must stay bounded.
+BOOST_AUTO_TEST_CASE(orphan_object_requests_are_capped_per_tick)
+{
+    constexpr size_t cap{CGovernanceManager::MAX_ORPHAN_OBJECT_REQUESTS};
+    std::set<uint256> parents;
+    const auto add_orphans = [&](size_t count) {
+        for (size_t i = 0; i < count; ++i) {
+            const uint256 parent{GetRandHash()};
+            parents.insert(parent);
+            m_node.govman->AddOrphanVoteForTesting(MakeGovernanceVote(parent));
+        }
+    };
+
+    // Up to the cap, every orphan parent is requested.
+    add_orphans(cap);
+    auto hashes{m_node.govman->GetOrphanVoteObjectHashes()};
+    BOOST_CHECK(std::set<uint256>(hashes.begin(), hashes.end()) == parents);
+
+    // Beyond it, each tick requests exactly cap distinct ones among them.
+    add_orphans(cap);
+    for (int tick = 0; tick < 2; ++tick) {
+        hashes = m_node.govman->GetOrphanVoteObjectHashes();
+        BOOST_CHECK_EQUAL(hashes.size(), cap);
+        const std::set<uint256> unique(hashes.begin(), hashes.end());
+        BOOST_CHECK_EQUAL(unique.size(), cap);
+        BOOST_CHECK(std::includes(parents.begin(), parents.end(), unique.begin(), unique.end()));
+    }
+}
+
 BOOST_AUTO_TEST_SUITE_END()

From 8030debbbec1ab84d07b8272d0b17fc0e5a471ff Mon Sep 17 00:00:00 2001
From: Konstantin Akimov <github@knstqq.com>
Date: Mon, 26 Oct 2026 17:00:20 +0000
Subject: [PATCH 09/51] Merge bitcoin/bitcoin#36669: refactor: store positions
 as a 64 bits integer in flatfiles

48092a9042d8fcfd6bb7ae5911a1d53b8746d546 flatfile: use 64-bit file positioning syscalls in Windows (Antoine Poinsot)
17556cb1f52fcbc807f65245101f72e8ec1573d8 flatfile: store position as a 64 bits integer (Antoine Poinsot)

Pull request description:

  That field is the last 32-bit in flat files management that is only bounded indirectly by callers' usage (unlike the file number for instance). In the spirit of the ongoing effort to avoid unnecessarily using 32 bits integers or platform specific types (for instance #24214, #33724, #34109, #35097, #35616), i was scanning for fields it could be prudent to promote to prevent any possible future misuse. This one is a good candidate because it does not change on-disk representation, since we serialize positions as varints.

ACKs for top commit:
  sedited:
    tACK 48092a9042d8fcfd6bb7ae5911a1d53b8746d546
  hebasto:
    ACK 48092a9042d8fcfd6bb7ae5911a1d53b8746d546, I have reviewed the code and it looks OK.
  instagibbs:
    ACK 48092a9042d8fcfd6bb7ae5911a1d53b8746d546
  l0rinc:
    tested ACK 48092a9042d8fcfd6bb7ae5911a1d53b8746d546

Tree-SHA512: 0f7a8e5b14cd13b56eb9b663e8d17e03abf94da2662332a24c802fc9c608b9acb1bae01e476502228e4a2cc65332fddd934b96ec7bdbe14fadc9ba3db08b1542

Co-authored-by: merge-script <fanquake@gmail.com>
---
 src/chain.h         |  8 ++++----
 src/flatfile.cpp    | 10 +++++-----
 src/flatfile.h      |  4 ++--
 src/util/system.cpp |  8 ++++----
 src/util/system.h   | 35 +++++++++++++++++++++++++++++++++--
 5 files changed, 48 insertions(+), 17 deletions(-)

diff --git a/src/chain.h b/src/chain.h
index 4236e5a7adff..94bc57797954 100644
--- a/src/chain.h
+++ b/src/chain.h
@@ -41,8 +41,8 @@ class CBlockFileInfo
 {
 public:
     unsigned int nBlocks{};      //!< number of blocks stored in file
-    unsigned int nSize{};        //!< number of used bytes of block file
-    unsigned int nUndoSize{};    //!< number of used bytes in the undo file
+    uint64_t nSize{};        //!< number of used bytes of block file
+    uint64_t nUndoSize{};    //!< number of used bytes in the undo file
     unsigned int nHeightFirst{}; //!< lowest height of block in file
     unsigned int nHeightLast{};  //!< highest height of block in file
     uint64_t nTimeFirst{};       //!< earliest time of block in file
@@ -150,10 +150,10 @@ class CBlockIndex
     int nFile GUARDED_BY(::cs_main){0};
 
     //! Byte offset within blk?????.dat where this block's data is stored
-    unsigned int nDataPos GUARDED_BY(::cs_main){0};
+    uint64_t nDataPos GUARDED_BY(::cs_main){0};
 
     //! Byte offset within rev?????.dat where this block's undo data is stored
-    unsigned int nUndoPos GUARDED_BY(::cs_main){0};
+    uint64_t nUndoPos GUARDED_BY(::cs_main){0};
 
     //! (memory only) Total amount of work (expected number of hashes) in the chain up to and including this block
     arith_uint256 nChainWork{};
diff --git a/src/flatfile.cpp b/src/flatfile.cpp
index 0fecf4f50499..d05fdced1705 100644
--- a/src/flatfile.cpp
+++ b/src/flatfile.cpp
@@ -44,7 +44,7 @@ FILE* FlatFileSeq::Open(const FlatFilePos& pos, bool read_only)
         LogPrintf("Unable to open file %s\n", fs::PathToString(path));
         return nullptr;
     }
-    if (pos.nPos && fseek(file, pos.nPos, SEEK_SET)) {
+    if (pos.nPos && FileSeek64(file, pos.nPos, SEEK_SET)) {
         LogPrintf("Unable to seek to position %u of %s\n", pos.nPos, fs::PathToString(path));
         fclose(file);
         return nullptr;
@@ -56,11 +56,11 @@ size_t FlatFileSeq::Allocate(const FlatFilePos& pos, size_t add_size, bool& out_
 {
     out_of_space = false;
 
-    unsigned int n_old_chunks = (pos.nPos + m_chunk_size - 1) / m_chunk_size;
-    unsigned int n_new_chunks = (pos.nPos + add_size + m_chunk_size - 1) / m_chunk_size;
+    uint64_t n_old_chunks = (pos.nPos + m_chunk_size - 1) / m_chunk_size;
+    uint64_t n_new_chunks = (pos.nPos + add_size + m_chunk_size - 1) / m_chunk_size;
     if (n_new_chunks > n_old_chunks) {
-        size_t old_size = pos.nPos;
-        size_t new_size = n_new_chunks * m_chunk_size;
+        uint64_t old_size = pos.nPos;
+        uint64_t new_size = n_new_chunks * m_chunk_size;
         size_t inc_size = new_size - old_size;
 
         if (CheckDiskSpace(m_dir, inc_size)) {
diff --git a/src/flatfile.h b/src/flatfile.h
index 9c0a1541eabf..be2344eaa12d 100644
--- a/src/flatfile.h
+++ b/src/flatfile.h
@@ -14,7 +14,7 @@
 struct FlatFilePos
 {
     int nFile{-1};
-    unsigned int nPos{0};
+    uint64_t nPos{0};
 
     SERIALIZE_METHODS(FlatFilePos, obj)
     {
@@ -23,7 +23,7 @@ struct FlatFilePos
 
     FlatFilePos() {}
 
-    FlatFilePos(int nFileIn, unsigned int nPosIn) :
+    FlatFilePos(int nFileIn, uint64_t nPosIn) :
         nFile(nFileIn),
         nPos(nPosIn)
     {}
diff --git a/src/util/system.cpp b/src/util/system.cpp
index d769dbd055be..0c284972a550 100644
--- a/src/util/system.cpp
+++ b/src/util/system.cpp
@@ -1255,9 +1255,9 @@ void DirectoryCommit(const fs::path &dirname)
 #endif
 }
 
-bool TruncateFile(FILE *file, unsigned int length) {
+bool TruncateFile(FILE *file, uint64_t length) {
 #if defined(WIN32)
-    return _chsize(_fileno(file), length) == 0;
+    return _chsize_s(_fileno(file), length) == 0;
 #else
     return ftruncate(fileno(file), length) == 0;
 #endif
@@ -1290,7 +1290,7 @@ int RaiseFileDescriptorLimit(int nMinFD) {
  * this function tries to make a particular range of a file allocated (corresponding to disk space)
  * it is advisory, and the range specified in the arguments will never contain live data
  */
-void AllocateFileRange(FILE *file, unsigned int offset, unsigned int length) {
+void AllocateFileRange(FILE *file, uint64_t offset, unsigned int length) {
 #if defined(WIN32)
     // Windows-specific version
     HANDLE hFile = (HANDLE)_get_osfhandle(_fileno(file));
@@ -1324,7 +1324,7 @@ void AllocateFileRange(FILE *file, unsigned int offset, unsigned int length) {
     // Fallback version
     // TODO: just write one byte per block
     static const char buf[65536] = {};
-    if (fseek(file, offset, SEEK_SET)) {
+    if (FileSeek64(file, offset, SEEK_SET)) {
         return;
     }
     while (length > 0) {
diff --git a/src/util/system.h b/src/util/system.h
index 08722d5f57bc..584e40f4e451 100644
--- a/src/util/system.h
+++ b/src/util/system.h
@@ -70,9 +70,40 @@ bool FileCommit(FILE *file);
  */
 void DirectoryCommit(const fs::path &dirname);
 
-bool TruncateFile(FILE *file, unsigned int length);
+bool TruncateFile(FILE *file, uint64_t length);
+
+/**
+ * 64-bit-clean file positioning.
+ *
+ * The wrapper is necessary for Windows, because `long` is only 32 bits there,
+ * even in 64-bit builds (LLP64).
+ */
+inline int FileSeek64(FILE* file, int64_t offset, int origin)
+{
+#if defined(WIN32)
+    return _fseeki64(file, offset, origin);
+#else
+    return fseeko(file, offset, origin);
+#endif
+}
+
+/**
+ * 64-bit-clean file positioning.
+ *
+ * The wrapper is necessary for Windows, because `long` is only 32 bits there,
+ * even in 64-bit builds (LLP64).
+ */
+inline int64_t FileTell64(FILE* file)
+{
+#if defined(WIN32)
+    return _ftelli64(file);
+#else
+    return ftello(file);
+#endif
+}
+
 int RaiseFileDescriptorLimit(int nMinFD);
-void AllocateFileRange(FILE *file, unsigned int offset, unsigned int length);
+void AllocateFileRange(FILE *file, uint64_t offset, unsigned int length);
 
 /**
  * Rename src to dest.

From 58abb28d9ce4977f4ea202728af7bb4fc77f86cf Mon Sep 17 00:00:00 2001
From: Konstantin Akimov <github@knstqq.com>
Date: Mon, 26 Oct 2026 16:03:11 +0000
Subject: [PATCH 10/51] Merge bitcoin/bitcoin#36665: sock: align exception
 monitoring between poll() and select() backends

1e0c407377034e9cbb4d52f1f534c06cdf202a36 sock: align exception monitoring between poll() and select() backends (Antoine Poinsot)

Pull request description:

  On non-Linux platforms, `WaitMany` monitors every socket for exceptional conditions, even when we are not looking to read from it. On Linux, it never monitors those.

  Monitoring for certain socket events on some platforms but not others is inconsistent and surprising. In this instance it probably means these cases receive less testing as well, since they are ignored on our most well-tested platform.

  Fix this issue by only monitoring for exceptional conditions (which is necessary to detect failed connection attempts early on Windows) for sockets we are also waiting to read from.

ACKs for top commit:
  vasild:
    ACK 1e0c407377034e9cbb4d52f1f534c06cdf202a36
  sedited:
    utACK 1e0c407377034e9cbb4d52f1f534c06cdf202a36
  instagibbs:
    ACK 1e0c407377034e9cbb4d52f1f534c06cdf202a36
  pinheadmz:
    ACK 1e0c407377034e9cbb4d52f1f534c06cdf202a36

Tree-SHA512: 58109efad8ad3bda6c76fa8fad8855e7337bbd54ca046b286940319de0a835d82a4eb66ccc052b23eb6a15840a90c4d29d2fd7345a6318471bc3d9826aab2d10

Co-authored-by: merge-script <fanquake@gmail.com>
---
 src/net.cpp       | 2 +-
 src/util/sock.cpp | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/net.cpp b/src/net.cpp
index f186489c743a..33aba24a5830 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -2347,7 +2347,7 @@ Sock::EventsPerSock CConnman::GenerateWaitSockets(Span<CNode* const> nodes)
     }
 
     for (CNode* pnode : nodes) {
-        bool select_recv = !pnode->fHasRecvData;
+        bool select_recv = !pnode->fHasRecvData && !pnode->fPauseRecv;
         bool select_send = !pnode->fCanSendData;
         if (!select_recv && !select_send) continue;
 
diff --git a/src/util/sock.cpp b/src/util/sock.cpp
index ddc8d437432e..d266009993c9 100644
--- a/src/util/sock.cpp
+++ b/src/util/sock.cpp
@@ -367,12 +367,14 @@ bool Sock::WaitManySelect(std::chrono::milliseconds timeout,
         const auto& s = sock;
         if (events.requested & RECV) {
             FD_SET(s, &recv);
+            FD_SET(s, &err);
         }
         if (events.requested & SEND) {
             FD_SET(s, &send);
         }
-        FD_SET(s, &err);
-        socket_max = std::max(socket_max, s);
+        if (events.requested & (RECV | SEND)) {
+            socket_max = std::max(socket_max, s);
+        }
     }
 
     timeval tv = MillisToTimeval(timeout);

From 7a217529808b3f2145ad1c198832b9ab317ca7e0 Mon Sep 17 00:00:00 2001
From: Konstantin Akimov <github@knstqq.com>
Date: Mon, 26 Oct 2026 16:47:35 +0000
Subject: [PATCH 11/51] Merge bitcoin/bitcoin#36667: net: enforce timeout
 interval for paused send peers

cc2534cdf7b14d0f1a18928ebaab7f7fdd7e839e net: enforce timeout interval for paused send peers (Antoine Poinsot)

Pull request description:

  Today it's possible to keep some peers running ancient versions paused for a long time. If such a peer is so slow to read as to not drain our send buffer down to the 1MB threshold within a reasonable time frame, we really shouldn't be wasting a connection slot on them. I picked 20 minutes as the reasonable time frame, since it's what we already use for ping timeouts today.

ACKs for top commit:
  instagibbs:
    ACK https://github.com/bitcoin/bitcoin/pull/36667/commits/cc2534cdf7b14d0f1a18928ebaab7f7fdd7e839e
  sedited:
    Re-ACK cc2534cdf7b14d0f1a18928ebaab7f7fdd7e839e
  l0rinc:
    tested ACK cc2534cdf7b14d0f1a18928ebaab7f7fdd7e839e

Tree-SHA512: 05e0ab6bc7908ea533612c5d4bf5757545936e18a056fa04448615ef096e9477f007bf241b311a888ef0570e31a227140305e4d4aec2687d2d88462df9bb2a1a

Co-authored-by: merge-script <fanquake@gmail.com>
---
 src/net.cpp | 19 +++++++++++++++++--
 src/net.h   |  2 ++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/net.cpp b/src/net.cpp
index 33aba24a5830..77068e1169ea 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -1768,7 +1768,11 @@ std::pair<size_t, bool> CConnman::SocketSendData(CNode& node) const
         }
     }
 
-    node.fPauseSend = node.m_send_memusage + node.m_transport->GetSendMemoryUsage() > nSendBufferMaxSize;
+    const bool pause_send{node.m_send_memusage + node.m_transport->GetSendMemoryUsage() > nSendBufferMaxSize};
+    if (pause_send && !node.fPauseSend) {
+        node.m_pause_send_since = GetTime<std::chrono::seconds>();
+    }
+    node.fPauseSend = pause_send;
 
     if (it == node.vSendMsg.end()) {
         assert(node.m_send_memusage == 0);
@@ -2326,6 +2330,14 @@ bool CConnman::InactivityCheck(const CNode& node) const
         return true;
     }
 
+    if (node.fPauseSend) {
+        const auto last_pause{node.m_pause_send_since.load()};
+        if (now > last_pause + TIMEOUT_INTERVAL) {
+            LogPrint(BCLog::NET, "send buffer full for %is peer=%d\n", count_seconds(now - last_pause), node.GetId());
+            return true;
+        }
+    }
+
     if (!node.fSuccessfullyConnected) {
         if (node.m_transport->GetInfo().transport_type == TransportProtocolType::DETECTING) {
             LogPrint(BCLog::NET, "V2 handshake timeout peer=%d\n", node.GetId());
@@ -4844,7 +4856,10 @@ void CConnman::PushMessage(CNode* pnode, CSerializedNetMsg&& msg)
 
         // Update memory usage of send buffer.
         pnode->m_send_memusage += msg.GetMemoryUsage();
-        if (pnode->m_send_memusage + pnode->m_transport->GetSendMemoryUsage() > nSendBufferMaxSize) pnode->fPauseSend = true;
+        if (pnode->m_send_memusage + pnode->m_transport->GetSendMemoryUsage() > nSendBufferMaxSize && !pnode->fPauseSend) {
+            pnode->m_pause_send_since = GetTime<std::chrono::seconds>();
+            pnode->fPauseSend = true;
+        }
         // Move message to vSendMsg queue.
         pnode->vSendMsg.push_back(std::move(msg));
         pnode->nSendMsgSize = pnode->vSendMsg.size();
diff --git a/src/net.h b/src/net.h
index 8434b06eae75..8ba847fc482d 100644
--- a/src/net.h
+++ b/src/net.h
@@ -804,6 +804,8 @@ class CNode
 
     std::atomic_bool fPauseRecv{false};
     std::atomic_bool fPauseSend{false};
+    /** When was fPauseSend last set from false to true */
+    std::atomic<std::chrono::seconds> m_pause_send_since{0s};
 
     std::atomic_bool fHasRecvData{false};
     std::atomic_bool fCanSendData{false};

From 58b9bce32692f37f3da18378586a28c5c96cf951 Mon Sep 17 00:00:00 2001
From: Konstantin Akimov <github@knstqq.com>
Date: Thu, 29 Oct 2026 12:42:54 +0700
Subject: [PATCH 12/51] fix: keep flat-file positions 64-bit clean at the
 remaining raw seek/tell sites

bitcoin#36669 widens FlatFilePos::nPos to 64 bits, but Dash still captures
the write position in WriteBlockToDisk and UndoWriteToDisk through a 32-bit
`long ftell()` and then narrows it with `(unsigned int)`. That cast is where
a position past 4 GiB wraps, and the `long` return is where Windows fails
past 2 GiB, so the widened field alone changes nothing at the write site.
Upstream dropped these lines when AutoFile started caching its position
(bitcoin#30884, bitcoin#31490), which Dash has not backported.

TxIndex::FindTx still seeks with a raw `fseek()` where upstream now goes
through AutoFile::seek(), itself a FileSeek64() wrapper.

Route both through FileTell64()/FileSeek64() and assign the position
without narrowing.
---
 src/index/txindex.cpp     | 2 +-
 src/node/blockstorage.cpp | 8 ++++----
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/index/txindex.cpp b/src/index/txindex.cpp
index 1a6a0cf7fe01..45636cb8cf2b 100644
--- a/src/index/txindex.cpp
+++ b/src/index/txindex.cpp
@@ -87,7 +87,7 @@ bool TxIndex::FindTx(const uint256& tx_hash, uint256& block_hash, CTransactionRe
     CBlockHeader header;
     try {
         file >> header;
-        if (fseek(file.Get(), postx.nTxOffset, SEEK_CUR)) {
+        if (FileSeek64(file.Get(), postx.nTxOffset, SEEK_CUR)) {
             return error("%s: fseek(...) failed", __func__);
         }
         file >> tx;
diff --git a/src/node/blockstorage.cpp b/src/node/blockstorage.cpp
index 76fd09843ac7..e2637f80feed 100644
--- a/src/node/blockstorage.cpp
+++ b/src/node/blockstorage.cpp
@@ -497,11 +497,11 @@ static bool UndoWriteToDisk(const CBlockUndo& blockundo, FlatFilePos& pos, const
     fileout << messageStart << nSize;
 
     // Write undo data
-    long fileOutPos = ftell(fileout.Get());
+    const int64_t fileOutPos{FileTell64(fileout.Get())};
     if (fileOutPos < 0) {
         return error("%s: ftell failed", __func__);
     }
-    pos.nPos = (unsigned int)fileOutPos;
+    pos.nPos = fileOutPos;
     fileout << blockundo;
 
     // calculate & write checksum
@@ -705,11 +705,11 @@ static bool WriteBlockToDisk(const CBlock& block, FlatFilePos& pos, const CMessa
     fileout << messageStart << nSize;
 
     // Write block
-    long fileOutPos = ftell(fileout.Get());
+    const int64_t fileOutPos{FileTell64(fileout.Get())};
     if (fileOutPos < 0) {
         return error("WriteBlockToDisk: ftell failed");
     }
-    pos.nPos = (unsigned int)fileOutPos;
+    pos.nPos = fileOutPos;
     fileout << block;
 
     return true;

From 46875501d12907e64a8f50b3a6ee540c6f55a29f Mon Sep 17 00:00:00 2001
From: Pasta <pasta@dashboost.org>
Date: Tue, 7 Jul 2026 12:24:55 -0500
Subject: [PATCH 13/51] Merge #7385: fix: reject invalid extended masternode
 net info

334198886a0f32399d48bdb576f831869aa5e32d test: cover invalid deserialized ExtNetInfo tx validation (PastaClaw)
44a536d58178600f0cf0e91f9a51bd1ae184ead0 fix: reject semantically invalid deserialized ExtNetInfo states (PastaClaw)

Pull request description:

  # Summary

  ## Issue being fixed or feature implemented

  Extended masternode net info loaded from serialized transaction payloads can
  contain semantic states that the in-memory builder rejects during normal
  construction. Validation should reject those states explicitly instead of
  relying on internal assertions.

  ## What was done?

  - Added a validation backstop for per-purpose extended net info entry limits.
  - Mapped semantically invalid extended net info states to stable transaction
    validation failures.
  - Added primitive coverage for deserialized duplicate entries, oversized
    per-purpose lists, and domain entries under non-HTTPS purposes.
  - Added transaction-level `CheckProRegTx` regression coverage for the same
    invalid deserialized net info states.

  ## How Has This Been Tested?

  Tested locally on macOS:

  ```text
  git diff HEAD~1..HEAD --check
  make -j6 src/test/test_dash
  ./src/test/test_dash --run_test=evo_netinfo_tests/extnetinfo_validate_deser
  ./src/test/test_dash --run_test=evo_netinfo_tests
  ./src/test/test_dash --run_test=evo_dip3_activation_tests/proregtx_rejects_invalid_deserialized_extnetinfo
  ./src/test/test_dash --run_test=evo_dip3_activation_tests
  ```

  Pre-PR automated code review was also run for
  `upstream/develop..fix/extnetinfo-validation` after the transaction-level
  coverage was added and returned `ship`.

  ## Breaking Changes

  None.

  ## Checklist

  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone
        _(for repository code-owners and collaborators only)_

ACKs for top commit:
  PastaPastaPasta:
    utACK 334198886a0f32399d48bdb576f831869aa5e32d

Tree-SHA512: 45600aef011ffa3266f2d15a10487b738b446775afc0d923508364ee686dc66b5731ab5150d2a2f202e3005687724a27996523e25d1027e5b3522cf0a1fcbac4
(cherry picked from commit 82d1492dd8bcf6b585de9dd0e85c86a793b97e35)

v23.1.x adaptation: dropped the transaction-level CheckProRegTx test added to
src/test/evo_deterministicmns_tests.cpp; it depends on the develop-only
TestChainV24SignalBeforeV19Setup fixture absent from v23.1.x. The fix and its
evo_netinfo_tests.cpp unit coverage are kept intact.
---
 src/evo/netinfo.cpp            |  5 +++
 src/evo/specialtxman.cpp       |  6 ++--
 src/test/evo_netinfo_tests.cpp | 63 ++++++++++++++++++++++++++++++++++
 3 files changed, 72 insertions(+), 2 deletions(-)

diff --git a/src/evo/netinfo.cpp b/src/evo/netinfo.cpp
index 3a8a920d46eb..9c766c0e82ef 100644
--- a/src/evo/netinfo.cpp
+++ b/src/evo/netinfo.cpp
@@ -595,6 +595,11 @@ NetInfoStatus ExtNetInfo::Validate() const
             // Purpose if present in map must have at least one entry
             return NetInfoStatus::Malformed;
         }
+        if (entries.size() > MAX_ENTRIES_EXTNETINFO) {
+            // Per-purpose entry count is bounded at insertion; a deserialized object
+            // may exceed it and must be rejected here
+            return NetInfoStatus::MaxLimit;
+        }
         if (HasAddrDuplicates(entries)) {
             return NetInfoStatus::Duplicate;
         }
diff --git a/src/evo/specialtxman.cpp b/src/evo/specialtxman.cpp
index cd1855440c6e..04fd43551515 100644
--- a/src/evo/specialtxman.cpp
+++ b/src/evo/specialtxman.cpp
@@ -786,11 +786,13 @@ static bool CheckService(const ProTx& proTx, TxValidationState& state)
         return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-bad");
     case NetInfoStatus::Success:
         return true;
-    // Shouldn't be possible during self-checks
+    // Reachable through a serialized netInfo that bypasses the in-memory builder's checks
     case NetInfoStatus::BadInput:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-entry");
     case NetInfoStatus::Duplicate:
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-dup-netinfo-entry");
     case NetInfoStatus::MaxLimit:
-        assert(false);
+        return state.Invalid(TxValidationResult::TX_BAD_SPECIAL, "bad-protx-netinfo-maxlimit");
     } // no default case, so the compiler can warn about missing cases
     assert(false);
 }
diff --git a/src/test/evo_netinfo_tests.cpp b/src/test/evo_netinfo_tests.cpp
index 23694ebc4454..2d2c0037d8f6 100644
--- a/src/test/evo_netinfo_tests.cpp
+++ b/src/test/evo_netinfo_tests.cpp
@@ -529,4 +529,67 @@ BOOST_AUTO_TEST_CASE(decode_provider_payload_without_netinfo)
     }
 }
 
+BOOST_FIXTURE_TEST_CASE(extnetinfo_validate_deser, RegTestingSetup)
+{
+    // The in-memory builder (AddEntry/ProcessCandidate) refuses duplicates, domains
+    // on non-HTTPS purposes, and lists exceeding MAX_ENTRIES_EXTNETINFO. None of those
+    // checks run on deserialization, so Validate() must catch them itself.
+    const uint16_t port{9998};
+
+    auto write_header = [](CDataStream& ds, size_t n_purposes) {
+        ds << uint8_t{1}; // current version
+        WriteCompactSize(ds, n_purposes);
+    };
+
+    {
+        // Two identical entries under the same purpose
+        CDataStream ds(SER_DISK, CLIENT_VERSION);
+        write_header(ds, 1);
+        ds << NetInfoPurpose::CORE_P2P;
+        WriteCompactSize(ds, 2);
+        const NetInfoEntry entry{LookupNumeric("1.1.1.1", port)};
+        BOOST_CHECK(entry.IsTriviallyValid());
+        ds << entry << entry;
+
+        ExtNetInfo netInfo;
+        ds >> netInfo;
+        BOOST_CHECK_EQUAL(netInfo.Validate(), NetInfoStatus::Duplicate);
+    }
+
+    {
+        // List exceeds MAX_ENTRIES_EXTNETINFO per purpose
+        CDataStream ds(SER_DISK, CLIENT_VERSION);
+        write_header(ds, 1);
+        ds << NetInfoPurpose::CORE_P2P;
+        WriteCompactSize(ds, MAX_ENTRIES_EXTNETINFO + 1);
+        for (size_t i = 1; i <= MAX_ENTRIES_EXTNETINFO + 1; ++i) {
+            const NetInfoEntry entry{LookupNumeric(strprintf("1.1.1.%d", i), port)};
+            BOOST_CHECK(entry.IsTriviallyValid());
+            ds << entry;
+        }
+
+        ExtNetInfo netInfo;
+        ds >> netInfo;
+        BOOST_CHECK_EQUAL(netInfo.Validate(), NetInfoStatus::MaxLimit);
+    }
+
+    {
+        // Domain entry under a non-PLATFORM_HTTPS purpose
+        DomainPort domain;
+        BOOST_CHECK_EQUAL(domain.Set("example.com", 443), DomainPort::Status::Success);
+        const NetInfoEntry entry{domain};
+        BOOST_CHECK(entry.IsTriviallyValid());
+
+        CDataStream ds(SER_DISK, CLIENT_VERSION);
+        write_header(ds, 1);
+        ds << NetInfoPurpose::CORE_P2P;
+        WriteCompactSize(ds, 1);
+        ds << entry;
+
+        ExtNetInfo netInfo;
+        ds >> netInfo;
+        BOOST_CHECK_EQUAL(netInfo.Validate(), NetInfoStatus::BadInput);
+    }
+}
+
 BOOST_AUTO_TEST_SUITE_END()

From 9739f356b5272f7a51f65f59c23a4fa2584fed02 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 1 Aug 2026 20:17:50 -0500
Subject: [PATCH 14/51] Merge #7488: fix: validate ProUpServTx nType at mempool
 acceptance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

7956e240565bc69d10e2ab5921b7622f2c10534d fix: address review feedback on ProUpServTx nType validation (UdjinM6)
51846b09b5fb71322438ab0b8dc0d6e6c2e0ac28 fix: validate ProUpServTx nType at mempool acceptance (pasta)
f33be3a1bb2229ee42ecc7871a975c802b71e6f6 test: reject ProUpServTx with invalid nType (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `CProUpServTx::IsTriviallyValid()` never validates `nType`, and `CheckProUpServTx()` never
  checks it against the registered masternode. `RebuildListFromBlock()` checks both
  (`specialtxman.cpp:395-425`).

  That asymmetry is a mempool-vs-block divergence. A ProUpServTx with an out-of-range `nType`,
  or one whose `nType` disagrees with the masternode it targets, is accepted into the mempool
  but can never be mined. Once such a transaction is in a miner's mempool, block assembly
  throws and `getblocktemplate` stops producing templates — for every node that accepted the
  transaction, from a single relayed message.

  ## What was done?

  Added, at mempool acceptance, the checks the block-connect path already performs:

  - `CProUpServTx::IsTriviallyValid()` rejects an out-of-range `nType` with `bad-protx-type`.
    This mirrors what `CProRegTx::IsTriviallyValid()` already does (`providertx.cpp:114`), so
    the two payload types are now consistent.
  - `CheckProUpServTx()` rejects `nType` mismatch against the registered masternode with
    `bad-protx-type-mismatch`. No separate range check is needed there: `GetValidatedPayload()`
    runs `IsTriviallyValid()` before the body, so an out-of-range `nType` is already gone by
    that point.

  Both reject reasons are deliberately identical to the ones the block path already uses, so a
  rejection reads the same regardless of which layer catches it.

  Additionally, the block path's own `IsValidMnType()` check was moved ahead of the
  `nType != dmn->nType` mismatch check in `RebuildListFromBlock()`. In its old position it was
  unreachable — `dmn->nType` is always in range, so an out-of-range payload `nType` always
  tripped the mismatch check first and was reported as `bad-protx-type-mismatch`. Block
  acceptance is unchanged; the same transactions are rejected either way. The reject reason is
  now the accurate one, and it matches what `IsTriviallyValid()` reports for the same payload.

  ### Why this is not a consensus change

  The block-connect path already rejected exactly these transactions, so nothing that was
  previously block-valid becomes block-invalid. The change only moves the rejection earlier,
  to the layer that was missing it. No transaction with these properties can exist in any
  chain's history, because it could never have been connected.

  ## How Has This Been Tested?

  Unit tests added in the commit *preceding* the fix:

  - `src/test/evo_trivialvalidation.cpp` — `proupserv_rejects_invalid_ntype`, covering
    `nType` values 42 and 65535.
  - `src/test/evo_deterministicmns_tests.cpp` — `proupserv_invalid_ntype_basic`, four cases:
    1. out-of-range `nType` fails trivial validation and never enters the mempool;
    2. valid-but-mismatched `nType` (Evo claimed for a Regular MN) fails contextual validation
       and mempool acceptance, with the `TxValidationResult` pinned so the peer punishment
       level cannot change unnoticed;
    3. the block path rejects a hand-built block for both reasons — `bad-protx-type` for the
       out-of-range value, `bad-protx-type-mismatch` for the valid-but-wrong one;
    4. a matching `nType` still reaches the mempool, guarding against over-rejection.

  Without the fix these produce 6 and 9 failures respectively; notably the mempool test shows
  the transaction being accepted, and the mismatch case reporting `protx-dup` instead of
  `bad-protx-type-mismatch`. With the fix, the full `evo_*` set (50 cases, including
  `evo_trivialvalidation` and `evo_dip3_activation_tests`) passes.

  Built and run on macOS/arm64 against current `develop`.

  ## Breaking Changes

  None. Relaying such a transaction now earns a `TX_CONSENSUS` rejection, which is the
  intended treatment — it could never have been mined.

  ## Known follow-up

  Coverage here is C++ unit level only. A functional test driving the divergence through a
  real miner's `getblocktemplate` would be a worthwhile addition; happy to add one in this PR
  if reviewers would prefer it before merge.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

Top commit has no ACKs.

Tree-SHA512: 71351474be7debd8abbe22a5dd00ca59cac7bfbab85201add8f50953ebd9a63da9281e0a732859ca0b4fc0c341019ab82557b25a0023f9fe54217f15157672a9

v23.1.x adaptation: kept the v23 `nVersion == ProTxVersion::ExtAddr` platform
gate (develop widened it to `>=`) and the v23
`IsVersionChangeValid(pindexPrev, tx.nType, ...)` signature. Dropped the
develop-only evo_trivialvalidation.cpp multipayout test context and the
develop-only hand-built-block test case; the nType test uses the v23
CreateProRegTx/FundTransaction/SignTransaction helpers and the v23 3-arg
IsTriviallyValid signature.
---
 src/evo/providertx.cpp                  |   3 +
 src/evo/specialtxman.cpp                |  14 ++-
 src/test/evo_deterministicmns_tests.cpp | 131 ++++++++++++++++++++++++
 3 files changed, 145 insertions(+), 3 deletions(-)

diff --git a/src/evo/providertx.cpp b/src/evo/providertx.cpp
index 8f97c5e53929..ec17492fdab8 100644
--- a/src/evo/providertx.cpp
+++ b/src/evo/providertx.cpp
@@ -171,6 +171,9 @@ bool CProUpServTx::IsTriviallyValid(gsl::not_null<const CBlockIndex*> pindexPrev
     if (nVersion < ProTxVersion::BasicBLS && nType == MnType::Evo) {
         return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-evo-version");
     }
+    if (!IsValidMnType(nType)) {
+        return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-type");
+    }
     if (netInfo->CanStorePlatform() != (nVersion == ProTxVersion::ExtAddr)) {
         return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-netinfo-version");
     }
diff --git a/src/evo/specialtxman.cpp b/src/evo/specialtxman.cpp
index 04fd43551515..981713af94c6 100644
--- a/src/evo/specialtxman.cpp
+++ b/src/evo/specialtxman.cpp
@@ -315,6 +315,9 @@ bool CSpecialTxProcessor::RebuildListFromBlock(const CBlock& block, gsl::not_nul
             if (!opt_proTx) {
                 return state.Invalid(BlockValidationResult::BLOCK_CONSENSUS, "bad-protx-payload");
             }
+            if (!IsValidMnType(opt_proTx->nType)) {
+                return state.Invalid(BlockValidationResult::BLOCK_CONSENSUS, "bad-protx-type");
+            }
 
             for (const auto& entry : opt_proTx->netInfo->GetEntries()) {
                 if (const auto service_opt{entry.GetAddrPort()}) {
@@ -339,9 +342,6 @@ bool CSpecialTxProcessor::RebuildListFromBlock(const CBlock& block, gsl::not_nul
             if (opt_proTx->nType != dmn->nType) {
                 return state.Invalid(BlockValidationResult::BLOCK_CONSENSUS, "bad-protx-type-mismatch");
             }
-            if (!IsValidMnType(opt_proTx->nType)) {
-                return state.Invalid(BlockValidationResult::BLOCK_CONSENSUS, "bad-protx-type");
-            }
 
             auto newState = std::make_shared<CDeterministicMNState>(*dmn->pdmnState);
             if (is_v24_deployed) {
@@ -1086,6 +1086,14 @@ bool CheckProUpServTx(const CTransaction& tx, gsl::not_null<const CBlockIndex*>
         return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-hash");
     }
 
+    // Mirror BuildNewListFromBlock: nType must match the registered MN. Without this check a
+    // mempool-accepted ProUpServTx can make CreateNewBlock fail. An out-of-range nType is already
+    // rejected by IsTriviallyValid, and dmn->nType is always in range, so no separate
+    // IsValidMnType check is reachable here.
+    if (opt_ptx->nType != dmn->nType) {
+        return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-protx-type-mismatch");
+    }
+
     if (!IsVersionChangeValid(pindexPrev, tx.nType, dmn->pdmnState->nVersion, opt_ptx->nVersion, chainman, state)) {
         // pass the state returned by the function above
         return false;
diff --git a/src/test/evo_deterministicmns_tests.cpp b/src/test/evo_deterministicmns_tests.cpp
index 2cedb92e444d..f46f1172d6a8 100644
--- a/src/test/evo_deterministicmns_tests.cpp
+++ b/src/test/evo_deterministicmns_tests.cpp
@@ -614,6 +614,129 @@ void FuncDIP3Protx(TestChainSetup& setup)
     const_cast<Consensus::Params&>(Params().GetConsensus()).DIP0003EnforcementHeight = DIP0003EnforcementHeightBackup;
 }
 
+// ProUpServTx with an out-of-range or mismatched nType must be rejected before
+// mempool acceptance. Historically IsTriviallyValid / CheckProUpServTx ignored nType while
+// BuildNewListFromBlock rejected it, so a single relayed tx stalled CreateNewBlock/getblocktemplate.
+void FuncProUpServInvalidNType(TestChainSetup& setup)
+{
+    auto& chainman = *Assert(setup.m_node.chainman.get());
+    auto& dmnman = *Assert(setup.m_node.dmnman);
+    auto tip_index = [&] { return WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()); };
+
+    auto utxos = BuildSimpleUtxoMap(setup.m_coinbase_txns);
+    const CScript coinbase_pk = GetScriptForRawPubKey(setup.coinbaseKey.GetPubKey());
+
+    CKey ownerKey;
+    CBLSSecretKey operatorKey;
+    auto tx_reg = CreateProRegTx(chainman.ActiveChain(), *(setup.m_node.mempool), utxos, /*port=*/1,
+                                 GenerateRandomAddress(), setup.coinbaseKey, ownerKey, operatorKey);
+    const uint256 proTxHash = tx_reg.GetHash();
+    setup.CreateAndProcessBlock({tx_reg}, coinbase_pk);
+    dmnman.UpdatedBlockTip(tip_index());
+    BOOST_REQUIRE(dmnman.GetListAtChainTip().HasMN(proTxHash));
+    BOOST_REQUIRE(dmnman.GetListAtChainTip().GetMN(proTxHash)->nType == MnType::Regular);
+
+    auto make_proupserv = [&](MnType nType) {
+        CProUpServTx proTx;
+        proTx.nVersion = ProTxVersion::GetMax(!bls::bls_legacy_scheme, /*is_extended_addr=*/false);
+        proTx.nType = nType;
+        proTx.netInfo = NetInfoInterface::MakeNetInfo(proTx.nVersion);
+        proTx.proTxHash = proTxHash;
+        BOOST_REQUIRE_EQUAL(proTx.netInfo->AddEntry(NetInfoPurpose::CORE_P2P, "1.1.1.1:42"), NetInfoStatus::Success);
+        if (nType == MnType::Evo) {
+            // Platform fields required by CheckProUpServTx when nType claims Evo.
+            proTx.platformNodeID.SetHex("00112233445566778899aabbccddeeff00112233");
+            proTx.platformP2PPort = 20001;
+            proTx.platformHTTPPort = 20002;
+        }
+
+        CMutableTransaction tx;
+        tx.nVersion = 3;
+        tx.nType = TRANSACTION_PROVIDER_UPDATE_SERVICE;
+        FundTransaction(chainman.ActiveChain(), tx, utxos, GetScriptForDestination(PKHash(setup.coinbaseKey.GetPubKey())),
+                        1 * COIN, setup.coinbaseKey);
+        // FundTransaction constructs a zero-fee tx; leave a small fee so ProcessTransaction
+        // reaches special-tx validation instead of failing on min-relay fee first.
+        BOOST_REQUIRE(!tx.vout.empty());
+        BOOST_REQUIRE(tx.vout[0].nValue > 10000);
+        tx.vout[0].nValue -= 10000;
+        proTx.inputsHash = CalcTxInputsHash(CTransaction(tx));
+        proTx.sig = operatorKey.Sign(::SerializeHash(proTx), bls::bls_legacy_scheme);
+        SetTxPayload(tx, proTx);
+        SignTransaction(*(setup.m_node.mempool), tx, setup.coinbaseKey);
+        return tx;
+    };
+
+    // Case 1: out-of-range nType. Must fail trivial validation and never enter the mempool.
+    {
+        auto tx = make_proupserv(static_cast<MnType>(42));
+        auto opt_payload = GetTxPayload<CProUpServTx>(tx, /*assert_type=*/false);
+        BOOST_REQUIRE(opt_payload.has_value());
+
+        TxValidationState trivial_state;
+        BOOST_CHECK(!opt_payload->IsTriviallyValid(tip_index(), chainman, trivial_state));
+        BOOST_CHECK_EQUAL(trivial_state.GetRejectReason(), "bad-protx-type");
+
+        TxValidationState check_state;
+        {
+            LOCK(cs_main);
+            BOOST_CHECK(!CheckProUpServTx(CTransaction(tx), tip_index(), dmnman, chainman, check_state, /*check_sigs=*/true));
+        }
+        BOOST_CHECK_EQUAL(check_state.GetRejectReason(), "bad-protx-type");
+
+        {
+            LOCK(cs_main);
+            const MempoolAcceptResult result = chainman.ProcessTransaction(MakeTransactionRef(tx));
+            BOOST_CHECK(result.m_result_type == MempoolAcceptResult::ResultType::INVALID);
+            BOOST_CHECK_EQUAL(result.m_state.GetRejectReason(), "bad-protx-type");
+        }
+    }
+
+    // Case 2: valid-range but mismatched nType (claim Evo for a Regular MN). Must fail contextual checks.
+    {
+        auto tx = make_proupserv(MnType::Evo);
+        auto opt_payload = GetTxPayload<CProUpServTx>(tx, /*assert_type=*/false);
+        BOOST_REQUIRE(opt_payload.has_value());
+
+        // Trivial validation accepts Evo as a valid type; contextual validation must still reject.
+        TxValidationState trivial_state;
+        BOOST_CHECK(opt_payload->IsTriviallyValid(tip_index(), chainman, trivial_state));
+
+        TxValidationState check_state;
+        {
+            LOCK(cs_main);
+            BOOST_CHECK(!CheckProUpServTx(CTransaction(tx), tip_index(), dmnman, chainman, check_state, /*check_sigs=*/true));
+        }
+        BOOST_CHECK_EQUAL(check_state.GetRejectReason(), "bad-protx-type-mismatch");
+        BOOST_CHECK(check_state.GetResult() == TxValidationResult::TX_CONSENSUS);
+
+        {
+            LOCK(cs_main);
+            const MempoolAcceptResult result = chainman.ProcessTransaction(MakeTransactionRef(tx));
+            BOOST_CHECK(result.m_result_type == MempoolAcceptResult::ResultType::INVALID);
+            BOOST_CHECK_EQUAL(result.m_state.GetRejectReason(), "bad-protx-type-mismatch");
+            BOOST_CHECK(result.m_state.GetResult() == TxValidationResult::TX_CONSENSUS);
+        }
+    }
+
+    // Case 3: the matching nType is still accepted, i.e. the new checks reject nothing legitimate.
+    {
+        auto tx = make_proupserv(MnType::Regular);
+        TxValidationState check_state;
+        {
+            LOCK(cs_main);
+            BOOST_CHECK_MESSAGE(CheckProUpServTx(CTransaction(tx), tip_index(), dmnman, chainman, check_state,
+                                                 /*check_sigs=*/true),
+                                "unexpected rejection: " << check_state.GetRejectReason());
+        }
+
+        LOCK(cs_main);
+        const MempoolAcceptResult result = chainman.ProcessTransaction(MakeTransactionRef(tx));
+        BOOST_CHECK_MESSAGE(result.m_result_type == MempoolAcceptResult::ResultType::VALID,
+                            "unexpected rejection: " << result.m_state.GetRejectReason());
+    }
+}
+
 void FuncTestMempoolReorg(TestChainSetup& setup)
 {
     auto& chainman = *Assert(setup.m_node.chainman.get());
@@ -1087,6 +1210,14 @@ BOOST_AUTO_TEST_CASE(dip3_protx_basic)
     FuncDIP3Protx(setup);
 }
 
+// Requires BasicBLS so ProUpServTx serialises nType. Pre-fix this test fails because
+// IsTriviallyValid / CheckProUpServTx accept out-of-range and mismatched nType.
+BOOST_AUTO_TEST_CASE(proupserv_invalid_ntype_basic)
+{
+    TestChainV19Setup setup;
+    FuncProUpServInvalidNType(setup);
+}
+
 BOOST_AUTO_TEST_CASE(test_mempool_reorg_legacy)
 {
     TestChainDIP3Setup setup;

From bb09c49d745900b98eac1cb07034810bcd6aee39 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 6 Aug 2026 19:27:56 -0500
Subject: [PATCH 15/51] Merge #7532: fix: bound DYNBITSET allocation against
 remaining stream size
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

aa1447f7e7b76bde0dac841f920ecc20476a0aea serialize: require SizedStream for ReadFixedBitSet instead of duck-typing it (pasta)
9f026a92b7a8e8dae0fedbadc4204d45ef031c24 fix: bound DYNBITSET allocation against remaining stream size (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `ReadFixedBitSet` allocated from a wire-declared `CompactSize` with no bound beyond `ReadCompactSize`'s 33,554,432 cap. Roughly five bytes on the wire — a `CompactSize` claiming millions of bits, with no payload following — therefore forced a `std::vector<bool>` resize plus a byte buffer totalling several MiB, all of which was only abandoned when the subsequent short read threw.

  `MAX_PROTOCOL_MESSAGE_LENGTH` does not help here, because the attack uses an *undersized* message.

  The primitive is reachable from an unauthenticated `QFCOMMITMENT` via `CFinalCommitment`'s `signers` and `validMembers` bitsets, and applies to every other `DYNBITSET` caller as well.

  This was split out of [#7523](https://github.com/dashpay/dash/pull/7523), where it was bundled with a much larger and more contentious DKG-intake change. The bound stands on its own, so it is offered separately for independent review.

  ## What was done?

  Bound the declared length against the bytes actually remaining in the stream, before allocating anything. A well-formed message always carries exactly the required bytes, so this rejects only claims that could never have been satisfied.

  The guard needs the stream to report how many bytes are still available, so `ReadFixedBitSet` is constrained on a `SizedStream` concept. That constraint is deliberately a hard requirement rather than a fallback: a stream without `size()` — `CHashVerifier`, for instance — now fails to compile here instead of silently deserializing an unbounded bitset. An earlier revision duck-typed the check with `if constexpr`, which would have let a future caller quietly lose the bound with no diagnostic.

  Nothing in tree is affected, because every stream that reaches this path already reports bytes *remaining*: `DataStream` (`vch.size() - m_read_pos`), `SpanReader`, and `OverrideStream`, which forwards to its wrapped stream. That "remaining, not total" requirement is what the bound rests on, so it is documented on the concept itself — a stream whose `size()` meant something else would weaken the bound silently rather than fail to compile.

  Note on what is deliberately *not* included: an earlier revision also checked `nbytes > MAX_SIZE`. That check is dead code — `size` comes from `ReadCompactSize`, which already caps at 33,554,432, so `(size + 7) / 8` can never exceed 4 MiB and the condition is always false.

  ## How Has This Been Tested?

  `src/test/serialize_tests.cpp` covers the amplification case (a declared length far exceeding the remaining stream must be rejected *before* allocating, not by a short read afterwards) and a maximum-size bitset (`MAX_SIZE`, 33,554,432 bits) round-tripping unchanged.

  Built locally and `test_dash --run_test=serialize_tests` passes. Full validation is delegated to CI.

  ## Breaking Changes

  None. Only messages declaring a bit count that the message could not possibly contain are affected, and those were never valid.

  ## Checklist:

  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

ACKs for top commit:
  knst:
    utACK aa1447f7e7b76bde0dac841f920ecc20476a0aea

Tree-SHA512: 0b7da754ac61d1aa21e6c3fcf75c6986f69f6e0f90d51b9061cf45b03909bdf77d6b125f5f3665976aeca8defe361300bc465789347cac927895433c90a035ae
(cherry picked from commit 4c33e7374d7b0669d861e5da610d113dc5aa3e66)
---
 src/serialize.h              | 23 +++++++++++++++--
 src/test/serialize_tests.cpp | 48 ++++++++++++++++++++++++++++++++++++
 2 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/src/serialize.h b/src/serialize.h
index 6aa00985312a..13127ff06803 100644
--- a/src/serialize.h
+++ b/src/serialize.h
@@ -435,12 +435,31 @@ void WriteFixedBitSet(Stream& s, const std::vector<bool>& vec, size_t size)
     s.write(AsBytes(Span{vBytes}));
 }
 
-template<typename Stream>
+/** A stream that can report how many bytes are still available to read.
+ *
+ * size() must mean bytes *remaining*, not the total the stream ever held. ReadFixedBitSet
+ * relies on that to bound a wire-declared bit count before allocating, so a stream whose
+ * size() means anything else would silently weaken the bound rather than fail to compile.
+ */
+template<typename S>
+concept SizedStream = requires(const S& s) { { s.size() } -> std::convertible_to<size_t>; };
+
+template<SizedStream Stream>
 void ReadFixedBitSet(Stream& s, std::vector<bool>& vec, size_t size)
 {
+    const size_t nbytes = (size + 7) / 8;
+    // Bound the wire-declared length against the bytes actually left in the stream before
+    // allocating anything. Otherwise a handful of bytes declaring millions of bits forces a
+    // multi-megabyte resize and zero-fill that is only abandoned when the short read throws.
+    // A well-formed message always carries exactly the required bytes, so this rejects only
+    // claims that could never have been satisfied.
+    if (nbytes > s.size()) {
+        throw std::ios_base::failure("ReadFixedBitSet(): declared size exceeds remaining bytes");
+    }
+
     vec.resize(size);
 
-    std::vector<uint8_t> vBytes((size + 7) / 8);
+    std::vector<uint8_t> vBytes(nbytes);
     s.read(AsWritableBytes(Span{vBytes}));
     for (size_t p = 0; p < size; p++)
         vec[p] = (vBytes[p / 8] & (1 << (p % 8))) != 0;
diff --git a/src/test/serialize_tests.cpp b/src/test/serialize_tests.cpp
index a51b98a1ba80..0c89b1eddd86 100644
--- a/src/test/serialize_tests.cpp
+++ b/src/test/serialize_tests.cpp
@@ -10,8 +10,10 @@
 
 #include <stdint.h>
 
+#include <ios>
 #include <limits>
 #include <stdexcept>
+#include <string>
 #include <string_view>
 #include <vector>
 
@@ -183,6 +185,52 @@ BOOST_AUTO_TEST_CASE(vector_bool)
     BOOST_CHECK(SerializeHash(vec1) == SerializeHash(vec2));
 }
 
+
+//! The message the bound throws. Matching it exactly keeps these tests from passing on an
+//! unrelated short read, which is the very failure mode the bound replaces.
+static constexpr std::string_view BOUND_REJECTION{"declared size exceeds remaining bytes"};
+
+/**
+ * DYNBITSET must not allocate from an attacker-declared CompactSize when the remaining stream
+ * is far too small to hold the claimed bit payload. A handful of bytes claiming ~1e6 bits is
+ * the amplification primitive: ReadCompactSize permits up to 33,554,432, which would resize a
+ * std::vector<bool> to ~4 MiB and allocate another ~4 MiB byte buffer before the short read
+ * throws. The claim below is deliberately modest so the pre-fix path also stays safe on CI.
+ */
+BOOST_AUTO_TEST_CASE(dynbitset_rejects_oversized_declared_length)
+{
+    constexpr uint64_t kClaimedBits = 1'000'000;
+
+    CDataStream s(SER_NETWORK, PROTOCOL_VERSION);
+    WriteCompactSize(s, kClaimedBits);
+    // No bit payload follows, so the remaining size is zero.
+
+    std::vector<bool> bits;
+    BOOST_CHECK_EXCEPTION(s >> DYNBITSET(bits), std::ios_base::failure,
+                          HasReason(std::string{BOUND_REJECTION}));
+    // Rejection has to precede the resize, so the destination must still hold its exact
+    // pre-deserialization state. Merely falling short of the declared size would also be
+    // satisfied by an allocation that happened and was then abandoned.
+    BOOST_CHECK(bits.empty());
+}
+
+/** The largest bit count accepted by ReadCompactSize must still round-trip unchanged. */
+BOOST_AUTO_TEST_CASE(dynbitset_accepts_maximum_size)
+{
+    constexpr size_t kSize = MAX_SIZE;
+    std::vector<bool> original(kSize, false);
+    for (size_t i = 0; i < kSize; i += 3) {
+        original[i] = true;
+    }
+
+    CDataStream s(SER_NETWORK, PROTOCOL_VERSION);
+    s << DYNBITSET(original);
+
+    std::vector<bool> decoded;
+    s >> DYNBITSET(decoded);
+    BOOST_CHECK(decoded == original);
+}
+
 BOOST_AUTO_TEST_CASE(noncanonical)
 {
     // Write some non-canonical CompactSize encodings, and

From dfa7db17da0bab4a4ac80ec984e7c420de173ead Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Fri, 7 Aug 2026 13:55:39 -0500
Subject: [PATCH 16/51] Merge #7518: fix: memoize governance vote signature
 checks to bound govsync cost

3b03544f209c2bf54aeaa83419603e230506049c fix: memoize governance vote signature checks to bound govsync cost (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `CGovernanceManager::GetSyncableVoteInvs()` walks every stored vote for a requested object and calls `CGovernanceVote::IsValid()`, which unconditionally re-runs full cryptographic verification via `CheckSignature()` - ECDSA recovery for proposal funding votes, or a BLS pairing (~1 ms) for operator-key votes. Those signatures were already verified at acceptance in `CGovernanceObject::ProcessVote`, so the work is pure waste.

  The walk is driven by the P2P `MNGOVERNANCESYNC` handler and runs on the single message-handler thread while holding `cs_store` and `govobj.cs`. On a mainnet trigger with thousands of masternode votes this is seconds of pairing work per request, stalling all P2P message processing.

  Any unauthenticated peer can trigger it once the victim is synced. The existing `CNetFulfilledRequestManager` quota does not help: it is keyed on `peer.addr`, a `CService` that **includes the ephemeral source port**, and it is per-object, so it is bypassed by reconnecting or by cycling through other known objects.

  ## What was done?

  - Add a signature-verification memo to `CGovernanceVote`, keyed on the verification key, `GetSignatureHash()` and the signature bytes. `GetSignatureHash()` is a `SerializeHash` over exactly the fields that `GetSignatureString()` signs, so the memo cannot be bypassed by mutating a covered field, and key-type confusion is not possible.
  - Add `CGovernanceObjectVoteFile::ForEachVote()` so `GetSyncableVoteInvs` visits the stored votes in place instead of `GetVotes()` copies, which would discard the memo on every walk.

  **On the fulfilled-request quota:** an alternative fix - keying the govsync throttle on IP rather than the full `CService` - was tried and deliberately abandoned. The quota map is shared with SyncManager's per-peer outbound bookkeeping and is coupled to `PeerMisbehaving(20)`; collapsing NAT-colocated honest peers onto one key would let one attacker get the others discouraged, and it breaks mnsync in tests where every node is on 127.0.0.1. A regression test (`fulfilled_request_manager_is_port_sensitive`) now pins port-sensitivity as the intended behaviour so this trade is not re-attempted by accident.

  **Known remaining gap:** the residual per-request cost is still O(votes) under `cs_store` - a `SerializeHash`, a bloom `contains` and a masternode lookup per vote - with no working rate limit, and a cold cache after restart pays full price once. A proper request-rate or work budget on `MNGOVERNANCESYNC`, keyed per `CNode` rather than per `CService`, is still needed and is not attempted here.

  ## How Has This Been Tested?

  New unit-test file `src/test/governance_vote_sync_tests.cpp`:

  - `fulfilled_request_manager_is_port_sensitive` - pins the govsync fulfilled-request quota as port-keyed (see above).
  - `vote_signature_verification_is_cached` - a verdict is memoised per key and a different key is a different question.
  - `stored_vote_file_reuses_signature_cache` - the `AddVote` copy carries the memo warmed by `ProcessVote`'s pre-check, so sync walks answer from it.
  - `signature_cache_invalidated_by_signed_field_mutation` - mutating a signed field (`SetTime`) leaves no usable memo; the next check re-verifies and rejects.
  - `signature_cache_does_not_confuse_key_types` - a BLS verdict is never served to the `CKeyID` overload or vice versa.

  Full build and test validation is delegated to CI on this PR; the changes were not built locally.

  ## Breaking Changes

  None.

  ## Checklist:

  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

Top commit has no ACKs.

Tree-SHA512: 8613865346502d6b96fae2e93e38334c04f95e52158a7191fa76652b24fe508321f2ba32c343ab34a7b9b210f540fb35292fb60268ff763683bd8a631c55b2fb
(cherry picked from commit 16afc23aaf5ec969903716ecb0dc211342cd2cb4)
---
 src/Makefile.test.include               |   1 +
 src/governance/governance.cpp           |  11 +-
 src/governance/vote.cpp                 |  68 +++++++-
 src/governance/vote.h                   |  45 ++++++
 src/governance/votedb.h                 |  10 ++
 src/test/governance_vote_sync_tests.cpp | 201 ++++++++++++++++++++++++
 6 files changed, 324 insertions(+), 12 deletions(-)
 create mode 100644 src/test/governance_vote_sync_tests.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index 6e0a964521ca..e82f90df3e2c 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -121,6 +121,7 @@ BITCOIN_TESTS =\
   test/getarg_tests.cpp \
   test/governance_inv_tests.cpp \
   test/governance_validators_tests.cpp \
+  test/governance_vote_sync_tests.cpp \
   test/governance_vote_wire_tests.cpp \
   test/coinjoin_inouts_tests.cpp \
   test/coinjoin_dstxmanager_tests.cpp \
diff --git a/src/governance/governance.cpp b/src/governance/governance.cpp
index a584aa8b2ef0..b4dcb4ce2178 100644
--- a/src/governance/governance.cpp
+++ b/src/governance/governance.cpp
@@ -656,17 +656,20 @@ std::vector<CInv> CGovernanceManager::GetSyncableVoteInvs(const uint256& nProp,
 
     const auto& govobj = *Assert(it->second);
     LOCK(govobj.cs);
-    const auto& fileVotes = govobj.GetVoteFile();
-    for (const auto& vote : fileVotes.GetVotes()) {
+    // Visit the stored votes in place: CheckSignature memoises its verdict on
+    // the vote instance, and a GetVotes() copy would discard that memo, so every
+    // walk would pay a fresh ECDSA recovery or BLS pairing per vote.
+    invs.reserve(govobj.GetVoteFile().GetVoteCount());
+    govobj.GetVoteFile().ForEachVote([&](const CGovernanceVote& vote) {
         uint256 nVoteHash = vote.GetHash();
 
         bool onlyVotingKeyAllowed = govobj.GetObjectType() == GovernanceObject::PROPOSAL && vote.GetSignal() == VOTE_SIGNAL_FUNDING;
 
         if (filter.contains(nVoteHash) || !vote.IsValid(tip_mn_list, onlyVotingKeyAllowed)) {
-            continue;
+            return;
         }
         invs.emplace_back(MSG_GOVERNANCE_OBJECT_VOTE, nVoteHash);
-    }
+    });
 
     return invs;
 }
diff --git a/src/governance/vote.cpp b/src/governance/vote.cpp
index 91556dbfd4a5..e700e99473bf 100644
--- a/src/governance/vote.cpp
+++ b/src/governance/vote.cpp
@@ -19,6 +19,42 @@
 static_assert(CGovernanceVote::COMPACT_SIG_SIZE == CPubKey::COMPACT_SIGNATURE_SIZE);
 static_assert(CGovernanceVote::BLS_SIG_SIZE == CBLSSignature::SerSize);
 
+namespace {
+//! Hash the inputs that determine the verification result. Dropping any of them
+//! breaks the memo; see CGovernanceVote::SignatureMemo.
+uint256 SignatureCacheKey(const CKeyID& key, const uint256& sigHash, const std::vector<unsigned char>& vchSig)
+{
+    HashWriter ss{};
+    ss << key << sigHash << vchSig;
+    return ss.GetHash();
+}
+
+//! The BLS verdict is always computed with VerifyInsecure(..., /*specificLegacyScheme=*/false),
+//! so the key must be fingerprinted under that same scheme. Serializing via operator<< would
+//! instead use the mutable bls_legacy_scheme global, and a legacy encoding of P can equal the
+//! basic encoding of -P. Across an activation or a reorg that flips the global, a verdict cached
+//! for one key could then be served for the other.
+uint256 SignatureCacheKey(const CBLSPublicKey& key, const uint256& sigHash,
+                          const std::vector<unsigned char>& vchSig)
+{
+    HashWriter ss{};
+    const auto key_bytes = key.ToBytes(/*specificLegacyScheme=*/false);
+    ss.write(MakeByteSpan(key_bytes));
+    ss << sigHash << vchSig;
+    return ss.GetHash();
+}
+} // namespace
+
+std::optional<bool> CGovernanceVote::GetMemoisedVerdict(const CKeyID& keyID) const
+{
+    return m_sig_memo.Lookup(SignatureCacheKey(keyID, GetSignatureHash(), vchSig));
+}
+
+std::optional<bool> CGovernanceVote::GetMemoisedVerdict(const CBLSPublicKey& pubKey) const
+{
+    return m_sig_memo.Lookup(SignatureCacheKey(pubKey, GetSignatureHash(), vchSig));
+}
+
 std::string CGovernanceVoting::ConvertOutcomeToString(vote_outcome_enum_t nOutcome)
 {
     static const std::map<vote_outcome_enum_t, std::string> mapOutcomeString = {
@@ -127,33 +163,49 @@ uint256 CGovernanceVote::GetHash() const
 
 bool CGovernanceVote::CheckSignature(const CKeyID& keyID) const
 {
+    const uint256 sigHash{GetSignatureHash()};
+    const uint256 fingerprint{SignatureCacheKey(keyID, sigHash, vchSig)};
+    if (const auto memoised{m_sig_memo.Lookup(fingerprint)}) {
+        return *memoised;
+    }
+
     std::string strError;
+    bool valid{false};
 
     // Harden Spork6 so that it is active on testnet and no other networks
     if (Params().NetworkIDString() == CBaseChainParams::TESTNET) {
-        if (!CHashSigner::VerifyHash(GetSignatureHash(), keyID, vchSig, strError)) {
+        valid = CHashSigner::VerifyHash(sigHash, keyID, vchSig, strError);
+        if (!valid) {
             LogPrint(BCLog::GOBJECT, "CGovernanceVote::IsValid -- VerifyHash() failed, error: %s\n", strError);
-            return false;
         }
     } else {
-        if (!CMessageSigner::VerifyMessage(keyID, vchSig, GetSignatureString(), strError)) {
+        valid = CMessageSigner::VerifyMessage(keyID, vchSig, GetSignatureString(), strError);
+        if (!valid) {
             LogPrint(BCLog::GOBJECT, "CGovernanceVote::IsValid -- VerifyMessage() failed, error: %s\n", strError);
-            return false;
         }
     }
 
-    return true;
+    m_sig_memo.Store(fingerprint, valid);
+    return valid;
 }
 
 bool CGovernanceVote::CheckSignature(const CBLSPublicKey& pubKey) const
 {
+    const uint256 sigHash{GetSignatureHash()};
+    const uint256 fingerprint{SignatureCacheKey(pubKey, sigHash, vchSig)};
+    if (const auto memoised{m_sig_memo.Lookup(fingerprint)}) {
+        return *memoised;
+    }
+
     CBLSSignature sig;
     sig.SetBytes(vchSig, false);
-    if (!sig.VerifyInsecure(pubKey, GetSignatureHash(), false)) {
+    const bool valid{sig.VerifyInsecure(pubKey, sigHash, false)};
+    if (!valid) {
         LogPrintf("CGovernanceVote::CheckSignature -- VerifyInsecure() failed\n");
-        return false;
     }
-    return true;
+
+    m_sig_memo.Store(fingerprint, valid);
+    return valid;
 }
 
 bool CGovernanceVote::IsValid(const CDeterministicMNList& tip_mn_list, bool useVotingKey) const
diff --git a/src/governance/vote.h b/src/governance/vote.h
index 773c4ef4802a..8355cdb36cfb 100644
--- a/src/governance/vote.h
+++ b/src/governance/vote.h
@@ -11,6 +11,8 @@
 #include <uint256.h>
 #include <util/string.h>
 
+#include <optional>
+
 class CBLSPublicKey;
 class CDeterministicMNList;
 class CGovernanceVote;
@@ -81,6 +83,44 @@ class CGovernanceVote
     const uint256 hash{0};
     void UpdateHash() const;
 
+    /**
+     * Result of the last CheckSignature call, so that re-verifying an unchanged
+     * vote costs a hash instead of an ECDSA recovery or a BLS pairing.
+     *
+     * The fingerprint covers the key, the signature hash and the signature
+     * bytes, so a hit means this exact verification already ran. Answering from
+     * a bare "already checked" flag would be wrong two ways: the same vote gets
+     * checked against different keys (voting vs operator, and operator keys
+     * rotate), and a vote can be modified after verification, which would
+     * otherwise keep its stale verdict.
+     */
+    class SignatureMemo
+    {
+        std::optional<uint256> m_fingerprint;
+        bool m_valid{false};
+
+    public:
+        std::optional<bool> Lookup(const uint256& fingerprint) const
+        {
+            if (m_fingerprint != fingerprint) return std::nullopt;
+            return m_valid;
+        }
+
+        void Store(const uint256& fingerprint, bool valid)
+        {
+            m_fingerprint = fingerprint;
+            m_valid = valid;
+        }
+    };
+
+    /**
+     * Memory only, and not internally synchronised. Shared votes live in
+     * CGovernanceObjectVoteFile, reachable only through
+     * CGovernanceObject::GetVoteFile() under the object's cs; every other vote
+     * has a single owner.
+     */
+    mutable SignatureMemo m_sig_memo;
+
 public:
     CGovernanceVote() = default;
     CGovernanceVote(const COutPoint& outpointMasternodeIn, const uint256& nParentHashIn, vote_signal_enum_t eVoteSignalIn, vote_outcome_enum_t eVoteOutcomeIn);
@@ -104,6 +144,11 @@ class CGovernanceVote
     bool CheckSignature(const CKeyID& keyID) const;
     bool CheckSignature(const CBLSPublicKey& pubKey) const;
     bool IsValid(const CDeterministicMNList& tip_mn_list, bool useVotingKey) const;
+
+    /** The memoised verdict for this key, or nullopt if the next CheckSignature
+     *  with it would have to run the cryptography. */
+    std::optional<bool> GetMemoisedVerdict(const CKeyID& keyID) const;
+    std::optional<bool> GetMemoisedVerdict(const CBLSPublicKey& pubKey) const;
     std::string GetSignatureString() const
     {
         return masternodeOutpoint.ToStringShort() + "|" + nParentHash.ToString() + "|" +
diff --git a/src/governance/votedb.h b/src/governance/votedb.h
index 169196cb9ff8..3f518bb7f550 100644
--- a/src/governance/votedb.h
+++ b/src/governance/votedb.h
@@ -65,6 +65,16 @@ class CGovernanceObjectVoteFile
 
     std::vector<CGovernanceVote> GetVotes() const;
 
+    /** Visit the stored votes in place, so callers warm and reuse the per-vote
+     *  signature memo instead of discarding it with a GetVotes() copy. Takes a
+     *  callback rather than returning the list: the caller's lock on the owning
+     *  object's cs cannot be expressed on a returned reference. */
+    template <typename Fn>
+    void ForEachVote(Fn&& fn) const
+    {
+        for (const auto& vote : listVotes) fn(vote);
+    }
+
     void RemoveVotesFromMasternode(const COutPoint& outpointMasternode);
     std::set<uint256> RemoveInvalidVotes(const CDeterministicMNList& tip_mn_list, const COutPoint& outpointMasternode, bool fProposal);
 
diff --git a/src/test/governance_vote_sync_tests.cpp b/src/test/governance_vote_sync_tests.cpp
new file mode 100644
index 000000000000..b6e06e5b8a8c
--- /dev/null
+++ b/src/test/governance_vote_sync_tests.cpp
@@ -0,0 +1,201 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <bls/bls.h>
+#include <governance/vote.h>
+#include <governance/votedb.h>
+#include <key.h>
+#include <netaddress.h>
+#include <netfulfilledman.h>
+#include <primitives/transaction.h>
+#include <pubkey.h>
+#include <uint256.h>
+
+#include <test/util/setup_common.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <cstdint>
+#include <string>
+
+namespace {
+//! A vote carrying a valid BLS operator signature over its own signed content.
+CGovernanceVote MakeSignedVote(const CBLSSecretKey& sk, const COutPoint& outpoint, const uint256& parent,
+                               vote_signal_enum_t signal, int64_t time)
+{
+    CGovernanceVote vote{outpoint, parent, signal, VOTE_OUTCOME_YES};
+    vote.SetTime(time);
+    vote.SetSignature(sk.Sign(vote.GetSignatureHash(), /*legacy_scheme=*/false).ToByteVector(/*legacy=*/false));
+    return vote;
+}
+} // namespace
+
+BOOST_FIXTURE_TEST_SUITE(governance_vote_sync_tests, BasicTestingSetup)
+
+// CNetFulfilledRequestManager must stay keyed on the full CService, port included.
+//
+// It is tempting to strip the port: peer.addr carries the remote ephemeral source
+// port for inbound peers, so the govsync quota is per-connection and an attacker
+// resets it by reconnecting. But this map is shared with SyncManager's per-peer
+// outbound bookkeeping ("full-sync", "governance-sync", "spork-sync",
+// "mempool-sync") and the govsync quota is coupled to PeerMisbehaving(20).
+// Several honest nodes legitimately share one address (NAT, colocation, CI), and
+// collapsing them onto one key makes the second honest peer look like a repeat
+// offender -- the ban score escalates to discouragement, and mnsync breaks
+// outright (feature_governance.py, where every node is on 127.0.0.1).
+//
+// This test pins port-sensitivity as the intended behaviour. Bounding the cost
+// of a single vote-sync request is a separate problem from this quota.
+BOOST_AUTO_TEST_CASE(fulfilled_request_manager_is_port_sensitive)
+{
+    in_addr ipv4{};
+    ipv4.s_addr = htonl(0x0a000001); // 10.0.0.1
+    const CService peer_a{CNetAddr{ipv4}, /*port=*/40000};
+    const CService peer_b{CNetAddr{ipv4}, /*port=*/40001};
+
+    CNetFulfilledRequestManager fulfilled;
+    BOOST_REQUIRE(fulfilled.LoadCache(/*load_cache=*/false));
+
+    const std::string request{"mngovernancesync-votes-deadbeef"};
+    BOOST_CHECK(!fulfilled.HasFulfilledRequest(peer_a, request));
+    fulfilled.AddFulfilledRequest(peer_a, request);
+    BOOST_CHECK(fulfilled.HasFulfilledRequest(peer_a, request));
+
+    // A different peer on the same host must NOT inherit peer_a's quota, or it
+    // would be misbehaviour-scored for its own first request.
+    BOOST_CHECK_MESSAGE(!fulfilled.HasFulfilledRequest(peer_b, request),
+                        "distinct peers sharing an address must not share a fulfilled-request quota");
+
+    // Per-peer cleanup must likewise not disturb the other peer's entries.
+    fulfilled.AddFulfilledRequest(peer_b, request);
+    fulfilled.RemoveAllFulfilledRequests(peer_b);
+    BOOST_CHECK(!fulfilled.HasFulfilledRequest(peer_b, request));
+    BOOST_CHECK(fulfilled.HasFulfilledRequest(peer_a, request));
+}
+
+// Every vote-sync request walks the stored votes and calls IsValid/CheckSignature
+// on each one, so an unchanged vote checked against the same key must reuse its
+// memoised verdict instead of paying for another BLS pairing or ECDSA recovery.
+BOOST_AUTO_TEST_CASE(vote_signature_verification_is_cached)
+{
+    CBLSSecretKey sk;
+    sk.MakeNewKey();
+    const CBLSPublicKey pk{sk.GetPublicKey()};
+
+    CGovernanceVote vote{MakeSignedVote(sk, COutPoint{uint256S("01"), /*n=*/0}, uint256S("02"), VOTE_SIGNAL_VALID,
+                                        1'700'000'000)};
+
+    // Nothing memoised yet, so the first check has to run the pairing.
+    BOOST_CHECK(!vote.GetMemoisedVerdict(pk).has_value());
+
+    BOOST_REQUIRE(vote.CheckSignature(pk));
+    BOOST_CHECK(vote.GetMemoisedVerdict(pk) == true);
+
+    // A different operator key is a different question: it must not be answered
+    // from the memo, and checking it takes the single slot.
+    CBLSSecretKey sk_other;
+    sk_other.MakeNewKey();
+    const CBLSPublicKey pk_other{sk_other.GetPublicKey()};
+    BOOST_CHECK(!vote.GetMemoisedVerdict(pk_other).has_value());
+    BOOST_CHECK(!vote.CheckSignature(pk_other));
+    BOOST_CHECK(vote.GetMemoisedVerdict(pk_other) == false);
+    BOOST_CHECK(!vote.GetMemoisedVerdict(pk).has_value());
+
+    // Re-checking the original key repopulates it.
+    BOOST_REQUIRE(vote.CheckSignature(pk));
+    BOOST_CHECK(vote.GetMemoisedVerdict(pk) == true);
+}
+
+// The cache must live on the vote instances stored in CGovernanceObjectVoteFile,
+// not on ephemeral GetVotes() copies, so repeated sync walks stay cheap.
+BOOST_AUTO_TEST_CASE(stored_vote_file_reuses_signature_cache)
+{
+    CBLSSecretKey sk;
+    sk.MakeNewKey();
+    const CBLSPublicKey pk{sk.GetPublicKey()};
+
+    CGovernanceVote vote{MakeSignedVote(sk, COutPoint{uint256S("11"), /*n=*/1}, uint256S("22"), VOTE_SIGNAL_DELETE,
+                                        1'700'000'100)};
+
+    CGovernanceObjectVoteFile file;
+    // Pre-check so AddVote stores a vote whose cache is already warm — the same
+    // sequence ProcessVote uses (IsValid then AddVote).
+    BOOST_REQUIRE(vote.CheckSignature(pk));
+    file.AddVote(vote);
+    BOOST_REQUIRE_EQUAL(file.GetVoteCount(), 1);
+
+    // The stored instance must carry the warm memo, so a sync walk answers from
+    // it rather than re-running the pairing for every vote it visits.
+    file.ForEachVote([&](const CGovernanceVote& stored) {
+        BOOST_CHECK_MESSAGE(stored.GetMemoisedVerdict(pk) == true,
+                            "the stored vote lost the memo warmed before AddVote");
+        BOOST_REQUIRE(stored.CheckSignature(pk));
+        BOOST_CHECK(stored.GetMemoisedVerdict(pk) == true);
+    });
+}
+
+// The memo must never be keyed on the verification key alone. nTime is part of
+// the signed payload (GetSignatureString/SerializeHash) but is mutable via
+// SetTime(), which governance.cpp and object.cpp call on reconstructed votes
+// before verifying them. A key-only memo would return the stale "valid" verdict
+// for content that was never signed -- a signature-check bypass.
+BOOST_AUTO_TEST_CASE(signature_cache_invalidated_by_signed_field_mutation)
+{
+    CBLSSecretKey sk;
+    sk.MakeNewKey();
+    const CBLSPublicKey pk{sk.GetPublicKey()};
+
+    CGovernanceVote vote{MakeSignedVote(sk, COutPoint{uint256S("33"), /*n=*/2}, uint256S("44"), VOTE_SIGNAL_FUNDING,
+                                        1'700'000'200)};
+
+    BOOST_REQUIRE(vote.CheckSignature(pk));
+
+    // Mutate a signed field. The signature no longer covers this content, so the
+    // very next check with the *same* key must re-verify and reject.
+    vote.SetTime(1'700'009'999);
+    BOOST_CHECK_MESSAGE(!vote.GetMemoisedVerdict(pk).has_value(),
+                        "mutating a signed field must leave no usable memo");
+    BOOST_CHECK_MESSAGE(!vote.CheckSignature(pk),
+                        "mutating a signed field must invalidate the signature memo");
+
+    // Restoring the original signed content makes the vote valid again.
+    vote.SetTime(1'700'000'200);
+    BOOST_CHECK(vote.CheckSignature(pk));
+}
+
+// The two CheckSignature overloads (CKeyID / CBLSPublicKey) share one memo slot.
+// A verdict produced by the BLS overload must never be served to the ECDSA
+// overload or vice versa: the key types serialise to different lengths and
+// contents, so the derived cache keys must differ. If they ever collided, a
+// BLS-valid vote would be reported valid for an unrelated voting key -- a
+// signature-check bypass across key types.
+BOOST_AUTO_TEST_CASE(signature_cache_does_not_confuse_key_types)
+{
+    CBLSSecretKey sk;
+    sk.MakeNewKey();
+    const CBLSPublicKey pk{sk.GetPublicKey()};
+
+    CGovernanceVote vote{MakeSignedVote(sk, COutPoint{uint256S("55"), /*n=*/3}, uint256S("66"), VOTE_SIGNAL_VALID,
+                                        1'700'000'300)};
+
+    // Warm the memo with a *valid* BLS verdict.
+    BOOST_REQUIRE(vote.CheckSignature(pk));
+
+    // Now ask the ECDSA overload. The BLS signature is not a valid compact ECDSA
+    // signature for any CKeyID, so this must re-verify and reject rather than
+    // inherit the cached "valid".
+    CKey ecdsa_key;
+    ecdsa_key.MakeNewKey(/*fCompressedIn=*/true);
+    const CKeyID keyid{ecdsa_key.GetPubKey().GetID()};
+
+    BOOST_CHECK_MESSAGE(!vote.GetMemoisedVerdict(keyid).has_value(),
+                        "a BLS verdict must not be visible to the CKeyID overload");
+    BOOST_CHECK_MESSAGE(!vote.CheckSignature(keyid),
+                        "a BLS verdict must not be reused by the CKeyID overload");
+
+    // And the BLS verdict must still be reachable afterwards (recomputed, not corrupted).
+    BOOST_CHECK(vote.CheckSignature(pk));
+}
+
+BOOST_AUTO_TEST_SUITE_END()

From c077d32d6d375378fb0ffc584fcb2efe63770d58 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Fri, 7 Aug 2026 15:44:47 -0500
Subject: [PATCH 17/51] Merge #7527: fix: require a valid masternode signature
 before caching an orphan governance vote
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

1e37fc4c369ff543c4a41af054965e1607d1b188 fix: only accept the voting key for funding votes in the orphan-vote gate (pasta)
1a510252b76102654239192edc89ee15f4e1cda9 fix: require a valid masternode signature before caching an orphan vote (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `CGovernanceManager::ProcessVote()` caches votes whose parent governance object is not yet
  in `mapObjects` ("orphan votes") into `cmmapOrphanVotes`, keyed by the vote's `nParentHash`.
  Today the insert happens **before any masternode-membership or signature check**, and the
  exception raised carries a zero misbehaviour penalty. The only thing standing between a peer
  and that cache is the announce-then-request tracker in `src/governance/net_governance.cpp`
  (the peer has to INV the vote hash first). Nothing about the vote's contents is verified.

  So a peer can put arbitrary unvalidated attacker-chosen data into a node's governance cache
  and pay nothing for it, and the node will additionally emit an `MNGOVERNANCESYNC` request for
  the invented parent hash. Caching unverified peer data is the wrong default regardless of how
  much of it fits.

  Note also that the same garbage vote is scored differently depending on whether its parent
  object happens to have arrived: with a parent present, `CGovernanceObject::ProcessVote`
  rejects an unknown masternode with `GOVERNANCE_EXCEPTION_PERMANENT_ERROR` / penalty 20;
  without a parent, the identical vote is silently cached with penalty 0.

  ## What was done?

  In the orphan branch of `CGovernanceManager::ProcessVote`, require the vote to carry a valid
  signature from a masternode present in the tip list before it may enter `cmmapOrphanVotes`:

  ```cpp
  if (!vote.IsValidForUnknownParent(tip_mn_list)) {
      // GOVERNANCE_EXCEPTION_PERMANENT_ERROR, penalty 20
  }
  ```

  Notes on the specifics:

  * **The existing validator is called rather than re-implementing its checks inline.**
    `CGovernanceVote::IsValid` already performs the future-time check, the signal/outcome bounds
    checks, the `GetMNByCollateral` lookup and the signature verification. Duplicating those
    inline would guarantee they drift apart from the known-object path over time.
  * **Key selection is signal-aware** (`CGovernanceVote::IsValidForUnknownParent`). Which key is
    correct depends on the parent object's type and the vote signal (`onlyVotingKeyAllowed` in
    `CGovernanceObject::ProcessVote`): only `PROPOSAL` + `VOTE_SIGNAL_FUNDING` may ever use the
    voting key; every other signal requires the operator BLS key for every object type. So for a
    funding vote — whose parent type is by definition unknown on this path — either key is
    accepted, while all other signals are checked against the operator key only. This matters
    because the voting key is the lower-trust credential (routinely delegated to third-party
    voting services): without the signal check, a voting-key holder could cache non-funding votes
    that can never validate once their parent arrives. A funding vote on a non-proposal object
    still gets re-checked against the operator-key requirement at replay time.
  * **Penalty 20 / `GOVERNANCE_EXCEPTION_PERMANENT_ERROR`** matches exactly what
    `CGovernanceObject::ProcessVote` already applies for an unknown masternode or a failed
    `IsValid` on the known-object path, so the same bad vote now costs the sender the same
    either way.
  * **The orphan branch itself stays at penalty 0.** Once the gate passes, reaching that branch
    means the vote is signed by a masternode and the only reason it cannot be applied is that
    its parent has not arrived — a benign relay race that happens routinely during governance
    sync. Misbehaviour scores never decay, so scoring there would eventually disconnect honest
    relays.
  * **Gate rejections are deliberately not inserted into `cmapInvalidVotes`.** That would make
    replays cheaper to reject, but `cmapInvalidVotes` is sized `MAX_CACHE_SIZE = 1'000'000` and
    caching gate rejections would create a *new* unauthenticated path for filling it with
    attacker-chosen entries — i.e. exactly the class of problem this change is meant to reduce.
  * `m_dmnman.GetListAtChainTip()` is hoisted to the top of `ProcessVote` so both the orphan gate
    and the known-object path share a single call; previously it was fetched inline at the
    `govobj.ProcessVote` call site.

  **On verifying signatures under `cs_store`:** this is not a new class of work under that lock.
  The known-object path already does exactly this — `CGovernanceManager::ProcessVote` holds
  `cs_store` across `govobj.ProcessVote(...)`, which calls `vote.IsValid(...)` at
  `src/governance/object.cpp:458`. This change applies the established pattern to the orphan
  branch. It does add up to two verifications for a vote that fails both, but only on the orphan
  path and only for peers that already passed the announce-then-request gate.

  ### What this does and does not fix

  This is a validation change. It does **not** close the underlying resource-exhaustion issue on
  `cmmapOrphanVotes`, for four reasons worth stating plainly:

  1. **A valid masternode signature is not scarce.** `nParentHash` *is* covered by the signature
     (see `GetSignatureString()` and the `SER_GETHASH` serialization in `src/governance/vote.h`),
     but nothing ties the signed parent hash to an object that actually exists. Any one of the
     ~4000 masternode keys can sign an unbounded number of votes naming invented parent hashes,
     and each one lands in a distinct cache slot.
  2. **That path is penalty-0 by design** (see above), so a flood of well-signed orphan votes is
     unscored on purpose.
  3. **Misbehaviour scoring is suppressed while `!IsSynced()`** — see the `m_node_sync.IsSynced()`
     condition guarding `PeerMisbehaving` in `net_governance.cpp` — which is precisely the window
     in which orphan votes are most common.
  4. **Per-masternode vote rate limiting is unreachable here.** `GOVERNANCE_UPDATE_MIN` is
     enforced inside `CGovernanceObject::ProcessVote`, i.e. after the parent lookup, and it is
     explicitly disabled on replay (`ScopedLockBool guard(cs_store, fRateChecksEnabled, false)`
     in `CheckOrphanVotes`).

  What it does buy: the cost of entry into the orphan cache goes from *free for any
  unauthenticated peer* to *requires a masternode key*, and garbage votes that previously
  vanished into the cache unscored are now scoreable — consistently with the known-object path.
  That is correct hygiene, but the bound on the data structure is what actually caps the damage.
  Bounding/expiring the cache is complementary work and is being handled separately in #7517 and
  #7526; this PR is intentionally independent of both and will conflict with them textually.

  One known side effect is deliberately left out of scope here.
  `CGovernanceVote::CheckSignature(const CBLSPublicKey&)` logs its failure with an unconditional
  `LogPrintf`, unlike its `CKeyID` sibling and unlike the rest of `IsValid`, which use
  `LogPrint(BCLog::GOBJECT, ...)`. Reaching it previously required a vote naming a governance object
  we actually have; after the gate, a vote naming an invented parent hash reaches it too, so a peer
  holding a real masternode outpoint (public data) plus a garbage signature can write a line to
  debug.log per message without `-debug` being set. Putting that log behind the `gobject` category
  is a one-word fix but touches an unrelated file, so it is not bundled here.

  ## How Has This Been Tested?

  Built with `--enable-debug --enable-suppress-external-warnings --without-gui` on
  aarch64-apple-darwin (clang).

  New unit tests in `src/test/governance_inv_tests.cpp`:

  * `orphan_votes_require_a_valid_masternode_signature` — a vote naming an outpoint that is not in
    the tip masternode list, delivered by a peer that legitimately announced it, does not enter
    the orphan cache (`GetOrphanVoteObjectHashes()` stays empty), triggers no `MNGOVERNANCESYNC`
    request for the invented parent, and scores the sender 20.
  * `invalid_vote_is_scored_alike_with_and_without_a_parent_object` — the same unauthenticated
    vote costs 20 whether or not its parent object is present, i.e. the orphan gate and
    `CGovernanceObject::ProcessVote` agree.

  Two existing tests were updated. `governance_votes_require_peer_announcement_or_request` and
  `governance_vote_authorization_survives_unsynced_drop` previously used "an `MNGOVERNANCESYNC`
  was emitted" as the observable proving that a vote reached `ProcessVote`; the votes they build
  carry a placeholder signature, so under this change they no longer reach the orphan branch and
  no such message is sent. They now use the misbehaviour score as the observable instead: a peer
  that passes the announce-then-request gate reaches `ProcessVote` and is scored 20, while a peer
  that fails the gate returns before `ProcessVote` and stays at 0. That is a stricter test of the
  authorization gate than the old one — it distinguishes "reached `ProcessVote`" from "did not"
  rather than relying on an incidental side effect. Both now advance `mn_sync` to
  `MASTERNODE_SYNC_FINISHED`, since penalties are only applied once `IsSynced()`.

  Coverage limit, stated plainly: `GovernanceInvSetup` is a `TestingSetup{MAIN}` fixture with no
  chain and therefore an empty deterministic masternode list, so `CGovernanceVote::IsValid`
  short-circuits on the `GetMNByCollateral` lookup before reaching `CheckSignature`. These tests
  therefore prove that the gate exists, runs on the orphan path, rejects a vote no masternode
  could have authored, and scores it identically to the known-object path — but they do not
  exercise `CheckSignature` itself, in either direction. Covering that (a registered masternode
  with a forged signature rejected, and one with a valid signature still accepted into the orphan
  cache) needs a chain-backed fixture with a real ProRegTx, which would mean rebuilding this
  fixture on `TestChainSetup` and is deliberately not attempted here. The positive path is
  covered end-to-end by `feature_governance.py`, which votes with real masternodes.

  The new assertions were verified to fail against unmodified code: with the change to
  `governance.cpp` reverted and the tests kept, the suite reports 7 failures, including
  `check m_node.govman->GetOrphanVoteObjectHashes().empty() has failed` and
  `check CountQueuedMessages(*peer, NetMsgType::MNGOVERNANCESYNC) == 0U has failed [1 != 0]`.

  Ran:

  * `./src/test/test_dash --run_test=governance_inv_tests` — passes (6 cases)
  * `./src/test/test_dash` — passes (794 cases)
  * `test/functional/test_runner.py feature_governance.py feature_governance_cl.py` — passes
  * `test/lint/lint-whitespace.py`, `test/lint/lint-circular-dependencies.py` — clean

  ## Breaking Changes

  None to consensus, RPC or the P2P wire format. Behavioural change on the P2P vote path: a
  governance vote whose parent object is unknown is now dropped instead of cached unless it
  carries a valid masternode signature, and a peer that sends such a vote is assigned a
  misbehaviour score of 20 (only while fully synced). A node that legitimately relays orphan
  votes ahead of their parent objects is unaffected, since those votes are validly signed.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

Top commit has no ACKs.

Tree-SHA512: 6f6a2ad05c896e3774c8ca15985cae3d43481565053f3aacf43336a0a4402e171bd8ca16e73b010c5b2d14f81dd6c00e1da8cbd9223d45a6ca6a2b8f53ac5e08

v23.1.x adaptation: CGovernanceManager reaches the MN list via
Assert(m_dmnman)->GetListAtChainTip() (develop holds m_dmnman by reference) and
CGovernanceObject::ProcessVote takes the manager (*this) instead of develop's
fRateChecksEnabled. The governance_inv_tests cases are rewritten for v23's
fixture shape: the two existing gate tests observe the penalty-20 rejection and
the two new upstream cases are added.
---
 src/governance/governance.cpp     |  13 +++-
 src/governance/vote.cpp           |   8 ++
 src/governance/vote.h             |   9 +++
 src/test/governance_inv_tests.cpp | 122 +++++++++++++++++++++++++-----
 4 files changed, 131 insertions(+), 21 deletions(-)

diff --git a/src/governance/governance.cpp b/src/governance/governance.cpp
index b4dcb4ce2178..e45f82ded9b0 100644
--- a/src/governance/governance.cpp
+++ b/src/governance/governance.cpp
@@ -804,6 +804,8 @@ bool CGovernanceManager::ProcessVote(CNode* pfrom, const CGovernanceVote& vote,
     AssertLockNotHeld(cs_store);
     hashToRequest = uint256{};
 
+    const auto tip_mn_list{Assert(m_dmnman)->GetListAtChainTip()};
+
     LOCK(cs_store);
     uint256 nHashVote = vote.GetHash();
     uint256 nHashGovobj = vote.GetParentHash();
@@ -824,8 +826,17 @@ bool CGovernanceManager::ProcessVote(CNode* pfrom, const CGovernanceVote& vote,
 
     auto it = mapObjects.find(nHashGovobj);
     if (it == mapObjects.end()) {
+        if (!vote.IsValidForUnknownParent(tip_mn_list)) {
+            std::string msg{strprintf("CGovernanceManager::%s -- Invalid vote for unknown parent object %s, MN outpoint = %s, vote hash = %s",
+                __func__, nHashGovobj.ToString(), vote.GetMasternodeOutpoint().ToStringShort(), nHashVote.ToString())};
+            LogPrint(BCLog::GOBJECT, "%s\n", msg);
+            exception = CGovernanceException(msg, GOVERNANCE_EXCEPTION_PERMANENT_ERROR, 20);
+            return false;
+        }
         std::string msg{strprintf("CGovernanceManager::%s -- Unknown parent object %s, MN outpoint = %s", __func__,
             nHashGovobj.ToString(), vote.GetMasternodeOutpoint().ToStringShort())};
+        // No penalty: the vote is signed by a masternode, it just arrived before its parent object,
+        // which routinely happens during governance sync. Misbehaviour scores never decay.
         exception = CGovernanceException(msg, GOVERNANCE_EXCEPTION_WARNING);
         if (cmmapOrphanVotes.Insert(nHashGovobj, vote_time_pair_t(vote, count_seconds(GetTime<std::chrono::seconds>() +
                                                                                       GOVERNANCE_ORPHAN_EXPIRATION_TIME)))) {
@@ -843,7 +854,7 @@ bool CGovernanceManager::ProcessVote(CNode* pfrom, const CGovernanceVote& vote,
         return false;
     }
 
-    bool fOk = govobj.ProcessVote(m_mn_metaman, *this, Assert(m_dmnman)->GetListAtChainTip(), vote, exception);
+    bool fOk = govobj.ProcessVote(m_mn_metaman, *this, tip_mn_list, vote, exception);
     if (fOk) {
         fOk = cmapVoteToObject.Insert(nHashVote, it->second);
     } else if (exception.GetType() == GOVERNANCE_EXCEPTION_PERMANENT_ERROR && exception.GetNodePenalty() == 20) {
diff --git a/src/governance/vote.cpp b/src/governance/vote.cpp
index e700e99473bf..c023c0d89c0c 100644
--- a/src/governance/vote.cpp
+++ b/src/governance/vote.cpp
@@ -241,6 +241,14 @@ bool CGovernanceVote::IsValid(const CDeterministicMNList& tip_mn_list, bool useV
 }
 
 
+bool CGovernanceVote::IsValidForUnknownParent(const CDeterministicMNList& tip_mn_list) const
+{
+    if (nVoteSignal == VOTE_SIGNAL_FUNDING && IsValid(tip_mn_list, /*useVotingKey=*/true)) {
+        return true;
+    }
+    return IsValid(tip_mn_list, /*useVotingKey=*/false);
+}
+
 bool operator==(const CGovernanceVote& vote1, const CGovernanceVote& vote2)
 {
     bool fResult = ((vote1.masternodeOutpoint == vote2.masternodeOutpoint) &&
diff --git a/src/governance/vote.h b/src/governance/vote.h
index 8355cdb36cfb..18050477412c 100644
--- a/src/governance/vote.h
+++ b/src/governance/vote.h
@@ -144,6 +144,15 @@ class CGovernanceVote
     bool CheckSignature(const CKeyID& keyID) const;
     bool CheckSignature(const CBLSPublicKey& pubKey) const;
     bool IsValid(const CDeterministicMNList& tip_mn_list, bool useVotingKey) const;
+    /**
+     * Validation for a vote whose parent object is unknown, so the exact key
+     * requirement cannot be derived yet. Only a funding vote can ever be
+     * voting-key-signed (PROPOSAL + VOTE_SIGNAL_FUNDING -- see onlyVotingKeyAllowed
+     * in CGovernanceObject::ProcessVote); every other signal requires the operator
+     * key for every object type, and a funding vote on a non-proposal will be
+     * re-checked against the operator-key requirement when its parent arrives.
+     */
+    bool IsValidForUnknownParent(const CDeterministicMNList& tip_mn_list) const;
 
     /** The memoised verdict for this key, or nullopt if the next CheckSignature
      *  with it would have to run the cryptography. */
diff --git a/src/test/governance_inv_tests.cpp b/src/test/governance_inv_tests.cpp
index 5a9831ecf012..f3a86c57c358 100644
--- a/src/test/governance_inv_tests.cpp
+++ b/src/test/governance_inv_tests.cpp
@@ -167,6 +167,13 @@ void ProcessGovernanceVote(NetGovernance& net_gov, CNode& peer, const CGovernanc
     vote_stream << vote;
     net_gov.ProcessMessage(peer, NetMsgType::MNGOVERNANCEOBJECTVOTE, vote_stream);
 }
+
+void AssertMisbehaviorScore(PeerManager& peerman, const CNode& peer, int expected)
+{
+    CNodeStateStats stats;
+    BOOST_REQUIRE(peerman.GetNodeStateStats(peer.GetId(), stats));
+    BOOST_CHECK_EQUAL(stats.m_misbehavior_score, expected);
+}
 } // namespace
 
 BOOST_FIXTURE_TEST_SUITE(governance_inv_tests, GovernanceInvSetup)
@@ -415,9 +422,15 @@ BOOST_AUTO_TEST_CASE(governance_votes_require_peer_announcement_or_request)
     m_node.peerman->InitializeNode(*second_announcing_peer, NODE_NETWORK);
     m_node.peerman->InitializeNode(*unsolicited_peer, NODE_NETWORK);
 
-    auto& connman = static_cast<ConnmanTestMsg&>(*m_node.connman);
     CNodeStateStats stats;
 
+    // The vote below carries an unknown masternode outpoint, so CGovernanceManager::ProcessVote
+    // rejects it with a penalty of 20. Only a peer that passes the announce-then-request gate
+    // reaches ProcessVote at all, which makes the score the observable for the gate itself.
+    // Penalties are applied only once fully synced.
+    m_node.mn_sync->SwitchToNextAsset();
+    BOOST_REQUIRE(m_node.mn_sync->IsSynced());
+
     const CGovernanceVote vote{MakeGovernanceVote(uint256S("31"))};
     const CInv vote_inv{MSG_GOVERNANCE_OBJECT_VOTE, vote.GetHash()};
 
@@ -429,22 +442,17 @@ BOOST_AUTO_TEST_CASE(governance_votes_require_peer_announcement_or_request)
     ProcessInv(*m_node.peerman, *announcing_peer, vote_inv);
     ProcessInv(*m_node.peerman, *second_announcing_peer, vote_inv);
 
-    connman.FlushSendBuffer(*announcing_peer);
     ProcessGovernanceVote(net_gov, *announcing_peer, vote);
-    BOOST_CHECK_EQUAL(CountQueuedMessages(*announcing_peer, NetMsgType::MNGOVERNANCESYNC), 1U);
-    BOOST_REQUIRE(m_node.peerman->GetNodeStateStats(announcing_peer->GetId(), stats));
-    BOOST_CHECK_EQUAL(stats.m_misbehavior_score, 0);
+    BOOST_CHECK(
+        !WITH_LOCK(::cs_main, return m_node.peerman->PeerConsumeObjectRequest(announcing_peer->GetId(), vote_inv)));
+    AssertMisbehaviorScore(*m_node.peerman, *announcing_peer, 20);
 
-    connman.FlushSendBuffer(*second_announcing_peer);
     ProcessGovernanceVote(net_gov, *second_announcing_peer, vote);
-    // Second announcer: the gate accepts (it independently announced the vote) and consumes
-    // its per-peer request entry. A rejected vote would return before the gate consumes and
-    // leave the entry intact, so this proves the accept path independently of the (deduped)
-    // orphan-request side effect.
+    // Consumption is per-peer: the second announcer's own entry is accepted and consumed,
+    // independent of the first peer's already-consumed entry.
     BOOST_CHECK(!WITH_LOCK(::cs_main,
                            return m_node.peerman->PeerConsumeObjectRequest(second_announcing_peer->GetId(), vote_inv)));
-    BOOST_REQUIRE(m_node.peerman->GetNodeStateStats(second_announcing_peer->GetId(), stats));
-    BOOST_CHECK_EQUAL(stats.m_misbehavior_score, 0);
+    AssertMisbehaviorScore(*m_node.peerman, *second_announcing_peer, 20);
 
     m_node.peerman->FinalizeNode(*announcing_peer);
     m_node.peerman->FinalizeNode(*second_announcing_peer);
@@ -467,7 +475,6 @@ BOOST_AUTO_TEST_CASE(governance_vote_authorization_survives_unsynced_drop)
 
     auto peer{MakeGovernanceInvPeer(/*id=*/31)};
     m_node.peerman->InitializeNode(*peer, NODE_NETWORK);
-    auto& connman = static_cast<ConnmanTestMsg&>(*m_node.connman);
 
     const CGovernanceVote vote{MakeGovernanceVote(uint256S("41"))};
     const CInv vote_inv{MSG_GOVERNANCE_OBJECT_VOTE, vote.GetHash()};
@@ -479,23 +486,98 @@ BOOST_AUTO_TEST_CASE(governance_vote_authorization_survives_unsynced_drop)
     // Not synced: delivering the vote is dropped at the sync gate and must NOT consume the request.
     m_node.mn_sync->Reset(/*fForce=*/true, /*fNotifyReset=*/false);
     BOOST_REQUIRE(!m_node.mn_sync->IsBlockchainSynced());
-    connman.FlushSendBuffer(*peer);
     ProcessGovernanceVote(net_gov, *peer, vote);
-    BOOST_CHECK_EQUAL(CountQueuedMessages(*peer, NetMsgType::MNGOVERNANCESYNC), 0U);
+    AssertMisbehaviorScore(*m_node.peerman, *peer, 0);
+
+    // Back in sync, the retransmit is still authorized and reaches ProcessVote, which rejects the
+    // unknown masternode outpoint with a penalty of 20. Had the unsynced drop consumed the request,
+    // the gate would now reject the vote as unrequested and return before ProcessVote, leaving the
+    // score at 0.
+    while (!m_node.mn_sync->IsSynced()) {
+        m_node.mn_sync->SwitchToNextAsset();
+    }
+    ProcessGovernanceVote(net_gov, *peer, vote);
+    AssertMisbehaviorScore(*m_node.peerman, *peer, 20);
+
+    m_node.peerman->FinalizeNode(*peer);
+    chainstate.ResetIbd();
+}
 
-    // Back in sync, the retransmit is still authorized: ProcessVote runs and (orphan parent)
-    // requests the missing object. Had the unsynced drop consumed the request, the gate would now
-    // reject the vote as unrequested and send no MNGOVERNANCESYNC.
+// A vote whose parent object is unknown must prove masternode authorship before it is cached.
+BOOST_AUTO_TEST_CASE(orphan_votes_require_a_valid_masternode_signature)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+
+    TestChainState& chainstate =
+        *static_cast<TestChainState*>(&m_node.chainman->ActiveChainstate());
+    chainstate.JumpOutOfIbd();
+
+    // Penalties are applied only once fully synced.
     m_node.mn_sync->SwitchToNextAsset();
-    BOOST_REQUIRE(m_node.mn_sync->IsBlockchainSynced());
+    BOOST_REQUIRE(m_node.mn_sync->IsSynced());
+
+    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
+                          *m_node.netfulfilledman, *m_node.connman);
+
+    auto peer{MakeGovernanceInvPeer(/*id=*/41)};
+    m_node.peerman->InitializeNode(*peer, NODE_NETWORK);
+    auto& connman = static_cast<ConnmanTestMsg&>(*m_node.connman);
+
+    // The tip masternode list is empty in this setup, so no vote can name a known collateral.
+    const CGovernanceVote vote{MakeGovernanceVote(uint256S("51"))};
+    const CInv vote_inv{MSG_GOVERNANCE_OBJECT_VOTE, vote.GetHash()};
+
+    ProcessInv(*m_node.peerman, *peer, vote_inv);
     connman.FlushSendBuffer(*peer);
     ProcessGovernanceVote(net_gov, *peer, vote);
-    BOOST_CHECK_EQUAL(CountQueuedMessages(*peer, NetMsgType::MNGOVERNANCESYNC), 1U);
+
+    BOOST_CHECK(m_node.govman->GetOrphanVoteObjectHashes().empty());
+    BOOST_CHECK_EQUAL(CountQueuedMessages(*peer, NetMsgType::MNGOVERNANCESYNC), 0U);
+    AssertMisbehaviorScore(*m_node.peerman, *peer, 20);
 
     m_node.peerman->FinalizeNode(*peer);
     chainstate.ResetIbd();
 }
 
+// The same unauthenticated vote must cost the sender the same whether or not its parent object
+// happens to have arrived first.
+BOOST_AUTO_TEST_CASE(invalid_vote_is_scored_alike_with_and_without_a_parent_object)
+{
+    LOCK(NetEventsInterface::g_msgproc_mutex);
+
+    TestChainState& chainstate =
+        *static_cast<TestChainState*>(&m_node.chainman->ActiveChainstate());
+    chainstate.JumpOutOfIbd();
+
+    m_node.mn_sync->SwitchToNextAsset();
+    BOOST_REQUIRE(m_node.mn_sync->IsSynced());
+
+    NetGovernance net_gov(m_node.peerman.get(), *m_node.govman, *m_node.mn_sync,
+                          *m_node.netfulfilledman, *m_node.connman);
+
+    auto orphan_peer{MakeGovernanceInvPeer(/*id=*/51)};
+    auto known_parent_peer{MakeGovernanceInvPeer(/*id=*/52)};
+    m_node.peerman->InitializeNode(*orphan_peer, NODE_NETWORK);
+    m_node.peerman->InitializeNode(*known_parent_peer, NODE_NETWORK);
+
+    const CGovernanceObject govobj{MakeGovernanceObject(GetTime<std::chrono::seconds>().count(), uint256S("61"))};
+    const CGovernanceVote orphan_vote{MakeGovernanceVote(uint256S("62"))};
+    const CGovernanceVote known_parent_vote{MakeGovernanceVote(govobj.GetHash())};
+
+    ProcessInv(*m_node.peerman, *orphan_peer, CInv{MSG_GOVERNANCE_OBJECT_VOTE, orphan_vote.GetHash()});
+    ProcessGovernanceVote(net_gov, *orphan_peer, orphan_vote);
+    AssertMisbehaviorScore(*m_node.peerman, *orphan_peer, 20);
+
+    m_node.govman->AddGovernanceObjectForTesting(govobj);
+    ProcessInv(*m_node.peerman, *known_parent_peer, CInv{MSG_GOVERNANCE_OBJECT_VOTE, known_parent_vote.GetHash()});
+    ProcessGovernanceVote(net_gov, *known_parent_peer, known_parent_vote);
+    AssertMisbehaviorScore(*m_node.peerman, *known_parent_peer, 20);
+
+    m_node.peerman->FinalizeNode(*orphan_peer);
+    m_node.peerman->FinalizeNode(*known_parent_peer);
+    chainstate.ResetIbd();
+}
+
 
 // Every orphan parent hash is re-requested from every peer on each governance tick, and one
 // masternode key can sign votes for any number of invented parents, so the hashes requested per tick

From 9f2946ec970a04de2041c4a6ae15233c15395f5b Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 8 Aug 2026 18:34:07 -0500
Subject: [PATCH 18/51] Merge #7487: fix: bound DomainPort string
 deserialization and stop swallowing deser failures
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

545a9b73c2c986e30a15947dfd3b8c5150e67f18 fix: bound DomainPort string and stop swallowing deser failures (pasta)
c44bd886e2cda10d68954c216e771fc0423043c6 test: prove DomainPort unbounded string deserialization DoS (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `DomainPort` deserializes an unbounded `std::string`, and `NetInfoEntry::Unserialize()`
  swallows the resulting `ios_base::failure`. Together these give a large allocate-and-zero
  amplification factor from a small ProTx payload.

  Mechanism:

  - `DomainPort`'s serializer reads `m_addr` as a plain `std::string`, so an attacker-chosen
    `CompactSize` drives `resize()` before any length check. `ValidateDomain()` enforces the
    253-byte RFC 1035 ceiling, but only *after* the allocation has already happened.
  - When the body is short or oversized and deserialization throws, `NetInfoEntry::Unserialize()`
    catches `ios_base::failure` and calls `Clear()`. The stream position is left unmoved (or
    advanced only by the `CompactSize`), so the enclosing vector loop keeps going and repeats
    the allocation.

  The result is that a few attacker-controlled bytes turn into repeated multi-megabyte
  allocate-and-zero cycles while the payload is parsed.

  ## What was done?

  - `DomainPort`'s serializer now uses `LIMITED_STRING(obj.m_addr, DOMAIN_MAX_LEN)`, so an
    oversized `CompactSize` claim is rejected *before* `resize()` rather than after.
    `LimitedStringFormatter` checks the length and throws without allocating.
  - `DOMAIN_MAX_LEN` moved from `netinfo.cpp` to `netinfo.h` (and `uint8_t` → `size_t` for the
    template parameter) so the serialization layer and `ValidateDomain()` share one constant
    and cannot drift apart.
  - The `Domain` branch of `NetInfoEntry::Unserialize()` no longer swallows
    `ios_base::failure`. It propagates, so a malformed domain entry rejects the whole ProTx
    payload instead of leaving the stream desynchronised for the rest of the loop.

  The `Service` branch deliberately still catches. A `CService` is fixed-size, so a malformed
  one cannot desynchronise the stream or amplify allocation — there is nothing to defend
  against there, and changing it would alter behaviour for no benefit.

  ### Note on deployment status

  This tightens a serialization rule, so the natural question is whether it needs gating.
  It does not: `DEPLOYMENT_V24` is `NEVER_ACTIVE` on both mainnet (`chainparams.cpp:213`) and
  testnet (`chainparams.cpp:415`), so `ExtNetInfo` — and therefore `DomainPort` — cannot
  appear in any mainnet or testnet chain data. There is nothing already mined for the stricter
  rule to retroactively invalidate.

  ## How Has This Been Tested?

  Unit tests in `src/test/evo_netinfo_tests.cpp`, added in the commit *preceding* the fix:

  - `domainport_deser_rejects_oversized_string`
  - `netinfoentry_domain_deser_rejects_oversized_string`
  - `extnetinfo_domain_amplification_rejected`

  Without the fix all three fail with `exception std::ios_base::failure expected but not
  raised`. With the fix the full `evo_netinfo_tests` suite passes (14 cases), confirming
  well-formed domains up to the 253-byte ceiling still round-trip.

  Built and run on macOS/arm64 against current `develop`.

  ## Breaking Changes

  None reachable on mainnet or testnet, per the deployment note above. On devnet/regtest,
  a ProTx carrying a domain entry longer than 253 bytes is now rejected at deserialization
  instead of being cleared and then rejected by netinfo validation — same outcome, earlier
  and cheaper.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

Top commit has no ACKs.

Tree-SHA512: 64d5a3031d7c517f9d2fb819cbc86f8c68dad2a2865714e3e1547f1117b7a27f83b1134ff1e20dc9fe561d592845e50d06a49e923006c137f214209b6334ab66

v23.1.x note: this merge-pick carries the complete upstream #7487 test set
(four DomainPort/ExtNetInfo deserialization cases), which is richer than the
leaner squashed set that shipped on the flat v23.1.9 branch. Every referenced
symbol exists in v23.1.x (NetInfoEntry::NetInfoType::Domain, DOMAIN_MAX_LEN,
LIMITED_STRING, RegTestingSetup, ser_writedata16be, MakeByteSpan) and the fix
in netinfo.{h,cpp} is byte-identical to the vetted v23 version, so the tests
exercise the same behavior.
---
 src/evo/netinfo.cpp            |  2 -
 src/evo/netinfo.h              | 20 +++++---
 src/test/evo_netinfo_tests.cpp | 86 ++++++++++++++++++++++++++++++++++
 3 files changed, 100 insertions(+), 8 deletions(-)

diff --git a/src/evo/netinfo.cpp b/src/evo/netinfo.cpp
index 9c766c0e82ef..cdd376120fd4 100644
--- a/src/evo/netinfo.cpp
+++ b/src/evo/netinfo.cpp
@@ -20,8 +20,6 @@ static std::once_flag g_main_params_flag;
 
 /** Maximum length of a label in a domain per RFC 1035 */
 static constexpr uint8_t DOMAIN_LABEL_MAX_LEN{63};
-/** Maximum possible length of a ASCII FQDN */
-static constexpr uint8_t DOMAIN_MAX_LEN{253};
 /** Minimum length of a FQDN */
 static constexpr uint8_t DOMAIN_MIN_LEN{3};
 
diff --git a/src/evo/netinfo.h b/src/evo/netinfo.h
index 33d81963ca5b..ccaa903b11cb 100644
--- a/src/evo/netinfo.h
+++ b/src/evo/netinfo.h
@@ -19,6 +19,11 @@ class UniValue;
 /** Maximum entries that can be stored in an ExtNetInfo per purpose code */
 static constexpr uint8_t MAX_ENTRIES_EXTNETINFO{4};
 
+/** Maximum possible length of an ASCII FQDN (RFC 1035). Applied at the
+ *  serialization layer so oversized CompactSize claims are rejected before
+ *  allocate-and-zero; ValidateDomain enforces the same ceiling after decode. */
+static constexpr size_t DOMAIN_MAX_LEN{253};
+
 enum class NetInfoStatus : uint8_t {
     // Managing entries
     BadInput,
@@ -167,7 +172,7 @@ class DomainPort
 
     SERIALIZE_METHODS(DomainPort, obj)
     {
-        READWRITE(obj.m_addr);
+        READWRITE(LIMITED_STRING(obj.m_addr, DOMAIN_MAX_LEN));
         READWRITE(Using<BigEndianFormatter<2>>(obj.m_port));
     }
 
@@ -243,11 +248,14 @@ class NetInfoEntry
                 if (!service.IsValid()) { Clear(); } // Invalid CService, mark as invalid
             } catch (const std::ios_base::failure&) { Clear(); } // Deser failed, mark as invalid
         } else if (m_type == NetInfoType::Domain) {
-            try {
-                auto& domain{m_data.emplace<DomainPort>()};
-                s >> domain;
-                if (!domain.IsValid()) { Clear(); } // Invalid DomainPort, mark as invalid
-            } catch (const std::ios_base::failure&) { Clear(); } // Deser failed, mark as invalid
+            // Do not swallow deserialization failures: a short/oversized domain
+            // body would otherwise leave the stream position unmoved (or only
+            // advanced by CompactSize) while the enclosing vector loop continues,
+            // amplifying a few attacker bytes into repeated allocations.
+            // Propagate ios_base::failure so the whole ProTx payload is rejected.
+            auto& domain{m_data.emplace<DomainPort>()};
+            s >> domain;
+            if (!domain.IsValid()) { Clear(); } // Invalid DomainPort, mark as invalid
         } else { Clear(); } // Invalid type code, mark as invalid
     }
 
diff --git a/src/test/evo_netinfo_tests.cpp b/src/test/evo_netinfo_tests.cpp
index 2d2c0037d8f6..5302ffd9328e 100644
--- a/src/test/evo_netinfo_tests.cpp
+++ b/src/test/evo_netinfo_tests.cpp
@@ -529,6 +529,92 @@ BOOST_AUTO_TEST_CASE(decode_provider_payload_without_netinfo)
     }
 }
 
+// DomainPort used a bare std::string unserialize path (bounded only by
+// MAX_SIZE == 32 MiB) and NetInfoEntry::Unserialize swallowed ios_base::failure.
+// That combination allowed a tiny ProTx ExtNetInfo payload to force repeated
+// allocate-and-zero of multi-megabyte strings. These tests pin the serialization
+// layer to reject oversized domain claims without performing the large allocation.
+static CDataStream MakeOversizedDomainPortStream(const size_t claimed_len)
+{
+    CDataStream ds(SER_DISK, CLIENT_VERSION);
+    WriteCompactSize(ds, claimed_len);
+    // Provide a full body so pre-fix code can complete the string read; the
+    // bound must reject based on the CompactSize alone, not on a short read.
+    const std::string body(claimed_len, 'a');
+    if (!body.empty()) {
+        ds.write(MakeByteSpan(body));
+    }
+    ser_writedata16be(ds, 443);
+    return ds;
+}
+
+BOOST_AUTO_TEST_CASE(domainport_deser_rejects_oversized_string)
+{
+    // DOMAIN_MAX_LEN is 253; a fully-formed 1000-byte domain must be rejected at
+    // deserialization time (LIMITED_STRING), not accepted then failed later in
+    // ValidateDomain.
+    constexpr size_t kOversized{1000};
+    CDataStream ds{MakeOversizedDomainPortStream(kOversized)};
+
+    DomainPort domain;
+    BOOST_CHECK_THROW(ds >> domain, std::ios_base::failure);
+}
+
+BOOST_AUTO_TEST_CASE(netinfoentry_domain_deser_rejects_oversized_string)
+{
+    // NetInfoEntry must not swallow the length-limit failure: rethrow so the
+    // enclosing ProTx payload deserialization aborts and the peer is penalised.
+    constexpr size_t kOversized{1000};
+    CDataStream ds(SER_DISK, CLIENT_VERSION);
+    ds << uint8_t{NetInfoEntry::NetInfoType::Domain};
+    {
+        CDataStream body{MakeOversizedDomainPortStream(kOversized)};
+        ds.write(MakeByteSpan(body));
+    }
+
+    NetInfoEntry entry;
+    BOOST_CHECK_THROW(ds >> entry, std::ios_base::failure);
+}
+
+BOOST_AUTO_TEST_CASE(domainport_deser_rejects_huge_claimed_length)
+{
+    // CompactSize claims 1 MiB with no body. Pre-fix this would allocate 1 MiB
+    // then throw on short-read; post-fix LIMITED_STRING rejects before resize.
+    // Either way the operation must throw; the important property is that a
+    // declared length above DOMAIN_MAX_LEN never produces a successful DomainPort.
+    CDataStream ds(SER_DISK, CLIENT_VERSION);
+    WriteCompactSize(ds, size_t{1} << 20);
+
+    DomainPort domain;
+    BOOST_CHECK_THROW(ds >> domain, std::ios_base::failure);
+}
+
+BOOST_AUTO_TEST_CASE(extnetinfo_domain_amplification_rejected)
+{
+    // Simulate the attack shape: ExtNetInfo vector of Domain entries each
+    // claiming a large string length from a small stream. Pre-fix,
+    // NetInfoEntry swallows the short-read and the vector loop continues
+    // (stream position does not advance on the failed body read), producing
+    // repeated large allocations. Post-fix the first oversized claim throws
+    // and aborts the whole ExtNetInfo unserialize.
+    constexpr size_t kClaimed{1 << 16}; // 64 KiB — large enough to prove, small enough to not OOM pre-fix
+    constexpr size_t kEntries{8};
+
+    CDataStream ds(SER_DISK, CLIENT_VERSION);
+    ds << uint8_t{1}; // ExtNetInfo version
+    WriteCompactSize(ds, 1); // one purpose
+    ds << NetInfoPurpose::PLATFORM_HTTPS;
+    WriteCompactSize(ds, kEntries);
+    for (size_t i = 0; i < kEntries; ++i) {
+        ds << uint8_t{NetInfoEntry::NetInfoType::Domain};
+        // Claim kClaimed bytes but supply none — CompactSize only.
+        WriteCompactSize(ds, kClaimed);
+    }
+
+    ExtNetInfo netInfo;
+    BOOST_CHECK_THROW(ds >> netInfo, std::ios_base::failure);
+}
+
 BOOST_FIXTURE_TEST_CASE(extnetinfo_validate_deser, RegTestingSetup)
 {
     // The in-memory builder (AddEntry/ProcessCandidate) refuses duplicates, domains

From 9ebf78f00f28bab61e37f28788e9fc2880c6a8a7 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sun, 9 Aug 2026 12:37:10 -0500
Subject: [PATCH 19/51] Merge #7522: fix(net): bound verified inbound
 connections per proRegTxHash
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

d25df32c6a5a7224d171959f573bdb5886ddece8 fix(net): bound verified inbound connections per proRegTxHash (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  A verified inbound masternode peer gets two privileges:

  - it is subtracted from the inbound limit in `CConnman::CreateNodeFromAcceptedSocket` (`nInbound - nVerifiedInboundMasternodes >= nMaxInbound`), so it costs nothing against the cap;
  - it is unconditionally protected from eviction in `CConnman::GetEvictionCandidates`.

  The in-tree comment justifies granting both with "we know that such connections are naturally limited by the total number of MNs, so this is not usable for attacks". That reasoning assumes the number of verified inbound connections per proRegTxHash is bounded. It was not.

  `CMNAuth::ProcessMessage`'s duplicate handling does not converge when **both** legs are inbound:

  - in the `deterministicOutbound == myProTxHash` branch it only sets `m_masternode_probe_connection` on the old leg — a deferred hint acted on by `CMasternodeUtils::DoMaintenance` only after `PROBE_WAIT_INTERVAL`, and only once outbound capacity is tight;
  - in the other branch it tests `!IsInboundConn()` on both peers, which is false for both, so nothing happens at all.

  Either way both sockets stay verified. An attacker holding a single masternode operator BLS key can therefore open connections to a masternode victim and accumulate limit-exempt, eviction-immune slots without end — exhausting connection slots and crowding honest peers out of the victim's inbound table, which also helps toward degrading a quorum member.

  MNAUTH is signed over a per-connection random challenge, so it cannot be replayed: the attacker must genuinely hold an operator key, and the victim must itself be an active masternode.

  ## What was done?

  Cap the number of simultaneous verified **inbound** connections per proRegTxHash at `MAX_VERIFIED_INBOUND_PER_PROTX`.

  Enforcement lives in a new `CConnman::TryMarkVerified(NodeId, proRegTxHash, pubKeyHash)`, which is now the **single gate** through which a connection acquires verified-masternode status. It counts the verified inbound legs already carrying the identity and grants (or refuses) in one exclusive `m_nodes_mutex` scope — the count and the set are atomic, so the bound holds even if a future caller is not serialized the way today's message-handler thread is. Placing enforcement next to the state it guards and the privileges that state buys (both in `net.cpp`) means the cap is bounded by construction rather than by an invariant maintained at a distant call site.

  Both callers route through the gate:

  - `CMNAuth::ProcessMessage` calls it instead of setting the verified hash directly, and disconnects the new peer if the grant is refused;
  - the regtest-only `mnauth` RPC calls it too, which additionally lets a functional test exercise the refusal path end to end.

  The existing duplicate-resolution logic is deliberately left exactly as it is. The deterministic-outbound preference, the probe marking, and the drop-outbound branches are all unchanged; the gate simply refuses a new inbound leg once the identity is already at its limit.

  **Why a cap rather than enforcing uniqueness.** The defect is that the count was *unbounded*, not that duplicates exist at all. Duplicates below the cap keep every privilege they have today, so ordinary churn is unaffected — in particular a reconnect that races a socket we have not yet detected as dead legitimately produces a second verified inbound leg. Refusing that leg would strand the peer until `InactivityCheck` fires at `TIMEOUT_INTERVAL` (20 minutes); there is no `SO_KEEPALIVE` or `TCP_USER_TIMEOUT` anywhere in `src/` to reap a half-open socket sooner, the peer retries every 60 s in the meantime, and where the peer is the deterministic outbound side this node never dials it, so there is no other recovery path. Leaving headroom avoids that class of problem entirely while still making the exemption a bounded multiple of the masternode count. A refused grant carries **no** misbehavior penalty, for the same reason.

  Only inbound legs are counted, since neither the limit exemption nor the eviction protection applies to outbound ones. Legs already flagged `fDisconnect` do not count, so a reconnect racing a socket that is being torn down is accepted immediately.

  The cap value is a named constant (currently 3: one live leg plus up to two not-yet-reaped stale ones) documented in `net.h` and trivial to tune.

  ## How Has This Been Tested?

  `src/test/evo_mnauth_tests.cpp` builds a `ConnmanTestMsg` with fake peers and drives `TryMarkVerified` directly, asserting that grants succeed up to the cap and the next inbound leg for the same identity is refused and left unmarked; that the budget is per-identity (one peer cannot consume another's); that outbound legs are exempt from the cap; and that flagging a verified leg `fDisconnect` frees its slot for a reconnect. A `static_assert` pins that the cap can never be tightened to 1, so the reconnect-churn case cannot be regressed later.

  `test/functional/rpc_mnauth.py` now drives the same path through the RPC: it fills the identity's budget, asserts the next inbound leg is refused and stays unverified, disconnects a verified leg, and asserts the refused peer can then be verified. Because the RPC now routes through the gate, this is real end-to-end coverage of the enforcement rather than of `SetVerifiedProRegTxHash` alone.

  Built locally; `test_dash --run_test=evo_mnauth_tests` and `rpc_mnauth.py` pass. Full validation is delegated to CI.

  ## Breaking Changes

  None for honest peers. A masternode that legitimately holds fewer than `MAX_VERIFIED_INBOUND_PER_PROTX` verified inbound connections to a single peer sees no change in behaviour.

  ## Checklist:

  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

Top commit has no ACKs.

Tree-SHA512: e90583681611bc027c039ad509c5343bf2a0dadab596618099ce6d161c87c6efb3eb51472e67cb9812f13eb84ed09f8e80b3a536370a368d477c349933e2eb3a
(cherry picked from commit 1fbf489a5c7d5d7f37f2e048f46ba5b8af0a0cdc)
---
 src/Makefile.test.include     |  1 +
 src/evo/mnauth.cpp            |  8 ++-
 src/net.cpp                   | 34 +++++++++++--
 src/net.h                     | 30 +++++++++++
 src/rpc/node.cpp              |  8 +--
 src/test/evo_mnauth_tests.cpp | 93 +++++++++++++++++++++++++++++++++++
 test/functional/rpc_mnauth.py | 24 +++++++++
 7 files changed, 186 insertions(+), 12 deletions(-)
 create mode 100644 src/test/evo_mnauth_tests.cpp

diff --git a/src/Makefile.test.include b/src/Makefile.test.include
index e82f90df3e2c..b29cdccdfc3b 100644
--- a/src/Makefile.test.include
+++ b/src/Makefile.test.include
@@ -111,6 +111,7 @@ BITCOIN_TESTS =\
   test/evo_assetlocks_tests.cpp \
   test/evo_deterministicmns_tests.cpp \
   test/evo_islock_tests.cpp \
+  test/evo_mnauth_tests.cpp \
   test/evo_mnhf_tests.cpp \
   test/evo_netinfo_tests.cpp \
   test/evo_simplifiedmns_tests.cpp \
diff --git a/src/evo/mnauth.cpp b/src/evo/mnauth.cpp
index d724e30e5807..99ca508aa069 100644
--- a/src/evo/mnauth.cpp
+++ b/src/evo/mnauth.cpp
@@ -155,8 +155,12 @@ MessageProcessingResult CMNAuth::ProcessMessage(CNode& peer, ServiceFlags node_s
         return {};
     }
 
-    peer.SetVerifiedProRegTxHash(mnauth.proRegTxHash);
-    peer.SetVerifiedPubKeyHash(dmn->pdmnState->pubKeyOperator.GetHash());
+    if (!connman.TryMarkVerified(peer.GetId(), mnauth.proRegTxHash, dmn->pdmnState->pubKeyOperator.GetHash())) {
+        // At the verified-inbound cap for this identity. Not a misbehavior: a legitimate
+        // reconnect racing not-yet-reaped stale legs must not be banned.
+        peer.fDisconnect = true;
+        return {};
+    }
 
     if (!peer.m_masternode_iqr_connection && connman.IsMasternodeQuorumRelayMember(peer.GetVerifiedProRegTxHash())) {
         // Tell our peer that we're interested in plain LLMQ recovered signatures.
diff --git a/src/net.cpp b/src/net.cpp
index f186489c743a..a555f900b83e 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -1953,9 +1953,9 @@ void CConnman::CreateNodeFromAcceptedSocket(std::unique_ptr<Sock>&& sock,
 
     // Evict connections until we are below nMaxInbound. In case eviction protection resulted in nodes to not be evicted
     // before, they might get evicted in batches now (after the protection timeout).
-    // We don't evict verified MN connections and also don't take them into account when checking limits. We can do this
-    // because we know that such connections are naturally limited by the total number of MNs, so this is not usable
-    // for attacks.
+    // We don't evict verified MN connections and also don't take them into account when checking limits. We can do
+    // this because such connections are limited by the total number of MNs times MAX_VERIFIED_INBOUND_PER_PROTX
+    // (enforced in TryMarkVerified), so this is not usable for attacks.
     while (nInbound - nVerifiedInboundMasternodes >= nMaxInbound)
     {
         if (!AttemptToEvictConnection()) {
@@ -4476,6 +4476,34 @@ void CConnman::AddPendingProbeConnections(const std::set<uint256> &proTxHashes)
     masternodePendingProbes.insert(proTxHashes.begin(), proTxHashes.end());
 }
 
+bool CConnman::TryMarkVerified(NodeId id, const uint256& proregtx_hash, const uint256& pubkey_hash)
+{
+    // Exclusive, not shared: the count and the grant must be one atomic step or concurrent
+    // callers could each pass the check and jointly exceed the cap.
+    LOCK(m_nodes_mutex);
+    CNode* node = FindNodeMutable(id, /*fExcludeDisconnecting=*/false);
+    if (node == nullptr) {
+        return false;
+    }
+    if (node->IsInboundConn()) {
+        size_t verified_inbound{0};
+        for (const CNode* pnode : m_nodes) {
+            if (pnode != node && !pnode->fDisconnect && pnode->IsInboundConn() &&
+                pnode->GetVerifiedProRegTxHash() == proregtx_hash) {
+                ++verified_inbound;
+            }
+        }
+        if (verified_inbound >= MAX_VERIFIED_INBOUND_PER_PROTX) {
+            LogPrint(BCLog::NET_NETCONN, "CConnman::%s -- refusing to verify masternode %s: already %d verified inbound connections, peer=%d\n",
+                     __func__, proregtx_hash.ToString(), verified_inbound, id);
+            return false;
+        }
+    }
+    node->SetVerifiedProRegTxHash(proregtx_hash);
+    node->SetVerifiedPubKeyHash(pubkey_hash);
+    return true;
+}
+
 size_t CConnman::GetNodeCount(ConnectionDirection flags) const
 {
     READ_LOCK(m_nodes_mutex);
diff --git a/src/net.h b/src/net.h
index 8434b06eae75..949a4d93f29e 100644
--- a/src/net.h
+++ b/src/net.h
@@ -98,6 +98,26 @@ static const int MAX_BLOCK_RELAY_ONLY_CONNECTIONS = 2;
 static const int MAX_DESIRED_ONION_CONNECTIONS = 2;
 /** Maximum number of feeler connections */
 static const int MAX_FEELER_CONNECTIONS = 1;
+/**
+ * Upper bound on simultaneous verified *inbound* connections carrying the same proRegTxHash,
+ * enforced by CConnman::TryMarkVerified.
+ *
+ * A verified inbound masternode peer is exempt from the inbound connection limit
+ * (CreateNodeFromAcceptedSocket) and protected from eviction (GetEvictionCandidates), so without a
+ * bound a single operator key could stack such slots without end.
+ *
+ * The limit is not 1: a reconnect racing a socket we have not yet detected as dead legitimately
+ * produces a second verified inbound leg. Refusing it would strand the peer until InactivityCheck
+ * fires (TIMEOUT_INTERVAL, 20 minutes) — nothing in src/ sets SO_KEEPALIVE or TCP_USER_TIMEOUT, so
+ * that is the only reaper of half-open sockets, and where the peer is the deterministic outbound
+ * side we never dial it, leaving no other recovery path. A small allowance keeps that case working
+ * while making the exemption a bounded multiple of the masternode count. If a lower-level reaper
+ * is ever added, this value can likely be tightened.
+ *
+ * Consequently, up to this many verified legs per proRegTxHash may coexist: code that maps
+ * proRegTxHash -> node (e.g. sig-share routing) must tolerate duplicates.
+ */
+static constexpr size_t MAX_VERIFIED_INBOUND_PER_PROTX{3};
 /** -listen default */
 static const bool DEFAULT_LISTEN = true;
 /** The maximum number of peer connections to maintain.
@@ -1480,6 +1500,16 @@ friend class CNode;
     bool IsMasternodeQuorumRelayMember(const uint256& protxHash);
     void AddPendingProbeConnections(const std::set<uint256>& proTxHashes);
 
+    /**
+     * Mark a peer as a verified masternode connection, granting it the inbound-limit exemption and
+     * eviction protection tied to that status. Returns false, leaving the peer unmarked, if the
+     * peer no longer exists or — for inbound peers — once MAX_VERIFIED_INBOUND_PER_PROTX verified
+     * inbound connections already carry the same proRegTxHash; see that constant for the rationale.
+     * All paths that verify a masternode connection must go through this gate.
+     */
+    bool TryMarkVerified(NodeId id, const uint256& proregtx_hash, const uint256& pubkey_hash)
+        EXCLUSIVE_LOCKS_REQUIRED(!m_nodes_mutex);
+
     size_t GetNodeCount(ConnectionDirection) const EXCLUSIVE_LOCKS_REQUIRED(!m_nodes_mutex);
     std::map<CNetAddr, LocalServiceInfo> getNetLocalAddresses() const;
     size_t GetMaxOutboundNodeCount();
diff --git a/src/rpc/node.cpp b/src/rpc/node.cpp
index a095d2f42a54..41f9f4e04cda 100644
--- a/src/rpc/node.cpp
+++ b/src/rpc/node.cpp
@@ -311,13 +311,7 @@ static RPCHelpMan mnauth()
     }
 
     const NodeContext& node = EnsureAnyNodeContext(request.context);
-    bool fSuccess = node.connman->ForNode(nodeId, CConnman::AllNodes, [&](CNode* pNode){
-        pNode->SetVerifiedProRegTxHash(proTxHash);
-        pNode->SetVerifiedPubKeyHash(publicKey.GetHash());
-        return true;
-    });
-
-    return fSuccess;
+    return node.connman->TryMarkVerified(nodeId, proTxHash, publicKey.GetHash());
 },
     };
 }
diff --git a/src/test/evo_mnauth_tests.cpp b/src/test/evo_mnauth_tests.cpp
new file mode 100644
index 000000000000..bb96ad9cae1d
--- /dev/null
+++ b/src/test/evo_mnauth_tests.cpp
@@ -0,0 +1,93 @@
+// Copyright (c) 2026 The Dash Core developers
+// Distributed under the MIT software license, see the accompanying
+// file COPYING or http://www.opensource.org/licenses/mit-license.php.
+
+#include <net.h>
+#include <node/connection_types.h>
+#include <protocol.h>
+#include <test/util/net.h>
+#include <test/util/setup_common.h>
+#include <uint256.h>
+
+#include <boost/test/unit_test.hpp>
+
+#include <memory>
+
+static_assert(MAX_VERIFIED_INBOUND_PER_PROTX >= 2,
+              "cap must tolerate a reconnect racing a not-yet-reaped socket");
+
+BOOST_FIXTURE_TEST_SUITE(evo_mnauth_tests, BasicTestingSetup)
+
+namespace {
+
+//! Ownership passes to ConnmanTestMsg, which deletes the nodes in ClearTestNodes().
+CNode& AddNode(ConnmanTestMsg& connman, NodeId id, ConnectionType conn_type)
+{
+    auto* node = new CNode{id,
+                           /*sock=*/nullptr,
+                           CAddress{},
+                           /*nKeyedNetGroupIn=*/0,
+                           /*nLocalHostNonceIn=*/0,
+                           CAddress{},
+                           /*addrNameIn=*/"",
+                           conn_type,
+                           /*inbound_onion=*/false};
+    connman.AddTestNode(*node);
+    return *node;
+}
+
+} // namespace
+
+/**
+ * CConnman::TryMarkVerified is the sole gate to verified-masternode status, which exempts an
+ * inbound peer from the inbound connection limit and protects it from eviction. It must refuse the
+ * grant once MAX_VERIFIED_INBOUND_PER_PROTX verified inbound connections already carry the same
+ * proRegTxHash, else one operator key could stack limit-exempt, eviction-immune slots without end.
+ */
+BOOST_AUTO_TEST_CASE(verified_inbound_capped_per_protx)
+{
+    auto connman = std::make_unique<ConnmanTestMsg>(0x1337, 0x1337, *m_node.addrman, *m_node.netgroupman);
+
+    const uint256 attacker{1};
+    const uint256 other{2};
+    const uint256 pubkey_hash{3};
+    NodeId id{0};
+
+    // An unknown peer id cannot be granted anything.
+    BOOST_CHECK(!connman->TryMarkVerified(/*id=*/1337, attacker, pubkey_hash));
+
+    // Inbound legs sharing one identity accumulate against that identity's budget; grants below
+    // the cap succeed, the first grant beyond it is refused and leaves the peer unmarked.
+    CNode* first_leg{nullptr};
+    for (size_t i = 0; i < MAX_VERIFIED_INBOUND_PER_PROTX; ++i) {
+        CNode& node = AddNode(*connman, id++, ConnectionType::INBOUND);
+        if (i == 0) first_leg = &node;
+        BOOST_CHECK(connman->TryMarkVerified(node.GetId(), attacker, pubkey_hash));
+        BOOST_CHECK_EQUAL(node.GetVerifiedProRegTxHash(), attacker);
+        BOOST_CHECK_EQUAL(node.GetVerifiedPubKeyHash(), pubkey_hash);
+    }
+    CNode& refused = AddNode(*connman, id++, ConnectionType::INBOUND);
+    BOOST_CHECK(!connman->TryMarkVerified(refused.GetId(), attacker, pubkey_hash));
+    BOOST_CHECK(refused.GetVerifiedProRegTxHash().IsNull());
+    BOOST_CHECK(refused.GetVerifiedPubKeyHash().IsNull());
+
+    // The budget is per identity, and unverified inbound legs such as `refused` do not consume it:
+    // they already count against nInbound and remain ordinary eviction candidates.
+    CNode& other_node = AddNode(*connman, id++, ConnectionType::INBOUND);
+    BOOST_CHECK(connman->TryMarkVerified(other_node.GetId(), other, pubkey_hash));
+
+    // Outbound legs are not part of the resource being bounded: neither the limit exemption nor
+    // eviction protection applies to them, so they are granted beyond the cap.
+    CNode& outbound = AddNode(*connman, id++, ConnectionType::OUTBOUND_FULL_RELAY);
+    BOOST_CHECK(connman->TryMarkVerified(outbound.GetId(), attacker, pubkey_hash));
+
+    // A verified leg already flagged for disconnect no longer holds its slot, so a reconnect
+    // racing a stale socket is accepted as soon as the stale leg is being torn down.
+    first_leg->fDisconnect = true;
+    BOOST_CHECK(connman->TryMarkVerified(refused.GetId(), attacker, pubkey_hash));
+    BOOST_CHECK_EQUAL(refused.GetVerifiedProRegTxHash(), attacker);
+
+    connman->ClearTestNodes();
+}
+
+BOOST_AUTO_TEST_SUITE_END()
diff --git a/test/functional/rpc_mnauth.py b/test/functional/rpc_mnauth.py
index c5b3007e317e..d09ef4e022fd 100755
--- a/test/functional/rpc_mnauth.py
+++ b/test/functional/rpc_mnauth.py
@@ -57,6 +57,30 @@ def run_test(self):
                                                          null_hash)
         assert not node.mnauth(-1, protx_hash, public_key)
 
+        # Bound on verified inbound connections per proRegTxHash; keep in sync with
+        # MAX_VERIFIED_INBOUND_PER_PROTX in src/net.h.
+        max_verified_inbound = 3
+
+        # The connection verified above already holds one slot; fill the remaining budget.
+        extra_peers = []
+        for _ in range(max_verified_inbound - 1):
+            extra_peers.append(node.add_p2p_connection(P2PInterface()))
+            peer_id = node.getpeerinfo()[-1]["id"]
+            assert node.mnauth(peer_id, protx_hash, public_key)
+
+        # The next inbound leg carrying the same identity is refused and stays unverified...
+        node.add_p2p_connection(P2PInterface())
+        refused_id = node.getpeerinfo()[-1]["id"]
+        assert not node.mnauth(refused_id, protx_hash, public_key)
+        assert "verified_proregtx_hash" not in node.getpeerinfo()[-1]
+
+        # ...until a verified leg goes away and frees its slot.
+        peer_count = len(node.getpeerinfo())
+        extra_peers[0].peer_disconnect()
+        self.wait_until(lambda: len(node.getpeerinfo()) == peer_count - 1)
+        assert node.mnauth(refused_id, protx_hash, public_key)
+        assert_equal(node.getpeerinfo()[-1]["verified_proregtx_hash"], protx_hash)
+
 
 if __name__ == '__main__':
     FakeMNAUTHTest().main()

From 5278ce89d09d57c1f43b4aba816064c5c9c1df07 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 12 Aug 2026 11:55:45 -0500
Subject: [PATCH 20/51] Merge #7583: fix: bound pending DKG message retention
 per proTxHash

cf852838357edaa1236273d4ba4404a7053144c7 test: cover per-proTx DKG pending-message quotas (pasta)
4b7e21fbc1828809b5872cd7527b511c2e02606d fix: bound pending DKG message retention per proTxHash (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  The DKG pending-message retention quota in `CDKGPendingMessages` is keyed by NodeId, which resets on every reconnect. A single masternode identity can therefore retain an effectively unbounded number of pending DKG messages on a victim masternode by reconnecting between sends.

  This extracts the DoS-relevant part of #7557 so it can ship in the release; the deserialize-once/framing intake redesign remains in #7557 for post-RC.

  ## What was done?

  - Rekeyed the retention quota to the sender's MNAuth-verified proTxHash (locally produced messages charge this node's own proTxHash). The quota is cumulative for the round and not refunded on pop, so neither reconnects nor queue drains regain retention slots. The MNAuth gate pins quota keys to registered masternode identities.
  - The duplicate-hash check now runs before the quota charge so resent hashes don't burn budget, and quota-dropped hashes are not marked seen, so another peer with remaining budget can re-deliver the message.
  - `PopAndDeserializeMessages` and the framing/deserialize-once changes from #7557 are intentionally not included.

  ## How Has This Been Tested?

  - New unit tests in `llmq_dkg_tests`: quota survives NodeId changes, quota is per-proTx, duplicates are rejected before charging the quota, own-message enqueue path shares the quota.
  - Extended `feature_llmq_dkg_intake.py` with a late-message scenario: a reconnecting identity cannot exceed its budget across `2*llmq_size` fresh NodeIds, over-quota drops are silent (banscore 0), a distinct proTx has its own budget, and round-start clearing discards retained messages without scoring.
  - `make -j5`, `test_dash --run_test=llmq_dkg_tests`, `test_runner.py feature_llmq_dkg_intake.py`, `lint-python`, `lint-whitespace`.

  ## Breaking Changes

  None. Honest masternodes send one message per type per round, far under the unchanged `size * 2` budget; the only behavior change is that a reconnecting identity can no longer refill its retention quota.

  ## Checklist:

  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

Top commit has no ACKs.

Tree-SHA512: cf881cef9465b8b37f31b9630c937d35c40024ed86771d20d717b4a09a06b9c2467662d05c50a8b4a1f92b96d62dceafe565478eafb6f35610f2f994ef6e2ce0

v23.1.x adaptation: develop routes the quota through src/llmq/net_dkg.cpp
(NetDKG/EnqueueOwn), which does not exist in v23.1.x. The fix is re-threaded
through the v23 intake path instead: the sender proTxHash flows through
CDKGSessionHandler::ProcessMessage, CDKGSessionManager, and the own-message
path in active/dkgsession.cpp, with CDKGPendingMessages keyed by proTxHash.
The develop-only net_dkg.cpp change is dropped (file absent on v23.1.x) and the
feature_llmq_dkg_intake.py functional-test extension is not included; the three
upstream unit tests are ported to the v23 interface in llmq_dkg_tests.cpp.
---
 src/active/dkgsession.cpp      |   8 +--
 src/llmq/dkgsessionhandler.cpp |  37 +++++++----
 src/llmq/dkgsessionhandler.h   |  30 ++++++---
 src/llmq/dkgsessionmgr.cpp     |   6 +-
 src/test/llmq_dkg_tests.cpp    | 114 +++++++++++++++++++++++++++++++++
 5 files changed, 167 insertions(+), 28 deletions(-)

diff --git a/src/active/dkgsession.cpp b/src/active/dkgsession.cpp
index e3135a6a01c3..7cc27c2d5f6a 100644
--- a/src/active/dkgsession.cpp
+++ b/src/active/dkgsession.cpp
@@ -115,7 +115,7 @@ void ActiveDKGSession::SendContributions(CDKGPendingMessages& pendingMessages, P
         return true;
     });
 
-    pendingMessages.PushPendingMessage(-1, qc, peerman);
+    pendingMessages.PushPendingMessage(-1, myProTxHash, qc, peerman);
 }
 
 // Verifies all pending secret key contributions in one batch
@@ -312,7 +312,7 @@ void ActiveDKGSession::SendComplaint(CDKGPendingMessages& pendingMessages, PeerM
         return true;
     });
 
-    pendingMessages.PushPendingMessage(-1, qc, peerman);
+    pendingMessages.PushPendingMessage(-1, myProTxHash, qc, peerman);
 }
 
 void ActiveDKGSession::VerifyAndJustify(CDKGPendingMessages& pendingMessages, PeerManager& peerman)
@@ -402,7 +402,7 @@ void ActiveDKGSession::SendJustification(CDKGPendingMessages& pendingMessages, P
         return true;
     });
 
-    pendingMessages.PushPendingMessage(-1, qj, peerman);
+    pendingMessages.PushPendingMessage(-1, myProTxHash, qj, peerman);
 }
 
 void ActiveDKGSession::VerifyAndCommit(CDKGPendingMessages& pendingMessages, PeerManager& peerman)
@@ -559,7 +559,7 @@ void ActiveDKGSession::SendCommitment(CDKGPendingMessages& pendingMessages, Peer
         return true;
     });
 
-    pendingMessages.PushPendingMessage(-1, qc, peerman);
+    pendingMessages.PushPendingMessage(-1, myProTxHash, qc, peerman);
 }
 
 std::vector<CFinalCommitment> ActiveDKGSession::FinalizeCommitments()
diff --git a/src/llmq/dkgsessionhandler.cpp b/src/llmq/dkgsessionhandler.cpp
index 2c83b07266e5..588e1a12fd30 100644
--- a/src/llmq/dkgsessionhandler.cpp
+++ b/src/llmq/dkgsessionhandler.cpp
@@ -7,6 +7,7 @@
 #include <hash.h>
 #include <logging.h>
 #include <span.h>
+#include <util/check.h>
 
 #include <stdexcept>
 
@@ -26,7 +27,7 @@ CDKGSessionHandler::CDKGSessionHandler(const Consensus::LLMQParams& _params) :
 
 CDKGSessionHandler::~CDKGSessionHandler() = default;
 
-MessageProcessingResult CDKGPendingMessages::PushPendingMessage(NodeId from, CDataStream& vRecv)
+MessageProcessingResult CDKGPendingMessages::PushPendingMessage(NodeId from, const uint256& sender_protx, CDataStream& vRecv)
 {
     // this will also consume the data, even if we bail out early
     auto pm = std::make_shared<CDataStream>(std::move(vRecv));
@@ -42,18 +43,27 @@ MessageProcessingResult CDKGPendingMessages::PushPendingMessage(NodeId from, CDa
 
     LOCK(cs_messages);
 
-    if (messagesPerNode[from] >= maxMessagesPerNode) {
-        // TODO ban?
-        LogPrint(BCLog::LLMQ_DKG, "CDKGPendingMessages::%s -- too many messages, peer=%d\n", __func__, from);
+    // Check duplicates before the quota so resent hashes don't burn budget
+    if (seenMessages.count(hash) != 0) {
+        LogPrint(BCLog::LLMQ_DKG, "CDKGPendingMessages::%s -- already seen %s, peer=%d\n", __func__, hash.ToString(), from);
         return ret;
     }
-    messagesPerNode[from]++;
 
-    if (!seenMessages.emplace(hash).second) {
-        LogPrint(BCLog::LLMQ_DKG, "CDKGPendingMessages::%s -- already seen %s, peer=%d\n", __func__, hash.ToString(), from);
+    // Callers always pass an identity (the MNAuth gate for remote, our own
+    // proTxHash for local); drop rather than share a null-keyed quota bucket
+    if (!Assume(!sender_protx.IsNull())) {
+        return ret;
+    }
+    auto& count = messagesPerProTx[sender_protx];
+    if (count >= maxMessagesPerProTx) {
+        // TODO ban?
+        LogPrint(BCLog::LLMQ_DKG, "CDKGPendingMessages::%s -- too many messages from %s, peer=%d\n", __func__,
+                 sender_protx.ToString(), from);
         return ret;
     }
+    count++;
 
+    seenMessages.emplace(hash);
     pendingMessages.emplace_back(std::make_pair(from, std::move(pm)));
     return ret;
 }
@@ -87,23 +97,24 @@ void CDKGPendingMessages::Clear()
 {
     LOCK(cs_messages);
     pendingMessages.clear();
-    messagesPerNode.clear();
+    messagesPerProTx.clear();
     seenMessages.clear();
 }
 
 //////
 
-MessageProcessingResult CDKGSessionHandler::ProcessMessage(NodeId from, std::string_view msg_type, CDataStream& vRecv)
+MessageProcessingResult CDKGSessionHandler::ProcessMessage(NodeId from, const uint256& sender_protx,
+                                                           std::string_view msg_type, CDataStream& vRecv)
 {
     // We don't handle messages in the calling thread as deserialization/processing of these would block everything
     if (msg_type == NetMsgType::QCONTRIB) {
-        return pendingContributions.PushPendingMessage(from, vRecv);
+        return pendingContributions.PushPendingMessage(from, sender_protx, vRecv);
     } else if (msg_type == NetMsgType::QCOMPLAINT) {
-        return pendingComplaints.PushPendingMessage(from, vRecv);
+        return pendingComplaints.PushPendingMessage(from, sender_protx, vRecv);
     } else if (msg_type == NetMsgType::QJUSTIFICATION) {
-        return pendingJustifications.PushPendingMessage(from, vRecv);
+        return pendingJustifications.PushPendingMessage(from, sender_protx, vRecv);
     } else if (msg_type == NetMsgType::QPCOMMITMENT) {
-        return pendingPrematureCommitments.PushPendingMessage(from, vRecv);
+        return pendingPrematureCommitments.PushPendingMessage(from, sender_protx, vRecv);
     }
     return {};
 }
diff --git a/src/llmq/dkgsessionhandler.h b/src/llmq/dkgsessionhandler.h
index 19ea22cdd6c7..c0a1d57aa8cf 100644
--- a/src/llmq/dkgsessionhandler.h
+++ b/src/llmq/dkgsessionhandler.h
@@ -63,17 +63,27 @@ class CDKGPendingMessages
 
 private:
     const uint32_t invType;
-    const size_t maxMessagesPerNode;
+    const size_t maxMessagesPerProTx;
     mutable Mutex cs_messages;
     std::list<BinaryMessage> pendingMessages GUARDED_BY(cs_messages);
-    std::map<NodeId, size_t> messagesPerNode GUARDED_BY(cs_messages);
+    // Keyed by proTxHash rather than NodeId so the quota survives reconnects,
+    // and cumulative for the round (not refunded on pop) so draining the queue
+    // does not regain retention slots. MNAuth pins keys to registered MNs.
+    std::map<uint256, size_t> messagesPerProTx GUARDED_BY(cs_messages);
     std::set<uint256> seenMessages GUARDED_BY(cs_messages);
 
 public:
-    explicit CDKGPendingMessages(size_t _maxMessagesPerNode, uint32_t _invType) :
-            invType(_invType), maxMessagesPerNode(_maxMessagesPerNode) {};
-
-    [[nodiscard]] MessageProcessingResult PushPendingMessage(NodeId from, CDataStream& vRecv)
+    explicit CDKGPendingMessages(size_t _maxMessagesPerProTx, uint32_t _invType) :
+            invType(_invType), maxMessagesPerProTx(_maxMessagesPerProTx) {};
+
+    /**
+     * Enqueue a serialized DKG message received from @p from. @p sender_protx keys the per-proTx
+     * quota: the sender's MNAuth-verified proTxHash for remote messages, or this node's own for
+     * messages it produced itself (@p from == -1). Drops the message silently on quota overflow or
+     * duplicate hash; quota-dropped messages are not marked seen, so another peer with budget can
+     * re-deliver them.
+     */
+    [[nodiscard]] MessageProcessingResult PushPendingMessage(NodeId from, const uint256& sender_protx, CDataStream& vRecv)
         EXCLUSIVE_LOCKS_REQUIRED(!cs_messages);
     std::list<BinaryMessage> PopPendingMessages(size_t maxCount) EXCLUSIVE_LOCKS_REQUIRED(!cs_messages);
     bool HasSeen(const uint256& hash) const EXCLUSIVE_LOCKS_REQUIRED(!cs_messages);
@@ -81,11 +91,12 @@ class CDKGPendingMessages
     void Clear() EXCLUSIVE_LOCKS_REQUIRED(!cs_messages);
 
     template <typename Message>
-    void PushPendingMessage(NodeId from, Message& msg, PeerManager& peerman) EXCLUSIVE_LOCKS_REQUIRED(!cs_messages)
+    void PushPendingMessage(NodeId from, const uint256& sender_protx, Message& msg, PeerManager& peerman)
+        EXCLUSIVE_LOCKS_REQUIRED(!cs_messages)
     {
         CDataStream ds(SER_NETWORK, PROTOCOL_VERSION);
         ds << msg;
-        peerman.PostProcessMessage(PushPendingMessage(from, ds), from);
+        peerman.PostProcessMessage(PushPendingMessage(from, sender_protx, ds), from);
     }
 
     // Might return nullptr messages, which indicates that deserialization failed for some reason
@@ -138,7 +149,8 @@ class CDKGSessionHandler
     explicit CDKGSessionHandler(const Consensus::LLMQParams& _params);
     virtual ~CDKGSessionHandler();
 
-    [[nodiscard]] MessageProcessingResult ProcessMessage(NodeId from, std::string_view msg_type, CDataStream& vRecv);
+    [[nodiscard]] MessageProcessingResult ProcessMessage(NodeId from, const uint256& sender_protx,
+                                                         std::string_view msg_type, CDataStream& vRecv);
 
 public:
     virtual bool GetContribution(const uint256& hash, CDKGContribution& ret) const { return false; }
diff --git a/src/llmq/dkgsessionmgr.cpp b/src/llmq/dkgsessionmgr.cpp
index 8191e212e43a..7c8a5eb86a5d 100644
--- a/src/llmq/dkgsessionmgr.cpp
+++ b/src/llmq/dkgsessionmgr.cpp
@@ -192,7 +192,9 @@ MessageProcessingResult CDKGSessionManager::ProcessMessage(CNode& pfrom, bool is
     // attacker-controlled payloads, so they must originate from an MNAuth-verified
     // masternode. qwatch is unauthenticated (any peer can set it via QWATCH) and is
     // only meaningful for pull/observation paths; it must not bypass this gate.
-    if (pfrom.GetVerifiedProRegTxHash().IsNull()) {
+    // Read once: the same value keys the retention quota below
+    const uint256 sender_protx = pfrom.GetVerifiedProRegTxHash();
+    if (sender_protx.IsNull()) {
         return MisbehavingError{10, "DKG message from non-verified peer"};
     }
 
@@ -277,7 +279,7 @@ MessageProcessingResult CDKGSessionManager::ProcessMessage(CNode& pfrom, bool is
     }
 
     WITH_LOCK(cs_indexedQuorumsCache, indexedQuorumsCache[llmqType].insert(quorumHash, quorumIndex));
-    return Assert(dkgSessionHandlers.at({llmqType, quorumIndex}))->ProcessMessage(pfrom.GetId(), msg_type, vRecv);
+    return Assert(dkgSessionHandlers.at({llmqType, quorumIndex}))->ProcessMessage(pfrom.GetId(), sender_protx, msg_type, vRecv);
 }
 
 bool CDKGSessionManager::AlreadyHave(const CInv& inv) const
diff --git a/src/test/llmq_dkg_tests.cpp b/src/test/llmq_dkg_tests.cpp
index 0a341480a3b7..4a844c26190a 100644
--- a/src/test/llmq_dkg_tests.cpp
+++ b/src/test/llmq_dkg_tests.cpp
@@ -2,7 +2,12 @@
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
+#include <hash.h>
 #include <llmq/dkgsession.h>
+#include <llmq/dkgsessionhandler.h>
+#include <protocol.h>
+#include <span.h>
+#include <streams.h>
 #include <util/irange.h>
 #include <util/underlying.h>
 
@@ -23,6 +28,115 @@ BOOST_AUTO_TEST_CASE(llmq_dkgerror)
     BOOST_REQUIRE(GetSimulatedErrorRate(llmq::DKGError::type::_COUNT) == 0.0);
 }
 
+namespace {
+CDataStream MakeDKGMessage(uint8_t value)
+{
+    CDataStream ds{SER_NETWORK, PROTOCOL_VERSION};
+    ds << value;
+    return ds;
+}
+
+//! The inventory hash CDKGPendingMessages records for MakeDKGMessage(value)
+uint256 MessageHash(uint8_t value)
+{
+    const CDataStream ds{MakeDKGMessage(value)};
+    CHashWriter hw(SER_GETHASH, 0);
+    hw.write(AsBytes(Span{ds}));
+    return hw.GetHash();
+}
+
+void Push(llmq::CDKGPendingMessages& pending, NodeId from, const uint256& sender_protx, uint8_t value)
+{
+    CDataStream ds{MakeDKGMessage(value)};
+    (void)pending.PushPendingMessage(from, sender_protx, ds);
+}
+
+uint256 MakeProTx(uint8_t value)
+{
+    uint256 hash;
+    hash.begin()[0] = value;
+    return hash;
+}
+} // namespace
+
+BOOST_AUTO_TEST_CASE(pending_messages_own_messages_share_quota_path)
+{
+    using namespace llmq;
+
+    const uint256 own_protx = MakeProTx(0xee);
+
+    // Own messages (from=-1) are enqueued under this node's proTxHash and
+    // charged like any other sender's.
+    CDKGPendingMessages pending{/*_maxMessagesPerProTx=*/2, MSG_QUORUM_CONTRIB};
+    Push(pending, /*from=*/-1, own_protx, 1);
+    Push(pending, /*from=*/-1, own_protx, 2);
+    Push(pending, /*from=*/-1, own_protx, 3);
+    BOOST_CHECK(pending.HasSeen(MessageHash(2)));
+    BOOST_CHECK(!pending.HasSeen(MessageHash(3)));
+
+    BOOST_CHECK_EQUAL(pending.PopPendingMessages(3).size(), 2U);
+}
 
+BOOST_AUTO_TEST_CASE(pending_messages_quota_survives_reconnect)
+{
+    using namespace llmq;
+
+    const uint256 protx_a = MakeProTx(0xa1);
+
+    CDKGPendingMessages pending{/*_maxMessagesPerProTx=*/2, MSG_QUORUM_CONTRIB};
+    Push(pending, /*from=*/1, protx_a, 1);
+    Push(pending, /*from=*/1, protx_a, 2);
+    BOOST_CHECK(pending.HasSeen(MessageHash(1)));
+    BOOST_CHECK(pending.HasSeen(MessageHash(2)));
+
+    // Reconnecting mints a fresh NodeId but keeps the proTxHash, so the quota
+    // is already spent.
+    Push(pending, /*from=*/2, protx_a, 3);
+    Push(pending, /*from=*/3, protx_a, 4);
+    BOOST_CHECK(!pending.HasSeen(MessageHash(3)));
+    BOOST_CHECK(!pending.HasSeen(MessageHash(4)));
+
+    // Draining frees queue slots but does not refund the per-proTx quota.
+    BOOST_CHECK_EQUAL(pending.PopPendingMessages(5).size(), 2U);
+    Push(pending, /*from=*/4, protx_a, 5);
+    BOOST_CHECK(!pending.HasSeen(MessageHash(5)));
+
+    // A new round resets everything.
+    pending.Clear();
+    Push(pending, /*from=*/4, protx_a, 5);
+    BOOST_CHECK(pending.HasSeen(MessageHash(5)));
+}
+
+BOOST_AUTO_TEST_CASE(pending_messages_quota_is_per_protx)
+{
+    using namespace llmq;
+
+    const uint256 protx_a = MakeProTx(0xa1);
+    const uint256 protx_b = MakeProTx(0xb1);
+
+    CDKGPendingMessages pending{/*_maxMessagesPerProTx=*/2, MSG_QUORUM_CONTRIB};
+    Push(pending, /*from=*/1, protx_a, 1);
+    Push(pending, /*from=*/1, protx_a, 2);
+
+    // Duplicates are rejected before charging the quota.
+    Push(pending, /*from=*/2, protx_b, 1);
+    Push(pending, /*from=*/2, protx_b, 2);
+
+    // One proTx's spent quota has no effect on another's.
+    Push(pending, /*from=*/2, protx_b, 3);
+    Push(pending, /*from=*/2, protx_b, 4);
+    Push(pending, /*from=*/2, protx_b, 5);
+    BOOST_CHECK(pending.HasSeen(MessageHash(3)));
+    BOOST_CHECK(pending.HasSeen(MessageHash(4)));
+    BOOST_CHECK(!pending.HasSeen(MessageHash(5)));
+
+    // A quota-dropped hash is not marked seen, so a sender with remaining
+    // budget can still deliver it.
+    const uint256 protx_c = MakeProTx(0xc1);
+    Push(pending, /*from=*/3, protx_c, 5);
+    BOOST_CHECK(pending.HasSeen(MessageHash(5)));
+
+    BOOST_CHECK_EQUAL(pending.PopPendingMessages(6).size(), 5U);
+}
 
 BOOST_AUTO_TEST_SUITE_END()

From 9bc1e7714f7d0a69384ecce25d7d71e34449fa5a Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sun, 23 Aug 2026 11:36:59 -0500
Subject: [PATCH 21/51] Merge #7489: fix: conflict ProRegTx collateral reuse
 with in-mempool masternode updates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

95341f5a5c38e9f92290c6c09c0f07f8b5057c7e refactor: extract removeProTxReferences and cover replacement eviction (pasta)
9b3ca40aa7eb157b88d98546e05ef23c204f3380 fix: conflict ProReg collateral reuse with mempool MN updates (pasta)
4d4f5791acad52b100a2c1395f202fa8efd509fe test: prove ProReg replacement conflicts with same-MN updates (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  A ProRegTx that reuses an external collateral *replaces* the masternode that collateral
  currently backs — the old masternode ceases to exist and its `proTxHash` becomes unknown.

  The mempool does not model that. It tracks collateral *spends*
  (`removeProTxSpentCollateralConflicts`), but reuse is not a spend, so:

  - A replacement ProRegTx and an update (ProUpServTx / ProUpRegTx / ProUpRevTx) targeting the
    masternode being replaced can sit in the mempool at the same time.
  - If both are selected into one block, `BuildNewListFromBlock()` deletes the masternode when
    it applies the ProRegTx, then fails `bad-protx-hash` on the update.
  - That aborts block assembly in the miner.

  The same hazard exists when the replacement ProRegTx arrives in a block rather than through
  the mempool: the stale update is left behind and can never be mined.

  ## What was done?

  Three commits.

  **1. Mempool admission (`existsProviderTxConflict`)** — the two directions are now
  symmetric:

  - A ProRegTx reusing an external collateral conflicts if any mempool transaction still
    references the incumbent masternode's `proTxHash`.
  - A ProUpServTx / ProUpRegTx / ProUpRevTx conflicts if a pending ProRegTx already claims its
    masternode's collateral outpoint.

  This is first-in-wins with no RBF-style tiebreak. That is a deliberate policy choice: both
  transactions are individually valid, and the only requirement is that they not coexist.
  Preferring the incumbent would mean evicting an already-accepted transaction on arrival of a
  new one, which is a bigger policy change than this problem warrants.

  **2. Eviction on block connect (`removeProTxConflicts`)** — when a collateral-reusing
  ProRegTx is mined, any mempool transaction still targeting the replaced masternode is
  removed. This covers the case where the ProRegTx never passed through this node's mempool,
  so the admission check above never ran.

  **3. Refactor** — the removal loop inside `removeProTxSpentCollateralConflicts` is extracted
  as `CTxMemPool::removeProTxReferences()` and reused by both call sites. No behaviour change;
  it just avoids a second copy of the iterator-invalidation-safe loop.

  ### One thing reviewers should look at

  The eviction in (2) calls `dmnman->GetListAtChainTip()` and needs it to resolve to the list
  at the *previous* tip, so `GetMNByCollateral()` returns the masternode being replaced rather
  than its replacement. That holds because `CDeterministicMNManager::tipIndex` is assigned in
  `UpdatedBlockTip()`, which fires from `ActivateBestChain()` (`validation.cpp:3339-3340`) —
  after `ConnectTip()` calls `removeForBlock()` (`validation.cpp:3025`).

  `removeProTxSpentCollateralConflicts()` already depends on this ordering, so the new code is
  consistent with the file. The difference is that there it is an optimisation, whereas here it
  is load-bearing: if the ordering changed, `GetMNByCollateral()` would return the replacement
  masternode and the eviction would silently become a no-op. I have noted the dependency in a
  comment, but flagging it explicitly since it is the least obvious part of the change.

  ## How Has This Been Tested?

  `test_mempool_proreg_replacement_update_conflict` in
  `src/test/evo_deterministicmns_tests.cpp`, added in the commit *preceding* the fix. It
  covers both paths:

  - admission, via `existsProviderTxConflict()` in both directions;
  - eviction, via `removeForBlock()` with a block containing the replacement ProRegTx.

  Without the fix the admission assertions fail (2 failures) — the conflicting pair is
  accepted. With the fix, `evo_dip3_activation_tests` passes (19 cases).

  Built and run on macOS/arm64 against current `develop`.

  ## Breaking Changes

  Mempool policy only; no consensus rules change. Some transaction pairs that were previously
  accepted together are now mutually exclusive in the mempool. Neither could have been mined
  together, so nothing that was previously minable is rejected.

  ## Known follow-up

  Coverage is C++ unit level only. A functional test exercising the miner path end to end
  would strengthen this; happy to add one in this PR if reviewers would prefer it before merge.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

Top commit has no ACKs.

Tree-SHA512: 07fc7348712ce7e48e40f8234c9a988eb9cac50baed9a85e5229300a1a18ab7caefe46110f348978a44a3943aa7ce068253b4823af51619fc82e02cda7820224

v23.1.x adaptation: CTxMemPool holds the dmnman as an atomic pointer, so the
new GetListAtChainTip() calls go through the local `dmnman` in
existsProviderTxConflict and Assert(m_dmnman.load(std::memory_order_acquire)) in
removeProTxConflicts/removeProTxSpentCollateralConflicts, instead of develop's
`m_dmnman` reference. The shared removeProTxReferences helper is extracted as a
member. The test uses v23-shaped CreateSpendTx/GetCollateralOutpoint/
CreateProRegTxExternalCollateral helpers and a ConnectManagers()-based mempool.
---
 src/test/evo_deterministicmns_tests.cpp | 163 ++++++++++++++++++++++++
 src/txmempool.cpp                       |  73 ++++++++---
 src/txmempool.h                         |   4 +
 3 files changed, 219 insertions(+), 21 deletions(-)

diff --git a/src/test/evo_deterministicmns_tests.cpp b/src/test/evo_deterministicmns_tests.cpp
index f46f1172d6a8..9a9d5f025b72 100644
--- a/src/test/evo_deterministicmns_tests.cpp
+++ b/src/test/evo_deterministicmns_tests.cpp
@@ -7,6 +7,7 @@
 #include <chainparams.h>
 #include <consensus/validation.h>
 #include <deploymentstatus.h>
+#include <evo/chainhelper.h>
 #include <evo/deterministicmns.h>
 #include <evo/providertx.h>
 #include <evo/simplifiedmns.h>
@@ -128,6 +129,51 @@ static CMutableTransaction CreateProRegTx(const CChain& active_chain, const CTxM
     return tx;
 }
 
+static CMutableTransaction CreateSpendTx(const CChain& active_chain, const CTxMemPool& mempool, SimpleUTXOMap& utxos, const CScript& scriptPayout, CAmount amount, const CKey& coinbaseKey)
+{
+    CMutableTransaction tx;
+    FundTransaction(active_chain, tx, utxos, scriptPayout, amount, coinbaseKey);
+    SignTransaction(mempool, tx, coinbaseKey);
+    return tx;
+}
+
+static COutPoint GetCollateralOutpoint(const CMutableTransaction& tx)
+{
+    for (size_t i = 0; i < tx.vout.size(); ++i) {
+        if (tx.vout[i].nValue == dmn_types::Regular.collat_amount) {
+            return COutPoint(tx.GetHash(), i);
+        }
+    }
+    return COutPoint();
+}
+
+// ProRegTx that references a pre-existing collateral output instead of funding the collateral inline.
+static CMutableTransaction CreateProRegTxExternalCollateral(const CChain& active_chain, const CTxMemPool& mempool, SimpleUTXOMap& utxos, int port, const COutPoint& collateralOutpoint, const CScript& scriptPayout, const CKey& ownerKey, const CBLSSecretKey& operatorKey, const CKey& collateralKey, const CKey& coinbaseKey)
+{
+    CProRegTx proTx;
+    proTx.nVersion = ProTxVersion::GetMax(!bls::bls_legacy_scheme, /*is_extended_addr=*/false);
+    proTx.netInfo = NetInfoInterface::MakeNetInfo(proTx.nVersion);
+    BOOST_CHECK_EQUAL(proTx.netInfo->AddEntry(NetInfoPurpose::CORE_P2P, strprintf("1.1.1.1:%d", port)),
+                      NetInfoStatus::Success);
+    proTx.collateralOutpoint = collateralOutpoint;
+    proTx.keyIDOwner = ownerKey.GetPubKey().GetID();
+    proTx.pubKeyOperator.Set(operatorKey.GetPublicKey(), bls::bls_legacy_scheme.load());
+    proTx.keyIDVoting = ownerKey.GetPubKey().GetID();
+    proTx.scriptPayout = scriptPayout;
+
+    CMutableTransaction tx;
+    tx.nVersion = 3;
+    tx.nType = TRANSACTION_PROVIDER_REGISTER;
+    // The collateral is external (referenced via collateralOutpoint), so this tx only needs to fund a fee.
+    FundTransaction(active_chain, tx, utxos, scriptPayout, /*amount=*/1 * COIN, coinbaseKey);
+    proTx.inputsHash = CalcTxInputsHash(CTransaction(tx));
+    CMessageSigner::SignMessage(proTx.MakeSignString(), proTx.vchSig, collateralKey);
+    SetTxPayload(tx, proTx);
+    SignTransaction(mempool, tx, coinbaseKey);
+
+    return tx;
+}
+
 static CMutableTransaction CreateProUpServTx(const CChain& active_chain, const CTxMemPool& mempool, SimpleUTXOMap& utxos, const uint256& proTxHash, const CBLSSecretKey& operatorKey, int port, const CScript& scriptOperatorPayout, const CKey& coinbaseKey)
 {
     CProUpServTx proTx;
@@ -961,6 +1007,117 @@ void FuncTestMempoolDualProregtx(TestChainSetup& setup)
     BOOST_CHECK(testPool.existsProviderTxConflict(CTransaction(tx_reg2)));
 }
 
+// A ProRegTx that reuses a confirmed external collateral replaces the live MN at block
+// connect time. An update (ProUpServ/ProUpReg/ProUpRev) for the replaced proTxHash is still
+// mempool-valid against the pre-block tip list, so fee-ordered packaging can put the replacement
+// ProRegTx before the update and make BuildNewListFromBlock return bad-protx-hash, aborting
+// CreateNewBlock/getblocktemplate. The mempool must treat them as conflicts.
+void FuncTestMempoolProRegReplacementUpdateConflict(TestChainSetup& setup)
+{
+    auto& chainman = *Assert(setup.m_node.chainman.get());
+    auto& dmnman = *Assert(setup.m_node.dmnman);
+    auto& mempool = *Assert(setup.m_node.mempool);
+    auto tip_index = [&] { return WITH_LOCK(::cs_main, return chainman.ActiveChain().Tip()); };
+    auto tip_height = [&] { return WITH_LOCK(::cs_main, return chainman.ActiveChain().Height()); };
+    auto sync_dmn_tip = [&] { dmnman.UpdatedBlockTip(tip_index()); };
+
+    const CScript coinbase_pk = GetScriptForRawPubKey(setup.coinbaseKey.GetPubKey());
+    int nHeight = tip_height();
+    auto utxos = BuildSimpleUtxoMap(setup.m_coinbase_txns);
+
+    CKey ownerKey;
+    CKey payoutKey;
+    CKey collateralKey;
+    CBLSSecretKey operatorKey;
+    ownerKey.MakeNewKey(true);
+    payoutKey.MakeNewKey(true);
+    collateralKey.MakeNewKey(true);
+    operatorKey.MakeNewKey();
+
+    auto scriptPayout = GetScriptForDestination(PKHash(payoutKey.GetPubKey()));
+    auto scriptCollateral = GetScriptForDestination(PKHash(collateralKey.GetPubKey()));
+
+    // Fund and mine an external collateral, then register MN X against it.
+    auto tx_collateral = CreateSpendTx(chainman.ActiveChain(), mempool, utxos, scriptCollateral,
+                                       dmn_types::Regular.collat_amount, setup.coinbaseKey);
+    auto block = std::make_shared<CBlock>(setup.CreateBlock({tx_collateral}, coinbase_pk, chainman.ActiveChainstate()));
+    BOOST_REQUIRE(chainman.ProcessNewBlock(block, true, nullptr));
+    sync_dmn_tip();
+    BOOST_CHECK_EQUAL(tip_height(), nHeight + 1);
+
+    const auto collateralOutpoint = GetCollateralOutpoint(tx_collateral);
+    auto tx_reg = CreateProRegTxExternalCollateral(chainman.ActiveChain(), mempool, utxos, /*port=*/1, collateralOutpoint,
+                                                   scriptPayout, ownerKey, operatorKey, collateralKey, setup.coinbaseKey);
+    const uint256 proTxHash = tx_reg.GetHash();
+    block = std::make_shared<CBlock>(setup.CreateBlock({tx_reg}, coinbase_pk, chainman.ActiveChainstate()));
+    BOOST_REQUIRE(chainman.ProcessNewBlock(block, true, nullptr));
+    sync_dmn_tip();
+    BOOST_CHECK_EQUAL(tip_height(), nHeight + 2);
+    BOOST_REQUIRE(dmnman.GetListAtChainTip().HasMN(proTxHash));
+    BOOST_REQUIRE(dmnman.GetListAtChainTip().GetMNByCollateral(collateralOutpoint) != nullptr);
+    BOOST_CHECK_EQUAL(dmnman.GetListAtChainTip().GetMNByCollateral(collateralOutpoint)->proTxHash.ToString(),
+                      proTxHash.ToString());
+
+    // Replacement ProRegTx reusing the same external collateral with fresh keys/address.
+    CKey ownerKey2;
+    CKey payoutKey2;
+    CBLSSecretKey operatorKey2;
+    ownerKey2.MakeNewKey(true);
+    payoutKey2.MakeNewKey(true);
+    operatorKey2.MakeNewKey();
+    auto scriptPayout2 = GetScriptForDestination(PKHash(payoutKey2.GetPubKey()));
+    auto tx_reg_replace = CreateProRegTxExternalCollateral(chainman.ActiveChain(), mempool, utxos, /*port=*/3,
+                                                           collateralOutpoint, scriptPayout2, ownerKey2, operatorKey2,
+                                                           collateralKey, setup.coinbaseKey);
+
+    // Same-block-style update for the MN that the replacement would delete.
+    auto tx_up_serv = CreateProUpServTx(chainman.ActiveChain(), mempool, utxos, proTxHash, operatorKey, /*port=*/2,
+                                        CScript(), setup.coinbaseKey);
+
+    // Prove the in-block hazard itself: replacement first, then update of the deleted proTxHash.
+    {
+        LOCK(cs_main);
+        CBlock hazard_block;
+        hazard_block.vtx.emplace_back(MakeTransactionRef(CMutableTransaction())); // dummy coinbase slot
+        hazard_block.vtx.emplace_back(MakeTransactionRef(tx_reg_replace));
+        hazard_block.vtx.emplace_back(MakeTransactionRef(tx_up_serv));
+
+        BlockValidationState state;
+        CDeterministicMNList mn_list;
+        BOOST_CHECK(!chainman.ActiveChainstate().ChainHelper().special_tx->BuildNewListFromBlock(
+            hazard_block, tip_index(), chainman.ActiveChainstate().CoinsTip(), /*debugLogs=*/false, state, mn_list));
+        BOOST_CHECK_EQUAL(state.GetRejectReason(), "bad-protx-hash");
+    }
+
+    // Mempool acceptance must refuse the second of these once one is present.
+    CTxMemPool testPool;
+    testPool.ConnectManagers(setup.m_node.dmnman.get(), setup.m_node.llmq_ctx->isman.get());
+    TestMemPoolEntryHelper entry;
+
+    {
+        LOCK2(cs_main, testPool.cs);
+        // Replacement already in mempool => update for the MN it replaces is a conflict.
+        testPool.addUnchecked(entry.FromTx(tx_reg_replace));
+        BOOST_CHECK_EQUAL(testPool.size(), 1U);
+        BOOST_CHECK(testPool.existsProviderTxConflict(CTransaction(tx_up_serv)));
+        testPool.removeRecursive(CTransaction(tx_reg_replace), MemPoolRemovalReason::MANUAL);
+        BOOST_CHECK_EQUAL(testPool.size(), 0U);
+
+        // Update already in mempool => replacement ProRegTx reusing that MN's collateral conflicts.
+        testPool.addUnchecked(entry.FromTx(tx_up_serv));
+        BOOST_CHECK_EQUAL(testPool.size(), 1U);
+        BOOST_CHECK(testPool.existsProviderTxConflict(CTransaction(tx_reg_replace)));
+
+        // existsProviderTxConflict only gates our own acceptance; it cannot stop a miner from
+        // confirming the replacement. Once that block arrives, removeForBlock must evict the
+        // now-unmineable update, otherwise it lingers and stalls our own block assembly.
+        std::vector<CTransactionRef> connected{MakeTransactionRef(CMutableTransaction()),
+                                               MakeTransactionRef(tx_reg_replace)};
+        testPool.removeForBlock(connected, tip_height() + 1);
+        BOOST_CHECK_EQUAL(testPool.size(), 0U);
+    }
+}
+
 void FuncVerifyDB(TestChainSetup& setup)
 {
     auto& chainman = *Assert(setup.m_node.chainman.get());
@@ -1254,6 +1411,12 @@ BOOST_AUTO_TEST_CASE(test_mempool_dual_proregtx_basic)
     FuncTestMempoolDualProregtx(setup);
 }
 
+BOOST_AUTO_TEST_CASE(test_mempool_proreg_replacement_update_conflict)
+{
+    TestChainV19Setup setup;
+    FuncTestMempoolProRegReplacementUpdateConflict(setup);
+}
+
 //This one can be started only with legacy scheme, since inside undo block will switch it back to legacy resulting into an inconsistency
 BOOST_AUTO_TEST_CASE(verify_db_legacy)
 {
diff --git a/src/txmempool.cpp b/src/txmempool.cpp
index 0bbfa8bd9953..728ea08aae83 100644
--- a/src/txmempool.cpp
+++ b/src/txmempool.cpp
@@ -951,41 +951,43 @@ void CTxMemPool::removeProTxCollateralConflicts(const CTransaction &tx, const CO
     }
 }
 
+void CTxMemPool::removeProTxReferences(const uint256& proTxHash)
+{
+    // Can't use equal_range here as every call to removeRecursive might invalidate iterators
+    AssertLockHeld(cs);
+    while (true) {
+        auto it = mapProTxRefs.find(proTxHash);
+        if (it == mapProTxRefs.end()) {
+            break;
+        }
+        auto conflictIt = mapTx.find(it->second);
+        if (conflictIt != mapTx.end()) {
+            removeRecursive(conflictIt->GetTx(), MemPoolRemovalReason::CONFLICT);
+        } else {
+            // Should not happen as we track referencing TXs in addUnchecked/removeUnchecked.
+            // But lets be on the safe side and not run into an endless loop...
+            LogPrint(BCLog::MEMPOOL, "%s: ERROR: found invalid TX ref in mapProTxRefs, proTxHash=%s, txHash=%s\n", __func__, proTxHash.ToString(), it->second.ToString());
+            mapProTxRefs.erase(it);
+        }
+    }
+}
+
 void CTxMemPool::removeProTxSpentCollateralConflicts(const CTransaction &tx)
 {
     auto dmnman = Assert(m_dmnman.load(std::memory_order_acquire));
 
     // Remove TXs that refer to a MN for which the collateral was spent
-    auto removeSpentCollateralConflict = [&](const uint256& proTxHash) EXCLUSIVE_LOCKS_REQUIRED(cs) {
-        // Can't use equal_range here as every call to removeRecursive might invalidate iterators
-        AssertLockHeld(cs);
-        while (true) {
-            auto it = mapProTxRefs.find(proTxHash);
-            if (it == mapProTxRefs.end()) {
-                break;
-            }
-            auto conflictIt = mapTx.find(it->second);
-            if (conflictIt != mapTx.end()) {
-                removeRecursive(conflictIt->GetTx(), MemPoolRemovalReason::CONFLICT);
-            } else {
-                // Should not happen as we track referencing TXs in addUnchecked/removeUnchecked.
-                // But lets be on the safe side and not run into an endless loop...
-                LogPrint(BCLog::MEMPOOL, "%s: ERROR: found invalid TX ref in mapProTxRefs, proTxHash=%s, txHash=%s\n", __func__, proTxHash.ToString(), it->second.ToString());
-                mapProTxRefs.erase(it);
-            }
-        }
-    };
     auto mnList = dmnman->GetListAtChainTip();
     for (const auto& in : tx.vin) {
         auto collateralIt = mapProTxCollaterals.find(in.prevout);
         if (collateralIt != mapProTxCollaterals.end()) {
             // These are not yet mined ProRegTxs
-            removeSpentCollateralConflict(collateralIt->second);
+            removeProTxReferences(collateralIt->second);
         }
         auto dmn = mnList.GetMNByCollateral(in.prevout);
         if (dmn) {
             // These are updates referring to a mined ProRegTx
-            removeSpentCollateralConflict(dmn->proTxHash);
+            removeProTxReferences(dmn->proTxHash);
         }
     }
 }
@@ -1043,6 +1045,13 @@ void CTxMemPool::removeProTxConflicts(const CTransaction &tx)
         }
         if (!proTx.collateralOutpoint.hash.IsNull()) {
             removeProTxCollateralConflicts(tx, proTx.collateralOutpoint);
+            // A ProRegTx reusing an external collateral replaces the MN that collateral
+            // currently backs, so that MN ceases to exist. Drop any mempool update that
+            // still targets its proTxHash; such an update can never be mined afterwards.
+            // removeProTxSpentCollateralConflicts only covers collateral *spends*, not reuse.
+            if (auto dmn = Assert(m_dmnman.load(std::memory_order_acquire))->GetListAtChainTip().GetMNByCollateral(proTx.collateralOutpoint)) {
+                removeProTxReferences(dmn->proTxHash);
+            }
         } else {
             removeProTxCollateralConflicts(tx, COutPoint(tx_hash, proTx.collateralOutpoint.n));
         }
@@ -1415,6 +1424,14 @@ bool CTxMemPool::existsProviderTxConflict(const CTransaction &tx) const {
                 // there is another tx that spends the collateral
                 return true;
             }
+            // A replacement ProRegTx deletes the live MN backed by this collateral. Any
+            // in-mempool update that still targets that MN's proTxHash would then fail
+            // BuildNewListFromBlock with bad-protx-hash if both were mined in one block.
+            if (auto dmn = dmnman->GetListAtChainTip().GetMNByCollateral(proTx.collateralOutpoint)) {
+                if (mapProTxRefs.find(dmn->proTxHash) != mapProTxRefs.end()) {
+                    return true;
+                }
+            }
         }
         return false;
     } else if (tx.nType == TRANSACTION_PROVIDER_UPDATE_SERVICE) {
@@ -1435,6 +1452,12 @@ bool CTxMemPool::existsProviderTxConflict(const CTransaction &tx) const {
                 return true;
             }
         }
+        // Conflict with a replacement ProRegTx that reuses this MN's external collateral.
+        if (auto dmn = dmnman->GetListAtChainTip().GetMN(opt_proTx->proTxHash)) {
+            if (mapProTxCollaterals.count(dmn->collateralOutpoint)) {
+                return true;
+            }
+        }
     } else if (tx.nType == TRANSACTION_PROVIDER_UPDATE_REGISTRAR) {
         const auto opt_proTx = GetTxPayload<CProUpRegTx>(tx);
         if (!opt_proTx) {
@@ -1449,6 +1472,10 @@ bool CTxMemPool::existsProviderTxConflict(const CTransaction &tx) const {
             LogPrint(BCLog::MEMPOOL, "%s: ERROR: Masternode is not in the list, proTxHash: %s\n", __func__, proTx.proTxHash.ToString());
             return true; // i.e. failed to find validated ProTx == conflict
         }
+        // Conflict with a replacement ProRegTx that reuses this MN's external collateral.
+        if (mapProTxCollaterals.count(dmn->collateralOutpoint)) {
+            return true;
+        }
         // only allow one operator key change in the mempool
         if (dmn->pdmnState->pubKeyOperator != proTx.pubKeyOperator) {
             if (hasKeyChangeInMempool(proTx.proTxHash)) {
@@ -1471,6 +1498,10 @@ bool CTxMemPool::existsProviderTxConflict(const CTransaction &tx) const {
             LogPrint(BCLog::MEMPOOL, "%s: ERROR: Masternode is not in the list, proTxHash: %s\n", __func__, proTx.proTxHash.ToString());
             return true; // i.e. failed to find validated ProTx == conflict
         }
+        // Conflict with a replacement ProRegTx that reuses this MN's external collateral.
+        if (mapProTxCollaterals.count(dmn->collateralOutpoint)) {
+            return true;
+        }
         // only allow one operator key change in the mempool
         if (dmn->pdmnState->pubKeyOperator.Get() != CBLSPublicKey()) {
             if (hasKeyChangeInMempool(proTx.proTxHash)) {
diff --git a/src/txmempool.h b/src/txmempool.h
index 7300134cf59b..085725d09dd0 100644
--- a/src/txmempool.h
+++ b/src/txmempool.h
@@ -634,6 +634,10 @@ class CTxMemPool
     void removeProTxPubKeyConflicts(const CTransaction &tx, const CBLSLazyPublicKey &pubKey) EXCLUSIVE_LOCKS_REQUIRED(cs);
     void removeProTxPlatformNodeIDConflicts(const CTransaction &tx, const uint160 &platformNodeID) EXCLUSIVE_LOCKS_REQUIRED(cs);
     void removeProTxCollateralConflicts(const CTransaction &tx, const COutPoint &collateralOutpoint) EXCLUSIVE_LOCKS_REQUIRED(cs);
+    /** Remove every mempool TX that refers to proTxHash. Used when the MN it names ceases to exist
+     *  (collateral spent, or collateral reused by a replacement ProRegTx), since such TXs can never
+     *  be mined afterwards and would abort block assembly with "bad-protx-hash". */
+    void removeProTxReferences(const uint256& proTxHash) EXCLUSIVE_LOCKS_REQUIRED(cs);
     void removeProTxSpentCollateralConflicts(const CTransaction &tx) EXCLUSIVE_LOCKS_REQUIRED(cs);
     void removeProTxKeyChangedConflicts(const CTransaction &tx, const uint256& proTxHash, const uint256& newKeyHash) EXCLUSIVE_LOCKS_REQUIRED(cs);
     void removeProTxConflicts(const CTransaction &tx) EXCLUSIVE_LOCKS_REQUIRED(cs);

From be3b55ec30b2cd27b4a0cfa6378f635a13ac07c7 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 9 Sep 2026 14:13:47 -0500
Subject: [PATCH 22/51] Merge #7662: fix: isolate missing quorums in
 InstantSend batches

71cf6252599d1e716e0f5e68628eb9cddd935069 test: prove missing InstantSend quorum is reachable from peers (pasta)
2e7f4a9a37894b28cdfb288a7087e9cbd4964cab fix: isolate missing quorums in InstantSend batches (pasta)

Pull request description:

  ## Issue being fixed or feature implemented
  A peer can send a structurally valid ISDLOCK with the genesis block as its cycle hash and an arbitrary parseable BLS signature. The receive path accepts the known cycle-boundary hash, but a mature mainnet node selects signing height 287, before DIP0024 activation, so no quorum is available. The current early return then discards the entire dequeued batch, including unrelated locks that could otherwise be processed.

  ## What was done?
  Mark only the affected lock as a failed message and continue building the batch. Existing verification-result handling keeps that lock unaccepted and routes it through the previous-active-set retry without penalizing its peer solely for the unavailable quorum.

  Add a receive-path regression that serializes a peer-supplied genesis-cycle lock, passes it through `NetInstantSend::ProcessMessage`, fetches the real pending queue, and verifies missing-quorum handling without peer punishment. This uses a mined regtest chain and does not inject quorum or recovered-signature state.

  Retain the batch-isolation regression placing an unavailable-quorum lock between two locks with cached recovered signatures, including one from the same peer. Cover rotating and non-rotating quorum selection, the retry path, and the absence of acceptance or reconstructed signatures for the failed lock.

  ## How Has This Been Tested?
  - Local macOS arm64 build with prebuilt depends: `make -j8`.
  - `./src/test/test_dash --run_test=evo_islock_tests --log_level=message`.
  - All 10 cases in `evo_islock_tests` pass. The receive-path regression fails at both expected failure-set checks when the original `return nullptr` is restored, and passes with the fix.
  - Changed-line clang-format, whitespace/assertion lint, and independent security/code review.

  ## Breaking Changes
  None. Signature verification and quorum selection rules are unchanged.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [x] I have commented my code, particularly in hard-to-understand areas
  - [x] I have added or updated relevant unit/integration/functional/e2e tests

  This pull request was created by Codex.

Top commit has no ACKs.

Tree-SHA512: 3e10250a672983986c9049683ab9f5244555e51d89818f217f34603be809a7a4e25d963c046f2d012f92de72d74cc83da1b1bb5e57aa3affef2d866694083572

v23.1.x adaptation: the InstantSend test is taken in its v23 shape. Develop's
NetInstantSend constructor, m_node.isman access, and Params().SporkAddress()
do not exist on v23.1.x (v23 uses the 4-argument NetInstantSend constructor,
m_node.llmq_ctx->isman, and Params().SporkAddresses().front()). The develop-only
received_genesis_cycle_has_no_quorum case, which depends on that constructor and
on SelectQuorumForSigning/MakeTestPeer plumbing absent here, is not included.
The net_instantsend.{cpp,h} fix is byte-identical to the vetted v23 version.

v23.1.x adaptation: the test calls SetMinSporkKeys(1) after SetSporkAddress.
Unlike develop, v23.1.x defaults the spork signer threshold to INT_MAX, so
without lowering it SPORK_2_INSTANTSEND_ENABLED never activates and AlreadyHave
returns true for every lock, which would make the regression check vacuous.
---
 src/instantsend/net_instantsend.cpp |  5 ++-
 src/instantsend/net_instantsend.h   |  1 +
 src/test/evo_islock_tests.cpp       | 65 +++++++++++++++++++++++++++++
 3 files changed, 69 insertions(+), 2 deletions(-)

diff --git a/src/instantsend/net_instantsend.cpp b/src/instantsend/net_instantsend.cpp
index 45821225f724..14d50ddb65ce 100644
--- a/src/instantsend/net_instantsend.cpp
+++ b/src/instantsend/net_instantsend.cpp
@@ -122,8 +122,9 @@ std::unique_ptr<NetInstantSend::BatchVerificationData> NetInstantSend::BuildVeri
                                               : m_qman.GetQuorum(llmq_params.type, islock->cycleHash);
 
         if (!quorum) {
-            // should not happen, but if one fails to select, all others will also fail to select
-            return nullptr;
+            // Different cycle hashes can select different quorums within the same batch.
+            data->batchVerifier.badMessages.emplace(hash);
+            continue;
         }
         uint256 signHash = llmq::SignHash{llmq_params.type, quorum->qc->quorumHash, id, islock->txid}.Get();
         data->batchVerifier.PushMessage(nodeId, hash, signHash, sig, quorum->qc->quorumPublicKey);
diff --git a/src/instantsend/net_instantsend.h b/src/instantsend/net_instantsend.h
index 5601cbb5f1c2..b717f0e1e0e6 100644
--- a/src/instantsend/net_instantsend.h
+++ b/src/instantsend/net_instantsend.h
@@ -48,6 +48,7 @@ class NetInstantSend final : public NetHandler
     void WorkThreadMain();
 
 private:
+    friend struct NetInstantSendTest;
     struct BatchVerificationData;
 
     bool ValidateIncomingISLock(const instantsend::InstantSendLock& islock, NodeId node_id);
diff --git a/src/test/evo_islock_tests.cpp b/src/test/evo_islock_tests.cpp
index 2e681b906236..a5a52ab38f2c 100644
--- a/src/test/evo_islock_tests.cpp
+++ b/src/test/evo_islock_tests.cpp
@@ -4,19 +4,84 @@
 
 #include <consensus/consensus.h>
 #include <hash.h>
+#include <instantsend/instantsend.h>
 #include <instantsend/lock.h>
+#include <instantsend/net_instantsend.h>
+#include <llmq/context.h>
 #include <llmq/signhash.h>
+#include <llmq/signing.h>
 #include <primitives/transaction.h>
+#include <spork.h>
 #include <streams.h>
+#include <test/util/llmq_tests.h>
+#include <test/util/setup_common.h>
 #include <uint256.h>
 #include <util/strencodings.h>
+#include <validation.h>
 
 #include <string_view>
 
 #include <boost/test/unit_test.hpp>
 
+struct NetInstantSendTest : RegTestingSetup {
+    static Uint256HashSet ProcessBatch(NetInstantSend& net, const Consensus::LLMQParams& params, int offset,
+                                       const std::vector<instantsend::PendingISLockEntry>& locks)
+    {
+        return net.ProcessPendingInstantSendLocks(params, offset, /*ban=*/true, locks);
+    }
+};
+
 BOOST_AUTO_TEST_SUITE(evo_islock_tests)
 
+BOOST_FIXTURE_TEST_CASE(missing_quorum_does_not_drop_batch, NetInstantSendTest)
+{
+    constexpr const char* REGTEST_SPORK_PRIVKEY{"cP4EKFyJsHT39LDqgdcB43Y3YXjNyjb5Fuas1GQSeAtjnZWmZEQK"};
+    BOOST_REQUIRE(m_node.sporkman->SetSporkAddress(Params().SporkAddresses().front()));
+    BOOST_REQUIRE(m_node.sporkman->SetMinSporkKeys(1));
+    BOOST_REQUIRE(m_node.sporkman->SetPrivKey(REGTEST_SPORK_PRIVKEY));
+    BOOST_REQUIRE(m_node.sporkman->UpdateSpork(SPORK_2_INSTANTSEND_ENABLED, 0).has_value());
+    auto& sigman = *m_node.llmq_ctx->sigman;
+    auto& isman = *m_node.llmq_ctx->isman;
+    NetInstantSend net{m_node.peerman.get(), isman, *m_node.llmq_ctx->qman, m_node.chainman->ActiveChainstate()};
+    const auto cycle_hash = WITH_LOCK(cs_main, return m_node.chainman->ActiveChain().Genesis()->GetBlockHash());
+    CBLSSecretKey key;
+    key.MakeNewKey();
+
+    for (const auto type : {Consensus::LLMQType::LLMQ_TEST_DIP0024, Consensus::LLMQType::LLMQ_TEST_INSTANTSEND}) {
+        const auto& params = llmq::testutils::GetLLMQParams(type);
+        std::vector<instantsend::PendingISLockEntry> locks;
+        for (int i = 0; i < 3; ++i) {
+            auto islock = std::make_shared<instantsend::InstantSendLock>();
+            islock->txid = GetRandHash();
+            islock->inputs.emplace_back(GetRandHash(), 0);
+            islock->cycleHash = cycle_hash;
+            const auto sign_hash = llmq::SignHash{type, cycle_hash, islock->GetRequestId(), islock->txid}.Get();
+            const bool legacy = bls::bls_legacy_scheme.load();
+            islock->sig.Set(key.Sign(sign_hash, legacy), legacy);
+            if (i != 1) {
+                // Exercise the already-verified path on either side of an unavailable quorum.
+                BOOST_REQUIRE(sigman.ProcessRecoveredSig(
+                    std::make_shared<llmq::CRecoveredSig>(type, cycle_hash, islock->GetRequestId(), islock->txid,
+                                                          islock->sig)));
+            }
+            locks.push_back({{i == 2 ? 2 : 1, islock}, ::SerializeHash(*islock)});
+        }
+
+        const auto failed = ProcessBatch(net, params, /*offset=*/0, locks);
+        BOOST_CHECK_EQUAL(failed.size(), 1U);
+        BOOST_CHECK(failed.contains(locks[1].islock_hash));
+        BOOST_CHECK(isman.AlreadyHave(CInv{MSG_ISDLOCK, locks[0].islock_hash}));
+        BOOST_CHECK(!isman.AlreadyHave(CInv{MSG_ISDLOCK, locks[1].islock_hash}));
+        BOOST_CHECK(isman.AlreadyHave(CInv{MSG_ISDLOCK, locks[2].islock_hash}));
+
+        const auto retried = ProcessBatch(net, params, params.dkgInterval, {locks[1]});
+        BOOST_CHECK(retried.contains(locks[1].islock_hash));
+        BOOST_CHECK(!isman.AlreadyHave(CInv{MSG_ISDLOCK, locks[1].islock_hash}));
+        BOOST_CHECK(!sigman.HasRecoveredSig(type, locks[1].islock->GetRequestId(), locks[1].islock->txid));
+        BOOST_CHECK(sigman.FetchPendingReconstructed().empty());
+    }
+}
+
 uint256 CalculateRequestId(const std::vector<COutPoint>& inputs)
 {
     CHashWriter hw(SER_GETHASH, 0);

From 457af6d547aa751daa98d71bf1f5f6bcf79037e3 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 23 Sep 2026 14:02:02 -0500
Subject: [PATCH 23/51] Merge #7738: refactor: avoid double lookups and
 default-inserting map access in governance
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

4be10a84f29ad4b3e462e2195461310c1309ee17 refactor: avoid double lookups and default-inserting map access in governance (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  Several governance code paths look up a map entry twice (`count()` followed by `operator[]`, or `find()` followed by `insert()`), or create a default entry before they know it will be needed. This PR switches them to a single lookup, and makes `CGovernanceObject::ProcessVote` write to the vote record only once a vote has been accepted.

  ## What was done?

  - `CGovernanceObject::ProcessVote`: the masternode's current vote instance for the signal is now read with `find()` into a local copy, instead of being default-inserted into `mapCurrentMNVotes` with `emplace()`. All checks (signal, timestamp ordering, rate limit, `IsValid()`) run against that copy, and `mapCurrentMNVotes` is written once, after the vote has passed them. Previously a rejected vote still left an empty record for the masternode behind. For accepted votes the result is the same as before.
  - `CGovernanceManager::FindGovernanceObjectInternal`: single `find()` instead of `count()` + `operator[]`.
  - `CGovernanceManager::MasternodeRateUpdate`: `try_emplace()` instead of `find()` + `insert()`.
  - `CGovernanceManager::FetchGovernanceObjectVotes`: one lookup into `mapAskedRecently` and `std::erase_if` over the peer map, instead of repeated `operator[]` calls and a manual erase loop.
  - `CGovernanceObjectVoteFile::RebuildIndex`: `emplace().second` instead of `find()` + `operator[]`.
  - `SuperblockManager::AddNewTrigger`: `contains()` instead of `count()`.

  ## How Has This Been Tested?

  - Extended `invalid_signature_does_not_suppress_valid_vote` in `src/test/governance_vote_processing_tests.cpp` to check that a vote rejected for a bad signature leaves no vote record (voting-key funding vote) and no vote instance for its signal (operator-key vote).
  - Reverted only the `ProcessVote` change and re-ran the suite: both new checks fail. With the change they pass.
  - `./src/test/test_dash --run_test='governance_*'`: all 26 test cases pass.
  - Built `dashd` and `test_dash` on macOS arm64 (Apple clang, depends, `--enable-debug --enable-werror`) after rebasing onto develop with #7737.

  ## Breaking Changes

  None.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

Top commit has no ACKs.

Tree-SHA512: 371e220ed2ad43bef82b3283b0c3450545d8cdc9f911e260f637fd2caab4b4dcf4914e82213b9d57fed3f80eac9eedfddbc1af64a3043e3b10bcb1fb456e572f

v23.1.x adaptation: minimal port of the security-relevant part of #7738 only -
CGovernanceObject::ProcessVote now reads the existing vote instance without
default-inserting and writes the record only after the vote passes every check,
so a rejected (e.g. bad-signature) vote no longer leaves an empty record that
the masternode's own trigger voting would read as "already voted". The rest of
develop's PR is a develop-only lookup refactor (governance.cpp, classes.cpp,
superblock.cpp, votedb.cpp) and is intentionally excluded. The upstream
governance_vote_processing_tests.cpp does not exist on v23.1.x, so a focused
rejected_vote_leaves_no_vote_record case is added to governance_inv_tests.cpp.
---
 src/governance/object.cpp         | 23 +++++++++++--------
 src/test/governance_inv_tests.cpp | 38 +++++++++++++++++++++++++++++++
 2 files changed, 51 insertions(+), 10 deletions(-)

diff --git a/src/governance/object.cpp b/src/governance/object.cpp
index fc99fa4d559e..f0cd816a0b7b 100644
--- a/src/governance/object.cpp
+++ b/src/governance/object.cpp
@@ -80,8 +80,6 @@ bool CGovernanceObject::ProcessVote(CMasternodeMetaMan& mn_metaman, CGovernanceM
         return false;
     }
 
-    auto it = mapCurrentMNVotes.emplace(vote_m_t::value_type(vote.GetMasternodeOutpoint(), vote_rec_t())).first;
-    vote_rec_t& voteRecordRef = it->second;
     vote_signal_enum_t eSignal = vote.GetSignal();
     if (eSignal == VOTE_SIGNAL_NONE) {
         std::string msg{strprintf("CGovernanceObject::%s -- Vote signal: none", __func__)};
@@ -96,20 +94,24 @@ bool CGovernanceObject::ProcessVote(CMasternodeMetaMan& mn_metaman, CGovernanceM
         exception = CGovernanceException(msg, GOVERNANCE_EXCEPTION_PERMANENT_ERROR, 20);
         return false;
     }
-    auto it2 = voteRecordRef.mapInstances.emplace(vote_instance_m_t::value_type(int(eSignal), vote_instance_t())).first;
-    vote_instance_t& voteInstanceRef = it2->second;
+    vote_instance_t voteInstance;
+    if (const auto it = mapCurrentMNVotes.find(vote.GetMasternodeOutpoint()); it != mapCurrentMNVotes.end()) {
+        if (const auto it2 = it->second.mapInstances.find(int(eSignal)); it2 != it->second.mapInstances.end()) {
+            voteInstance = it2->second;
+        }
+    }
 
     // Reject obsolete votes
-    if (vote.GetTimestamp() < voteInstanceRef.nCreationTime) {
+    if (vote.GetTimestamp() < voteInstance.nCreationTime) {
         std::string msg{strprintf("CGovernanceObject::%s -- Obsolete vote", __func__)};
         LogPrint(BCLog::GOBJECT, "%s\n", msg);
         exception = CGovernanceException(msg, GOVERNANCE_EXCEPTION_NONE);
         return false;
-    } else if (vote.GetTimestamp() == voteInstanceRef.nCreationTime) {
+    } else if (vote.GetTimestamp() == voteInstance.nCreationTime) {
         // Someone is doing something fishy, there can be no two votes from the same masternode
         // with the same timestamp for the same object and signal and yet different hash/outcome.
         std::string msg{strprintf("CGovernanceObject::%s -- Invalid vote, same timestamp for the different outcome", __func__)};
-        if (vote.GetOutcome() < voteInstanceRef.eOutcome) {
+        if (vote.GetOutcome() < voteInstance.eOutcome) {
             // This is an arbitrary comparison, we have to agree on some way
             // to pick the "winning" vote.
             msg += ", rejected";
@@ -122,9 +124,9 @@ bool CGovernanceObject::ProcessVote(CMasternodeMetaMan& mn_metaman, CGovernanceM
     }
 
     int64_t nNow = GetAdjustedTime();
-    int64_t nVoteTimeUpdate = voteInstanceRef.nTime;
+    int64_t nVoteTimeUpdate = voteInstance.nTime;
     if (govman.AreRateChecksEnabled()) {
-        int64_t nTimeDelta = nNow - voteInstanceRef.nTime;
+        int64_t nTimeDelta = nNow - voteInstance.nTime;
         if (nTimeDelta < GOVERNANCE_UPDATE_MIN) {
             std::string msg{strprintf("CGovernanceObject::%s -- Masternode voting too often, MN outpoint = %s, "
                                       "governance object hash = %s, time delta = %d",
@@ -150,7 +152,8 @@ bool CGovernanceObject::ProcessVote(CMasternodeMetaMan& mn_metaman, CGovernanceM
 
     mn_metaman.AddGovernanceVote(dmn->proTxHash, vote.GetParentHash());
 
-    voteInstanceRef = vote_instance_t(vote.GetOutcome(), nVoteTimeUpdate, vote.GetTimestamp());
+    mapCurrentMNVotes[vote.GetMasternodeOutpoint()].mapInstances[int(eSignal)] =
+        vote_instance_t(vote.GetOutcome(), nVoteTimeUpdate, vote.GetTimestamp());
     fileVotes.AddVote(vote);
     fDirtyCache = true;
     // SEND NOTIFICATION TO SCRIPT/ZMQ
diff --git a/src/test/governance_inv_tests.cpp b/src/test/governance_inv_tests.cpp
index f3a86c57c358..96aa7e6b0b1a 100644
--- a/src/test/governance_inv_tests.cpp
+++ b/src/test/governance_inv_tests.cpp
@@ -2,10 +2,16 @@
 // Distributed under the MIT software license, see the accompanying
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
+#include <bls/bls.h>
 #include <common/bloom.h>
+#include <evo/deterministicmns.h>
+#include <evo/dmnstate.h>
+#include <evo/netinfo.h>
+#include <evo/providertx.h>
 #include <governance/governance.h>
 #include <governance/net_governance.h>
 #include <governance/object.h>
+#include <key.h>
 #include <masternode/meta.h>
 #include <masternode/sync.h>
 #include <net.h>
@@ -578,6 +584,38 @@ BOOST_AUTO_TEST_CASE(invalid_vote_is_scored_alike_with_and_without_a_parent_obje
     chainstate.ResetIbd();
 }
 
+// A vote that fails validation must not leave a vote record behind: the masternode's own trigger
+// voting treats any record for its collateral as "already voted".
+BOOST_AUTO_TEST_CASE(rejected_vote_leaves_no_vote_record)
+{
+    CGovernanceObject govobj{MakeGovernanceObject(GetTime<std::chrono::seconds>().count(), uint256S("71"))};
+    // MakeGovernanceVote names this collateral and carries an all-zero signature.
+    const COutPoint collateral{uint256S("11"), 1};
+
+    CKey voting_key;
+    voting_key.MakeNewKey(true);
+    CBLSSecretKey operator_key;
+    operator_key.MakeNewKey();
+    auto state = std::make_shared<CDeterministicMNState>();
+    state->keyIDOwner = voting_key.GetPubKey().GetID();
+    state->keyIDVoting = voting_key.GetPubKey().GetID();
+    state->pubKeyOperator.Set(operator_key.GetPublicKey(), /*specificLegacyScheme=*/false);
+    state->netInfo = NetInfoInterface::MakeNetInfo(ProTxVersion::BasicBLS);
+    auto dmn = std::make_shared<CDeterministicMN>(/*_internalId=*/1, MnType::Regular);
+    dmn->proTxHash = uint256S("72");
+    dmn->collateralOutpoint = collateral;
+    dmn->pdmnState = state;
+    CDeterministicMNList mn_list;
+    mn_list.AddMN(dmn);
+
+    CGovernanceException exception;
+    BOOST_CHECK(!govobj.ProcessVote(*m_node.mn_metaman, *m_node.govman, mn_list, MakeGovernanceVote(govobj.GetHash()),
+                                    exception));
+    BOOST_CHECK_EQUAL(exception.GetNodePenalty(), 20);
+    vote_rec_t vote_record;
+    BOOST_CHECK(!govobj.GetCurrentMNVotes(collateral, vote_record));
+}
+
 
 // Every orphan parent hash is re-requested from every peer on each governance tick, and one
 // masternode key can sign votes for any number of invented parents, so the hashes requested per tick

From 8888af88710cb0e7fd7c95e5d0ee1555b7cff45b Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 30 Sep 2026 11:12:11 -0500
Subject: [PATCH 24/51] Merge #7753: fix: bound masternode list caches by size
 instead of by new block

2af352825b4cddbd8f99f62e7ea2f25d25ea58c1 fix(evo): bound masternode list caches by size instead of by new block (Konstantin Akimov)

Pull request description:

  ## Issue being fixed or feature implemented

  CleanupCache() only ran from the scheduler after a block was connected. Between blocks nothing bounded mnListsCache: every getmnlistd or getqrinfo for a block below the cache window loads a full list from disk and derives mini-snapshots from it, and a peer can request a new period every few tens of milliseconds while the scheduler fires every 10 seconds. A per-lookup cleanup, as tried before, evicts the lists a sequential walk asks for next and runs inside block validation.

  ## What was done?

  Trigger the existing CleanupCache() from the lookup itself, only once the cache holds more than MAX_CACHED_LISTS entries. Cleanup retains the tip and live quorum bases, so a peer can grow the cache by at most a couple dozen disk snapshots, while masternode payments, protx listdiff, syncing peers and a background chainstate keep their intermediate lists until the budget overflows and then rebuild once. The tip and quorum lookups are cache hits and insert nothing, so they never pay for the check.

  A connected block adds one list that shares its structure with its predecessor, so the budget covers block connection too. Drop the scheduled cleanup, the to_cleanup signal and cs_cleanup.

  Alternate for https://github.com/dashpay/dash/pull/7746 and https://github.com/dashpay/dash/pull/7485

  ## How Has This Been Tested?
  Run unit & functional tests

  ## Breaking Changes
  N/A

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

Top commit has no ACKs.

Tree-SHA512: 70c1140531939d63e2e3db13695ddb289bfc384c957a0fef0212cf899408ba72ef2ed5149b31dcb585905a68609eee1879cc51162c31f312fffbd057fda679c6

v23.1.x adaptation: deterministicmns.h drops only <atomic> (develop replaced it
with <algorithm>, not needed here). evo_deterministicmns_tests.cpp keeps the v23
test shape (chainman.ActiveChain().Height()/UpdatedBlockTip) and only removes the
six dmnman.DoMaintenance() calls; develop's sync_dmn_tip()/tip_height() helper
refactor is not adopted. The companion #7868 rate-limit and #7833 GetQuorum
changes are not included.
---
 src/evo/deterministicmns.cpp            | 17 ++++-------------
 src/evo/deterministicmns.h              | 15 ++++++---------
 src/init.cpp                            |  1 -
 src/test/evo_deterministicmns_tests.cpp |  6 ------
 4 files changed, 10 insertions(+), 29 deletions(-)

diff --git a/src/evo/deterministicmns.cpp b/src/evo/deterministicmns.cpp
index cb963d53a808..67b2cd851415 100644
--- a/src/evo/deterministicmns.cpp
+++ b/src/evo/deterministicmns.cpp
@@ -726,10 +726,6 @@ bool CDeterministicMNManager::ProcessBlock(const CBlock& block, gsl::not_null<co
         }
         LogPrintf("CDeterministicMNManager::%s -- DIP3 is enforced now. nHeight=%d\n", __func__, nHeight);
     }
-    int current = to_cleanup.load();
-    while (nHeight > current && !to_cleanup.compare_exchange_weak(current, nHeight)) {
-        // Loop continues if compare_exchange_weak failed (another thread changed it) (current is updated to the new value in to_cleanup)
-    }
     return true;
 }
 
@@ -785,6 +781,10 @@ CDeterministicMNList CDeterministicMNManager::GetListForBlockInternal(gsl::not_n
 
     AssertLockHeld(cs);
 
+    if (tipIndex != nullptr && mnListsCache.size() > MAX_CACHED_LISTS) {
+        CleanupCache(tipIndex->nHeight);
+    }
+
     std::list<const CBlockIndex*> listDiffIndexes;
 
     while (true) {
@@ -946,15 +946,6 @@ void CDeterministicMNManager::CleanupCache(int nHeight)
 
 //end
 
-void CDeterministicMNManager::DoMaintenance() {
-    LOCK(cs_cleanup);
-    int loc_to_cleanup = to_cleanup.load();
-    if (loc_to_cleanup <= did_cleanup) return;
-    LOCK(cs);
-    CleanupCache(loc_to_cleanup);
-    did_cleanup = loc_to_cleanup;
-}
-
 bool CDeterministicMNManager::IsMigrationRequired() const
 {
     // Check if there are any legacy format diffs in the database
diff --git a/src/evo/deterministicmns.h b/src/evo/deterministicmns.h
index 3a684ffa78df..3d81db63db2e 100644
--- a/src/evo/deterministicmns.h
+++ b/src/evo/deterministicmns.h
@@ -21,7 +21,6 @@
 #include <gsl/pointers.h>
 #include <immer/map.hpp>
 
-#include <atomic>
 #include <limits>
 #include <numeric>
 #include <unordered_map>
@@ -682,15 +681,15 @@ class CDeterministicMNManager
     // keep cache for enough disk snapshots to have all active quourms covered
     static constexpr int DISK_SNAPSHOTS = llmq_max_blocks() / DISK_SNAPSHOT_PERIOD + 1;
     static constexpr int LIST_DIFFS_CACHE_SIZE = DISK_SNAPSHOT_PERIOD * DISK_SNAPSHOTS;
+    //! Lists the cache may hold before a lookup runs CleanupCache(). Cleanup retains only the
+    //! tip and the bases of live quorums, a few dozen lists; the rest is scratch that historical
+    //! requests (a full list read from disk plus its mini-snapshots) and connected blocks added.
+    //! The budget caps what peers can make the node hold through historical requests, while
+    //! sequential historical work keeps its intermediate lists until it outgrows the budget.
+    static constexpr size_t MAX_CACHED_LISTS{64};
 
 private:
     Mutex cs;
-    Mutex cs_cleanup;
-    // We have performed CleanupCache() on this height.
-    int did_cleanup GUARDED_BY(cs_cleanup) {0};
-
-    // Main thread has indicated we should perform cleanup up to this height
-    std::atomic<int> to_cleanup {0};
 
     CEvoDB& m_evoDb;
     CMasternodeMetaMan& m_mn_metaman;
@@ -723,8 +722,6 @@ class CDeterministicMNManager
     // Test if given TX is a ProRegTx which also contains the collateral at index n
     static bool IsProTxWithCollateral(const CTransactionRef& tx, uint32_t n);
 
-    void DoMaintenance() EXCLUSIVE_LOCKS_REQUIRED(!cs, !cs_cleanup);
-
     // Recalculate and optionally repair diffs between snapshots
     struct RecalcDiffsResult {
         int start_height{0};
diff --git a/src/init.cpp b/src/init.cpp
index 20e9a5f4ac00..0a6aba05153d 100644
--- a/src/init.cpp
+++ b/src/init.cpp
@@ -2330,7 +2330,6 @@ bool AppInitMain(NodeContext& node, interfaces::BlockAndHeaderTipInfo* tip_info)
 
     node.scheduler->scheduleEvery(std::bind(&CNetFulfilledRequestManager::DoMaintenance, std::ref(*node.netfulfilledman)), std::chrono::minutes{1});
     node.scheduler->scheduleEvery(std::bind(&CMasternodeUtils::DoMaintenance, std::ref(*node.connman), std::ref(*node.dmnman), std::ref(*node.mn_sync), node.cj_walletman.get()), std::chrono::minutes{1});
-    node.scheduler->scheduleEvery(std::bind(&CDeterministicMNManager::DoMaintenance, std::ref(*node.dmnman)), std::chrono::seconds{10});
     node.peerman->ScheduleHandlers(*node.scheduler);
 
     if (node.active_ctx) {
diff --git a/src/test/evo_deterministicmns_tests.cpp b/src/test/evo_deterministicmns_tests.cpp
index 9a9d5f025b72..883e19df49df 100644
--- a/src/test/evo_deterministicmns_tests.cpp
+++ b/src/test/evo_deterministicmns_tests.cpp
@@ -354,7 +354,6 @@ void FuncV19Activation(TestChainSetup& setup)
     ++nHeight;
     BOOST_CHECK_EQUAL(chainman.ActiveChain().Height(), nHeight);
     dmnman.UpdatedBlockTip(chainman.ActiveChain().Tip());
-    dmnman.DoMaintenance();
     auto tip_list = dmnman.GetListAtChainTip();
     BOOST_REQUIRE(tip_list.HasMN(tx_reg_hash));
     auto pindex_create = chainman.ActiveChain().Tip();
@@ -372,7 +371,6 @@ void FuncV19Activation(TestChainSetup& setup)
     ++nHeight;
     BOOST_CHECK_EQUAL(chainman.ActiveChain().Height(), nHeight);
     dmnman.UpdatedBlockTip(chainman.ActiveChain().Tip());
-    dmnman.DoMaintenance();
     tip_list = dmnman.GetListAtChainTip();
     BOOST_REQUIRE(tip_list.HasMN(tx_reg_hash));
     diffs.push_back(base_list.BuildDiff(tip_list));
@@ -392,7 +390,6 @@ void FuncV19Activation(TestChainSetup& setup)
     ++nHeight;
     BOOST_CHECK_EQUAL(chainman.ActiveChain().Height(), nHeight);
     dmnman.UpdatedBlockTip(chainman.ActiveChain().Tip());
-    dmnman.DoMaintenance();
     diffs.push_back(tip_list.BuildDiff(dmnman.GetListAtChainTip()));
     tip_list = dmnman.GetListAtChainTip();
     BOOST_REQUIRE(!tip_list.HasMN(tx_reg_hash));
@@ -404,7 +401,6 @@ void FuncV19Activation(TestChainSetup& setup)
     ++nHeight;
     BOOST_CHECK_EQUAL(chainman.ActiveChain().Height(), nHeight);
     dmnman.UpdatedBlockTip(chainman.ActiveChain().Tip());
-    dmnman.DoMaintenance();
     diffs.push_back(tip_list.BuildDiff(dmnman.GetListAtChainTip()));
     tip_list = dmnman.GetListAtChainTip();
     BOOST_REQUIRE(!tip_list.HasMN(tx_reg_hash));
@@ -416,7 +412,6 @@ void FuncV19Activation(TestChainSetup& setup)
     ++nHeight;
     BOOST_CHECK_EQUAL(chainman.ActiveChain().Height(), nHeight);
     dmnman.UpdatedBlockTip(chainman.ActiveChain().Tip());
-    dmnman.DoMaintenance();
     diffs.push_back(tip_list.BuildDiff(dmnman.GetListAtChainTip()));
     tip_list = dmnman.GetListAtChainTip();
     BOOST_REQUIRE(!tip_list.HasMN(tx_reg_hash));
@@ -437,7 +432,6 @@ void FuncV19Activation(TestChainSetup& setup)
             DeploymentActiveAfter(chainman.ActiveChain().Tip(), chainman.GetConsensus(), Consensus::DEPLOYMENT_V19));
         BOOST_CHECK_EQUAL(chainman.ActiveChain().Height(), nHeight + 1 + i);
         dmnman.UpdatedBlockTip(chainman.ActiveChain().Tip());
-        dmnman.DoMaintenance();
         diffs.push_back(tip_list.BuildDiff(dmnman.GetListAtChainTip()));
         tip_list = dmnman.GetListAtChainTip();
         BOOST_REQUIRE(!tip_list.HasMN(tx_reg_hash));

From fdf40fee456c7467f9eb8140baa3e660ebdd7b5e Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 8 Oct 2026 18:28:36 -0500
Subject: [PATCH 25/51] Merge #7828: fix: omit recovery words from invalid
 mnemonic errors

e5fe71d2350b73e731f7099f821f140921f02aff fix: omit recovery words from invalid mnemonic errors (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  Invalid-mnemonic errors included the submitted recovery words. The legacy wallet startup path forwards those errors to stderr and debug.log, exposing recovery material in diagnostics.

  ## What was done?

  Remove the words from the two existing error messages. Mnemonic validation, seed derivation and error propagation are unchanged.

  ## How Has This Been Tested?

  `make -j1`, the existing `bip39_tests` and `wallet_crypto_tests`, and diff, whitespace and include checks pass.

  The production edits are identical to the previously validated version: a standalone before/after check with a synthetic public mnemonic confirmed redaction in legacy startup stderr/debug.log and descriptor RPC errors. No test is added by this PR.

  ## Breaking Changes

  Invalid-mnemonic errors no longer echo recovery words.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [x] Documentation is not needed for this diagnostic change
  - [ ] I have assigned this pull request to a milestone

  This pull request was created by Codex.

Top commit has no ACKs.

Tree-SHA512: b4aa992abcf5d79f04da63cda5297160dac8fccc01bb4cb3b7fee9259158b43f8e66f24062e35cdaffe1a5bdb5ad70432eb791357ab3fc51a98fcb48f7cadecf
(cherry picked from commit e075859785a6d1a18730bd248c056f0d13d9f1f2)
---
 src/wallet/hdchain.cpp | 2 +-
 src/wallet/wallet.cpp  | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/wallet/hdchain.cpp b/src/wallet/hdchain.cpp
index 94b5e598d605..af8854090c4b 100644
--- a/src/wallet/hdchain.cpp
+++ b/src/wallet/hdchain.cpp
@@ -67,7 +67,7 @@ bool CHDChain::SetMnemonic(const SecureString& ssMnemonic, const SecureString& s
 
         // printf("mnemonic: %s\n", ssMnemonicTmp.c_str());
         if (!CMnemonic::Check(ssMnemonicTmp)) {
-            throw std::runtime_error(std::string(__func__) + ": invalid mnemonic: `" + std::string(ssMnemonicTmp) + "`");
+            throw std::runtime_error(std::string(__func__) + ": invalid mnemonic");
         }
 
         CMnemonic::ToSeed(ssMnemonicTmp, ssMnemonicPassphrase, vchSeed);
diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index 6267fea52101..52e8ebb2061f 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -3919,7 +3919,7 @@ void CWallet::SetupDescriptorScriptPubKeyMans(const SecureString& mnemonic_arg,
     // TODO: remove duplicated code with CHDChain::SetMnemonic
     const SecureString mnemonic = mnemonic_arg.empty() ? CMnemonic::Generate(m_args.GetIntArg("-mnemonicbits", CHDChain::DEFAULT_MNEMONIC_BITS)) : mnemonic_arg;
     if (!CMnemonic::Check(mnemonic)) {
-        throw std::runtime_error(std::string(__func__) + ": invalid mnemonic: `" + std::string(mnemonic) + "`");
+        throw std::runtime_error(std::string(__func__) + ": invalid mnemonic");
     }
     SecureVector seed_key;
     CMnemonic::ToSeed(mnemonic, mnemonic_passphrase, seed_key);

From c7393c0acb69b6f312078026730f7ce217b1777f Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 8 Oct 2026 18:59:54 -0500
Subject: [PATCH 26/51] Merge #7833: fix: gate signing intake before quorum
 retrieval

438708e9cf885b5ff20b8c5751c464ad305bb7ad fix: gate signing intake before quorum retrieval (pasta)

Pull request description:

  ## Issue being fixed or feature implemented
  Signing-session announcements (`QSIGSESANN`) and direct sig shares (`QSIGSHARE`) resolved the referenced quorum before checking whether it belongs to the retained active signing set. A peer could therefore make a node build or load historical quorums, and an announcement for a stale quorum created a receiving session. The reachable admission defect is reproduced; CPU/exhaustion magnitude is unmeasured.

  ## What was done?
  Run the existing active-quorum predicate (`IsQuorumActive`) before quorum retrieval in `ProcessMessageSigSesAnn` and `ProcessMessageSigShare`. The per-peer session capacity check under the session mutex is unchanged. `PreVerifySigShareQuorum` keeps its own active-quorum check on purpose, because the batched path depends on it. This is a Dash-specific change with no corresponding Bitcoin backport.

  ## How Has This Been Tested?
  On macOS arm64 with the existing depends configuration, `make` of `dashd`, `dash-cli`, `dash-wallet` and `test_dash`; the full `llmq_utils_tests` suite, include lint, circular dependency lint and `git diff --check` passed. `feature_llmq_signing.py` (both variants), `feature_llmq_is_retroactive.py` and `p2p_quorum_data.py` passed. No dedicated unit test is included: the change only reorders an existing active-quorum check ahead of quorum retrieval. No CPU benchmark, sanitizer stress or operational exhaustion demonstration is claimed.

  ## Breaking Changes
  None. Existing active-quorum policy and wire formats are preserved.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

  No user-facing documentation change is required.

Top commit has no ACKs.

Tree-SHA512: 2490d8320f21e71fff1b55a6b7785843960c0027a7e91f922e474df835ecce4b649f34b9bd7d919d16c76a3d654fadeb2667ea3439bff3a6a29b2464322a3b70
(cherry picked from commit 18de2e580f68eb8291996dd0d0e8dbd7b11e569c)

v23.1.x adaptation: ProcessMessageSigShare returns void on v23.1.x (develop returns bool), so its active-quorum gate uses `return;` rather than `return true;`.
---
 src/llmq/signing_shares.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/llmq/signing_shares.cpp b/src/llmq/signing_shares.cpp
index f6038e9148e8..5e2f6054f257 100644
--- a/src/llmq/signing_shares.cpp
+++ b/src/llmq/signing_shares.cpp
@@ -435,6 +435,10 @@ bool CSigSharesManager::ProcessMessageSigSesAnn(const CNode& pfrom, const CSigSe
 
     LogPrint(BCLog::LLMQ_SIGS, "CSigSharesManager::%s -- ann={%s}, node=%d\n", __func__, ann.ToString(), pfrom.GetId());
 
+    if (!IsQuorumActive(llmqType, qman, ann.getQuorumHash())) {
+        return true;
+    }
+
     auto quorum = qman.GetQuorum(llmqType, ann.getQuorumHash());
     if (!quorum) {
         // TODO should we ban here?
@@ -592,6 +596,10 @@ bool CSigSharesManager::ProcessMessageBatchedSigShares(const CNode& pfrom, const
 
 void CSigSharesManager::ProcessMessageSigShare(NodeId fromId, const CSigShare& sigShare)
 {
+    if (!IsQuorumActive(sigShare.getLlmqType(), qman, sigShare.getQuorumHash())) {
+        return;
+    }
+
     auto quorum = qman.GetQuorum(sigShare.getLlmqType(), sigShare.getQuorumHash());
     if (!quorum) {
         return;

From 4da0099637551f00d2efbc986985e9f953580550 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 8 Oct 2026 21:22:24 -0500
Subject: [PATCH 27/51] Merge #7821: fix: relock encrypted wallets after HD
 upgrade failures

973f59e21ee33384acd412b04bb6d23875e8a69c fix: relock encrypted wallets after HD upgrade failures (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  An encrypted wallet temporarily unlocked by `upgradetohd` remained fully unlocked when mnemonic validation or later HD setup threw. An already authenticated caller with signing/spending permissions could then use existing keys until another lock event. This does not bypass RPC authentication.

  ## What was done?

  Install the existing cleanup handler before the temporary unlock and relock on every subsequent exit, including success, while the wallet locks are still held. Keep early validation behavior and relock before any rescan.

  ## How Has This Been Tested?

  On macOS arm64 with prebuilt depends, built baseline and candidate with `make -j1`. The added regression fails on the baseline in both legacy and descriptor modes because signing succeeds after a rejected upgrade. Full `wallet_upgradetohd.py --legacy-wallet` and `--descriptors` pass with the fix, covering signing denial after invalid mnemonic, legacy overlength passphrase and successful upgrade, plus verified signatures after explicit unlock. Existing recovery/rescan tests remain covered by those full runs.

  Ran `test_dash --run_test=bip39_tests,wallet_crypto_tests`, changed-file Python lint using the repository's enabled rules, and `git diff --check`. An independent four-pass review approved the final source and inspected the reproduced baseline evidence; its remaining cache/test suggestions were resolved by the complete reruns. No fund movement or RPC authentication bypass was demonstrated.

  ## Breaking Changes

  None.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

  This pull request was created by Codex.

Top commit has no ACKs.

Tree-SHA512: 01898d5180b07590481c09119cdcc7fcdc0cbefd347d1a938348c42b3471041641fe68b3b065551ec2bf48dd1bed8f9cd9fc237261632245e679155c446520a9

v23.1.x adaptation: develop's relock handler uses interfaces::MakeCleanupHandler,
which does not exist on v23.1.x; it is replaced with interfaces::MakeHandler (the
behavior - locking the wallet on scope exit - is identical). The functional test
is taken in its v23 shape (a focused failed-upgrade-stays-locked check) rather
than develop's fuller descriptor-aware test_failed_upgrade method, which relies on
self.options.descriptors handling not present here.
---
 src/wallet/rpc/wallet.cpp             | 9 +++++----
 test/functional/wallet_upgradetohd.py | 3 +++
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/src/wallet/rpc/wallet.cpp b/src/wallet/rpc/wallet.cpp
index 8201ecafdacc..1a92ab4002ae 100644
--- a/src/wallet/rpc/wallet.cpp
+++ b/src/wallet/rpc/wallet.cpp
@@ -7,6 +7,7 @@
 #include <chainparams.h>
 #include <core_io.h>
 #include <httpserver.h>
+#include <interfaces/handler.h>
 #include <policy/policy.h>
 #include <rpc/blockchain.h>
 #include <rpc/rawtransaction_util.h>
@@ -368,11 +369,14 @@ static RPCHelpMan upgradetohd()
         pwallet->WalletLogPrintf("Upgrading wallet to HD\n");
         pwallet->SetMinVersion(FEATURE_HD);
 
+        std::unique_ptr<interfaces::Handler> relock;
         if (pwallet->IsCrypted()) {
             if (wallet_passphrase.empty()) {
                 throw JSONRPCError(RPC_WALLET_PASSPHRASE_INCORRECT, "Error: Wallet encrypted but supplied empty wallet passphrase");
             }
 
+            relock = interfaces::MakeHandler([&pwallet] { pwallet->Lock(); });
+
             // We are intentionally re-locking the wallet so we can validate passphrase
             // by verifying if it can unlock the wallet
             pwallet->Lock();
@@ -411,10 +415,7 @@ static RPCHelpMan upgradetohd()
             }
         }
 
-        if (pwallet->IsCrypted()) {
-            // Relock encrypted wallet
-            pwallet->Lock();
-        } else if (!wallet_passphrase.empty()) {
+        if (!pwallet->IsCrypted() && !wallet_passphrase.empty()) {
             // Encrypt non-encrypted wallet
             if (!pwallet->EncryptWallet(wallet_passphrase)) {
                 throw JSONRPCError(RPC_WALLET_ENCRYPTION_FAILED, "Failed to encrypt HD wallet");
diff --git a/test/functional/wallet_upgradetohd.py b/test/functional/wallet_upgradetohd.py
index fae83ebd99e6..9d396074fc0c 100755
--- a/test/functional/wallet_upgradetohd.py
+++ b/test/functional/wallet_upgradetohd.py
@@ -208,6 +208,9 @@ def run_test(self):
         node.stop()
         node.wait_until_stopped()
         self.start_node(0, extra_args=['-rescan'])
+        # A failed upgrade must leave the encrypted wallet locked
+        assert_raises_rpc_error(-1, "invalid mnemonic", node.upgradetohd, "invalid mnemonic", "", walletpass)
+        assert_raises_rpc_error(-13, "Error: Please enter the wallet passphrase with walletpassphrase first.", node.signmessage, node.get_deterministic_priv_key().address, "after failed upgrade")
         assert_raises_rpc_error(-13, "Error: Wallet encrypted but passphrase not supplied to RPC.", node.upgradetohd, mnemonic[0])
         assert_raises_rpc_error(-14, "Error: The wallet passphrase entered was incorrect", node.upgradetohd, mnemonic[0], "", "111")
         assert node.upgradetohd(mnemonic[0], "", walletpass)

From 3055a195a9e84a1c1543319e6a6c9e2c44da0e47 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 10 Oct 2026 17:50:58 -0500
Subject: [PATCH 28/51] Merge #7850: perf: let CHECKDATASIG use the signature
 cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

344f05d7d0d85570ef07c91f26b0947515621d77 perf: let CHECKDATASIG use the signature cache (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `CHECKDATASIG` / `CHECKDATASIGVERIFY` verify their ECDSA signature by calling `CPubKey::Verify` directly from the interpreter. Transaction signatures instead go through `GenericTransactionSignatureChecker::VerifySignature`, which `CachingTransactionSignatureChecker` overrides to consult the salted signature cache. As a result, a data signature that was already verified at mempool admission is verified again when the block connects, and a script full of data signatures gets no help from the cache.

  ## What was done?

  - New virtual `BaseSignatureChecker::CheckDataSig(sig, message, pubkey)`. The base implementation keeps today's behaviour: the raw signature, `SHA256(message)` and `CPubKey::Verify`. Checkers without a transaction (`BaseSignatureChecker`, `DummySignatureChecker`, the fuzz checker) are therefore unchanged.
  - `GenericTransactionSignatureChecker` implements it through its virtual `VerifySignature`. Like `CheckSig`, it first rejects a public key that `CPubKey` considers invalid. An invalid key contributes no bytes to a signature cache entry, so without that check `(hash, <invalid key>, key || sig)` would alias the cached entry for `(hash, key, sig)`. `CPubKey::Verify` already returns false for an invalid key, so results don't change. `CachingTransactionSignatureChecker` then stores and looks up data signatures as it does any other (hash, signature, public key) triple. `DeferringSignatureChecker` forwards the call.
  - The interpreter keeps its encoding checks, empty-signature handling (an empty signature never reaches the checker) and NULLFAIL handling. It now asks the checker instead of calling `CPubKey::Verify` itself.

  Sharing the cache is safe: an entry records that `CPubKey::Verify(hash, sig)` succeeded for that public key. The data-signature path makes the same call with the same arguments it would make without the cache, so a hit is exactly as strong as the verification it replaces. A transaction signature and a data signature can only share an entry if they share the hash, signature and key, and then both verify anyway.

  Two side effects. Block connection looks up entries without storing, and a hit marks the entry discardable. An identical data signature repeated across several transactions may therefore be verified again once its entry is evicted, exactly as for transaction signatures. Data signatures now also take signature cache slots. Each one is a verification the node already performs.

  ## How Has This Been Tested?

  macOS arm64, depends build, `make -j1`.

  - The existing `checkdatasig_tests/checkdatasig_test` matrix now runs every case through `BaseSignatureChecker`, `TransactionSignatureChecker` and `CachingTransactionSignatureChecker` (storing). The matrix covers pubkey encodings, high-S, non-DER, NULLFAIL, empty signatures, and no flags versus standard flags. All three checkers give identical results.
  - New `checkdatasig_signature_cache_controls`: after a storing caching checker accepts a valid data signature, a lookup-only checker still accepts it. It rejects the same signature with a changed message or a different public key, and rejects a corrupted signature, including after the corrupted one has gone through the storing checker. It then moves the public key into the signature (`key || sig`) and passes an empty, 1-byte or truncated public key. Each must be rejected even with the valid entry freshly stored. Without the `IsValid` check, these aliases hit the cached entry and verify.
  - `./src/test/test_dash --run_test='checkdatasig_tests:dip0020opcodes_tests:script_tests:script_p2sh_tests:transaction_tests:txvalidationcache_tests:multisig_tests:sigopcount_tests'`: 40 cases, no errors.
  - `git diff --check`, `lint-whitespace.py`, `lint-circular-dependencies.py`, `lint-includes.py`, `lint-logs.py`: clean.

  Limits:
  - The cache is internal, so a cache hit is not observed directly. The tests show that the cache path is reached and that it never accepts anything the direct check would reject.
  - No benchmark was run.

  ## Breaking Changes

  None. Script results are unchanged. Data signatures are now cached like transaction signatures.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

ACKs for top commit:
  knst:
    utACK 344f05d7d0d85570ef07c91f26b0947515621d77

Tree-SHA512: e7825cc356f970e50b208e8ebd82d8fc08c974e7357bc17b9916f1fedeaf7007f2672e7853a83782cbb4d447eff7beb04820d90fd88205eeb90944c38475da12
(cherry picked from commit 0981a582f524d514a3dbe8a8d1e8f6d572c9f6fd)
---
 src/script/interpreter.cpp      | 31 +++++++++--
 src/script/interpreter.h        | 11 ++++
 src/test/checkdatasig_tests.cpp | 99 ++++++++++++++++++++++++++++-----
 3 files changed, 123 insertions(+), 18 deletions(-)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index 1dac934c232f..64ef3f65103f 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1063,11 +1063,7 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
 
                     bool fSuccess = false;
                     if (vchSig.size()) {
-                        valtype vchHash(32);
-                        CSHA256()
-                            .Write(vchMessage.data(), vchMessage.size())
-                            .Finalize(vchHash.data());
-                        fSuccess = CPubKey(vchPubKey).Verify(uint256(vchHash), vchSig);
+                        fSuccess = checker.CheckDataSig(vchSig, vchMessage, vchPubKey);
                     }
 
                     if (!fSuccess && (flags & SCRIPT_VERIFY_NULLFAIL) && vchSig.size()) {
@@ -1533,12 +1529,37 @@ uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn
 template uint256 SignatureHash<CMutableTransaction>(const CScript& scriptCode, const CMutableTransaction& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache);
 template uint256 SignatureHash<CTransaction>(const CScript& scriptCode, const CTransaction& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache);
 
+static uint256 DataSignatureHash(const std::vector<unsigned char>& vchMessage)
+{
+    uint256 hash;
+    CSHA256().Write(vchMessage.data(), vchMessage.size()).Finalize(hash.begin());
+    return hash;
+}
+
+bool BaseSignatureChecker::CheckDataSig(const std::vector<unsigned char>& vchSig, const std::vector<unsigned char>& vchMessage,
+                                        const std::vector<unsigned char>& vchPubKey) const
+{
+    return CPubKey(vchPubKey).Verify(DataSignatureHash(vchMessage), vchSig);
+}
+
 template <class T>
 bool GenericTransactionSignatureChecker<T>::VerifySignature(const std::vector<unsigned char>& vchSig, const CPubKey& pubkey, const uint256& sighash) const
 {
     return pubkey.Verify(sighash, vchSig);
 }
 
+template <class T>
+bool GenericTransactionSignatureChecker<T>::CheckDataSig(const std::vector<unsigned char>& vchSig,
+                                                         const std::vector<unsigned char>& vchMessage,
+                                                         const std::vector<unsigned char>& vchPubKey) const
+{
+    // An invalid key serializes to no bytes in the signature cache entry, so it must not reach the cache
+    const CPubKey pubkey(vchPubKey);
+    if (!pubkey.IsValid()) return false;
+    // Through the virtual VerifySignature, so CachingTransactionSignatureChecker caches the result
+    return VerifySignature(vchSig, pubkey, DataSignatureHash(vchMessage));
+}
+
 template <class T>
 bool GenericTransactionSignatureChecker<T>::CheckSig(const std::vector<unsigned char>& vchSigIn, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const
 {
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index 6d95191fa56a..5f49aec9e73e 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -153,6 +153,10 @@ class BaseSignatureChecker
          return false;
     }
 
+    /** Verify vchSig as an ECDSA signature by vchPubKey over SHA256(vchMessage), as CHECKDATASIG does */
+    virtual bool CheckDataSig(const std::vector<unsigned char>& vchSig, const std::vector<unsigned char>& vchMessage,
+                              const std::vector<unsigned char>& vchPubKey) const;
+
     virtual ~BaseSignatureChecker() {}
 };
 
@@ -184,6 +188,8 @@ class GenericTransactionSignatureChecker : public BaseSignatureChecker
     bool CheckSig(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override;
     bool CheckLockTime(const CScriptNum& nLockTime) const override;
     bool CheckSequence(const CScriptNum& nSequence) const override;
+    bool CheckDataSig(const std::vector<unsigned char>& vchSig, const std::vector<unsigned char>& vchMessage,
+                      const std::vector<unsigned char>& vchPubKey) const override;
 };
 
 using TransactionSignatureChecker = GenericTransactionSignatureChecker<CTransaction>;
@@ -209,6 +215,11 @@ class DeferringSignatureChecker : public BaseSignatureChecker
     {
         return m_checker.CheckSequence(nSequence);
     }
+    bool CheckDataSig(const std::vector<unsigned char>& vchSig, const std::vector<unsigned char>& vchMessage,
+                      const std::vector<unsigned char>& vchPubKey) const override
+    {
+        return m_checker.CheckDataSig(vchSig, vchMessage, vchPubKey);
+    }
 };
 
 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* error = nullptr);
diff --git a/src/test/checkdatasig_tests.cpp b/src/test/checkdatasig_tests.cpp
index 70e4544fc4a6..231d4323d8ee 100644
--- a/src/test/checkdatasig_tests.cpp
+++ b/src/test/checkdatasig_tests.cpp
@@ -3,7 +3,9 @@
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <policy/policy.h>
+#include <primitives/transaction.h>
 #include <script/interpreter.h>
+#include <script/sigcache.h>
 
 #include <test/lcg.h>
 #include <test/util/setup_common.h>
@@ -11,6 +13,7 @@
 #include <boost/test/unit_test.hpp>
 
 #include <array>
+#include <functional>
 
 typedef std::vector<uint8_t> valtype;
 typedef std::vector<valtype> stacktype;
@@ -36,27 +39,46 @@ struct KeyData {
     }
 };
 
+static CMutableTransaction SpendingTx()
+{
+    CMutableTransaction tx;
+    tx.vin.resize(1);
+    return tx;
+}
+
+//! Data signatures must behave the same with the plain, transaction and caching signature checkers
+static void ForEachChecker(const std::function<void(const BaseSignatureChecker&)>& check)
+{
+    const CTransaction tx{SpendingTx()};
+    PrecomputedTransactionData txdata;
+    check(BaseSignatureChecker{});
+    check(TransactionSignatureChecker{&tx, 0, 0, MissingDataBehavior::FAIL});
+    check(CachingTransactionSignatureChecker{&tx, 0, 0, txdata, /*storeIn=*/true});
+}
+
 static void CheckError(uint32_t flags, const stacktype& original_stack,
                        const CScript& script, ScriptError expected)
 {
-    BaseSignatureChecker sigchecker;
-    ScriptError err = ScriptError::SCRIPT_ERR_OK;
-    stacktype stack{original_stack};
-    bool r = EvalScript(stack, script, flags, sigchecker, SigVersion::BASE, &err);
-    BOOST_CHECK(!r);
-    BOOST_CHECK(err == expected);
+    ForEachChecker([&](const BaseSignatureChecker& sigchecker) {
+        ScriptError err = ScriptError::SCRIPT_ERR_OK;
+        stacktype stack{original_stack};
+        bool r = EvalScript(stack, script, flags, sigchecker, SigVersion::BASE, &err);
+        BOOST_CHECK(!r);
+        BOOST_CHECK(err == expected);
+    });
 }
 
 static void CheckPass(uint32_t flags, const stacktype& original_stack,
                       const CScript& script, const stacktype& expected)
 {
-    BaseSignatureChecker sigchecker;
-    ScriptError err = ScriptError::SCRIPT_ERR_OK;
-    stacktype stack{original_stack};
-    bool r = EvalScript(stack, script, flags, sigchecker, SigVersion::BASE, &err);
-    BOOST_CHECK(r);
-    BOOST_CHECK(err == ScriptError::SCRIPT_ERR_OK);
-    BOOST_CHECK(stack == expected);
+    ForEachChecker([&](const BaseSignatureChecker& sigchecker) {
+        ScriptError err = ScriptError::SCRIPT_ERR_OK;
+        stacktype stack{original_stack};
+        bool r = EvalScript(stack, script, flags, sigchecker, SigVersion::BASE, &err);
+        BOOST_CHECK(r);
+        BOOST_CHECK(err == ScriptError::SCRIPT_ERR_OK);
+        BOOST_CHECK(stack == expected);
+    });
 }
 
 /**
@@ -230,4 +252,55 @@ BOOST_AUTO_TEST_CASE(checkdatasig_test)
     }
 }
 
+static uint256 MessageHash(const valtype& message)
+{
+    uint256 hash;
+    CSHA256().Write(message.data(), message.size()).Finalize(hash.begin());
+    return hash;
+}
+
+// A cached valid data signature must not validate a different message, key or signature.
+BOOST_AUTO_TEST_CASE(checkdatasig_signature_cache_controls)
+{
+    KeyData kd;
+    const valtype message{0x03, 0x04};
+    valtype sig;
+    BOOST_REQUIRE(kd.privkeyC.Sign(MessageHash(message), sig));
+    const valtype pubkey{ToByteVector(kd.pubkeyC)};
+    CKey other_key;
+    other_key.MakeNewKey(/*fCompressed=*/true);
+    valtype bad_sig{sig};
+    bad_sig[bad_sig.size() - 1] ^= 0x01;
+
+    const CTransaction tx{SpendingTx()};
+    PrecomputedTransactionData txdata;
+    const CachingTransactionSignatureChecker storing{&tx, 0, 0, txdata, /*storeIn=*/true};
+    const CachingTransactionSignatureChecker lookup{&tx, 0, 0, txdata, /*storeIn=*/false};
+    const auto result = [](const BaseSignatureChecker& checker, const stacktype& args) {
+        stacktype stack{args};
+        ScriptError err;
+        BOOST_REQUIRE(EvalScript(stack, CScript() << OP_CHECKDATASIG, SCRIPT_VERIFY_NONE, checker, SigVersion::BASE, &err));
+        return stack == stacktype{{0x01}};
+    };
+
+    BOOST_CHECK(result(storing, {sig, message, pubkey}));
+    BOOST_CHECK(result(lookup, {sig, message, pubkey}));
+    BOOST_CHECK(!result(lookup, {sig, {0x03, 0x05}, pubkey}));
+    BOOST_CHECK(!result(lookup, {sig, message, ToByteVector(other_key.GetPubKey())}));
+    BOOST_CHECK(!result(lookup, {bad_sig, message, pubkey}));
+    BOOST_CHECK(!result(storing, {bad_sig, message, pubkey}));
+    BOOST_CHECK(!result(lookup, {bad_sig, message, pubkey}));
+
+    // An invalid public key adds no bytes to a cache entry, so moving the key into the signature must
+    // not match the cached (message, key, signature) entry
+    valtype alias{pubkey};
+    alias.insert(alias.end(), sig.begin(), sig.end());
+    for (const valtype& invalid_pubkey : {valtype{}, valtype{0x02}, valtype(pubkey.begin(), pubkey.end() - 1)}) {
+        // A lookup-only hit marks its entry discardable, so store the valid one again to keep it
+        BOOST_REQUIRE(result(storing, {sig, message, pubkey}));
+        BOOST_CHECK(!result(storing, {alias, message, invalid_pubkey}));
+        BOOST_CHECK(!result(lookup, {alias, message, invalid_pubkey}));
+    }
+}
+
 BOOST_AUTO_TEST_SUITE_END()

From 197b14a8438d71da3fc9718cd702f35d229f15e4 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 13 Oct 2026 08:33:37 -0500
Subject: [PATCH 29/51] Merge #7866: fix: stop `masternode payments` at the
 genesis block
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

2c1202786c6d16a202e9c8f5c9bb9ca1c4f90d9b fix: stop `masternode payments` at the genesis block (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `masternode payments` terminates dashd when it reaches the genesis block. For every block it visits, it reads the masternode list of the previous block with `GetListForBlock(pindex->pprev)`. That function takes a `gsl::not_null<const CBlockIndex*>`, so the genesis block's null `pprev` calls `std::terminate()`.

  Any RPC user can reach it in three ways:
  - `masternode payments <genesis hash>`
  - a negative count that walks back past block 1, e.g. `masternode payments <block 1 hash> -2`
  - `masternode payments` with no arguments on a chain still at height 0

  ## What was done?

  Payees for a block are chosen from the previous block's list, so the genesis block has no masternode payments. The loop now stops at the genesis block. Asking for the genesis block returns an empty array, and a backwards walk ends at block 1.

  ## How Has This Been Tested?

  - Reproduced the crash by hand on an unpatched regtest build (`std::terminate() called` in debug.log), both at height 0 and at height 1.
  - `rpc_masternode.py` gains two assertions: payments for the genesis block, and a backwards walk from block 1. Against the unpatched dashd the test fails at the first of them because the node dies. With the fix it passes.
  - macOS arm64, depends build.

  ## Breaking Changes

  None. Requests that used to crash the node now return results.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

ACKs for top commit:
  knst:
    utACK 2c1202786c6d16a202e9c8f5c9bb9ca1c4f90d9b

Tree-SHA512: 5b0a7646cde26c0c6de1a3341847e0619718acacbf392fc15e4cee034ab0bd680dd263d69d6937b1db0b43b9c1ae776cd9a1b5c5eaaffecd6d812dfbc18b7647
(cherry picked from commit 1aed5c3c8faf6cf6b7c603dc7fa373d95304629c)
---
 src/rpc/masternode.cpp            | 3 ++-
 test/functional/rpc_masternode.py | 4 ++++
 2 files changed, 6 insertions(+), 1 deletion(-)

diff --git a/src/rpc/masternode.cpp b/src/rpc/masternode.cpp
index 2fc9f556d1f5..2db0d47ddcd7 100644
--- a/src/rpc/masternode.cpp
+++ b/src/rpc/masternode.cpp
@@ -385,7 +385,8 @@ static RPCHelpMan masternode_payments()
 
     CHECK_NONFATAL(node.chain_helper);
     CHECK_NONFATAL(node.dmnman);
-    while (vecPayments.size() < uint64_t(std::abs(nCount)) && pindex != nullptr) {
+    // Payees are selected from the previous block's list, so the genesis block has none
+    while (vecPayments.size() < uint64_t(std::abs(nCount)) && pindex != nullptr && pindex->pprev != nullptr) {
         CBlock block;
         if (!ReadBlockFromDisk(block, pindex, Params().GetConsensus())) {
             throw JSONRPCError(RPC_INTERNAL_ERROR, "Can't read block from disk");
diff --git a/test/functional/rpc_masternode.py b/test/functional/rpc_masternode.py
index 7258f07d57b3..2e894ed5a2fe 100755
--- a/test/functional/rpc_masternode.py
+++ b/test/functional/rpc_masternode.py
@@ -65,6 +65,10 @@ def run_test(self):
         # using chaintip as a start block should return 2 blocks now, with the tip being the last one
         assert_equal(len(payments2_2), 2)
         assert_equal(payments[0], payments2_2[-1])
+        # the genesis block has no previous block to pay masternodes from
+        assert_equal(self.nodes[0].masternode("payments", self.nodes[0].getblockhash(0)), [])
+        payments_to_genesis = self.nodes[0].masternode("payments", self.nodes[0].getblockhash(1), -2)
+        assert_equal([p["height"] for p in payments_to_genesis], [1])
 
         self.log.info("test that `masternode payments` results at chaintip match `getblocktemplate` results for that block")
         gbt_masternode = self.nodes[0].getblocktemplate()["masternode"]

From dcc959657f02520e10d4830461b0330dafbb9b2c Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Tue, 13 Oct 2026 08:35:41 -0500
Subject: [PATCH 30/51] Merge #7867: fix: refuse masternode list RPCs for
 blocks outside the active chain
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

ec93e6914f30a66b2c8056cd6b99f9e9d0185eee fix: ProcessBlock now stores replaces existing items in cache of mn-lists (Konstantin Akimov)
0f5b8d647c50c45857208f2e28a5a6daac5ddbd8 fix: refuse masternode list RPCs for blocks outside the active chain (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  If an RPC asks for the masternode list at a block whose header the node has accepted but which it has never connected, the node caches a wrong list. It then rejects the next valid block and stalls.

  `CDeterministicMNManager::GetListForBlockInternal()` walks back from the requested block looking for a list snapshot or diff in EvoDB. If it finds neither, it treats that block as the initial snapshot: it caches an empty list under the block's hash and points `m_initial_snapshot_index` at it. A block that was never connected has no diff, so it lands in that fallback. When the block is connected later, `ProcessBlock()` adds the real list with `emplace`, which keeps the existing entry, so the empty list stays cached. The next block is then built on an empty list and rejected with `bad-cbtx-mnmerkleroot`.

  Steps on regtest with registered masternodes:
  1. `submitheader` block N
  2. `protx info <proTxHash> <hash N>` (returns "not found" because the list it read is the fabricated empty one)
  3. `submitblock` block N
  4. A correct block N+1 from a peer is rejected with `bad-cbtx-mnmerkleroot`

  The rejection is saved as `BLOCK_FAILED_VALID` in the block index. A restart drops the bad cache entry, but the block is still marked invalid, so the node stays stuck until someone runs `reconsiderblock`. I confirmed this on an unpatched build: after the restart, `getchaintips` still lists the peer's block as `invalid`.

  Three stock RPCs can reach this, all of which need an authenticated RPC user:
  - `protx info` with a block hash
  - `protx listdiff`
  - `masternode payments`, when it is given a block that is stored but whose parent is header-only

  `protx diff` and the P2P `getmnlistd`/`getqrinfo` handlers are not affected. They go through `BuildSimplifiedMNListDiff()`, which already requires both blocks to be in the active chain.

  ## What was done?

  - `protx info`, `protx listdiff` and `masternode payments` now return `RPC_INVALID_PARAMETER` ("Block is not in main chain") for a block outside the active chain. This is the same rule `protx diff` already follows.
  - `CDeterministicMNManager::ProcessBlock()` now stores each connected block's list with `insert_or_assign` instead of `emplace`. Whatever an earlier lookup cached under that block hash, connecting the block replaces it with the correct list. This closes the cache poisoning for any caller, not only these three RPCs; the RPC checks stay so callers get an error instead of a made-up empty list.

  ## How Has This Been Tested?

  - The new section in `rpc_masternode.py` follows the steps above: `generateblock` with `submit=False`, `submitheader`, then calls to the three RPCs at that hash. It then submits the block and mines the next one.
    - Unpatched dashd: the test fails, because the RPCs still answer.
    - Patched dashd: the test passes.
  - A separate probe run on the unpatched dashd went further. The node rejected a peer-mined block N+1 with `bad-cbtx-mnmerkleroot`, and still showed it as `invalid` after a restart.
  - Also passed on the patched build:
    - `feature_dip3_deterministicmns.py --descriptors` (uses `protx info` and `protx listdiff` at historical active-chain blocks)
    - `feature_llmq_simplepose.py` and `feature_llmq_simplepose.py --disable-spork23`
    - `rpc_quorum.py`
  - `evo_dip3_activation_tests/dip3_activation_legacy` now submits a block's header, reads the list for it, then connects the block and checks the tip list contains the newly registered masternode. With `emplace` restored the check fails (the stale empty list is still cached); with `insert_or_assign` it passes.
  - macOS arm64, depends build.

  ## Breaking Changes

  `protx info <proTxHash> <blockHash>`, `protx listdiff` and `masternode payments <blockHash>` now return an error for a block outside the active chain, including stale-fork blocks that were connected at some point. Before, they answered for any known block.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

ACKs for top commit:
  knst:
    self-ACK ec93e6914f30a66b2c8056cd6b99f9e9d0185eee

Tree-SHA512: aabc1c038cf43f6c601b93d81c4d2dac6b2d6f38796730b0d9fdd5ccdd38a687fa6d4d18df19473d1bff5c03ac5ba1d9938b705b6986b7969f140533e48487e2

v23.1.x adaptation: the cache-replace change maps onto v23's ProcessBlock, which
writes the diff/snapshot with plain m_evoDb.Write (no develop WriteDerived); both
mnListsCache.emplace calls become insert_or_assign. The functional test is adapted
because v23's generateblock has no `submit` argument: the header-only block is
mined on an isolated node and fed to node0 via submitheader/submitblock. The
unrelated "payments without historical transaction data" case is not included.
---
 src/evo/deterministicmns.cpp            |  4 ++--
 src/rpc/evo.cpp                         |  7 +++++++
 src/rpc/masternode.cpp                  |  4 ++++
 src/test/evo_deterministicmns_tests.cpp |  5 +++++
 test/functional/rpc_masternode.py       | 21 ++++++++++++++++++++-
 5 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/src/evo/deterministicmns.cpp b/src/evo/deterministicmns.cpp
index 67b2cd851415..a63a52885cd1 100644
--- a/src/evo/deterministicmns.cpp
+++ b/src/evo/deterministicmns.cpp
@@ -689,14 +689,14 @@ bool CDeterministicMNManager::ProcessBlock(const CBlock& block, gsl::not_null<co
         m_evoDb.Write(std::make_pair(DB_LIST_DIFF, newList.GetBlockHash()), diff);
         if ((nHeight % DISK_SNAPSHOT_PERIOD) == 0 || pindex->pprev == m_initial_snapshot_index) {
             m_evoDb.Write(std::make_pair(DB_LIST_SNAPSHOT, newList.GetBlockHash()), newList);
-            mnListsCache.emplace(newList.GetBlockHash(), newList);
+            mnListsCache.insert_or_assign(newList.GetBlockHash(), newList);
             LogPrintf("CDeterministicMNManager::%s -- Wrote snapshot. nHeight=%d, mapCurMNs.allMNsCount=%d\n",
                 __func__, nHeight, newList.GetCounts().total());
         }
 
         diff.nHeight = pindex->nHeight;
         mnListDiffsCache.emplace(pindex->GetBlockHash(), diff);
-        mnListsCache.emplace(newList.GetBlockHash(), newList);
+        mnListsCache.insert_or_assign(newList.GetBlockHash(), newList);
     } catch (const std::exception& e) {
         LogPrintf("CDeterministicMNManager::%s -- internal error: %s\n", __func__, e.what());
         return state.Invalid(BlockValidationResult::BLOCK_CONSENSUS, "failed-dmn-block");
diff --git a/src/rpc/evo.cpp b/src/rpc/evo.cpp
index a3a6555e3982..4d472bb95d40 100644
--- a/src/rpc/evo.cpp
+++ b/src/rpc/evo.cpp
@@ -1568,6 +1568,10 @@ static RPCHelpMan protx_info()
         if (pindex == nullptr) {
             throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "Block not found");
         }
+        // A block that was never connected has no list to read yet
+        if (!chainman.ActiveChain().Contains(pindex)) {
+            throw JSONRPCError(RPC_INVALID_PARAMETER, "Block is not in main chain");
+        }
     }
 
     auto mnList = dmnman.GetListForBlock(pindex);
@@ -1688,6 +1692,9 @@ static RPCHelpMan protx_listdiff()
 
     const CBlockIndex* pBaseBlockIndex = ParseBlockIndex(request.params[0], chainman, "baseBlock");
     const CBlockIndex* pTargetBlockIndex = ParseBlockIndex(request.params[1], chainman, "block");
+    if (!chainman.ActiveChain().Contains(pBaseBlockIndex) || !chainman.ActiveChain().Contains(pTargetBlockIndex)) {
+        throw JSONRPCError(RPC_INVALID_PARAMETER, "Block is not in main chain");
+    }
 
     if (pBaseBlockIndex == nullptr) {
         throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "Base block not found");
diff --git a/src/rpc/masternode.cpp b/src/rpc/masternode.cpp
index 2db0d47ddcd7..e2dc05444a7a 100644
--- a/src/rpc/masternode.cpp
+++ b/src/rpc/masternode.cpp
@@ -376,6 +376,10 @@ static RPCHelpMan masternode_payments()
         if (pindex == nullptr) {
             throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, "Block not found");
         }
+        // Payees come from the previous block's list, which an unconnected block may not have yet
+        if (!chainman.ActiveChain().Contains(pindex)) {
+            throw JSONRPCError(RPC_INVALID_PARAMETER, "Block is not in main chain");
+        }
     }
 
     int64_t nCount = request.params.size() > 1 ? ParseInt64V(request.params[1], "count") : 1;
diff --git a/src/test/evo_deterministicmns_tests.cpp b/src/test/evo_deterministicmns_tests.cpp
index 883e19df49df..bde91d9c41a0 100644
--- a/src/test/evo_deterministicmns_tests.cpp
+++ b/src/test/evo_deterministicmns_tests.cpp
@@ -321,6 +321,11 @@ void FuncDIP3Activation(TestChainSetup& setup)
     BOOST_CHECK_EQUAL(chainman.ActiveChain().Height(), nHeight + 1);
     // Mining a block with a DIP3 transaction should succeed now
     block = std::make_shared<CBlock>(setup.CreateBlock(txns, coinbase_pk, chainman.ActiveChainstate()));
+    // A list looked up while only the header is known must not outlive the block's connection
+    BlockValidationState header_state;
+    const CBlockIndex* header_index{nullptr};
+    BOOST_REQUIRE(chainman.ProcessNewBlockHeaders({block->GetBlockHeader()}, header_state, &header_index));
+    BOOST_REQUIRE(!dmnman.GetListForBlock(Assert(header_index)).HasMN(tx.GetHash()));
     BOOST_REQUIRE(chainman.ProcessNewBlock(block, true, nullptr));
     dmnman.UpdatedBlockTip(chainman.ActiveChain().Tip());
     BOOST_CHECK_EQUAL(chainman.ActiveChain().Height(), nHeight + 2);
diff --git a/test/functional/rpc_masternode.py b/test/functional/rpc_masternode.py
index 2e894ed5a2fe..aaf8edd12933 100755
--- a/test/functional/rpc_masternode.py
+++ b/test/functional/rpc_masternode.py
@@ -3,7 +3,7 @@
 # Distributed under the MIT software license, see the accompanying
 # file COPYING or http://www.opensource.org/licenses/mit-license.php.
 from test_framework.test_framework import DashTestFramework
-from test_framework.util import assert_equal
+from test_framework.util import assert_equal, assert_raises_rpc_error
 
 '''
 rpc_masternode.py
@@ -107,5 +107,24 @@ def run_test(self):
         # we have 3 masternodes that are running already and 2 new outputs we just created
         assert_equal(len(self.nodes[0].masternode("outputs")), 5)
 
+        self.log.info("test that masternode list RPCs refuse a block that is not connected")
+        # Mine a block on an isolated node so node0 can learn its header without being able to download it
+        self.sync_all()
+        self.isolate_node(1)
+        block_hash = self.generate(self.nodes[1], 1, sync_fun=self.no_op)[0]
+        header_hex = self.nodes[1].getblockheader(block_hash, False)
+        block_hex = self.nodes[1].getblock(block_hash, 0)
+        node = self.nodes[0]
+        node.submitheader(header_hex)
+        assert_raises_rpc_error(-8, "Block is not in main chain", node.protx, "info", self.mninfo[0].proTxHash, block_hash)
+        assert_raises_rpc_error(-8, "Block is not in main chain", node.protx, "listdiff", 1, block_hash)
+        assert_raises_rpc_error(-8, "Block is not in main chain", node.masternode, "payments", block_hash)
+        # a list cached for the header alone would make the next block fail with bad-cbtx-mnmerkleroot
+        assert_equal(node.submitblock(block_hex), None)
+        tip = self.generate(node, 1, sync_fun=self.no_op)[0]
+        assert_equal(node.getbestblockhash(), tip)
+        self.reconnect_isolated_node(1, 0)
+        self.sync_blocks()
+
 if __name__ == '__main__':
     RPCMasternodeTest().main()

From db9ec2bd8eb440a0cb5be05a2a18d4c4faf09504 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 14 Oct 2026 21:50:47 -0500
Subject: [PATCH 31/51] Merge #7826: fix: skip repeated authenticated Platform
 bans
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

2039964234da7a29c0d6433e8003b6ddcf40d00e fix: skip repeated authenticated Platform bans (pasta)

Pull request description:

  ## Issue being fixed or feature implemented
  Direct Platform ban messages repeat signature verification, handler logging and relay work even when the same authenticated context is already cached. Identical same-height ban updates also report a successful metadata transition. A sender needs a legitimate recent ban for an existing EvoNode to trigger this redundant work; no throughput loss or node outage is claimed.

  ## What was done?
  Check the existing authenticated-object cache before handler logging and verification, while preserving request bookkeeping. Make identical same-height bans idempotent and remember authenticated contexts even when a newer metadata watermark rejects the update, including after restart. Unknown contexts still pass all target, height, quorum and signature checks. Unsolicited first-hop ingress, historical quorum acceptance, newer-height watermark advancement and same-height ban precedence are preserved.

  ## How Has This Been Tested?
  On macOS arm64, `p2p_platform_ban.py` passed. A legitimate signed ban still propagates and affects the next quorum. Resending one identical direct message produces no new `PLATFORMBAN -- hash:` handler log, and a service update revives the EvoNode. This check would fail on develop, where the handler logs before any cache check.

  No replay throughput benchmark, log-amplification measurement or outage demonstration was performed. The skipped BLS work follows from the early return being placed before verification.

  ## Breaking Changes
  None

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

Top commit has no ACKs.

Tree-SHA512: 0b0d7e8f508e2ad3302d885a2f105822504dff3b344a83b660f59c63096d254cb3dfce71383b7b00ce6ba37762c76a202fc9857f6a8046609d71601a8fcb8a43

v23.1.x adaptation: net_processing.cpp has no develop solicitation-gate comment
and reaches the MN list via Assert(m_dmnman); the AlreadyHavePlatformBan early
return and the moved PLATFORMBAN log line are taken as upstream.
---
 src/masternode/meta.cpp             | 9 ++++-----
 src/masternode/meta.h               | 2 +-
 src/net_processing.cpp              | 8 ++++++--
 test/functional/p2p_platform_ban.py | 5 +++++
 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/src/masternode/meta.cpp b/src/masternode/meta.cpp
index 2c7a67e0d221..d1a37f3d5f44 100644
--- a/src/masternode/meta.cpp
+++ b/src/masternode/meta.cpp
@@ -200,11 +200,10 @@ bool CMasternodeMetaMan::SetPlatformBan(const uint256& inv_hash, PlatformBanMess
 
     const uint256& protx_hash = ban_msg.m_protx_hash;
 
-    bool ret = GetMetaInfo(protx_hash).SetPlatformBan(true, ban_msg.m_requested_height);
-    if (ret) {
-        m_seen_platform_bans.emplace(inv_hash, std::move(ban_msg));
-    }
-    return ret;
+    const bool changed = GetMetaInfo(protx_hash).SetPlatformBan(true, ban_msg.m_requested_height);
+    // Remember authenticated messages even when newer metadata supersedes them.
+    m_seen_platform_bans.emplace(inv_hash, std::move(ban_msg));
+    return changed;
 }
 
 bool CMasternodeMetaMan::AlreadyHavePlatformBan(const uint256& inv_hash) const
diff --git a/src/masternode/meta.h b/src/masternode/meta.h
index d8541b86a789..82fac75ce722 100644
--- a/src/masternode/meta.h
+++ b/src/masternode/meta.h
@@ -75,7 +75,7 @@ class CMasternodeMetaInfo
         if (height < m_platform_ban_updated) {
             return false;
         }
-        if (height == m_platform_ban_updated && !is_banned) {
+        if (height == m_platform_ban_updated && (!is_banned || m_platform_ban)) {
             return false;
         }
         m_platform_ban = is_banned;
diff --git a/src/net_processing.cpp b/src/net_processing.cpp
index 8ec68002dbc0..f82364df16a9 100644
--- a/src/net_processing.cpp
+++ b/src/net_processing.cpp
@@ -3825,10 +3825,14 @@ MessageProcessingResult PeerManagerImpl::ProcessPlatformBanMessage(NodeId node,
 
     const uint256 hash = ban_msg.GetHash();
 
-    LogPrintf("PLATFORMBAN -- hash: %s protx_hash: %s height: %d peer=%d\n", hash.ToString(), ban_msg.m_protx_hash.ToString(), ban_msg.m_requested_height, node);
-
     MessageProcessingResult ret{};
     ret.m_to_erase = CInv{MSG_PLATFORM_BAN, hash};
+    if (m_mn_metaman.AlreadyHavePlatformBan(hash)) {
+        return ret;
+    }
+
+    LogPrintf("PLATFORMBAN -- hash: %s protx_hash: %s height: %d peer=%d\n", hash.ToString(),
+              ban_msg.m_protx_hash.ToString(), ban_msg.m_requested_height, node);
 
     const auto list = Assert(m_dmnman)->GetListAtChainTip();
     auto dmn = list.GetMN(ban_msg.m_protx_hash);
diff --git a/test/functional/p2p_platform_ban.py b/test/functional/p2p_platform_ban.py
index bec2f5d0b2ea..1f6ee3d9cdf8 100755
--- a/test/functional/p2p_platform_ban.py
+++ b/test/functional/p2p_platform_ban.py
@@ -69,6 +69,11 @@ def run_test(self):
         wait_until_helper(lambda: p2p_node2.message_count["platformban"] > 0, timeout=10, lock=p2p_lock)
         p2p_node2.message_count["platformban"] = 0
 
+        self.log.info("An already verified Platform ban skips handler work")
+        ban_inv_hash = hash256(msg.serialize()[:-96])[::-1].hex()
+        with self.mninfo[2].get_node(self).assert_debug_log([], unexpected_msgs=[f"PLATFORMBAN -- hash: {ban_inv_hash}"]):
+            p2p_node2.send_and_ping(msg)
+
         assert not self.check_banned(self.mninfo[0])
 
         mninfos_valid = self.mninfo.copy()[1:]

From d2152809fd48b199060c4612e4b3fb1a3d504bfd Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 15 Oct 2026 20:51:31 -0500
Subject: [PATCH 32/51] Merge #7846: fix: treat pending owner keys and Platform
 node IDs as one conflict namespace
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

43ae7ac9c2ced80ca2fc1a4d1fd6abef4a597809 fix: treat pending owner keys and Platform node IDs as one namespace (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  The deterministic masternode list keeps owner key IDs and Platform node IDs in one uniqueness map. It is keyed by `SerializeHash`, and a `CKeyID` serializes exactly like a `uint160` with the same bytes. So once one masternode uses a 160-bit value as its owner key ID, no masternode can use it as a Platform node ID, and vice versa.

  The mempool tracks the two fields in separate maps (`mapProTxPubKeyIDs`, `mapProTxPlatformNodeIDs`) and checks each field only against its own map. Two pending provider transactions can therefore claim the same value, one as an owner key and one as a Platform node ID. Each is valid against the tip list and both are admitted. If block assembly selects both, `BuildNewListFromBlock` rejects the pair and `CreateNewBlock` / `getblocktemplate` fails until one of them leaves the mempool. The same applies when a block confirms one claim while the other is still pending: the pending one can no longer be mined, but nothing evicts it.

  Both transactions must be funded, collateral-backed provider transactions, so the cost is not trivial. A mempool that can stop template creation is still worth closing, and the fix is policy-only.

  ## What was done?

  `src/txmempool.cpp`. Consensus rules are unchanged.

  - `existsProviderTxConflict`:
    - A `ProRegTx` owner key, or each share owner key for a shared registration, conflicts with a pending owner key *or* a pending Platform node ID of the same value.
    - An EvoNode `ProRegTx` or `ProUpServTx` Platform node ID conflicts with a pending Platform node ID *or* a pending owner key of the same value.
    - A registration that uses one value for both its own owner key and its own Platform node ID is still accepted. The masternode list allows that within one masternode.
  - `removeProTxPubKeyConflicts(tx, CKeyID)` also evicts a pending transaction claiming the value as a Platform node ID. `removeProTxPlatformNodeIDConflicts` also evicts one claiming it as an owner key. A confirmed claim therefore removes the pending claim in the other field, together with its descendants.

  Not covered here: conflicts between provider transactions inside one submitted package. Package `PreChecks` run before any package transaction is in the mempool maps, so same-field conflicts inside a package aren't caught either. That gap predates this change, and `submitpackage` is a test-only RPC.

  ## How Has This Been Tested?

  macOS arm64, depends build.

  The coverage extends the existing `FuncTestMempoolDualProregtx` scenario (`evo_dip3_activation_tests/test_mempool_dual_proregtx_legacy` and `_basic`) in `src/test/evo_deterministicmns_tests.cpp`. It uses the public mempool API (`addUnchecked`, `existsProviderTxConflict`, `removeForBlock`) with unsigned provider payloads. It checks:

  - Non-shared registrations: a pending owner key blocks a `ProRegTx` and a `ProUpServTx` that claim the same value as their Platform node ID, and a pending Platform node ID blocks a `ProRegTx` owner key of the same value. An unrelated Platform node ID doesn't conflict.
  - Eviction: a confirmed owner key evicts a pending Platform node ID claim, and a confirmed Platform node ID evicts a pending owner key claim.
  - Shared registrations, in both directions: a share owner key colliding with a pending Platform node ID is rejected, and a Platform node ID colliding with a pending share owner key is rejected. Confirming either one evicts the other. The registrations use distinct operator keys, no addresses and internal collateral, so only the cross-namespace collision can conflict.
  - Negative case: an otherwise non-conflicting EvoNode registration that uses the same value for its own owner key and Platform node ID is accepted, with an unrelated registration pending.

  Mutation checks:

  - Restoring the owner-only lookup (`mapProTxPubKeyIDs.count`) in the shares branch of `existsProviderTxConflict` makes the shared-registration admission check fail in both test cases.
  - Making an EvoNode registration conflict with its own owner key equal to its Platform node ID makes the negative check fail in both test cases.

  All of `evo_dip3_activation_tests` (42 cases) and the other mempool unit tests pass. `git diff --check` and `lint-whitespace.py` are clean.

  Limits: no functional test submits two funded, collateral-backed provider transactions and then calls `getblocktemplate`.

  ## Breaking Changes

  None. Provider transactions whose owner key and Platform node ID collide across two pending transactions are now rejected from the mempool, or evicted, instead of breaking block assembly.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

ACKs for top commit:
  knst:
    utACK 43ae7ac9c2ced80ca2fc1a4d1fd6abef4a597809

Tree-SHA512: a410e026a0790685fdd0a4ad55c76a9586577c037929d5010706848836bf967a78b4cd04b6611c7fe1bcc88655693c552bd86b61ac3c84ad89f21752caf65752

v23.1.x adaptation: v23 has no shared masternodes, so the share-owner-key branch
of existsProviderTxConflict is dropped and only the keyIDOwner check is converted
to the shared owner-key/Platform-node-ID namespace. The unit test keeps the
owner-key/Platform-node-ID cases in FuncTestMempoolDualProregtx (v23 helpers; the
ProUpServTx is re-serialized as BasicBLS so nType/platformNodeID are present);
the shared-MN and ExtAddr cases are dropped.
---
 src/test/evo_deterministicmns_tests.cpp | 56 +++++++++++++++++++++++++
 src/txmempool.cpp                       | 27 +++++++++++-
 2 files changed, 81 insertions(+), 2 deletions(-)

diff --git a/src/test/evo_deterministicmns_tests.cpp b/src/test/evo_deterministicmns_tests.cpp
index bde91d9c41a0..33ae45dd5123 100644
--- a/src/test/evo_deterministicmns_tests.cpp
+++ b/src/test/evo_deterministicmns_tests.cpp
@@ -945,6 +945,25 @@ void FuncTestMempoolProTxKeyChangedConflictChain(TestChainSetup& setup)
     BOOST_CHECK_EQUAL(testPool.size(), 0U);
 }
 
+// Re-types a registration as an EvoNode with internal collateral claiming the given Platform node ID.
+// Only the mempool conflict maps are consulted by the callers, so the payload does not have to be valid.
+static CTransaction AsEvoWithPlatformNodeID(CMutableTransaction tx, const uint160& platform_node_id)
+{
+    auto pro_reg{*Assert(GetTxPayload<CProRegTx>(tx))};
+    pro_reg.nVersion = ProTxVersion::BasicBLS;
+    pro_reg.nType = MnType::Evo;
+    pro_reg.collateralOutpoint = COutPoint{};
+    pro_reg.platformNodeID = platform_node_id;
+    SetTxPayload(tx, pro_reg);
+    return CTransaction(tx);
+}
+
+static uint160 RandomUint160()
+{
+    const uint256 rand{GetRandHash()};
+    return uint160{Span<const unsigned char>{rand.begin(), uint160::size()}};
+}
+
 void FuncTestMempoolDualProregtx(TestChainSetup& setup)
 {
     auto& chainman = *Assert(setup.m_node.chainman.get());
@@ -1004,6 +1023,43 @@ void FuncTestMempoolDualProregtx(TestChainSetup& setup)
     testPool.addUnchecked(entry.FromTx(tx_reg1));
     BOOST_CHECK_EQUAL(testPool.size(), 1U);
     BOOST_CHECK(testPool.existsProviderTxConflict(CTransaction(tx_reg2)));
+
+    // The masternode list keeps owner key IDs and Platform node IDs in one uniqueness namespace, so a
+    // pending owner key and a pending Platform node ID with the same 160 bits cannot be mined in one block.
+    const uint160 owner1_id{ownerKey1.GetPubKey().GetID()};
+    // tx_reg2 has its own owner key, operator key and address; only its collateral reuse would clash with tx_reg1
+    const auto tx_platform_reg = AsEvoWithPlatformNodeID(tx_reg2, owner1_id);
+    const auto tx_unrelated_reg = AsEvoWithPlatformNodeID(tx_reg2, RandomUint160());
+    const auto tx_platform_up_serv = [&] {
+        auto tx = CreateProUpServTx(chainman.ActiveChain(), *(setup.m_node.mempool), utxos, tx_reg1.GetHash(),
+                                    operatorKey1, 5, CScript(), setup.coinbaseKey);
+        auto payload{*Assert(GetTxPayload<CProUpServTx>(tx))};
+        // nType and the Platform fields are only serialized from BasicBLS on
+        payload.nVersion = ProTxVersion::BasicBLS;
+        payload.nType = MnType::Evo;
+        payload.platformNodeID = owner1_id;
+        SetTxPayload(tx, payload);
+        return CTransaction(tx);
+    }();
+
+    // A pending owner key blocks a pending Platform node ID of the same value, at registration and at update
+    BOOST_CHECK(testPool.existsProviderTxConflict(tx_platform_reg));
+    BOOST_CHECK(testPool.existsProviderTxConflict(tx_platform_up_serv));
+    BOOST_CHECK(!testPool.existsProviderTxConflict(tx_unrelated_reg));
+
+    // ... and a pending Platform node ID blocks a pending owner key of the same value
+    testPool.removeRecursive(CTransaction(tx_reg1), MemPoolRemovalReason::MANUAL);
+    testPool.addUnchecked(entry.FromTx(MakeTransactionRef(tx_platform_reg)));
+    BOOST_CHECK(testPool.existsProviderTxConflict(CTransaction(tx_reg1)));
+
+    // A confirmed claim evicts the pending claim of the same value in the other field
+    testPool.removeForBlock({MakeTransactionRef(tx_reg1)}, chainman.ActiveChain().Height() + 1);
+    BOOST_CHECK(!testPool.exists(tx_platform_reg.GetHash()));
+
+    testPool.addUnchecked(entry.FromTx(tx_reg1));
+    testPool.removeForBlock({MakeTransactionRef(tx_platform_reg)}, chainman.ActiveChain().Height() + 1);
+    BOOST_CHECK(!testPool.exists(tx_reg1.GetHash()));
+    BOOST_CHECK_EQUAL(testPool.size(), 0U);
 }
 
 // A ProRegTx that reuses a confirmed external collateral replaces the live MN at block
diff --git a/src/txmempool.cpp b/src/txmempool.cpp
index 728ea08aae83..29243d071d81 100644
--- a/src/txmempool.cpp
+++ b/src/txmempool.cpp
@@ -919,6 +919,13 @@ void CTxMemPool::removeProTxPubKeyConflicts(const CTransaction &tx, const CKeyID
             removeRecursive(mapTx.find(conflictHash)->GetTx(), MemPoolRemovalReason::CONFLICT);
         }
     }
+    // Owner key IDs and Platform node IDs share one uniqueness namespace in the masternode list
+    if (mapProTxPlatformNodeIDs.count(keyId)) {
+        uint256 conflictHash = mapProTxPlatformNodeIDs[keyId];
+        if (conflictHash != tx.GetHash() && mapTx.count(conflictHash)) {
+            removeRecursive(mapTx.find(conflictHash)->GetTx(), MemPoolRemovalReason::CONFLICT);
+        }
+    }
 }
 
 void CTxMemPool::removeProTxPubKeyConflicts(const CTransaction &tx, const CBLSLazyPublicKey &pubKey)
@@ -939,6 +946,13 @@ void CTxMemPool::removeProTxPlatformNodeIDConflicts(const CTransaction &tx, cons
             removeRecursive(mapTx.find(conflictHash)->GetTx(), MemPoolRemovalReason::CONFLICT);
         }
     }
+    // Owner key IDs and Platform node IDs share one uniqueness namespace in the masternode list
+    if (mapProTxPubKeyIDs.count(CKeyID{platformNodeID})) {
+        uint256 conflictHash = mapProTxPubKeyIDs[CKeyID{platformNodeID}];
+        if (conflictHash != tx.GetHash() && mapTx.count(conflictHash)) {
+            removeRecursive(mapTx.find(conflictHash)->GetTx(), MemPoolRemovalReason::CONFLICT);
+        }
+    }
 }
 
 void CTxMemPool::removeProTxCollateralConflicts(const CTransaction &tx, const COutPoint &collateralOutpoint)
@@ -1396,6 +1410,12 @@ bool CTxMemPool::existsProviderTxConflict(const CTransaction &tx) const {
         return false;
     };
 
+    // Owner key IDs and Platform node IDs share one uniqueness namespace in the masternode list
+    auto isOwnerOrPlatformNodeIDClaimed = [&](const uint160& id) EXCLUSIVE_LOCKS_REQUIRED(cs) {
+        AssertLockHeld(cs);
+        return mapProTxPubKeyIDs.count(CKeyID{id}) || mapProTxPlatformNodeIDs.count(id);
+    };
+
     const uint256 tx_hash{tx.GetHash()};
     if (tx.nType == TRANSACTION_PROVIDER_REGISTER) {
         const auto opt_proTx = GetTxPayload<CProRegTx>(tx);
@@ -1409,10 +1429,10 @@ bool CTxMemPool::existsProviderTxConflict(const CTransaction &tx) const {
                 return true;
             }
         }
-        if (mapProTxPubKeyIDs.count(proTx.keyIDOwner) || mapProTxBlsPubKeyHashes.count(proTx.pubKeyOperator.GetHash())) {
+        if (isOwnerOrPlatformNodeIDClaimed(proTx.keyIDOwner) || mapProTxBlsPubKeyHashes.count(proTx.pubKeyOperator.GetHash())) {
             return true;
         }
-        if (proTx.nType == MnType::Evo && !proTx.platformNodeID.IsNull() && mapProTxPlatformNodeIDs.count(proTx.platformNodeID)) {
+        if (proTx.nType == MnType::Evo && !proTx.platformNodeID.IsNull() && isOwnerOrPlatformNodeIDClaimed(proTx.platformNodeID)) {
             return true;
         }
         if (!proTx.collateralOutpoint.hash.IsNull()) {
@@ -1451,6 +1471,9 @@ bool CTxMemPool::existsProviderTxConflict(const CTransaction &tx) const {
             if (it != mapProTxPlatformNodeIDs.end() && it->second != opt_proTx->proTxHash) {
                 return true;
             }
+            if (mapProTxPubKeyIDs.count(CKeyID{opt_proTx->platformNodeID})) {
+                return true;
+            }
         }
         // Conflict with a replacement ProRegTx that reuses this MN's external collateral.
         if (auto dmn = dmnman->GetListAtChainTip().GetMN(opt_proTx->proTxHash)) {

From b4cd3fa7677a395ffaa72160a91cf8ef917c2f54 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 02:27:06 +0000
Subject: [PATCH 33/51] fix(evo): only write credit pool snapshots inside a
 block-scoped EvoDB transaction (#7549)

CCreditPoolManager::AddToCache wrote a disk snapshot of every 576th
height's pool. When that pool was first constructed outside a block
connection, e.g. by getassetunlockstatuses (which Drive calls with the
chainlocked height while withdrawals are pending), block template
creation or mempool acceptance, the write landed in the current EvoDB
transaction outside any CEvoDBScopedCommitter. The next root commit
(a periodic flush between blocks) then hit assert(curDBTransaction.
IsClean()) and aborted the node. On mainnet this takes down every
evonode serving Platform at the same 576-block boundaries.

Track the open block-scoped transaction in CEvoDB (a depth counter
maintained by BeginTransaction and the committer's commit/rollback,
plus the thread that opened it) and expose HasActiveTransaction().
Skip the optional snapshot write when no transaction is open on the
calling thread, and write it instead from the first transaction-scoped
lookup that hits the cached pool, so block connection still persists
it. A skipped snapshot is only an optimization loss; it is
reconstructed from an earlier one.

Hand-port of the #7549 fix that develop carries inside #7639
(8503c5d211 and 0325195ecb). v23.1.x's CEvoDB has no active-transaction
tracking (develop got it from the AssumeUTXO per-chainstate EvoDB
rework), so a minimal equivalent is added here; v23 also writes with
plain Write() rather than WriteDerived(). The unit test is develop's
credit_pool_snapshot_persisted_after_transactionless_construction,
extended to check directly that a transaction-less lookup at a snapshot
height leaves the current EvoDB transaction clean (it fails before
this change).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

v23.1.x adaptation: the test reaches the credit-pool manager through the public CChainstateHelper::GetCreditPool passthrough (the credit_pool_manager member is private on v23.1.x).
---
 src/evo/creditpool.cpp            | 35 ++++++++++++++++----------
 src/evo/creditpool.h              |  3 +++
 src/evo/evodb.cpp                 |  5 ++++
 src/evo/evodb.h                   | 21 +++++++++++++++-
 src/test/evo_assetlocks_tests.cpp | 41 +++++++++++++++++++++++++++++++
 5 files changed, 91 insertions(+), 14 deletions(-)

diff --git a/src/evo/creditpool.cpp b/src/evo/creditpool.cpp
index 287560d936ac..ec26f6525a75 100644
--- a/src/evo/creditpool.cpp
+++ b/src/evo/creditpool.cpp
@@ -121,11 +121,13 @@ std::optional<CCreditPool> CCreditPoolManager::GetFromCache(const CBlockIndex& b
 
     const uint256 block_hash = block_index.GetBlockHash();
     CCreditPool pool;
-    {
-        LOCK(cache_mutex);
-        if (creditPoolCache.get(block_hash, pool)) {
-            return pool;
-        }
+    if (WITH_LOCK(cache_mutex, return creditPoolCache.get(block_hash, pool))) {
+        // The pool may have been constructed, and cached, outside a block-scoped transaction
+        // (mempool acceptance, template creation, RPC), where its snapshot cannot be written.
+        // Persist it from the first transaction-scoped lookup instead, or the snapshot would be
+        // lost for good: block connection only sees the cache hit and never constructs it again.
+        MaybeWriteSnapshot(block_hash, block_index.nHeight, pool);
+        return pool;
     }
     if (block_index.nHeight % DISK_SNAPSHOT_PERIOD == 0) {
         if (evoDb.Read(std::make_pair(DB_CREDITPOOL_SNAPSHOT, block_hash), pool)) {
@@ -137,15 +139,22 @@ std::optional<CCreditPool> CCreditPoolManager::GetFromCache(const CBlockIndex& b
     return std::nullopt;
 }
 
-void CCreditPoolManager::AddToCache(const uint256& block_hash, int height, const CCreditPool &pool)
+void CCreditPoolManager::MaybeWriteSnapshot(const uint256& block_hash, int height, const CCreditPool& pool)
 {
-    {
-        LOCK(cache_mutex);
-        creditPoolCache.insert(block_hash, pool);
-    }
-    if (height % DISK_SNAPSHOT_PERIOD == 0) {
-        evoDb.Write(std::make_pair(DB_CREDITPOOL_SNAPSHOT, block_hash), pool);
-    }
+    // The disk snapshot is an optimization; skip it outside a block-scoped EvoDB transaction
+    // (e.g. a pool constructed on a cold cache during mempool acceptance, template creation or
+    // an RPC such as getassetunlockstatuses), where the write would never be committed and would
+    // trip the clean-transaction assertion at the next root commit. GetFromCache() writes it
+    // once a transaction-scoped lookup hits the cached pool.
+    if (height % DISK_SNAPSHOT_PERIOD != 0 || !evoDb.HasActiveTransaction()) return;
+    evoDb.Write(std::make_pair(DB_CREDITPOOL_SNAPSHOT, block_hash), pool);
+}
+
+void CCreditPoolManager::AddToCache(const uint256& block_hash, int height, const CCreditPool& pool)
+{
+    MaybeWriteSnapshot(block_hash, height, pool);
+    LOCK(cache_mutex);
+    creditPoolCache.insert(block_hash, pool);
 }
 
 CCreditPool CCreditPoolManager::ConstructCreditPool(const gsl::not_null<const CBlockIndex*> block_index, CCreditPool prev)
diff --git a/src/evo/creditpool.h b/src/evo/creditpool.h
index e3eb066ecd75..46e19beb7165 100644
--- a/src/evo/creditpool.h
+++ b/src/evo/creditpool.h
@@ -142,6 +142,9 @@ class CCreditPoolManager
 private:
     std::optional<CCreditPool> GetFromCache(const CBlockIndex& block_index) EXCLUSIVE_LOCKS_REQUIRED(!cache_mutex);
     void AddToCache(const uint256& block_hash, int height, const CCreditPool& pool) EXCLUSIVE_LOCKS_REQUIRED(!cache_mutex);
+    /** Write the disk snapshot of a snapshot-height pool when a block-scoped EvoDB transaction
+     *  is open on this thread; a no-op otherwise. */
+    void MaybeWriteSnapshot(const uint256& block_hash, int height, const CCreditPool& pool);
 
     CCreditPool ConstructCreditPool(const gsl::not_null<const CBlockIndex*> block_index, CCreditPool prev)
         EXCLUSIVE_LOCKS_REQUIRED(!cache_mutex);
diff --git a/src/evo/evodb.cpp b/src/evo/evodb.cpp
index c387d5e313c6..f3a5fc6b7416 100644
--- a/src/evo/evodb.cpp
+++ b/src/evo/evodb.cpp
@@ -5,6 +5,7 @@
 #include <evo/evodb.h>
 
 #include <uint256.h>
+#include <util/check.h>
 
 CEvoDBScopedCommitter::CEvoDBScopedCommitter(CEvoDB &_evoDB) :
     evoDB(_evoDB)
@@ -45,12 +46,16 @@ void CEvoDB::CommitCurTransaction()
 {
     LOCK(cs);
     curDBTransaction.Commit();
+    Assume(m_transaction_depth > 0);
+    --m_transaction_depth;
 }
 
 void CEvoDB::RollbackCurTransaction()
 {
     LOCK(cs);
     curDBTransaction.Clear();
+    Assume(m_transaction_depth > 0);
+    --m_transaction_depth;
 }
 
 bool CEvoDB::CommitRootTransaction()
diff --git a/src/evo/evodb.h b/src/evo/evodb.h
index 38c6662633df..6982363eafe7 100644
--- a/src/evo/evodb.h
+++ b/src/evo/evodb.h
@@ -8,6 +8,8 @@
 #include <dbwrapper.h>
 #include <sync.h>
 
+#include <thread>
+
 class uint256;
 namespace util {
 struct DbWrapperParams;
@@ -38,7 +40,7 @@ class CEvoDBScopedCommitter
 class CEvoDB
 {
 public:
-    Mutex cs;
+    mutable Mutex cs;
 private:
     std::unique_ptr<CDBWrapper> db;
 
@@ -49,6 +51,10 @@ class CEvoDB
     RootTransaction rootDBTransaction;
     CurTransaction curDBTransaction;
 
+    //! Open CEvoDBScopedCommitter scopes, and the thread that opened the outermost one
+    int m_transaction_depth GUARDED_BY(cs){0};
+    std::thread::id m_transaction_thread GUARDED_BY(cs);
+
 public:
     CEvoDB() = delete;
     CEvoDB(const CEvoDB&) = delete;
@@ -59,9 +65,22 @@ class CEvoDB
     std::unique_ptr<CEvoDBScopedCommitter> BeginTransaction() EXCLUSIVE_LOCKS_REQUIRED(!cs)
     {
         LOCK(cs);
+        if (m_transaction_depth++ == 0) {
+            m_transaction_thread = std::this_thread::get_id();
+        }
         return std::make_unique<CEvoDBScopedCommitter>(*this);
     }
 
+    /** Whether a block-scoped transaction is open on this thread. Writes performed outside one
+     *  are never committed and trip the clean-transaction assertion at the next root commit, so
+     *  callers reachable from transaction-less contexts (mempool acceptance, mining, RPC) must
+     *  skip optional persistence when this is false. */
+    bool HasActiveTransaction() const EXCLUSIVE_LOCKS_REQUIRED(!cs)
+    {
+        LOCK(cs);
+        return m_transaction_depth > 0 && m_transaction_thread == std::this_thread::get_id();
+    }
+
     CurTransaction& GetCurTransaction() EXCLUSIVE_LOCKS_REQUIRED(cs)
     {
         AssertLockHeld(cs); // lock must be held from outside as long as the DB transaction is used
diff --git a/src/test/evo_assetlocks_tests.cpp b/src/test/evo_assetlocks_tests.cpp
index d21e8df73a03..2a04d8067ab5 100644
--- a/src/test/evo_assetlocks_tests.cpp
+++ b/src/test/evo_assetlocks_tests.cpp
@@ -7,7 +7,11 @@
 #include <consensus/amount.h>
 #include <consensus/tx_check.h>
 #include <consensus/validation.h>
+#include <deploymentstatus.h>
 #include <evo/assetlocktx.h>
+#include <evo/chainhelper.h>
+#include <evo/creditpool.h>
+#include <evo/evodb.h>
 #include <evo/specialtx.h>
 #include <llmq/context.h>
 #include <policy/settings.h>
@@ -406,4 +410,41 @@ BOOST_FIXTURE_TEST_CASE(evo_assetunlock, TestChain100Setup)
 
 }
 
+BOOST_FIXTURE_TEST_CASE(credit_pool_snapshot_persisted_after_transactionless_construction, TestChain100Setup)
+{
+    // getassetunlockstatuses, block assembly and mempool acceptance ask for a credit pool outside any
+    // block-scoped EvoDB transaction. At a snapshot height that constructs and caches the pool, and
+    // must not write its disk snapshot: the write would sit uncommitted in the current EvoDB
+    // transaction and abort the node on the IsClean() assertion at the next root commit. The next
+    // block connection hits the cached pool, so it must persist the snapshot then, or the snapshot
+    // is lost and every restart reconstructs the pool from an older one.
+    constexpr int SNAPSHOT_HEIGHT{576}; // CCreditPoolManager::DISK_SNAPSHOT_PERIOD
+    const CScript coinbase_pk = GetScriptForRawPubKey(coinbaseKey.GetPubKey());
+    const auto tip = [&]() { return WITH_LOCK(cs_main, return m_node.chainman->ActiveChain().Tip()); };
+    while (tip()->nHeight < SNAPSHOT_HEIGHT) {
+        CreateAndProcessBlock({}, coinbase_pk);
+    }
+    const CBlockIndex* snapshot_index = tip();
+    BOOST_REQUIRE_EQUAL(snapshot_index->nHeight, SNAPSHOT_HEIGHT);
+    BOOST_REQUIRE(WITH_LOCK(cs_main, return DeploymentActiveAt(*snapshot_index, m_node.chainman->GetConsensus(),
+                                                               Consensus::DEPLOYMENT_V20)));
+    const auto snapshot_key = std::make_pair(std::string{"cpm_S"}, snapshot_index->GetBlockHash());
+    BOOST_REQUIRE(!m_node.evodb->Exists(snapshot_key));
+
+    // A transaction-less lookup, as getassetunlockstatuses does, constructs the pool without
+    // leaving an uncommitted write behind.
+    BOOST_REQUIRE(!m_node.evodb->HasActiveTransaction());
+    const CCreditPool pool = m_node.chain_helper->GetCreditPool(snapshot_index);
+    BOOST_CHECK(!m_node.evodb->Exists(snapshot_key));
+    BOOST_CHECK(WITH_LOCK(m_node.evodb->cs, return m_node.evodb->GetCurTransaction().IsClean()));
+
+    // Connecting the next block persists the snapshot from the cached pool.
+    CreateAndProcessBlock({}, coinbase_pk);
+    CCreditPool snapshot;
+    BOOST_REQUIRE(m_node.evodb->Read(snapshot_key, snapshot));
+    BOOST_CHECK_EQUAL(snapshot.locked, pool.locked);
+    BOOST_CHECK_EQUAL(snapshot.currentLimit, pool.currentLimit);
+    BOOST_CHECK(WITH_LOCK(m_node.evodb->cs, return m_node.evodb->GetCurTransaction().IsClean()));
+}
+
 BOOST_AUTO_TEST_SUITE_END()

From 0d2e5791f093d999340fb68c62440f4af722a8fc Mon Sep 17 00:00:00 2001
From: Konstantin Akimov <github@knstqq.com>
Date: Thu, 15 Oct 2026 17:19:34 +0700
Subject: [PATCH 34/51] fix(evo): keep -allowprivatenet out of masternode
 address validation

MnNetInfo and ExtNetInfo reject unroutable addresses on networks with fRequireRoutableExternalIP through CNetAddr::IsRoutable(), which consults the node-local fAllowPrivateNet flag. A mainnet or testnet node started with -allowprivatenet=1 therefore accepted a ProTx carrying an RFC1918 address that every other node rejects, and would follow a different chain on such a block.

Check IsRFC1918() explicitly next to IsRoutable(), so the result no longer depends on the option. Nodes without the option already behaved this way.

Backport of the consensus-relevant part of dashpay/dash#7888 (this commit
only; the V24-gated ExtNetInfo/v3 ProTx parts are not taken). Source
applied cleanly; the test conflict is only the develop-only
provider_network_fields_main case, which is dropped.

(cherry picked from commit e3e780801b56053185721b29f1dace19d79fe9c1)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 src/evo/netinfo.cpp            |  4 ++--
 src/test/evo_netinfo_tests.cpp | 13 ++++++++++++-
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/evo/netinfo.cpp b/src/evo/netinfo.cpp
index cdd376120fd4..658e5c2bbfcf 100644
--- a/src/evo/netinfo.cpp
+++ b/src/evo/netinfo.cpp
@@ -285,7 +285,7 @@ NetInfoStatus MnNetInfo::ValidateService(const CService& service)
     if (!service.IsIPv4()) {
         return NetInfoStatus::BadType;
     }
-    if (Params().RequireRoutableExternalIP() && !service.IsRoutable()) {
+    if (Params().RequireRoutableExternalIP() && (service.IsRFC1918() || !service.IsRoutable())) {
         return NetInfoStatus::NotRoutable;
     }
 
@@ -451,7 +451,7 @@ NetInfoStatus ExtNetInfo::ValidateService(const CService& service)
     if (!service.IsCJDNS() && !service.IsI2P() && !service.IsIPv4() && !service.IsIPv6() && !service.IsTor()) {
         return NetInfoStatus::BadType;
     }
-    if (Params().RequireRoutableExternalIP() && !service.IsRoutable()) {
+    if (Params().RequireRoutableExternalIP() && (service.IsRFC1918() || !service.IsRoutable())) {
         return NetInfoStatus::NotRoutable;
     }
     const uint16_t service_port{service.GetPort()};
diff --git a/src/test/evo_netinfo_tests.cpp b/src/test/evo_netinfo_tests.cpp
index 5302ffd9328e..6203b56b338b 100644
--- a/src/test/evo_netinfo_tests.cpp
+++ b/src/test/evo_netinfo_tests.cpp
@@ -38,8 +38,9 @@ static const std::vector<TestEntry> addr_vals_main{
     // - Non-mainnet port on mainnet causes failure in MnNetInfo
     // - ExtNetInfo is indifferent to choice of port unless it's a bad port which 9998 isn't
     {{NetInfoPurpose::CORE_P2P, "1.1.1.1:9998"}, NetInfoStatus::BadPort, NetInfoStatus::Success},
-    // Internal addresses not allowed on mainnet
+    // Internal and private addresses not allowed on mainnet
     {{NetInfoPurpose::CORE_P2P, "127.0.0.1:9999"}, NetInfoStatus::NotRoutable, NetInfoStatus::NotRoutable},
+    {{NetInfoPurpose::CORE_P2P, "10.0.0.1:9999"}, NetInfoStatus::NotRoutable, NetInfoStatus::NotRoutable},
     // Valid IPv4 formatting but invalid IPv4 address
     {{NetInfoPurpose::CORE_P2P, "0.0.0.0:9999"}, NetInfoStatus::BadAddress, NetInfoStatus::BadAddress},
     // Port greater than uint16_t max
@@ -140,6 +141,16 @@ BOOST_AUTO_TEST_CASE(mnnetinfo_rules_main)
 
 BOOST_AUTO_TEST_CASE(extnetinfo_rules_main) { TestExtNetInfo(addr_vals_main); }
 
+BOOST_AUTO_TEST_CASE(netinfo_rules_main_allowprivatenet)
+{
+    // -allowprivatenet widens CNetAddr::IsRoutable() to RFC1918 addresses; a node-local option
+    // must not change which masternode addresses pass consensus validation
+    fAllowPrivateNet = true;
+    TestMnNetInfo(addr_vals_main);
+    TestExtNetInfo(addr_vals_main);
+    fAllowPrivateNet = DEFAULT_ALLOWPRIVATENET;
+}
+
 static const std::vector<TestEntry> addr_vals_reg{
     // - MnNetInfo doesn't mind using port 0
     // - ExtNetInfo requires non-zero ports

From 5f73355d97905f7e07ddeeec53641038a0a8a753 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 15 Oct 2026 10:13:09 -0500
Subject: [PATCH 35/51] Merge #7858: fix: do not InstantSend-lock provider
 transactions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

18484d1bc7f55f90f179e06f9ad3263429892a6f fix(instantsend): forget the seen time of txs that are no longer tracked (pasta)
09703a49ed64e175728cb54677aa22d78dea8df1 doc: add release note for #7858 (pasta)
8fa5ae44c64fc674cd4b52cabf867fefdd2c7d57 fix(instantsend): do not lock provider transactions (pasta)
2f33a238215492714e8c674d43bc533503b3bdb3 test: sync mempools before burying a tx (pasta)

Pull request description:

  ## Issue being fixed or feature implemented
  Provider transactions (ProRegTx, ProUpServTx, ProUpRegTx, ProUpRevTx and the new v24 provider types) can be removed from the mempool for conflicts that are not input conflicts: a duplicate collateral, owner/operator key, service address or proTxHash. An InstantSend lock on such a transaction therefore can't be relied on the way a lock on a normal transaction can. Masternodes should stop locking them.

  ## What was done?
  - `CheckCanLock(tx)` refuses all provider special transaction types, so masternodes no longer cast input-lock votes for them, and `TrySignInstantSendLock` won't sign an islock for one even when the input sigs were recovered by other signers.
  - A provider transaction that isn't locked is an unlocked parent like any other, so transactions spending its outputs become lockable once it is mined. A provider transaction that still gets a lock from signers without this change keeps it, and its children stay lockable as they are today.
  - This only changes what masternodes sign. Islocks for provider transactions received from other signers are still processed as before, so nodes that upgrade and nodes that don't keep the same view of locks during the transition.
  - Provider transactions are now confirmed the way unlocked transactions already are: miners include them after they have been in the mempool for 10 minutes, and the block is ChainLocked once its transactions are old enough. Mined provider transactions are not retroactively locked either, so if signers first see a provider transaction in a block, the ChainLock on that block waits for the same 10 minutes. This is a deliberate tradeoff.
  - With StatsD or `-debug=instantsend` active, the time a transaction was first seen is now forgotten once it stops being tracked. Before, a transaction that was mined without a lock and then ChainLocked kept its entry until restart, and every provider transaction now takes that path. #7839 already dropped the entry when a transaction leaves the mempool.
  - `bury_tx` in the test framework now syncs mempools before bumping mocktime. ChainLock signers measure a transaction's age from when they first saw it, so a provider transaction relayed after the bump would hold up ChainLocks in tests now that it isn't locked.

  ## How Has This Been Tested?
  - New `test_provider_tx_not_locked` case in `p2p_instantsend.py`: a ProUpServTx is not locked on any node while a later normal transaction is, and once it is mined after 10 minutes the block is ChainLocked. The case fails without the `signing.cpp` change (the ProTx gets locked) and passes with it.
  - Ran locally on macOS (arm64): p2p_instantsend.py, feature_llmq_chainlocks.py, feature_llmq_is_retroactive.py, feature_dip3_deterministicmns.py, feature_asset_locks.py, feature_masternode_payout_shares.py, feature_protx_version.py, feature_evo_shares_activation.py, feature_llmq_evo.py, feature_llmq_signing.py (with and without --spork21), feature_llmq_singlenode.py, feature_masternode_shares.py, p2p_platform_ban.py, rpc_netinfo.py, rpc_masternode.py, wallet_dash_rpcs.py, feature_llmq_simplepose.py (with and without --disable-spork23). feature_llmq_chainlocks.py failed before the `bury_tx` change and passes with it.
  - After rebasing onto develop with #7839, reran the full unit suite and p2p_instantsend.py, feature_llmq_is_retroactive.py, feature_asset_locks.py, feature_llmq_chainlocks.py, feature_llmq_is_cl_conflicts.py, interface_zmq_dash.py, feature_dip3_deterministicmns.py and mempool_limit.py; all pass. The seen-time map has no public accessor, so it has no unit test; functional tests run with `-debug`, so the code path is active in them.

  ## Breaking Changes
  Provider transactions no longer receive InstantSend locks from upgraded masternodes and take about 10 minutes to be mined and ChainLocked. Software that waits for an islock on a provider transaction should wait for a ChainLock or confirmations instead. There are no consensus changes.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [x] I have made corresponding changes to the documentation (release note)
  - [x] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

ACKs for top commit:
  knst:
    utACK 18484d1bc7f55f90f179e06f9ad3263429892a6f

Tree-SHA512: 9891883263ab67152d751765fd6270ea634c195a1757150c3ea162614706fbbddce78adf59d456572416965f67515084122af65de68da16cf26cea684913ac24
(cherry picked from commit a5e863a6235b46a8af14d03e68ed57ea1088d236)

v23.1.x adaptation: the C++ fix is mapped onto the v23 signing path.
IsProviderTx lists only the four provider special-tx types that exist on
v23.1.x (ProRegTx/ProUpServTx/ProUpRegTx/ProUpRevTx); the v24-only
TRANSACTION_PROVIDER_DISSOLVE/UPDATE_SHARE/UPDATE_SHARED_REGISTRAR enum values
do not exist here and are omitted. Develop's IsPlatformTransfer asset-unlock
branch of CheckCanLock and the manager member RemoveConfirmedInstantSendLocks
are absent on v23.1.x, so only the IsProviderTx guard was added to
CheckCanLock/TrySignInstantSendLock, and the !cs_timingsTxSeen annotation was
applied to RemoveNonLockedTx and its v23 wrapper HandleFullyConfirmedBlock.

The functional test test_provider_tx_not_locked is ported to v23.1.x shapes:
wait_for_instantlock takes (txid, node) here and does not bump mocktime or sync
on its own, so each wait is preceded by bump_mocktime(30) + sync_mempools and
runs per node; develop's DashTestFramework.bury_tx does not exist on v23.1.x
(the v23 bury_tx is an unrelated MasternodeInfo helper), so the bury-and-wait
step is inlined with sync_mempools + bump_mocktime(10*60+1) + generate +
wait_for_chainlocked_block. The develop-only test_isdlock_relayed_to_recsigs_observer
case does not exist here. The case fails without the signing.cpp change (the
ProTx gets an islock) and passes with it.
---
 doc/release-notes-7858.md          |  7 +++++++
 src/instantsend/instantsend.cpp    |  2 ++
 src/instantsend/instantsend.h      |  4 ++--
 src/instantsend/signing.cpp        | 25 +++++++++++++++++++++++++
 test/functional/p2p_instantsend.py | 27 +++++++++++++++++++++++++++
 5 files changed, 63 insertions(+), 2 deletions(-)
 create mode 100644 doc/release-notes-7858.md

diff --git a/doc/release-notes-7858.md b/doc/release-notes-7858.md
new file mode 100644
index 000000000000..c751ac8d1146
--- /dev/null
+++ b/doc/release-notes-7858.md
@@ -0,0 +1,7 @@
+InstantSend changes
+-------------------
+
+- Masternodes no longer InstantSend-lock provider transactions (ProRegTx, ProUpServTx, ProUpRegTx, ProUpRevTx and the
+  other provider special transactions). They are mined once they have been in the mempool for 10 minutes and are then
+  ChainLocked; transactions that spend their outputs can be locked once they are mined. Software that waits for an
+  islock on a provider transaction should wait for a ChainLock or confirmations instead. (#7858)
diff --git a/src/instantsend/instantsend.cpp b/src/instantsend/instantsend.cpp
index 8d39697608bd..4e7dc1355875 100644
--- a/src/instantsend/instantsend.cpp
+++ b/src/instantsend/instantsend.cpp
@@ -389,6 +389,8 @@ void CInstantSendManager::RemoveNonLockedTx(const uint256& txid, bool retryChild
     }
 
     nonLockedTxs.erase(it);
+    // A tx that is no longer tracked won't be locked, so its seen time would never be consumed
+    WITH_LOCK(cs_timingsTxSeen, timingsTxSeen.erase(txid));
 
     LogPrint(BCLog::INSTANTSEND, "CInstantSendManager::%s -- txid=%s, retryChildren=%d, retryChildrenCount=%d\n",
              __func__, txid.ToString(), retryChildren, retryChildrenCount);
diff --git a/src/instantsend/instantsend.h b/src/instantsend/instantsend.h
index 9b6dea2bb83b..6f15ca8d6571 100644
--- a/src/instantsend/instantsend.h
+++ b/src/instantsend/instantsend.h
@@ -139,7 +139,7 @@ class CInstantSendManager final : public instantsend::InstantSendSignerParent
     void AddNonLockedTx(const CTransactionRef& tx, const CBlockIndex* pindexMined)
         EXCLUSIVE_LOCKS_REQUIRED(!cs_nonLocked, !cs_pendingLocks, !cs_timingsTxSeen);
     void RemoveNonLockedTx(const uint256& txid, bool retryChildren)
-        EXCLUSIVE_LOCKS_REQUIRED(!cs_nonLocked, !cs_pendingRetry);
+        EXCLUSIVE_LOCKS_REQUIRED(!cs_nonLocked, !cs_pendingRetry, !cs_timingsTxSeen);
     void RemoveConflictedTx(const CTransaction& tx)
         EXCLUSIVE_LOCKS_REQUIRED(!cs_nonLocked, !cs_pendingRetry);
     void TruncateRecoveredSigsForInputs(const instantsend::InstantSendLock& islock);
@@ -150,7 +150,7 @@ class CInstantSendManager final : public instantsend::InstantSendSignerParent
         EXCLUSIVE_LOCKS_REQUIRED(!cs_nonLocked, !cs_pendingLocks, !cs_pendingRetry, !cs_height_cache);
 
     void HandleFullyConfirmedBlock(const CBlockIndex* pindex)
-        EXCLUSIVE_LOCKS_REQUIRED(!cs_nonLocked, !cs_pendingRetry);
+        EXCLUSIVE_LOCKS_REQUIRED(!cs_nonLocked, !cs_pendingRetry, !cs_timingsTxSeen);
 
 public:
     bool IsLocked(const uint256& txHash) const override;
diff --git a/src/instantsend/signing.cpp b/src/instantsend/signing.cpp
index 40dcc58d7589..c6d167b7bebb 100644
--- a/src/instantsend/signing.cpp
+++ b/src/instantsend/signing.cpp
@@ -28,6 +28,22 @@ using node::fReindex;
 using node::GetTransaction;
 
 namespace instantsend {
+namespace {
+bool IsProviderTx(const CTransaction& tx)
+{
+    if (!tx.IsSpecialTxVersion()) return false;
+    switch (tx.nType) {
+    case TRANSACTION_PROVIDER_REGISTER:
+    case TRANSACTION_PROVIDER_UPDATE_SERVICE:
+    case TRANSACTION_PROVIDER_UPDATE_REGISTRAR:
+    case TRANSACTION_PROVIDER_UPDATE_REVOKE:
+        return true;
+    default:
+        return false;
+    }
+}
+} // anonymous namespace
+
 InstantSendSigner::InstantSendSigner(CChainState& chainstate, const chainlock::Chainlocks& chainlocks,
                                      InstantSendSignerParent& isman, llmq::CSigningManager& sigman,
                                      llmq::CSigSharesManager& shareman, llmq::CQuorumManager& qman,
@@ -165,6 +181,13 @@ void InstantSendSigner::ProcessPendingRetryLockTxs(const std::vector<CTransactio
 
 bool InstantSendSigner::CheckCanLock(const CTransaction& tx, bool printDebug, const Consensus::Params& params) const
 {
+    if (IsProviderTx(tx)) {
+        if (printDebug) {
+            LogPrint(BCLog::INSTANTSEND, "%s -- txid=%s: provider txs are not locked\n", __func__,
+                     tx.GetHash().ToString());
+        }
+        return false;
+    }
     if (tx.vin.empty()) {
         // can't lock TXs without inputs (e.g. quorum commitments)
         return false;
@@ -354,6 +377,8 @@ bool InstantSendSigner::TrySignInputLocks(const CTransaction& tx, bool fRetroact
 
 void InstantSendSigner::TrySignInstantSendLock(const CTransaction& tx)
 {
+    if (IsProviderTx(tx)) return;
+
     const auto llmqType = Params().GetConsensus().llmqTypeDIP0024InstantSend;
 
     for (const auto& in : tx.vin) {
diff --git a/test/functional/p2p_instantsend.py b/test/functional/p2p_instantsend.py
index b92d563f9abc..70c433d749ae 100755
--- a/test/functional/p2p_instantsend.py
+++ b/test/functional/p2p_instantsend.py
@@ -36,6 +36,7 @@ def run_test(self):
 
         self.test_mempool_doublespend()
         self.test_block_doublespend()
+        self.test_provider_tx_not_locked()
 
     def test_block_doublespend(self):
         sender = self.nodes[self.sender_idx]
@@ -143,5 +144,31 @@ def test_mempool_doublespend(self):
         # mine more blocks
         self.generate(self.nodes[0], 2)
 
+    def test_provider_tx_not_locked(self):
+        self.log.info("Provider txs are not locked, but are mined and ChainLocked once safe")
+        node = self.nodes[0]
+        funds_addr = node.getnewaddress()
+        fund_id = node.sendtoaddress(funds_addr, 1)
+        self.bump_mocktime(30)
+        self.sync_mempools()
+        for n in self.nodes:
+            self.wait_for_instantlock(fund_id, n)
+
+        protx_id = self.mninfo[0].update_service(node, submit=True, fundsAddr=funds_addr)
+        later_id = node.sendtoaddress(node.getnewaddress(), 1)
+        self.bump_mocktime(30)
+        self.sync_mempools()
+        for n in self.nodes:
+            self.wait_for_instantlock(later_id, n)
+        for n in self.nodes:
+            assert not n.getrawtransaction(protx_id, True)["instantlock_internal"]
+
+        # An unlocked provider tx is mined like any other unlocked tx: after it has been in
+        # the mempool for 10 minutes, and the block is ChainLocked once its txs are old enough.
+        self.sync_mempools()
+        self.bump_mocktime(10 * 60 + 1)
+        tip = self.generate(node, 1)[0]
+        self.wait_for_chainlocked_block(node, tip)
+
 if __name__ == '__main__':
     InstantSendTest().main()

From 14dddb1bef20ff36c06437b40cd4e96e788df441 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 8 Oct 2026 19:02:48 -0500
Subject: [PATCH 36/51] Merge #7838: fix(wallet): authenticate unlock deadline
 extensions
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

86ba039389367344463abc8537824606eec43443 fix(wallet): authenticate unlock deadline extensions (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `CWallet::Unlock(SecureString)` returned `true` without checking the passphrase whenever the encrypted wallet was already fully unlocked. `walletpassphrase` treats that result as authentication and replaces the relock deadline and timer. So while a wallet is fully unlocked, a caller allowed to use `walletpassphrase` could keep it unlocked past the owner's deadline with any nonempty wrong passphrase. Spending or exporting keys after the original deadline still needs those RPC permissions too. A locked or mixing-only wallet cannot be unlocked this way, and RPC authentication is not bypassed.

  The early return is Dash-specific (added in 78c5ca53f6ff, blocked in 0.12.1, reintroduced by ff5540bf7301 in 0.16.0.0). Bitcoin Core decrypts the master key on every `Unlock`.

  ## What was done?

  - Removed the early return. Every request on an encrypted wallet now derives the key from the passphrase and decrypts the master key, as Bitcoin Core does.
  - When a master key is already held (full or mixing-only unlock), the decrypted candidate must match it, compared with `TimingResistantEqual`. A mismatch moves on to the next master-key entry.
    - This matters because the already-unlocked path skips `CheckDecryptionKey`, and a blank wallet passes that check trivially. Without the comparison, a wrong passphrase that happens to produce valid padding would still be accepted.
  - An authenticated request on a fully unlocked wallet is a no-op success. The metadata and descriptor-cache upgrades are not repeated.
  - The mixing-only → full upgrade path is unchanged, and so are the RPC timer logic, full → mixing rejection and the unencrypted-wallet result.

  ## How Has This Been Tested?

  macOS arm64, depends build.

  - **Regression test.** `wallet_encryption.py` now ends with one deterministic check under the mocktime the test already sets: with the wallet fully unlocked for 100 seconds, `walletpassphrase` with a wrong passphrase and a 1000-second timeout fails with `-14`, and `unlocked_until` does not change. Against an unpatched `wallet.cpp` the check fails ("No exception raised"). With the fix it passes.
  - `wallet_encryption.py --legacy-wallet` and `wallet_encryption.py --descriptors` both pass.
  - `test_dash --run_test=bip39_tests,wallet_crypto_tests` passes, and `lint-python.py` is clean.
  - All `Unlock(SecureString)` callers were checked: Qt unlock dialog and wallet controller, createwallet, EncryptWallet, migration and upgradetohd.

  Limits:
  - The valid-padding mismatch guard was reviewed in the source, not fault-injected. A wrong passphrase gets past decrypt padding only about 1 in 256 times, so a functional test cannot exercise the guard deterministically.
  - A *locked* blank encrypted wallet still accepts about 1 in 256 wrong passphrases. That gap already existed and Bitcoin Core has it too. Closing it needs a stored key check, so it is out of scope here.

  ## Breaking Changes

  None.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

Top commit has no ACKs.

Tree-SHA512: 18f0978db2da05fb2b658b83c0796fafc758859f27cc777d9f7b85196339f0824f128e94ad552feca7b903a3f387de61957e2900ae2995dace349cea9536b190
(cherry picked from commit 26309306348729cb4408f6fe042fb610ea5abf08)
---
 src/wallet/wallet.cpp                | 9 ++++++---
 test/functional/wallet_encryption.py | 7 +++++++
 2 files changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/wallet/wallet.cpp b/src/wallet/wallet.cpp
index 52e8ebb2061f..bf823e3717b2 100644
--- a/src/wallet/wallet.cpp
+++ b/src/wallet/wallet.cpp
@@ -32,6 +32,7 @@
 #include <util/error.h>
 #include <util/moneystr.h>
 #include <util/string.h>
+#include <util/strencodings.h>
 #include <util/translation.h>
 #ifdef USE_BDB
 #include <wallet/bdb.h>
@@ -3733,20 +3734,22 @@ bool CWallet::Lock(bool fAllowMixing)
 
 bool CWallet::Unlock(const SecureString& strWalletPassphrase, bool fForMixingOnly)
 {
-    if (!IsLocked()) // was already fully unlocked, not only for mixing
-        return true;
-
     CCrypter crypter;
     CKeyingMaterial _vMasterKey;
 
     {
         LOCK(cs_wallet);
+        if (!IsCrypted()) return true;
         for (const MasterKeyMap::value_type& pMasterKey : mapMasterKeys)
         {
             if (!crypter.SetKeyFromPassphrase(strWalletPassphrase, pMasterKey.second.vchSalt, pMasterKey.second.nDeriveIterations, pMasterKey.second.nDerivationMethod))
                 return false;
             if (!crypter.Decrypt(pMasterKey.second.vchCryptedKey, _vMasterKey))
                 continue; // try another master key
+            if (!vMasterKey.empty() && !TimingResistantEqual(_vMasterKey, vMasterKey)) {
+                continue;
+            }
+            if (!IsLocked()) return true;
             if (Unlock(_vMasterKey, fForMixingOnly)) {
                 // Now that we've unlocked, upgrade the key metadata
                 UpgradeKeyMetadata();
diff --git a/test/functional/wallet_encryption.py b/test/functional/wallet_encryption.py
index 090970834a0e..714810775b20 100755
--- a/test/functional/wallet_encryption.py
+++ b/test/functional/wallet_encryption.py
@@ -102,6 +102,13 @@ def run_test(self):
         assert self.nodes[0].verifymessage(address, sig, msg)
         self.nodes[0].walletlock()
 
+        self.log.info("Check that a wrong passphrase cannot extend a full unlock")
+        self.nodes[0].walletpassphrase(passphrase_with_nulls, 100)
+        unlocked_until = self.nodes[0].getwalletinfo()['unlocked_until']
+        assert_raises_rpc_error(-14, "wallet passphrase entered", self.nodes[0].walletpassphrase, "incorrect passphrase", 1000)
+        assert_equal(self.nodes[0].getwalletinfo()['unlocked_until'], unlocked_until)
+        self.nodes[0].walletlock()
+
 
 if __name__ == '__main__':
     WalletEncryptionTest().main()

From 71b3f0cf652da3f61af6c295cdc1b81f4c3dfc5c Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Fri, 7 Aug 2026 16:06:28 -0500
Subject: [PATCH 37/51] Merge #7556: fix: gate BLS vote-signature failure log
 behind gobject category

afe5fdac66383209aef1684c85021ae7a7462474 fix: gate BLS vote-signature failure log behind gobject category (pasta)

Pull request description:

  ## Issue being fixed or feature implemented
  In `CGovernanceVote::CheckSignature(const CBLSPublicKey&)` (`src/governance/vote.cpp`), a signature verification failure was logged unconditionally via `LogPrintf` instead of `LogPrint(BCLog::GOBJECT, ...)`, unlike key ID signature verification and the rest of vote validation.
  After PR #7527 (orphan governance votes must pass `GovernanceVote::IsValid` before caching), a peer holding a valid masternode outpoint (public data) plus an invalid BLS signature can reach this path with a vote naming an arbitrary parent hash, producing a `debug.log` line per message without `-debug=gobject` set.

  Similarly, `CGovernanceObject::ProcessVote` (`src/governance/object.cpp`) logged unsupported vote signals and invalid votes via unconditional `LogPrintf`.

  ## What was done?
  Updated the unconditional `LogPrintf` calls in `CGovernanceVote::CheckSignature` and `CGovernanceObject::ProcessVote` to use `LogPrint(BCLog::GOBJECT, ...)`.

  - `src/governance/vote.cpp`: `CGovernanceVote::CheckSignature(const CBLSPublicKey&)`
  - `src/governance/object.cpp`: `CGovernanceObject::ProcessVote` (unsupported vote signal and invalid vote paths)

  ## How Has This Been Tested?
  - Built locally with dependencies prefix.
  - Unit tests (`./src/test/test_dash --run_test="*gov*"`) pass.
  - Log and whitespace linters (`test/lint/lint-logs.py`, `test/lint/lint-whitespace.py`) pass.

  ## Breaking Changes
  None.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have commented my code, particularly in hard-to-understand areas
  - [ ] I have added or updated relevant unit/integration/functional/e2e tests
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

  This pull request was created by Codex.

Top commit has no ACKs.

Tree-SHA512: 99f9fa375dd5ac0d4a21e615938af367650898b3249204956203e3e17965a7e142a40c581bfc93ece8cec999d5064fd41b5443d73c8f453044422a952b20a3a2
(cherry picked from commit 42f92644443e9c10143086034b3c526dab5198ee)
---
 src/governance/object.cpp | 4 ++--
 src/governance/vote.cpp   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/src/governance/object.cpp b/src/governance/object.cpp
index f0cd816a0b7b..29906b72a4d5 100644
--- a/src/governance/object.cpp
+++ b/src/governance/object.cpp
@@ -90,7 +90,7 @@ bool CGovernanceObject::ProcessVote(CMasternodeMetaMan& mn_metaman, CGovernanceM
     if (eSignal < VOTE_SIGNAL_NONE || eSignal >= VOTE_SIGNAL_UNKNOWN) {
         std::string msg{strprintf("CGovernanceObject::%s -- Unsupported vote signal: %s", __func__,
             CGovernanceVoting::ConvertSignalToString(vote.GetSignal()))};
-        LogPrintf("%s\n", msg);
+        LogPrint(BCLog::GOBJECT, "%s\n", msg);
         exception = CGovernanceException(msg, GOVERNANCE_EXCEPTION_PERMANENT_ERROR, 20);
         return false;
     }
@@ -145,7 +145,7 @@ bool CGovernanceObject::ProcessVote(CMasternodeMetaMan& mn_metaman, CGovernanceM
         std::string msg{strprintf("CGovernanceObject::%s -- Invalid vote, MN outpoint = %s, governance object hash = %s, "
                                   "vote hash = %s",
             __func__, vote.GetMasternodeOutpoint().ToStringShort(), GetHash().ToString(), vote.GetHash().ToString())};
-        LogPrintf("%s\n", msg);
+        LogPrint(BCLog::GOBJECT, "%s\n", msg);
         exception = CGovernanceException(msg, GOVERNANCE_EXCEPTION_PERMANENT_ERROR, 20);
         return false;
     }
diff --git a/src/governance/vote.cpp b/src/governance/vote.cpp
index c023c0d89c0c..0af44bfa2f79 100644
--- a/src/governance/vote.cpp
+++ b/src/governance/vote.cpp
@@ -201,7 +201,7 @@ bool CGovernanceVote::CheckSignature(const CBLSPublicKey& pubKey) const
     sig.SetBytes(vchSig, false);
     const bool valid{sig.VerifyInsecure(pubKey, sigHash, false)};
     if (!valid) {
-        LogPrintf("CGovernanceVote::CheckSignature -- VerifyInsecure() failed\n");
+        LogPrint(BCLog::GOBJECT, "CGovernanceVote::CheckSignature -- VerifyInsecure() failed\n");
     }
 
     m_sig_memo.Store(fingerprint, valid);

From 4722ad9ecdf8ddab3744fdfedbded859a8f06447 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 06:42:41 +0000
Subject: [PATCH 38/51] chore: prepare v23.1.9 release

Bumps _CLIENT_VERSION_BUILD to 9 (_CLIENT_VERSION_IS_RELEASE stays true, no RC),
adds the flatpak metainfo release entry, writes the v23.1.9 release notes and
archives the v23.1.8 notes under doc/release-notes/dash/.

Man pages carry the version/date bump only; no CLI options changed this release.
A full contrib/devtools/gen-manpages.py regeneration from the release build is
part of the tag/build step.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 configure.ac                                  |   2 +-
 .../flatpak/org.dash.dash-core.metainfo.xml   |   1 +
 doc/man/dash-cli.1                            |   6 +-
 doc/man/dash-qt.1                             |   6 +-
 doc/man/dash-tx.1                             |   6 +-
 doc/man/dash-util.1                           |   6 +-
 doc/man/dash-wallet.1                         |   6 +-
 doc/man/dashd.1                               |   6 +-
 doc/release-notes.md                          | 190 +++++++++---------
 .../dash/release-notes-23.1.8.md              | 161 +++++++++++++++
 10 files changed, 274 insertions(+), 116 deletions(-)
 create mode 100644 doc/release-notes/dash/release-notes-23.1.8.md

diff --git a/configure.ac b/configure.ac
index fb96e7d29cec..aa1c4996db1b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -2,7 +2,7 @@ AC_PREREQ([2.69])
 dnl Don't forget to push a corresponding tag when updating any of _CLIENT_VERSION_* numbers
 define(_CLIENT_VERSION_MAJOR, 23)
 define(_CLIENT_VERSION_MINOR, 1)
-define(_CLIENT_VERSION_BUILD, 8)
+define(_CLIENT_VERSION_BUILD, 9)
 define(_CLIENT_VERSION_IS_RELEASE, true)
 define(_COPYRIGHT_YEAR, 2026)
 define(_COPYRIGHT_HOLDERS,[The %s developers])
diff --git a/contrib/flatpak/org.dash.dash-core.metainfo.xml b/contrib/flatpak/org.dash.dash-core.metainfo.xml
index 66e742659443..ba72128f9769 100644
--- a/contrib/flatpak/org.dash.dash-core.metainfo.xml
+++ b/contrib/flatpak/org.dash.dash-core.metainfo.xml
@@ -21,6 +21,7 @@
     </screenshot>
   </screenshots>
   <releases>
+    <release date="2026-10-29" version="23.1.9"/>
     <release date="2026-07-30" version="23.1.8"/>
     <release date="2026-06-30" version="23.1.7"/>
     <release date="2026-06-19" version="23.1.5"/>
diff --git a/doc/man/dash-cli.1 b/doc/man/dash-cli.1
index 8bf92ce8161b..9fda610b7d09 100644
--- a/doc/man/dash-cli.1
+++ b/doc/man/dash-cli.1
@@ -1,7 +1,7 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-CLI "1" "July 2026" "dash-cli v23.1.8" "User Commands"
+.TH DASH-CLI "1" "October 2026" "dash-cli v23.1.9" "User Commands"
 .SH NAME
-dash-cli \- manual page for dash-cli v23.1.8
+dash-cli \- manual page for dash-cli v23.1.9
 .SH SYNOPSIS
 .B dash-cli
 [\fI\,options\/\fR] \fI\,<command> \/\fR[\fI\,params\/\fR]  \fI\,Send command to Dash Core\/\fR
@@ -15,7 +15,7 @@ dash-cli \- manual page for dash-cli v23.1.8
 .B dash-cli
 [\fI\,options\/\fR] \fI\,help <command>      Get help for a command\/\fR
 .SH DESCRIPTION
-Dash Core RPC client version v23.1.8
+Dash Core RPC client version v23.1.9
 .SH OPTIONS
 .HP
 \-?
diff --git a/doc/man/dash-qt.1 b/doc/man/dash-qt.1
index 00cba193fda8..305803d723e2 100644
--- a/doc/man/dash-qt.1
+++ b/doc/man/dash-qt.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-QT "1" "July 2026" "dash-qt v23.1.8" "User Commands"
+.TH DASH-QT "1" "October 2026" "dash-qt v23.1.9" "User Commands"
 .SH NAME
-dash-qt \- manual page for dash-qt v23.1.8
+dash-qt \- manual page for dash-qt v23.1.9
 .SH SYNOPSIS
 .B dash-qt
 [\fI\,command-line options\/\fR] [\fI\,URI\/\fR]
 .SH DESCRIPTION
-Dash Core version v23.1.8
+Dash Core version v23.1.9
 .PP
 Optional URI is a Dash address in BIP21 URI format.
 .SH OPTIONS
diff --git a/doc/man/dash-tx.1 b/doc/man/dash-tx.1
index 7b587eeb9f19..906c258e33ca 100644
--- a/doc/man/dash-tx.1
+++ b/doc/man/dash-tx.1
@@ -1,7 +1,7 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-TX "1" "July 2026" "dash-tx v23.1.8" "User Commands"
+.TH DASH-TX "1" "October 2026" "dash-tx v23.1.9" "User Commands"
 .SH NAME
-dash-tx \- manual page for dash-tx v23.1.8
+dash-tx \- manual page for dash-tx v23.1.9
 .SH SYNOPSIS
 .B dash-tx
 [\fI\,options\/\fR] \fI\,<hex-tx> \/\fR[\fI\,commands\/\fR]  \fI\,Update hex-encoded dash transaction\/\fR
@@ -9,7 +9,7 @@ dash-tx \- manual page for dash-tx v23.1.8
 .B dash-tx
 [\fI\,options\/\fR] \fI\,-create \/\fR[\fI\,commands\/\fR]   \fI\,Create hex-encoded dash transaction\/\fR
 .SH DESCRIPTION
-Dash Core dash\-tx utility version v23.1.8
+Dash Core dash\-tx utility version v23.1.9
 .SH OPTIONS
 .HP
 \-?
diff --git a/doc/man/dash-util.1 b/doc/man/dash-util.1
index 3a47b0b8037a..55dc5922e6e6 100644
--- a/doc/man/dash-util.1
+++ b/doc/man/dash-util.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-UTIL "1" "July 2026" "dash-util v23.1.8" "User Commands"
+.TH DASH-UTIL "1" "October 2026" "dash-util v23.1.9" "User Commands"
 .SH NAME
-dash-util \- manual page for dash-util v23.1.8
+dash-util \- manual page for dash-util v23.1.9
 .SH SYNOPSIS
 .B dash-util
 [\fI\,options\/\fR] [\fI\,commands\/\fR]  \fI\,Do stuff\/\fR
 .SH DESCRIPTION
-Dash Core dash\-util utility version v23.1.8
+Dash Core dash\-util utility version v23.1.9
 .SH OPTIONS
 .HP
 \-?
diff --git a/doc/man/dash-wallet.1 b/doc/man/dash-wallet.1
index ffeaccdb710f..1ddce2058fde 100644
--- a/doc/man/dash-wallet.1
+++ b/doc/man/dash-wallet.1
@@ -1,9 +1,9 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASH-WALLET "1" "July 2026" "dash-wallet v23.1.8" "User Commands"
+.TH DASH-WALLET "1" "October 2026" "dash-wallet v23.1.9" "User Commands"
 .SH NAME
-dash-wallet \- manual page for dash-wallet v23.1.8
+dash-wallet \- manual page for dash-wallet v23.1.9
 .SH DESCRIPTION
-Dash Core dash\-wallet version v23.1.8
+Dash Core dash\-wallet version v23.1.9
 .PP
 dash\-wallet is an offline tool for creating and interacting with Dash Core wallet files.
 By default dash\-wallet will act on wallets in the default mainnet wallet directory in the datadir.
diff --git a/doc/man/dashd.1 b/doc/man/dashd.1
index 3f2e77656af2..cfddccb0d144 100644
--- a/doc/man/dashd.1
+++ b/doc/man/dashd.1
@@ -1,12 +1,12 @@
 .\" DO NOT MODIFY THIS FILE!  It was generated by help2man 1.49.3.
-.TH DASHD "1" "July 2026" "dashd v23.1.8" "User Commands"
+.TH DASHD "1" "October 2026" "dashd v23.1.9" "User Commands"
 .SH NAME
-dashd \- manual page for dashd v23.1.8
+dashd \- manual page for dashd v23.1.9
 .SH SYNOPSIS
 .B dashd
 [\fI\,options\/\fR]                     \fI\,Start Dash Core\/\fR
 .SH DESCRIPTION
-Dash Core version v23.1.8
+Dash Core version v23.1.9
 .SH OPTIONS
 .HP
 \-?
diff --git a/doc/release-notes.md b/doc/release-notes.md
index 2a8d804abe00..2f1c11f9b3bf 100644
--- a/doc/release-notes.md
+++ b/doc/release-notes.md
@@ -1,8 +1,10 @@
-# Dash Core version v23.1.8
+# Dash Core version v23.1.9
+
+This is a new patch version release. It fixes a consensus-affecting
+transaction-encoding bug, several remotely reachable crashes and
+denial-of-service issues in the masternode, DKG, signing and governance paths,
+and backports a number of hardening and robustness fixes from later releases.
 
-This is a new patch version release, fixing three remotely reachable crashes and
-bringing further hardening of the peer-to-peer message handlers along with
-networking, RPC and build fixes.
 Upgrading is **strongly recommended** for all nodes, and required for
 masternodes.
 
@@ -28,98 +30,91 @@ require a reindex.
 
 # Release Notes
 
-## Critical fixes
-
-This release fixes three crashes that a remote party could trigger. None of
-them affect consensus rules or put funds at risk, but each one can take a node
-offline, so all operators should upgrade promptly.
-
-- Fixed a crash while removing provider transactions that a masternode's
-  operator-key change invalidates. Those transactions are collected before any
-  of them are removed, so when one was an in-mempool descendant of another it
-  was already erased along with its ancestor, and the stale entry was then
-  dereferenced. Such entries are now skipped. This is reachable whenever a block
-  carries a provider registrar update or revocation for a masternode that has
-  chained service updates pending in the mempool.
-- Fixed a crash caused by an unvalidated LLMQ type in a `qsigshare` message. A
-  masternode that received a signature share naming an LLMQ type its chain does
-  not register would index a per-type quorum cache that is only populated for
-  known types, aborting the process. Unregistered types are now rejected before
-  the lookup, and the affected cache lookups no longer create missing entries.
-- Fixed a crash caused by a quorum commitment naming a block with no parent,
-  such as the genesis block. The parentless block index reached a non-null
-  precondition and terminated the process instead of failing validation, which
-  no exception handler could contain. Commitments with a parentless quorum base
-  block are now rejected, and the LLMQ activation check treats a null
-  predecessor as "not enabled" rather than a contract violation.
-
-## Security
-
-This release continues the hardening of peer-to-peer message handlers against
-denial-of-service from remote peers. These issues do not affect consensus and do
-not put funds at risk, but they could be used to crash or degrade nodes -
-masternodes in particular - so upgrading is recommended.
-
-- LLMQ / signing: the queues of not-yet-verified recovered signatures and
-  signature shares are now bounded, and the vectors carried by the QSIGSHARE,
-  QSIGSESANN, QSIGSHARESINV, QGETSIGSHARES and QBSIGSHARES messages are bounded
-  before any allocation or decoding takes place. The number of signing share
-  sessions a single peer may announce is also capped, so a peer can no longer
-  grow that per-peer state without limit (dash#7351).
-- LLMQ / DKG: the number of encrypted contribution blobs in a DKG contribution
-  is now checked against the quorum's lower bound as well as its upper bound.
-- LLMQ / quorum data: the verification vector and encrypted contribution
-  vectors in QDATA responses are validated against their expected sizes before
-  any BLS decoding is performed.
-- Transaction relay: an oversized `notfound` message is now penalised rather
-  than silently ignored (dash#7348).
-- ChainLocks: the cache of seen ChainLock signatures is now bounded.
-- Governance: per-object vote sync requests are now throttled per peer, and
-  governance object and vote responses are only accepted from a peer if that
-  peer announced them or they were requested from it, using the net-layer
-  per-peer request tracker. Governance vote signatures are bounded when read
-  from the network and must use one of the two legitimate encodings.
-- CoinJoin: the vectors carried by CoinJoin mixing messages are bounded before
-  allocation, and a non-participant can no longer abort another session's
-  signing phase. An invalid `dstx` message now carries a misbehaviour score
-  instead of being dropped for free (dash#7347).
-- Bloom filters: filterload and filteradd payloads are bounded before
-  allocation.
-- Sporks: spork signatures are bounded during deserialization, and malformed
-  spork messages now attribute misbehaviour to the sending peer.
-- Compact block relay: batched hardening backported from upstream Bitcoin Core
-  (dash#7398), including detection of mutated blocks as a defence-in-depth
-  measure.
-
-## RPC
-
-- `protx listdiff` no longer reports an always-zero `platformP2PPort` /
-  `platformHTTPPort` for masternodes registered with extended addresses; the
-  live Platform ports are reported instead.
-
-## GUI
-
-- The PoSe score column is no longer hidden together with banned masternodes in
-  the masternode list.
-- Fixed an abort when scaling widgets whose font was set in pixels rather than
-  points (for example by a stylesheet's `font-size: Npx`); such fonts are now
-  converted to a point size instead of being assumed to have one (dash#7465).
-
-## Build and CI
-
-- Fixed a CMake compatibility error when building the freetype dependency with
-  newer CMake (dash#7372).
-- Stabilized the `-par` / `-parbls` help text (and the generated man pages) so
-  they no longer embed the core count of the build machine.
-- Updated GitHub Actions pins for the Node 24 runtime.
-- Fixed the circular-dependencies lint script under Python 3.15.
-
-## Tests
-
-- Governance inventory cache coverage moved from a functional test to unit
-  tests, and governance vote test fixtures are now wire-valid.
-
-# v23.1.8 Change log
+## Consensus
+
+- Transactions whose version field is negative are now rejected once DIP3 is
+  active. The version and type share one 32-bit field; a negative version was
+  sign-extended when a transaction was re-serialized, so a block containing such
+  a transaction could be accepted by a node that received the original bytes and
+  rejected by every node that received the re-serialized form, leading to a
+  persistent chain split. The new rule rejects these transactions uniformly. No
+  valid or historical transaction is affected and transaction ids are unchanged.
+
+## Crash fixes
+
+These issues do not affect consensus rules or put funds at risk, but each one
+can take a node offline.
+
+- Fixed an abort during the DKG when a quorum member sent a contribution whose
+  decrypted secret-key share was invalid: the share reached an aggregation
+  assertion and terminated the process on every honest member of the quorum.
+  Invalid shares are now rejected before aggregation.
+- Fixed block-template failures caused by provider transactions: a
+  `ProUpServTx` with an invalid type, a `ProRegTx` reusing collateral already
+  referenced by an in-mempool update, and a pending owner key colliding with a
+  Platform node id are now rejected at mempool acceptance.
+- Bounded the masternode-list caches by size so a peer cannot drive unbounded
+  memory growth between blocks.
+- Bounded `DomainPort` deserialization so a small provider transaction can no
+  longer make the node allocate and zero very large buffers while holding
+  `cs_main`.
+- Decoding an unknown-version provider transaction through the verbose decode
+  RPCs no longer dereferences a missing network-info object.
+- `masternode payments` no longer aborts at the genesis block, and the
+  masternode-list RPCs no longer cache a list for a block outside the active
+  chain.
+- Evonodes no longer abort at credit-pool snapshot boundaries when the pool is
+  first constructed outside a block connection (for example by
+  `getassetunlockstatuses`).
+- Flat-file (block and undo) positions are now stored and seeked as 64-bit
+  values. Block-undo data can be several times the size of its block, so a busy
+  chain could push a data file past the point a 32-bit offset can address; the
+  write and seek paths no longer narrow the position to 32 bits, which avoided a
+  silent wrap (and, on Windows, a failure past 2 GiB).
+
+## InstantSend
+
+- Provider (masternode) transactions are no longer given InstantSend locks.
+  Locking them served no purpose and interacted badly with lock eviction on
+  mempool removal. Software that waited for an InstantSend lock on a provider
+  transaction should wait for a ChainLock or for confirmations instead.
+
+## Security and denial-of-service hardening
+
+These issues do not affect consensus and do not put funds at risk.
+
+- DKG contribution verification: a single verification-vector coefficient
+  shared between two members no longer fails the whole verification batch.
+  Previously that marked unrelated honest members' contributions invalid and
+  caused them to be complained about; contributions are now verified
+  individually, so only the offending member is affected.
+- Signature-share batch verification is now scoped per sender, so one peer can
+  no longer get an honest peer penalised or have a forged share stored in place
+  of an honest one. Malformed detached quorum share batches are rejected, and
+  signing intake is gated against the active-quorum set before any quorum is
+  retrieved.
+- Governance: an orphan vote now requires a valid masternode signature before
+  it is cached, the number of orphan parent objects re-requested per tick is
+  bounded, governance vote signature checks are memoised to bound the cost of a
+  sync request, a vote is no longer recorded before it is validated, and a
+  failed BLS vote-signature check is logged under the governance category
+  instead of unconditionally, so a peer cannot fill `debug.log` with it.
+- Socket exception monitoring is now consistent between the `poll()` and
+  `select()` backends, and a peer whose send buffer stalls is now subject to the
+  send timeout, so it can no longer hold a connection slot indefinitely.
+- Verified inbound connections are bounded per operator identity; `CHECKDATASIG`
+  uses the signature cache; repeated authenticated Platform bans are skipped;
+  `DYNBITSET` allocation is bounded against the remaining stream size; a bogus
+  InstantSend lock no longer drops a batch of unrelated locks; and
+  `-allowprivatenet` no longer influences masternode address validation.
+
+## Wallet
+
+- Invalid-mnemonic errors no longer echo the recovery phrase, an encrypted
+  wallet is relocked if an HD upgrade fails after it was unlocked, and a wallet
+  unlock deadline can no longer be extended without re-authenticating.
+
+# v23.1.9 Change log
 
 See detailed [set of changes][set-of-changes].
 
@@ -139,6 +134,7 @@ debug the release candidates.
 
 These releases are considered obsolete. Old release notes can be found here:
 
+- [v23.1.8](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.8.md) released Jul/29/2026
 - [v23.1.7](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.7.md) released Jun/30/2026
 - [v23.1.5](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.5.md) released Jun/19/2026
 - [v23.1.4](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.4.md) released Jun/18/2026
@@ -158,4 +154,4 @@ These releases are considered obsolete. Old release notes can be found here:
 - [v21.0.0](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-21.0.0.md) released Jul/25/2024
 - [v20.1.1](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-20.1.1.md) released April/3/2024
 
-[set-of-changes]: https://github.com/dashpay/dash/compare/v23.1.7...dashpay:v23.1.8
+[set-of-changes]: https://github.com/dashpay/dash/compare/v23.1.8...dashpay:v23.1.9
diff --git a/doc/release-notes/dash/release-notes-23.1.8.md b/doc/release-notes/dash/release-notes-23.1.8.md
new file mode 100644
index 000000000000..2a8d804abe00
--- /dev/null
+++ b/doc/release-notes/dash/release-notes-23.1.8.md
@@ -0,0 +1,161 @@
+# Dash Core version v23.1.8
+
+This is a new patch version release, fixing three remotely reachable crashes and
+bringing further hardening of the peer-to-peer message handlers along with
+networking, RPC and build fixes.
+Upgrading is **strongly recommended** for all nodes, and required for
+masternodes.
+
+Please report bugs using the issue tracker at GitHub:
+
+  <https://github.com/dashpay/dash/issues>
+
+# Upgrading and downgrading
+
+## How to Upgrade
+
+If you are running an older version, shut it down. Wait until it has completely
+shut down (which might take a few minutes for older versions), then run the
+installer (on Windows) or just copy over /Applications/Dash-Qt (on Mac) or
+dashd/dash-qt (on Linux).
+
+## Downgrade warning
+
+### Downgrade to a version < v23.0.0
+
+Downgrading to a version older than v23.0.0 is not supported, and will
+require a reindex.
+
+# Release Notes
+
+## Critical fixes
+
+This release fixes three crashes that a remote party could trigger. None of
+them affect consensus rules or put funds at risk, but each one can take a node
+offline, so all operators should upgrade promptly.
+
+- Fixed a crash while removing provider transactions that a masternode's
+  operator-key change invalidates. Those transactions are collected before any
+  of them are removed, so when one was an in-mempool descendant of another it
+  was already erased along with its ancestor, and the stale entry was then
+  dereferenced. Such entries are now skipped. This is reachable whenever a block
+  carries a provider registrar update or revocation for a masternode that has
+  chained service updates pending in the mempool.
+- Fixed a crash caused by an unvalidated LLMQ type in a `qsigshare` message. A
+  masternode that received a signature share naming an LLMQ type its chain does
+  not register would index a per-type quorum cache that is only populated for
+  known types, aborting the process. Unregistered types are now rejected before
+  the lookup, and the affected cache lookups no longer create missing entries.
+- Fixed a crash caused by a quorum commitment naming a block with no parent,
+  such as the genesis block. The parentless block index reached a non-null
+  precondition and terminated the process instead of failing validation, which
+  no exception handler could contain. Commitments with a parentless quorum base
+  block are now rejected, and the LLMQ activation check treats a null
+  predecessor as "not enabled" rather than a contract violation.
+
+## Security
+
+This release continues the hardening of peer-to-peer message handlers against
+denial-of-service from remote peers. These issues do not affect consensus and do
+not put funds at risk, but they could be used to crash or degrade nodes -
+masternodes in particular - so upgrading is recommended.
+
+- LLMQ / signing: the queues of not-yet-verified recovered signatures and
+  signature shares are now bounded, and the vectors carried by the QSIGSHARE,
+  QSIGSESANN, QSIGSHARESINV, QGETSIGSHARES and QBSIGSHARES messages are bounded
+  before any allocation or decoding takes place. The number of signing share
+  sessions a single peer may announce is also capped, so a peer can no longer
+  grow that per-peer state without limit (dash#7351).
+- LLMQ / DKG: the number of encrypted contribution blobs in a DKG contribution
+  is now checked against the quorum's lower bound as well as its upper bound.
+- LLMQ / quorum data: the verification vector and encrypted contribution
+  vectors in QDATA responses are validated against their expected sizes before
+  any BLS decoding is performed.
+- Transaction relay: an oversized `notfound` message is now penalised rather
+  than silently ignored (dash#7348).
+- ChainLocks: the cache of seen ChainLock signatures is now bounded.
+- Governance: per-object vote sync requests are now throttled per peer, and
+  governance object and vote responses are only accepted from a peer if that
+  peer announced them or they were requested from it, using the net-layer
+  per-peer request tracker. Governance vote signatures are bounded when read
+  from the network and must use one of the two legitimate encodings.
+- CoinJoin: the vectors carried by CoinJoin mixing messages are bounded before
+  allocation, and a non-participant can no longer abort another session's
+  signing phase. An invalid `dstx` message now carries a misbehaviour score
+  instead of being dropped for free (dash#7347).
+- Bloom filters: filterload and filteradd payloads are bounded before
+  allocation.
+- Sporks: spork signatures are bounded during deserialization, and malformed
+  spork messages now attribute misbehaviour to the sending peer.
+- Compact block relay: batched hardening backported from upstream Bitcoin Core
+  (dash#7398), including detection of mutated blocks as a defence-in-depth
+  measure.
+
+## RPC
+
+- `protx listdiff` no longer reports an always-zero `platformP2PPort` /
+  `platformHTTPPort` for masternodes registered with extended addresses; the
+  live Platform ports are reported instead.
+
+## GUI
+
+- The PoSe score column is no longer hidden together with banned masternodes in
+  the masternode list.
+- Fixed an abort when scaling widgets whose font was set in pixels rather than
+  points (for example by a stylesheet's `font-size: Npx`); such fonts are now
+  converted to a point size instead of being assumed to have one (dash#7465).
+
+## Build and CI
+
+- Fixed a CMake compatibility error when building the freetype dependency with
+  newer CMake (dash#7372).
+- Stabilized the `-par` / `-parbls` help text (and the generated man pages) so
+  they no longer embed the core count of the build machine.
+- Updated GitHub Actions pins for the Node 24 runtime.
+- Fixed the circular-dependencies lint script under Python 3.15.
+
+## Tests
+
+- Governance inventory cache coverage moved from a functional test to unit
+  tests, and governance vote test fixtures are now wire-valid.
+
+# v23.1.8 Change log
+
+See detailed [set of changes][set-of-changes].
+
+# Credits
+
+Thanks to everyone who directly contributed to this release:
+
+- Konstantin Akimov
+- PastaClaw
+- PastaPastaPasta
+- UdjinM6
+
+As well as everyone that submitted issues, reviewed pull requests and helped
+debug the release candidates.
+
+# Older releases
+
+These releases are considered obsolete. Old release notes can be found here:
+
+- [v23.1.7](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.7.md) released Jun/30/2026
+- [v23.1.5](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.5.md) released Jun/19/2026
+- [v23.1.4](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.4.md) released Jun/18/2026
+- [v23.1.3](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.3.md) released May/28/2026
+- [v23.1.2](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.2.md) released Mar/12/2026
+- [v23.1.0](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.1.0.md) released Feb/15/2026
+- [v23.0.2](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.0.2.md) released Dec/4/2025
+- [v23.0.0](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-23.0.0.md) released Nov/10/2025
+- [v22.1.3](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-22.1.3.md) released Jul/15/2025
+- [v22.1.2](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-22.1.2.md) released Apr/15/2025
+- [v22.1.1](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-22.1.1.md) released Feb/17/2025
+- [v22.1.0](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-22.1.0.md) released Feb/10/2025
+- [v22.0.0](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-22.0.0.md) released Dec/12/2024
+- [v21.1.1](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-21.1.1.md) released Oct/22/2024
+- [v21.1.0](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-21.1.0.md) released Aug/8/2024
+- [v21.0.2](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-21.0.2.md) released Aug/1/2024
+- [v21.0.0](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-21.0.0.md) released Jul/25/2024
+- [v20.1.1](https://github.com/dashpay/dash/blob/master/doc/release-notes/dash/release-notes-20.1.1.md) released April/3/2024
+
+[set-of-changes]: https://github.com/dashpay/dash/compare/v23.1.7...dashpay:v23.1.8

From 39bda8ff6c0066f889f8d2f7fb7967cc44fba444 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 28 Oct 2026 22:47:22 +0000
Subject: [PATCH 39/51] fix(consensus): reject negative transaction nVersion
 after DIP3

A tx version word in 0x8000-0xFFFF is read into int16 nVersion as negative and
sign-extends on re-serialization to type 0xFFFF, so a node fed the miner's
original wire bytes accepts a block that every relayed/compact/IBD/reindex copy
rejects -> permanent consensus split. Reject negative nVersion in
ContextualCheckTransaction once DIP3 is active (consensus-enforced for mempool
and block connection), and route version/type word packing through a single
PackVersionAndType() helper. Valid-tx txids are unchanged (no fork); no
activation height needed. Backport of knst fix-signed-nversion.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit 07494dd628a996debc772f11d96cbff68d56928f)
---
 src/primitives/transaction.h    | 11 +++++++++--
 src/script/interpreter.cpp      |  2 +-
 src/test/sighash_tests.cpp      |  2 +-
 src/test/transaction_tests.cpp  | 20 +++++++++++++++++++
 src/test/txvalidation_tests.cpp | 34 +++++++++++++++++++++++++++++++++
 src/validation.cpp              |  5 +++++
 6 files changed, 70 insertions(+), 4 deletions(-)

diff --git a/src/primitives/transaction.h b/src/primitives/transaction.h
index 14ae6d160349..f289c75cefaf 100644
--- a/src/primitives/transaction.h
+++ b/src/primitives/transaction.h
@@ -232,6 +232,13 @@ inline CAmount CalculateOutputValue(const TxType& tx)
 }
 
 
+/** nVersion and nType share one 32-bit wire field. nVersion fills the low half as raw bits:
+ *  sign-extending a negative nVersion would overwrite nType. */
+constexpr int32_t PackVersionAndType(int16_t nVersion, uint16_t nType)
+{
+    return static_cast<int32_t>(static_cast<uint16_t>(nVersion) | (static_cast<uint32_t>(nType) << 16));
+}
+
 /** The basic transaction that is broadcasted on the network and contained in
  * blocks.  A transaction can contain multiple inputs and outputs.
  */
@@ -268,7 +275,7 @@ class CTransaction
 
     template <typename Stream>
     inline void Serialize(Stream& s) const {
-        int32_t n32bitVersion = this->nVersion | (this->nType << 16);
+        int32_t n32bitVersion = PackVersionAndType(this->nVersion, this->nType);
         s << n32bitVersion;
         s << vin;
         s << vout;
@@ -354,7 +361,7 @@ struct CMutableTransaction
     SERIALIZE_METHODS(CMutableTransaction, obj)
     {
         int32_t n32bitVersion;
-        SER_WRITE(obj, n32bitVersion = obj.nVersion | (obj.nType << 16));
+        SER_WRITE(obj, n32bitVersion = PackVersionAndType(obj.nVersion, obj.nType));
         READWRITE(n32bitVersion);
         SER_READ(obj, obj.nVersion = (int16_t) (n32bitVersion & 0xffff));
         SER_READ(obj, obj.nType = (uint16_t) ((n32bitVersion >> 16) & 0xffff));
diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index 4c129a5c9b95..4206676612f5 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1420,7 +1420,7 @@ class CTransactionSignatureSerializer
     template<typename S>
     void Serialize(S &s) const {
         // Serialize nVersion
-        int32_t n32bitVersion = txTo.nVersion | (txTo.nType << 16);
+        int32_t n32bitVersion = PackVersionAndType(txTo.nVersion, txTo.nType);
         ::Serialize(s, n32bitVersion);
         // Serialize vin
         unsigned int nInputs = fAnyoneCanPay ? 1 : txTo.vin.size();
diff --git a/src/test/sighash_tests.cpp b/src/test/sighash_tests.cpp
index 51a92809acc1..1f7b4502776b 100644
--- a/src/test/sighash_tests.cpp
+++ b/src/test/sighash_tests.cpp
@@ -90,7 +90,7 @@ void static RandomScript(CScript &script) {
 
 void static RandomTransaction(CMutableTransaction &tx, bool fSingle)
 {
-    tx.nVersion = int(InsecureRandRange(2)) + 1;
+    tx.nVersion = static_cast<int16_t>(InsecureRandBits(16));
     tx.vin.clear();
     tx.vout.clear();
     tx.nLockTime = (InsecureRandBool()) ? InsecureRand32() : 0;
diff --git a/src/test/transaction_tests.cpp b/src/test/transaction_tests.cpp
index 27c1c406a1c6..17cc08a4fa95 100644
--- a/src/test/transaction_tests.cpp
+++ b/src/test/transaction_tests.cpp
@@ -333,6 +333,26 @@ BOOST_AUTO_TEST_CASE(basic_transaction_tests)
     BOOST_CHECK_MESSAGE(!CheckTransaction(CTransaction(tx), state) || !state.IsValid(), "Transaction with duplicate txins should be invalid.");
 }
 
+BOOST_AUTO_TEST_CASE(tx_version_type_roundtrip)
+{
+    // nVersion and nType share one 32-bit wire field; a negative nVersion must not sign-extend over nType
+    for (const auto& [version, type] : std::vector<std::pair<int16_t, uint16_t>>{{-1, TRANSACTION_NORMAL}, {-1, 0xffff}}) {
+        CMutableTransaction tx;
+        tx.nVersion = version;
+        tx.nType = type;
+        CDataStream mutable_stream(SER_NETWORK, PROTOCOL_VERSION);
+        mutable_stream << tx;
+        CDataStream stream(SER_NETWORK, PROTOCOL_VERSION);
+        stream << CTransaction(tx);
+        BOOST_CHECK_EQUAL(HexStr(stream), HexStr(mutable_stream));
+
+        CMutableTransaction tx_read;
+        stream >> tx_read;
+        BOOST_CHECK_EQUAL(tx_read.nVersion, version);
+        BOOST_CHECK_EQUAL(tx_read.nType, type);
+    }
+}
+
 BOOST_AUTO_TEST_CASE(test_Get)
 {
     FillableSigningProvider keystore;
diff --git a/src/test/txvalidation_tests.cpp b/src/test/txvalidation_tests.cpp
index 36042431f85c..5941e2a75619 100644
--- a/src/test/txvalidation_tests.cpp
+++ b/src/test/txvalidation_tests.cpp
@@ -8,6 +8,8 @@
 #include <policy/policy.h>
 #include <primitives/transaction.h>
 #include <script/script.h>
+#include <script/sign.h>
+#include <script/signingprovider.h>
 #include <script/standard.h>
 #include <test/util/setup_common.h>
 #include <validation.h>
@@ -20,6 +22,11 @@ struct TestChain100NoDIP0001Setup : public TestChain100Setup {
         : TestChain100Setup{CBaseChainParams::REGTEST, {"-testactivationheight=dip0001@2000"}} {}
 };
 
+struct TestChain100DIP3Setup : public TestChain100Setup {
+    TestChain100DIP3Setup()
+        : TestChain100Setup{CBaseChainParams::REGTEST, {"-dip3params=101:500"}} {}
+};
+
 
 BOOST_AUTO_TEST_SUITE(txvalidation_tests)
 
@@ -55,4 +62,31 @@ BOOST_FIXTURE_TEST_CASE(tx_mempool_reject_coinbase, TestChain100Setup)
     BOOST_CHECK_EQUAL(result.m_state.GetRejectReason(), "coinbase");
     BOOST_CHECK(result.m_state.GetResult() == TxValidationResult::TX_CONSENSUS);
 }
+
+/**
+ * Ensure that a negative nVersion is rejected by the mempool and in a block.
+ */
+BOOST_FIXTURE_TEST_CASE(tx_reject_negative_version, TestChain100DIP3Setup)
+{
+    const CScript scriptPubKey = CScript() << ToByteVector(coinbaseKey.GetPubKey()) << OP_CHECKSIG;
+    CMutableTransaction tx;
+    tx.nVersion = -1;
+    tx.vin.emplace_back(COutPoint{m_coinbase_txns[0]->GetHash(), 0});
+    tx.vout.emplace_back(1 * COIN, scriptPubKey);
+    FillableSigningProvider keystore;
+    keystore.AddKey(coinbaseKey);
+    BOOST_REQUIRE(SignSignature(keystore, *m_coinbase_txns[0], tx, 0, SIGHASH_ALL));
+
+    {
+        LOCK(cs_main);
+        const MempoolAcceptResult result = m_node.chainman->ProcessTransaction(MakeTransactionRef(tx));
+        BOOST_CHECK(result.m_result_type == MempoolAcceptResult::ResultType::INVALID);
+        BOOST_CHECK_EQUAL(result.m_state.GetRejectReason(), "bad-txns-version");
+    }
+
+    const int height{WITH_LOCK(cs_main, return m_node.chainman->ActiveChain().Height())};
+    const auto block = std::make_shared<CBlock>(CreateBlock({tx}, scriptPubKey, m_node.chainman->ActiveChainstate()));
+    BOOST_CHECK(!m_node.chainman->ProcessNewBlock(block, /*force_processing=*/true, /*new_block=*/nullptr));
+    BOOST_CHECK_EQUAL(WITH_LOCK(cs_main, return m_node.chainman->ActiveChain().Height()), height);
+}
 BOOST_AUTO_TEST_SUITE_END()
diff --git a/src/validation.cpp b/src/validation.cpp
index 85d41ae6d7c6..8150ab666817 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -376,6 +376,11 @@ static bool ContextualCheckTransaction(const CTransaction& tx, TxValidationState
         } else if (tx.nType != TRANSACTION_NORMAL) {
             return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-txns-type");
         }
+        // Releases that sign-extended nVersion over nType re-serialized a negative nVersion with nType 0xffff,
+        // so a block carrying one was accepted only by the peers that received the miner's own bytes
+        if (tx.nVersion < 0) {
+            return state.Invalid(TxValidationResult::TX_CONSENSUS, "bad-txns-version");
+        }
     }
 
     // Size limits

From abf2eb02cb3ab814bad82c6e585cc4088c8767d8 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 28 Oct 2026 22:59:12 +0000
Subject: [PATCH 40/51] fix(llmq): reject invalid decrypted DKG shares before
 aggregation

A quorum member could send a contribution whose decrypted secret-key share is
invalid (e.g. all-zero). It was stored unchecked and later reached
CBLSSecretKey::AggregateInsecure, whose assert(IsValid()) aborts the whole
dashd process on every honest member of the quorum each DKG - a remote
liveness attack on IS/ChainLock/Platform quorums by one member.

Reject an invalid decrypted share at intake (treat as a complaint, like the
undecryptable-share path), reject it on the QDATA recovery path, and make the
secret-key aggregator short-circuit to an invalid aggregate on any invalid
operand so peer-influenced data never reaches the assert (callers already
treat an invalid aggregate as a verification failure, not an abort).

Adds a regtest-only contribution-invalid DKG sim-error and a regression case
in feature_llmq_dkgerrors.py that aborts stock dashd and passes with the fix.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

(cherry picked from commit 8351db9f1445e500547847e77c657a062bf6f6be)

v24.0.x adaptation: the QDATA contribution decryption that v23.1.x has in
QuorumParticipant::ProcessContribQDATA (src/active/quorums.cpp) lives in
src/llmq/net_quorum.cpp on this branch, so the IsValid() check goes there.
The new feature_llmq_dkgerrors.py case passes numeric dkgsimerror rates,
which this branch's RPC requires.
---
 src/active/dkgsession.cpp                 |  8 ++++++++
 src/bls/bls_worker.cpp                    |  6 ++++++
 src/llmq/dkgsession.cpp                   |  7 +++++++
 src/llmq/dkgsession.h                     |  2 ++
 src/llmq/net_quorum.cpp                   |  7 +++++--
 test/functional/feature_llmq_dkgerrors.py | 13 +++++++++++++
 6 files changed, 41 insertions(+), 2 deletions(-)

diff --git a/src/active/dkgsession.cpp b/src/active/dkgsession.cpp
index b50bd966f194..7ab5d2756b90 100644
--- a/src/active/dkgsession.cpp
+++ b/src/active/dkgsession.cpp
@@ -92,6 +92,14 @@ std::optional<CDKGContribution> ActiveDKGSession::SendContributions()
             skContrib.MakeNewKey();
         }
 
+        if (i != myIdx && ShouldSimulateError(DKGError::type::CONTRIBUTION_INVALID)) {
+            // Deliver a share that decrypts to an all-zero (structurally invalid)
+            // CBLSSecretKey on the recipient. Used to exercise the DKG intake's
+            // handling of a peer-supplied invalid contribution share.
+            logger.Batch("sending invalid (zero) share to %s", m->dmn->proTxHash.ToString());
+            skContrib = CBLSSecretKey{};
+        }
+
         if (!qc.contributions->Encrypt(i, m->dmn->pdmnState->pubKeyOperator.Get(), skContrib, PROTOCOL_VERSION)) {
             logger.Batch("failed to encrypt contribution for %s", m->dmn->proTxHash.ToString());
             return std::nullopt;
diff --git a/src/bls/bls_worker.cpp b/src/bls/bls_worker.cpp
index 554f060a0767..e98903d13b7b 100644
--- a/src/bls/bls_worker.cpp
+++ b/src/bls/bls_worker.cpp
@@ -304,8 +304,14 @@ struct Aggregator : public std::enable_shared_from_this<Aggregator<T>> {
     template <typename TP>
     static T SyncAggregate(Span<TP> vec, size_t start, size_t count)
     {
+        // Defence in depth: AggregateInsecure() asserts that every operand is valid, so
+        // peer-influenced data (e.g. a decrypted contribution share) must never reach it
+        // while invalid. Short-circuit to an invalid aggregate instead; callers already
+        // treat an invalid result as an aggregation failure rather than aborting.
         T result = *vec[start];
+        if (!result.IsValid()) return {};
         for (size_t j = 1; j < count; j++) {
+            if (!vec[start + j]->IsValid()) return {};
             result.AggregateInsecure(*vec[start + j]);
         }
         return result;
diff --git a/src/llmq/dkgsession.cpp b/src/llmq/dkgsession.cpp
index e7a1998f8a4c..0df95d9fbd49 100644
--- a/src/llmq/dkgsession.cpp
+++ b/src/llmq/dkgsession.cpp
@@ -238,6 +238,13 @@ std::optional<CInv> CDKGSession::ReceiveMessage(const CDKGContribution& qc)
     if (!MaybeDecrypt(*qc.contributions, *myIdx, skContribution, PROTOCOL_VERSION)) {
         logger.Batch("contribution from %s could not be decrypted", member->dmn->proTxHash.ToString());
         complain = true;
+    } else if (!skContribution.IsValid()) {
+        // A decryptable but structurally-invalid (e.g. all-zero) share must never be
+        // retained: it later reaches CBLSSecretKey::AggregateInsecure() in the batched
+        // contribution verification, whose assert(IsValid()) would abort an honest node.
+        // Treat it as a bad contribution and complain.
+        logger.Batch("contribution from %s decrypted to an invalid share", member->dmn->proTxHash.ToString());
+        complain = true;
     } else if (member->idx != myIdx && ShouldSimulateError(DKGError::type::COMPLAIN_LIE)) {
         logger.Batch("lying/complaining for %s", member->dmn->proTxHash.ToString());
         complain = true;
diff --git a/src/llmq/dkgsession.h b/src/llmq/dkgsession.h
index 91b77abf1cf2..6b29c3427b0e 100644
--- a/src/llmq/dkgsession.h
+++ b/src/llmq/dkgsession.h
@@ -69,6 +69,7 @@ class DKGError {
         CONTRIBUTION_LIE,
         JUSTIFY_OMIT,
         JUSTIFY_LIE,
+        CONTRIBUTION_INVALID,
         _COUNT
     };
     static constexpr DKGError::type from_string(std::string_view in) {
@@ -79,6 +80,7 @@ class DKGError {
         if (in == "contribution-lie") return CONTRIBUTION_LIE;
         if (in == "justify-lie") return JUSTIFY_LIE;
         if (in == "justify-omit") return JUSTIFY_OMIT;
+        if (in == "contribution-invalid") return CONTRIBUTION_INVALID;
         return _COUNT;
     }
 };
diff --git a/src/llmq/net_quorum.cpp b/src/llmq/net_quorum.cpp
index 98bd4441def3..adbc2c488530 100644
--- a/src/llmq/net_quorum.cpp
+++ b/src/llmq/net_quorum.cpp
@@ -336,8 +336,11 @@ bool NetQuorum::ProcessContribQDATA(const CNode& pfrom, CDataStream& vRecv,
     std::vector<CBLSSecretKey> vecSecretKeys;
     vecSecretKeys.resize(vecEncrypted.size());
     for (const auto i : util::irange(vecEncrypted.size())) {
-        if (!m_nodeman->Decrypt(vecEncrypted[i], memberIdx, vecSecretKeys[i], PROTOCOL_VERSION)) {
-            m_peer_manager->PeerMisbehaving(pfrom.GetId(), 10, "failed to decrypt");
+        if (!m_nodeman->Decrypt(vecEncrypted[i], memberIdx, vecSecretKeys[i], PROTOCOL_VERSION) ||
+            !vecSecretKeys[i].IsValid()) {
+            // Reject an undecryptable or structurally-invalid (e.g. all-zero) share before
+            // it reaches AggregateSecretKeys()/AggregateInsecure(), which asserts validity.
+            m_peer_manager->PeerMisbehaving(pfrom.GetId(), 10, "invalid contribution share");
             return false;
         }
     }
diff --git a/test/functional/feature_llmq_dkgerrors.py b/test/functional/feature_llmq_dkgerrors.py
index 1041c7c3d726..a150a4dfc5b7 100755
--- a/test/functional/feature_llmq_dkgerrors.py
+++ b/test/functional/feature_llmq_dkgerrors.py
@@ -50,6 +50,19 @@ def run_test(self):
         qh = self.mine_quorum(expected_contributions=3, expected_complaints=2, expected_justifications=1, mninfos_valid=mninfos_valid)
         self.assert_member_valid(qh, self.mninfo[0].proTxHash, True)
 
+        self.log.info("Lets deliver a structurally-invalid (all-zero) contribution share but provide a correct justification")
+        # Regression test for the DKG abort via an invalid decrypted contribution share:
+        # before the intake gate rejected it, the share reached CBLSSecretKey::AggregateInsecure()
+        # in the batched verification and its assert aborted every honest recipient (SIGABRT).
+        # With the gate the invalid share is treated like a bad contribution: recipients complain,
+        # the sender justifies with its real shares, and the member remains valid - no crash.
+        # contribution-lie stays enabled from the previous case; contribution-invalid overrides it
+        # with an all-zero (structurally invalid) share, which is the EMBARGO-8 trigger.
+        self.mninfo[0].get_node(self).quorum('dkgsimerror', 'contribution-invalid', 100)
+        qh = self.mine_quorum(expected_contributions=3, expected_complaints=2, expected_justifications=1, mninfos_valid=mninfos_valid)
+        self.assert_member_valid(qh, self.mninfo[0].proTxHash, True)
+        self.mninfo[0].get_node(self).quorum('dkgsimerror', 'contribution-invalid', 0)
+
         self.log.info("Lets lie in the contribution and then omit the justification")
         self.mninfo[0].get_node(self).quorum('dkgsimerror', 'justify-omit', 100)
         qh = self.mine_quorum(expected_contributions=3, expected_complaints=2, mninfos_valid=mninfos_valid)

From 418f5ee2cfc738feaca8ac24e4402a85af1e3849 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 05:08:39 +0000
Subject: [PATCH 41/51] fix(llmq): verify DKG contributions individually when a
 batch vvec check fails

A coefficient point shared between two members' verification vectors made the
batched VerifyVerificationVectors check fail the entire batch, marking every other
honest member's contribution in that batch invalid and complaining about them - a
denial of service against those members' participation in the DKG, since the only
check the batched path adds over the per-member check already run in PreVerifyMessage
is cross-member duplicate detection. Fall back to verifying each contribution against
its own verification vector: a member fails only if its own share is inconsistent with
its own vvec, so a member that placed a colliding coefficient is caught on its own and
the honest members it collided with are unaffected. The quorum-vvec build path stays
strict.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
(cherry picked from commit 120b5db0e8b60c889edca08e088bc843bd4b4ace)

v24.0.x adaptation: include-only conflicts in bls_worker.cpp and bls_tests.cpp;
the new bls_tests case calls CBLSWorker::Start(4), since this branch's Start()
takes an explicit worker count.
---
 src/bls/bls_worker.cpp | 34 ++++++++++++++++++++++--
 src/test/bls_tests.cpp | 59 ++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 91 insertions(+), 2 deletions(-)

diff --git a/src/bls/bls_worker.cpp b/src/bls/bls_worker.cpp
index e98903d13b7b..4df462755953 100644
--- a/src/bls/bls_worker.cpp
+++ b/src/bls/bls_worker.cpp
@@ -5,6 +5,7 @@
 #include <bls/bls_worker.h>
 #include <hash.h>
 
+#include <logging.h>
 #include <util/system.h>
 
 #include <memory>
@@ -692,6 +693,13 @@ CBLSPublicKey CBLSWorker::BuildPubKeyShare(const BLSVerificationVectorPtr& vvec,
 void CBLSWorker::AsyncVerifyContributionShares(const CBLSId& forId, Span<BLSVerificationVectorPtr> vvecs, Span<CBLSSecretKey> skShares,
                                                bool parallel, bool aggregated, std::function<void(const std::vector<bool>&)> doneCallback)
 {
+    if (!forId.IsValid()) {
+        std::vector<bool> result;
+        result.assign(vvecs.size(), false);
+        doneCallback(result);
+        return;
+    }
+
     // Empty input never schedules any work, so doneCallback would never fire and the
     // future-based wrappers would throw broken_promise. Mirror the empty-input
     // short-circuit in AsyncBuildQuorumVerificationVector / AsyncAggregateHelper.
@@ -699,9 +707,31 @@ void CBLSWorker::AsyncVerifyContributionShares(const CBLSId& forId, Span<BLSVeri
         doneCallback(std::vector<bool>{});
         return;
     }
-    if (!forId.IsValid() || !VerifyVerificationVectors(vvecs)) {
+
+    if (!VerifyVerificationVectors(vvecs)) {
+        // A batch-level verification-vector problem must not fail the whole batch. The
+        // only thing the batched VerifyVerificationVectors adds over the per-member
+        // VerifyVerificationVector check already run in PreVerifyMessage is detecting a
+        // coefficient point shared between two members' vvecs. Failing the whole batch on
+        // that lets one member, by placing a coefficient that collides with another
+        // member's, force every other honest member in the same verification batch to be
+        // marked invalid and complained about - a denial of service against their
+        // participation in the DKG. Instead, verify each contribution on its own: a member
+        // fails only if its own share is inconsistent with its own vvec, so a member that
+        // placed a colliding coefficient is caught on its own while the honest members it
+        // collided with verify normally.
+        LogPrint(BCLog::LLMQ_DKG, "CBLSWorker::%s -- batch verification-vector check failed; verifying %d contributions individually\n",
+                  __func__, vvecs.size());
+        std::vector<std::future<bool>> futures;
+        futures.reserve(vvecs.size());
+        for (size_t i = 0; i < vvecs.size(); i++) {
+            futures.emplace_back(AsyncVerifyContributionShare(forId, vvecs[i], skShares[i]));
+        }
         std::vector<bool> result;
-        result.assign(vvecs.size(), false);
+        result.reserve(vvecs.size());
+        for (auto& f : futures) {
+            result.push_back(f.get());
+        }
         doneCallback(result);
         return;
     }
diff --git a/src/test/bls_tests.cpp b/src/test/bls_tests.cpp
index 5696a34273ff..3abcb14611f5 100644
--- a/src/test/bls_tests.cpp
+++ b/src/test/bls_tests.cpp
@@ -7,6 +7,7 @@
 #include <bls/bls_worker.h>
 #include <clientversion.h>
 #include <consensus/validation.h>
+#include <crypto/common.h>
 #include <deploymentstatus.h>
 #include <random.h>
 #include <script/standard.h>
@@ -644,6 +645,64 @@ BOOST_AUTO_TEST_CASE(bls_verify_contribution_shares_honest_tests)
     FuncVerifyContributionSharesHonest(false);
 }
 
+// A duplicate coefficient point between two members' verification vectors must not fail the
+// other members' contributions. CBLSWorker::VerifyContributionShares() batches the members'
+// vvecs, and the batched VerifyVerificationVectors() check rejects a coefficient shared
+// between two vvecs. Failing the whole batch on that let one member, by copying another
+// member's coefficient into its own vvec, mark every honest member in the batch invalid.
+// The fix verifies each contribution against its own vvec, so only the member whose share no
+// longer matches its own vvec fails. Regression: on the old all-or-nothing code every entry
+// came back false, so the honest members verifying true is what distinguishes fixed from broken.
+void FuncVerifyContributionSharesDuplicateCoefficient(const bool legacy_scheme)
+{
+    bls::bls_legacy_scheme.store(legacy_scheme);
+
+    CBLSWorker worker;
+    worker.Start(4);
+
+    const int threshold = 2;
+    std::vector<CBLSId> ids;
+    for (int i = 0; i < 4; i++) {
+        uint256 id;
+        WriteLE64(id.begin(), i + 1);
+        ids.emplace_back(id);
+    }
+
+    // Three dealers each generate a verification vector and their secret-key shares to each id.
+    std::vector<BLSVerificationVectorPtr> vvecs(3);
+    std::vector<std::vector<CBLSSecretKey>> skShares(3);
+    for (int d = 0; d < 3; d++) {
+        BOOST_REQUIRE(worker.GenerateContributions(threshold, ids, vvecs[d], skShares[d]));
+    }
+
+    // Receiver R collects each dealer's share to it.
+    const size_t R = 0;
+    const CBLSId& recvId = ids[R];
+    std::vector<CBLSSecretKey> recvShares{skShares[0][R], skShares[1][R], skShares[2][R]};
+
+    // All honest: every contribution verifies.
+    std::vector<bool> ok = worker.VerifyContributionShares(recvId, vvecs, recvShares);
+    BOOST_REQUIRE_EQUAL(ok.size(), 3U);
+    BOOST_CHECK(ok[0] && ok[1] && ok[2]);
+
+    // Dealer 0 copies dealer 1's leading coefficient into its own vvec (a cross-member
+    // duplicate) without touching its share, making the batch vvec check fail.
+    vvecs[0]->at(0) = vvecs[1]->at(0);
+    std::vector<bool> res = worker.VerifyContributionShares(recvId, vvecs, recvShares);
+    BOOST_REQUIRE_EQUAL(res.size(), 3U);
+    BOOST_CHECK(!res[0]);  // the member that planted the duplicate is caught alone
+    BOOST_CHECK(res[1]);   // the honest member whose coefficient was copied is unaffected
+    BOOST_CHECK(res[2]);   // the other honest member is unaffected
+
+    worker.Stop();
+}
+
+BOOST_AUTO_TEST_CASE(bls_verify_contribution_shares_duplicate_coefficient_tests)
+{
+    FuncVerifyContributionSharesDuplicateCoefficient(true);
+    FuncVerifyContributionSharesDuplicateCoefficient(false);
+}
+
 // A dummy BLS object that satisfies the minimal interface expected by CBLSLazyWrapper.
 class DummyBLS
 {

From 649259f201ec96d002f5b057d66ba3228d9d4405 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 05:33:59 +0000
Subject: [PATCH 42/51] fix(governance): cap the orphan parent objects
 re-requested per tick

Every 5 minutes NetGovernance re-requests the parent object of every
cached orphan vote from every connected peer. The orphan cache holds up
to a million votes, and after the previous commit an orphan vote still
only needs a valid masternode signature, which one masternode key can
produce for any number of invented parent hashes. Each such hash turns
into one MNGOVERNANCESYNC per peer per tick, so a single key could make
every node queue a send-buffer backlog proportional to (orphans x peers).

Return at most MAX_ORPHAN_OBJECT_REQUESTS (100) orphan parent hashes per
call, sampled at random so that ground parent hashes cannot pin which
ones get requested. 100 comfortably exceeds the number of governance
objects a synced node can legitimately be missing at once; the rest are
still picked on later ticks until the orphans expire, and the objects
themselves are also fetched through normal governance sync.

Not a backport: no equivalent bound exists on develop. The unit test
checks the returned set is complete up to the cap and exactly the cap
(distinct, all real orphan parents) beyond it, using a test-only
AddOrphanVoteForTesting helper next to AddGovernanceObjectForTesting.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

(cherry picked from commit 33ec74e4fb85b0861e42f47a09a0908df097a877)

v24.0.x adaptation: include and test-file context conflicts only; the new
test case is appended after this branch's last governance_inv_tests case.
AddOrphanVoteForTesting inserts this branch's governance::OrphanVote.
---
 src/governance/governance.cpp     | 15 ++++++++++++++
 src/governance/governance.h       |  9 +++++++-
 src/test/governance_inv_tests.cpp | 34 +++++++++++++++++++++++++++++++
 3 files changed, 57 insertions(+), 1 deletion(-)

diff --git a/src/governance/governance.cpp b/src/governance/governance.cpp
index c64fb419227a..138cd5ac8f7f 100644
--- a/src/governance/governance.cpp
+++ b/src/governance/governance.cpp
@@ -19,6 +19,7 @@
 #include <net.h>
 #include <node/interface_ui.h>
 #include <protocol.h>
+#include <random.h>
 #include <timedata.h>
 #include <util/check.h>
 #include <util/time.h>
@@ -388,6 +389,14 @@ void CGovernanceManager::AddGovernanceObjectForTesting(const CGovernanceObject&
     mapObjects.emplace(govobj.GetHash(), std::make_shared<CGovernanceObject>(govobj));
 }
 
+void CGovernanceManager::AddOrphanVoteForTesting(const CGovernanceVote& vote)
+{
+    AssertLockNotHeld(cs_store);
+    LOCK(cs_store);
+    cmmapOrphanVotes.Insert(vote.GetParentHash(),
+                            governance::OrphanVote{vote, Now<NodeSeconds>() + GOVERNANCE_ORPHAN_EXPIRATION_TIME});
+}
+
 void CGovernanceManager::CheckAndRemove()
 {
     AssertLockNotHeld(cs_store);
@@ -1159,6 +1168,12 @@ std::vector<uint256> CGovernanceManager::GetOrphanVoteObjectHashes()
         }
     }
 
+    // A random subset, so that parent hashes ground to sort first cannot pin which ones are requested
+    if (vecHashesFiltered.size() > MAX_ORPHAN_OBJECT_REQUESTS) {
+        Shuffle(vecHashesFiltered.begin(), vecHashesFiltered.end(), FastRandomContext());
+        vecHashesFiltered.resize(MAX_ORPHAN_OBJECT_REQUESTS);
+    }
+
     return vecHashesFiltered;
 }
 
diff --git a/src/governance/governance.h b/src/governance/governance.h
index 04536cb5ef04..481fc8875ebb 100644
--- a/src/governance/governance.h
+++ b/src/governance/governance.h
@@ -332,6 +332,8 @@ class CGovernanceManager : public GovernanceStore
      *  running collateral or chain validation. */
     void AddGovernanceObjectForTesting(const CGovernanceObject& govobj)
         EXCLUSIVE_LOCKS_REQUIRED(!cs_store);
+    /** Test-only helper: caches a vote as an orphan of its parent without validating it. */
+    void AddOrphanVoteForTesting(const CGovernanceVote& vote) EXCLUSIVE_LOCKS_REQUIRED(!cs_store);
 
     // Thread-safe accessors
     bool HaveObjectForHash(const uint256& nHash) const
@@ -358,7 +360,12 @@ class CGovernanceManager : public GovernanceStore
     // Used by NetGovernance
     std::vector<CInv> FetchRelayInventory() EXCLUSIVE_LOCKS_REQUIRED(!cs_relay);
     void CheckAndRemove() EXCLUSIVE_LOCKS_REQUIRED(!cs_store);
-    /** Get hashes of governance objects for which we have orphan votes. Also cleans up expired orphans. */
+    /** Upper bound on the orphan parent hashes GetOrphanVoteObjectHashes() returns per call. Each one is
+     *  re-requested from every peer, and one masternode key can sign votes for any number of invented
+     *  parent hashes. */
+    static constexpr size_t MAX_ORPHAN_OBJECT_REQUESTS{100};
+    /** Get hashes of governance objects for which we have orphan votes, at most
+     *  MAX_ORPHAN_OBJECT_REQUESTS of them chosen at random. Also cleans up expired orphans. */
     [[nodiscard]] std::vector<uint256> GetOrphanVoteObjectHashes() EXCLUSIVE_LOCKS_REQUIRED(!cs_store);
     std::pair<std::vector<uint256>, std::vector<uint256>> FetchGovernanceObjectVotes(
         size_t peers_per_hash_max, int64_t now, std::map<uint256, std::map<CService, int64_t>>& map_asked_recently) const
diff --git a/src/test/governance_inv_tests.cpp b/src/test/governance_inv_tests.cpp
index 880670bf862d..13a2c0c5f7c6 100644
--- a/src/test/governance_inv_tests.cpp
+++ b/src/test/governance_inv_tests.cpp
@@ -26,9 +26,11 @@
 
 #include <boost/test/unit_test.hpp>
 
+#include <algorithm>
 #include <atomic>
 #include <chrono>
 #include <memory>
+#include <set>
 #include <vector>
 
 using namespace std::chrono_literals;
@@ -550,4 +552,36 @@ BOOST_AUTO_TEST_CASE(invalid_vote_is_scored_alike_with_and_without_a_parent_obje
     chainstate.ResetIbd();
 }
 
+// Every orphan parent hash is re-requested from every peer on each governance tick, and one
+// masternode key can sign votes for any number of invented parents, so the hashes requested per tick
+// must stay bounded.
+BOOST_AUTO_TEST_CASE(orphan_object_requests_are_capped_per_tick)
+{
+    constexpr size_t cap{CGovernanceManager::MAX_ORPHAN_OBJECT_REQUESTS};
+    std::set<uint256> parents;
+    const auto add_orphans = [&](size_t count) {
+        for (size_t i = 0; i < count; ++i) {
+            const uint256 parent{GetRandHash()};
+            parents.insert(parent);
+            m_node.govman->AddOrphanVoteForTesting(MakeGovernanceVote(parent));
+        }
+    };
+
+    // Up to the cap, every orphan parent is requested.
+    add_orphans(cap);
+    auto hashes{m_node.govman->GetOrphanVoteObjectHashes()};
+    BOOST_CHECK(std::set<uint256>(hashes.begin(), hashes.end()) == parents);
+
+    // Beyond it, each tick requests exactly cap distinct ones among them.
+    add_orphans(cap);
+    for (int tick = 0; tick < 2; ++tick) {
+        hashes = m_node.govman->GetOrphanVoteObjectHashes();
+        BOOST_CHECK_EQUAL(hashes.size(), cap);
+        const std::set<uint256> unique(hashes.begin(), hashes.end());
+        BOOST_CHECK_EQUAL(unique.size(), cap);
+        BOOST_CHECK(std::includes(parents.begin(), parents.end(), unique.begin(), unique.end()));
+    }
+}
+
+
 BOOST_AUTO_TEST_SUITE_END()

From 4c0cbd6af9d60dd0a151672ccebf8e2a4edbaddf Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 29 Oct 2026 02:14:38 +0000
Subject: [PATCH 43/51] fix(llmq): judge every sig-share sender by its own
 verified shares

CSigSharesManager::ProcessPendingSigShares let a peer's sig shares be
stored without their own signature check by two routes.

1. Message-id aliasing. Shares were batch-verified with
   CBLSBatchVerifier<NodeId, SigShareKey>. The verifier stores messages
   in a std::map keyed by message id, and SigShareKey (signHash,
   quorumMember) does not include the signature or the sender. QSIGSHARE
   is accepted from any peer, so two peers can push shares with the same
   key in one batch; the second PushMessage is then a silent no-op and
   that peer's messagesBySource entry points at the first peer's message:

   - forged share first: the batch fails, the per-source fallback
     re-checks the forged share for both peers, and the honest sender
     lands in badSources and is banned;
   - honest share first: the batch passes on the honest signature, the
     forged share is never checked, and ProcessPendingSigShares can store
     it.

   Key batch entries by (NodeId, SigShareKey) so every sender is judged by
   its own signature. pendingIncomingSigShares already deduplicates by
   SigShareKey per node, so for a single sender, and for distinct keys
   across senders, the new keys map one-to-one onto the old ones and the
   batch is unchanged; the only difference is that a key pushed by
   several peers now produces one entry per peer instead of an aliased
   one. The verifier itself is unchanged and its other users (ISLOCK,
   recovered sigs) keep their ids, which already cover the signature.

2. Malformed-share break. A share whose lazy signature fails to
   deserialize called BanNode() and stopped pushing that peer's shares,
   but did not add the peer to badSources. The post-verification loop
   therefore still passed all of that peer's shares, the malformed one
   and every never-pushed one after it, to ProcessPendingSigShares, which
   stored them and filled their member slots so the honest shares were
   later dropped as already known. Record the peer in badSources instead,
   as develop does; the post-verification loop then bans it and skips its
   shares.

Test: sig_share_batch_verifier_judges_each_sender_by_its_own_share pushes
the same key from two peers in both orders, plus a same-share relay by
two honest peers, through PushSigShareToBatchVerifier and checks
badSources. With the pre-fix keying (SigShareKey only) the honest-first
row yields no bad sources and the attacker-first row yields both peers.
Route 2 is not unit-tested: it lives inside ProcessPendingSigShares,
which needs a full CSigSharesManager with a quorum and peer manager; it
was verified by inspection against the develop fix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

(cherry picked from commit b1178f9eb149a9b9620c347c89e8013967339b72)

v24.0.x adaptation: sig-share batch verification lives in
NetSigning::ProcessPendingSigShares (src/llmq/net_signing.cpp) on this branch,
so the per-sender batch key is applied there. Route 2 needs no change: this
branch already records a malformed share's sender in badSources.
---
 src/llmq/net_signing.cpp      |  4 ++--
 src/llmq/signing_shares.cpp   |  6 +++++
 src/llmq/signing_shares.h     |  9 ++++++++
 src/test/llmq_utils_tests.cpp | 43 +++++++++++++++++++++++++++++++++++
 4 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/src/llmq/net_signing.cpp b/src/llmq/net_signing.cpp
index 2e70d79d520b..bce2095b1c7e 100644
--- a/src/llmq/net_signing.cpp
+++ b/src/llmq/net_signing.cpp
@@ -401,7 +401,7 @@ void NetSigning::ProcessPendingSigShares(
 {
     // It's ok to perform insecure batched verification here as we verify against the quorum public key shares,
     // which are not craftable by individual entities, making the rogue public key attack impossible
-    CBLSBatchVerifier<NodeId, SigShareKey> batchVerifier(false, true);
+    SigShareBatchVerifier batchVerifier(false, true);
 
     cxxtimer::Timer prepareTimer(true);
     size_t verifyCount = 0;
@@ -432,7 +432,7 @@ void NetSigning::ProcessPendingSigShares(
                 assert(false);
             }
 
-            batchVerifier.PushMessage(nodeId, sigShare.GetKey(), sigShare.GetSignHash(), sig, pubKeyShare);
+            PushSigShareToBatchVerifier(batchVerifier, nodeId, sigShare, sig, pubKeyShare);
             verifyCount++;
         }
     }
diff --git a/src/llmq/signing_shares.cpp b/src/llmq/signing_shares.cpp
index 2d6bf9dac87a..8d1a123e0452 100644
--- a/src/llmq/signing_shares.cpp
+++ b/src/llmq/signing_shares.cpp
@@ -48,6 +48,12 @@ void CSigShare::UpdateKey()
     key.second = quorumMember;
 }
 
+void PushSigShareToBatchVerifier(SigShareBatchVerifier& batchVerifier, NodeId from, const CSigShare& sigShare,
+                                 const CBLSSignature& sig, const CBLSPublicKey& pubKeyShare)
+{
+    batchVerifier.PushMessage(from, {from, sigShare.GetKey()}, sigShare.GetSignHash(), sig, pubKeyShare);
+}
+
 std::string CSigSesAnn::ToString() const
 {
     return strprintf("sessionId=%d, llmqType=%d, quorumHash=%s, id=%s, msgHash=%s",
diff --git a/src/llmq/signing_shares.h b/src/llmq/signing_shares.h
index 5e885dff3ee5..509bf0366632 100644
--- a/src/llmq/signing_shares.h
+++ b/src/llmq/signing_shares.h
@@ -6,6 +6,7 @@
 #define BITCOIN_LLMQ_SIGNING_SHARES_H
 
 #include <bls/bls.h>
+#include <bls/bls_batchverifier.h>
 #include <evo/types.h>
 #include <llmq/params.h>
 #include <llmq/signhash.h>
@@ -88,6 +89,14 @@ class CSigShare : virtual public CSigBase
     }
 };
 
+// Batch entries are keyed by sender as well as SigShareKey. QSIGSHARE is accepted from any peer, so two peers can
+// push the same key; with a sender-less key the second push would alias the first entry, letting one peer's share be
+// judged in place of the other's (banning an honest sender, or never checking a forged share).
+using SigShareBatchVerifier = CBLSBatchVerifier<NodeId, std::pair<NodeId, SigShareKey>>;
+
+void PushSigShareToBatchVerifier(SigShareBatchVerifier& batchVerifier, NodeId from, const CSigShare& sigShare,
+                                 const CBLSSignature& sig, const CBLSPublicKey& pubKeyShare);
+
 // Nodes will first announce a signing session with a sessionId to be used in all future P2P messages related to that
 // session. We locally keep track of the mapping for each node. We also assign new sessionIds for outgoing sessions
 // and send QSIGSESANN messages appropriately. All values except the max value for uint32_t are valid as sessionId
diff --git a/src/test/llmq_utils_tests.cpp b/src/test/llmq_utils_tests.cpp
index bfee20443afd..31b10acb789c 100644
--- a/src/test/llmq_utils_tests.cpp
+++ b/src/test/llmq_utils_tests.cpp
@@ -5,6 +5,7 @@
 #include <test/util/llmq_tests.h>
 #include <test/util/setup_common.h>
 
+#include <bls/bls.h>
 #include <chainparams.h>
 #include <consensus/params.h>
 #include <dbwrapper.h>
@@ -23,6 +24,7 @@
 
 #include <map>
 #include <set>
+#include <vector>
 
 using namespace llmq;
 using namespace llmq::testutils;
@@ -259,6 +261,47 @@ BOOST_AUTO_TEST_CASE(pending_sig_shares_session_removal_updates_count)
     BOOST_CHECK_EQUAL(node_state.pendingIncomingSigShares.Size(), 1U);
 }
 
+BOOST_AUTO_TEST_CASE(sig_share_batch_verifier_judges_each_sender_by_its_own_share)
+{
+    const bool legacy_scheme{bls::bls_legacy_scheme.load()};
+    const CSigShare sig_share{MakeSigShare(1)};
+
+    CBLSSecretKey sk_share;
+    sk_share.MakeNewKey();
+    const CBLSPublicKey pk_share{sk_share.GetPublicKey()};
+    const CBLSSignature valid_sig{sk_share.Sign(sig_share.GetSignHash(), legacy_scheme)};
+
+    CBLSSecretKey sk_forger;
+    sk_forger.MakeNewKey();
+    const CBLSSignature forged_sig{sk_forger.Sign(sig_share.GetSignHash(), legacy_scheme)};
+
+    constexpr NodeId honest{1};
+    constexpr NodeId attacker{2};
+    constexpr NodeId other_honest{3};
+
+    struct Push {
+        NodeId from;
+        CBLSSignature sig;
+    };
+    const std::vector<std::pair<std::vector<Push>, std::set<NodeId>>> cases{
+        // Honest share first: the forged copy of the same key must still be checked, not shadowed.
+        {{{honest, valid_sig}, {attacker, forged_sig}}, {attacker}},
+        // Forged share first: the honest sender must be judged by its own share, not the attacker's.
+        {{{attacker, forged_sig}, {honest, valid_sig}}, {attacker}},
+        // The same valid share relayed by two peers is not misbehavior.
+        {{{honest, valid_sig}, {other_honest, valid_sig}}, {}},
+    };
+
+    for (const auto& [pushes, expected_bad_sources] : cases) {
+        SigShareBatchVerifier verifier(/*_secureVerification=*/false, /*_perMessageFallback=*/true);
+        for (const auto& push : pushes) {
+            PushSigShareToBatchVerifier(verifier, push.from, sig_share, push.sig, pk_share);
+        }
+        verifier.Verify();
+        BOOST_CHECK(verifier.badSources == expected_bad_sources);
+    }
+}
+
 BOOST_AUTO_TEST_CASE(batched_sig_shares_rejects_oversized_inner_vector)
 {
     CDataStream stream{SER_NETWORK, PROTOCOL_VERSION};

From 8becf6a07116b988563023d3a54077b943083f90 Mon Sep 17 00:00:00 2001
From: Konstantin Akimov <github@knstqq.com>
Date: Mon, 26 Oct 2026 17:00:20 +0000
Subject: [PATCH 44/51] Merge bitcoin/bitcoin#36669: refactor: store positions
 as a 64 bits integer in flatfiles

48092a9042d8fcfd6bb7ae5911a1d53b8746d546 flatfile: use 64-bit file positioning syscalls in Windows (Antoine Poinsot)
17556cb1f52fcbc807f65245101f72e8ec1573d8 flatfile: store position as a 64 bits integer (Antoine Poinsot)

Pull request description:

  That field is the last 32-bit in flat files management that is only bounded indirectly by callers' usage (unlike the file number for instance). In the spirit of the ongoing effort to avoid unnecessarily using 32 bits integers or platform specific types (for instance #24214, #33724, #34109, #35097, #35616), i was scanning for fields it could be prudent to promote to prevent any possible future misuse. This one is a good candidate because it does not change on-disk representation, since we serialize positions as varints.

ACKs for top commit:
  sedited:
    tACK 48092a9042d8fcfd6bb7ae5911a1d53b8746d546
  hebasto:
    ACK 48092a9042d8fcfd6bb7ae5911a1d53b8746d546, I have reviewed the code and it looks OK.
  instagibbs:
    ACK 48092a9042d8fcfd6bb7ae5911a1d53b8746d546
  l0rinc:
    tested ACK 48092a9042d8fcfd6bb7ae5911a1d53b8746d546

Tree-SHA512: 0f7a8e5b14cd13b56eb9b663e8d17e03abf94da2662332a24c802fc9c608b9acb1bae01e476502228e4a2cc65332fddd934b96ec7bdbe14fadc9ba3db08b1542

Co-authored-by: merge-script <fanquake@gmail.com>

(cherry picked from commit 8030debbbec1ab84d07b8272d0b17fc0e5a471ff)

v24.0.x adaptation: the file helpers that v23.1.x keeps in util/system.{h,cpp}
live in util/fs_helpers.{h,cpp} on this branch, so those hunks are applied there.
The upstream kernel/chain.h BlockInfo::data_pos hunk is applied to this branch's
interfaces/chain.h, and the streams.cpp ftell -> FileTell64 hunks to this branch's
AutoFile XOR read/write paths (it has no cached AutoFile position or seek wrapper).
---
 src/chain.h             |  8 ++++----
 src/flatfile.cpp        | 10 +++++-----
 src/flatfile.h          |  4 ++--
 src/interfaces/chain.h  |  2 +-
 src/streams.cpp         |  5 +++--
 src/util/fs_helpers.cpp |  8 ++++----
 src/util/fs_helpers.h   | 35 +++++++++++++++++++++++++++++++++--
 7 files changed, 52 insertions(+), 20 deletions(-)

diff --git a/src/chain.h b/src/chain.h
index d3ea67d24dfa..a67a88641e9f 100644
--- a/src/chain.h
+++ b/src/chain.h
@@ -41,8 +41,8 @@ class CBlockFileInfo
 {
 public:
     unsigned int nBlocks{};      //!< number of blocks stored in file
-    unsigned int nSize{};        //!< number of used bytes of block file
-    unsigned int nUndoSize{};    //!< number of used bytes in the undo file
+    uint64_t nSize{};        //!< number of used bytes of block file
+    uint64_t nUndoSize{};    //!< number of used bytes in the undo file
     unsigned int nHeightFirst{}; //!< lowest height of block in file
     unsigned int nHeightLast{};  //!< highest height of block in file
     uint64_t nTimeFirst{};       //!< earliest time of block in file
@@ -158,10 +158,10 @@ class CBlockIndex
     int nFile GUARDED_BY(::cs_main){0};
 
     //! Byte offset within blk?????.dat where this block's data is stored
-    unsigned int nDataPos GUARDED_BY(::cs_main){0};
+    uint64_t nDataPos GUARDED_BY(::cs_main){0};
 
     //! Byte offset within rev?????.dat where this block's undo data is stored
-    unsigned int nUndoPos GUARDED_BY(::cs_main){0};
+    uint64_t nUndoPos GUARDED_BY(::cs_main){0};
 
     //! (memory only) Total amount of work (expected number of hashes) in the chain up to and including this block
     arith_uint256 nChainWork{};
diff --git a/src/flatfile.cpp b/src/flatfile.cpp
index ef8df497afaf..bee9e6d9b51c 100644
--- a/src/flatfile.cpp
+++ b/src/flatfile.cpp
@@ -45,7 +45,7 @@ FILE* FlatFileSeq::Open(const FlatFilePos& pos, bool read_only)
         LogPrintf("Unable to open file %s\n", fs::PathToString(path));
         return nullptr;
     }
-    if (pos.nPos && fseek(file, pos.nPos, SEEK_SET)) {
+    if (pos.nPos && FileSeek64(file, pos.nPos, SEEK_SET)) {
         LogPrintf("Unable to seek to position %u of %s\n", pos.nPos, fs::PathToString(path));
         fclose(file);
         return nullptr;
@@ -57,11 +57,11 @@ size_t FlatFileSeq::Allocate(const FlatFilePos& pos, size_t add_size, bool& out_
 {
     out_of_space = false;
 
-    unsigned int n_old_chunks = (pos.nPos + m_chunk_size - 1) / m_chunk_size;
-    unsigned int n_new_chunks = (pos.nPos + add_size + m_chunk_size - 1) / m_chunk_size;
+    uint64_t n_old_chunks = (pos.nPos + m_chunk_size - 1) / m_chunk_size;
+    uint64_t n_new_chunks = (pos.nPos + add_size + m_chunk_size - 1) / m_chunk_size;
     if (n_new_chunks > n_old_chunks) {
-        size_t old_size = pos.nPos;
-        size_t new_size = n_new_chunks * m_chunk_size;
+        uint64_t old_size = pos.nPos;
+        uint64_t new_size = n_new_chunks * m_chunk_size;
         size_t inc_size = new_size - old_size;
 
         if (CheckDiskSpace(m_dir, inc_size)) {
diff --git a/src/flatfile.h b/src/flatfile.h
index 44b7c5ef9f51..d35793a26e93 100644
--- a/src/flatfile.h
+++ b/src/flatfile.h
@@ -14,7 +14,7 @@
 struct FlatFilePos
 {
     int nFile{-1};
-    unsigned int nPos{0};
+    uint64_t nPos{0};
 
     SERIALIZE_METHODS(FlatFilePos, obj)
     {
@@ -23,7 +23,7 @@ struct FlatFilePos
 
     FlatFilePos() {}
 
-    FlatFilePos(int nFileIn, unsigned int nPosIn) :
+    FlatFilePos(int nFileIn, uint64_t nPosIn) :
         nFile(nFileIn),
         nPos(nPosIn)
     {}
diff --git a/src/interfaces/chain.h b/src/interfaces/chain.h
index fa035a627ddf..b9280d26d0de 100644
--- a/src/interfaces/chain.h
+++ b/src/interfaces/chain.h
@@ -94,7 +94,7 @@ struct BlockInfo {
     const uint256* prev_hash = nullptr;
     int height = -1;
     int file_number = -1;
-    unsigned data_pos = 0;
+    uint64_t data_pos = 0;
     const CBlock* data = nullptr;
     const CBlockUndo* undo_data = nullptr;
 
diff --git a/src/streams.cpp b/src/streams.cpp
index 6921dad67733..98e29cd4d0ed 100644
--- a/src/streams.cpp
+++ b/src/streams.cpp
@@ -4,6 +4,7 @@
 
 #include <span.h>
 #include <streams.h>
+#include <util/fs_helpers.h>
 
 #include <array>
 
@@ -13,7 +14,7 @@ std::size_t AutoFile::detail_fread(Span<std::byte> dst)
     if (m_xor.empty()) {
         return std::fread(dst.data(), 1, dst.size(), m_file);
     } else {
-        const auto init_pos{std::ftell(m_file)};
+        const auto init_pos{FileTell64(m_file)};
         if (init_pos < 0) throw std::ios_base::failure("AutoFile::read: ftell failed");
         std::size_t ret{std::fread(dst.data(), 1, dst.size(), m_file)};
         util::Xor(dst.subspan(0, ret), m_xor, init_pos);
@@ -49,7 +50,7 @@ void AutoFile::write(Span<const std::byte> src)
             throw std::ios_base::failure("AutoFile::write: write failed");
         }
     } else {
-        auto current_pos{std::ftell(m_file)};
+        auto current_pos{FileTell64(m_file)};
         if (current_pos < 0) throw std::ios_base::failure("AutoFile::write: ftell failed");
         std::array<std::byte, 4096> buf;
         while (src.size() > 0) {
diff --git a/src/util/fs_helpers.cpp b/src/util/fs_helpers.cpp
index 7cc771d232c5..6394167ccaf8 100644
--- a/src/util/fs_helpers.cpp
+++ b/src/util/fs_helpers.cpp
@@ -198,10 +198,10 @@ void RemoveAllDurably(const fs::path& path)
     SyncDirectoryOrThrow(path.parent_path());
 }
 
-bool TruncateFile(FILE* file, unsigned int length)
+bool TruncateFile(FILE* file, uint64_t length)
 {
 #if defined(WIN32)
-    return _chsize(_fileno(file), length) == 0;
+    return _chsize_s(_fileno(file), length) == 0;
 #else
     return ftruncate(fileno(file), length) == 0;
 #endif
@@ -235,7 +235,7 @@ int RaiseFileDescriptorLimit(int nMinFD)
  * this function tries to make a particular range of a file allocated (corresponding to disk space)
  * it is advisory, and the range specified in the arguments will never contain live data
  */
-void AllocateFileRange(FILE* file, unsigned int offset, unsigned int length)
+void AllocateFileRange(FILE* file, uint64_t offset, unsigned int length)
 {
 #if defined(WIN32)
     // Windows-specific version
@@ -270,7 +270,7 @@ void AllocateFileRange(FILE* file, unsigned int offset, unsigned int length)
     // Fallback version
     // TODO: just write one byte per block
     static const char buf[65536] = {};
-    if (fseek(file, offset, SEEK_SET)) {
+    if (FileSeek64(file, offset, SEEK_SET)) {
         return;
     }
     while (length > 0) {
diff --git a/src/util/fs_helpers.h b/src/util/fs_helpers.h
index f4af1f9e4897..8ac2fa919f66 100644
--- a/src/util/fs_helpers.h
+++ b/src/util/fs_helpers.h
@@ -42,9 +42,40 @@ void RenameDurably(const fs::path& src, const fs::path& dest);
  *  counterpart for deletions, with the same throw contract as RenameDurably(). */
 void RemoveAllDurably(const fs::path& path);
 
-bool TruncateFile(FILE* file, unsigned int length);
+bool TruncateFile(FILE* file, uint64_t length);
+
+/**
+ * 64-bit-clean file positioning.
+ *
+ * The wrapper is necessary for Windows, because `long` is only 32 bits there,
+ * even in 64-bit builds (LLP64).
+ */
+inline int FileSeek64(FILE* file, int64_t offset, int origin)
+{
+#if defined(WIN32)
+    return _fseeki64(file, offset, origin);
+#else
+    return fseeko(file, offset, origin);
+#endif
+}
+
+/**
+ * 64-bit-clean file positioning.
+ *
+ * The wrapper is necessary for Windows, because `long` is only 32 bits there,
+ * even in 64-bit builds (LLP64).
+ */
+inline int64_t FileTell64(FILE* file)
+{
+#if defined(WIN32)
+    return _ftelli64(file);
+#else
+    return ftello(file);
+#endif
+}
+
 int RaiseFileDescriptorLimit(int nMinFD);
-void AllocateFileRange(FILE* file, unsigned int offset, unsigned int length);
+void AllocateFileRange(FILE* file, uint64_t offset, unsigned int length);
 
 /**
  * Rename src to dest.

From f1adb2ccd3ac062f2ade0a6bd8f9d76509244fa1 Mon Sep 17 00:00:00 2001
From: Konstantin Akimov <github@knstqq.com>
Date: Mon, 26 Oct 2026 16:03:11 +0000
Subject: [PATCH 45/51] Merge bitcoin/bitcoin#36665: sock: align exception
 monitoring between poll() and select() backends

1e0c407377034e9cbb4d52f1f534c06cdf202a36 sock: align exception monitoring between poll() and select() backends (Antoine Poinsot)

Pull request description:

  On non-Linux platforms, `WaitMany` monitors every socket for exceptional conditions, even when we are not looking to read from it. On Linux, it never monitors those.

  Monitoring for certain socket events on some platforms but not others is inconsistent and surprising. In this instance it probably means these cases receive less testing as well, since they are ignored on our most well-tested platform.

  Fix this issue by only monitoring for exceptional conditions (which is necessary to detect failed connection attempts early on Windows) for sockets we are also waiting to read from.

ACKs for top commit:
  vasild:
    ACK 1e0c407377034e9cbb4d52f1f534c06cdf202a36
  sedited:
    utACK 1e0c407377034e9cbb4d52f1f534c06cdf202a36
  instagibbs:
    ACK 1e0c407377034e9cbb4d52f1f534c06cdf202a36
  pinheadmz:
    ACK 1e0c407377034e9cbb4d52f1f534c06cdf202a36

Tree-SHA512: 58109efad8ad3bda6c76fa8fad8855e7337bbd54ca046b286940319de0a835d82a4eb66ccc052b23eb6a15840a90c4d29d2fd7345a6318471bc3d9826aab2d10

Co-authored-by: merge-script <fanquake@gmail.com>
(cherry picked from commit 58abb28d9ce4977f4ea202728af7bb4fc77f86cf)
---
 src/net.cpp       | 2 +-
 src/util/sock.cpp | 6 ++++--
 2 files changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/net.cpp b/src/net.cpp
index 4e9d3457cb7f..74b48a7096e5 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -2341,7 +2341,7 @@ Sock::EventsPerSock CConnman::GenerateWaitSockets(Span<CNode* const> nodes)
     }
 
     for (CNode* pnode : nodes) {
-        bool select_recv = !pnode->fHasRecvData;
+        bool select_recv = !pnode->fHasRecvData && !pnode->fPauseRecv;
         bool select_send = !pnode->fCanSendData;
         if (!select_recv && !select_send) continue;
 
diff --git a/src/util/sock.cpp b/src/util/sock.cpp
index 5daf694e57b6..ce2687eaa9d3 100644
--- a/src/util/sock.cpp
+++ b/src/util/sock.cpp
@@ -367,12 +367,14 @@ bool Sock::WaitManySelect(std::chrono::milliseconds timeout,
         const auto& s = sock;
         if (events.requested & RECV) {
             FD_SET(s, &recv);
+            FD_SET(s, &err);
         }
         if (events.requested & SEND) {
             FD_SET(s, &send);
         }
-        FD_SET(s, &err);
-        socket_max = std::max(socket_max, s);
+        if (events.requested & (RECV | SEND)) {
+            socket_max = std::max(socket_max, s);
+        }
     }
 
     timeval tv = MillisToTimeval(timeout);

From 54c97386671a0825f6cf8ef5793733044f62badb Mon Sep 17 00:00:00 2001
From: Konstantin Akimov <github@knstqq.com>
Date: Mon, 26 Oct 2026 16:47:35 +0000
Subject: [PATCH 46/51] Merge bitcoin/bitcoin#36667: net: enforce timeout
 interval for paused send peers

cc2534cdf7b14d0f1a18928ebaab7f7fdd7e839e net: enforce timeout interval for paused send peers (Antoine Poinsot)

Pull request description:

  Today it's possible to keep some peers running ancient versions paused for a long time. If such a peer is so slow to read as to not drain our send buffer down to the 1MB threshold within a reasonable time frame, we really shouldn't be wasting a connection slot on them. I picked 20 minutes as the reasonable time frame, since it's what we already use for ping timeouts today.

ACKs for top commit:
  instagibbs:
    ACK https://github.com/bitcoin/bitcoin/pull/36667/commits/cc2534cdf7b14d0f1a18928ebaab7f7fdd7e839e
  sedited:
    Re-ACK cc2534cdf7b14d0f1a18928ebaab7f7fdd7e839e
  l0rinc:
    tested ACK cc2534cdf7b14d0f1a18928ebaab7f7fdd7e839e

Tree-SHA512: 05e0ab6bc7908ea533612c5d4bf5757545936e18a056fa04448615ef096e9477f007bf241b311a888ef0570e31a227140305e4d4aec2687d2d88462df9bb2a1a

Co-authored-by: merge-script <fanquake@gmail.com>
(cherry picked from commit 7a217529808b3f2145ad1c198832b9ab317ca7e0)
---
 src/net.cpp | 19 +++++++++++++++++--
 src/net.h   |  2 ++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/src/net.cpp b/src/net.cpp
index 74b48a7096e5..38ba21d4b13b 100644
--- a/src/net.cpp
+++ b/src/net.cpp
@@ -1762,7 +1762,11 @@ std::pair<size_t, bool> CConnman::SocketSendData(CNode& node) const
         }
     }
 
-    node.fPauseSend = node.m_send_memusage + node.m_transport->GetSendMemoryUsage() > nSendBufferMaxSize;
+    const bool pause_send{node.m_send_memusage + node.m_transport->GetSendMemoryUsage() > nSendBufferMaxSize};
+    if (pause_send && !node.fPauseSend) {
+        node.m_pause_send_since = GetTime<std::chrono::seconds>();
+    }
+    node.fPauseSend = pause_send;
 
     if (it == node.vSendMsg.end()) {
         assert(node.m_send_memusage == 0);
@@ -2320,6 +2324,14 @@ bool CConnman::InactivityCheck(const CNode& node) const
         return true;
     }
 
+    if (node.fPauseSend) {
+        const auto last_pause{node.m_pause_send_since.load()};
+        if (now > last_pause + TIMEOUT_INTERVAL) {
+            LogPrint(BCLog::NET, "send buffer full for %is peer=%d\n", count_seconds(now - last_pause), node.GetId());
+            return true;
+        }
+    }
+
     if (!node.fSuccessfullyConnected) {
         if (node.m_transport->GetInfo().transport_type == TransportProtocolType::DETECTING) {
             LogPrint(BCLog::NET, "V2 handshake timeout peer=%d\n", node.GetId());
@@ -4885,7 +4897,10 @@ void CConnman::PushMessage(CNode* pnode, CSerializedNetMsg&& msg)
 
         // Update memory usage of send buffer.
         pnode->m_send_memusage += msg.GetMemoryUsage();
-        if (pnode->m_send_memusage + pnode->m_transport->GetSendMemoryUsage() > nSendBufferMaxSize) pnode->fPauseSend = true;
+        if (pnode->m_send_memusage + pnode->m_transport->GetSendMemoryUsage() > nSendBufferMaxSize && !pnode->fPauseSend) {
+            pnode->m_pause_send_since = GetTime<std::chrono::seconds>();
+            pnode->fPauseSend = true;
+        }
         // Move message to vSendMsg queue.
         pnode->vSendMsg.push_back(std::move(msg));
         pnode->nSendMsgSize = pnode->vSendMsg.size();
diff --git a/src/net.h b/src/net.h
index 3b1ded7de0fb..c23545887849 100644
--- a/src/net.h
+++ b/src/net.h
@@ -828,6 +828,8 @@ class CNode
 
     std::atomic_bool fPauseRecv{false};
     std::atomic_bool fPauseSend{false};
+    /** When was fPauseSend last set from false to true */
+    std::atomic<std::chrono::seconds> m_pause_send_since{0s};
 
     std::atomic_bool fHasRecvData{false};
     std::atomic_bool fCanSendData{false};

From db98ee247c99eb0c8d87f95862c0af6251d0e0fc Mon Sep 17 00:00:00 2001
From: Konstantin Akimov <github@knstqq.com>
Date: Thu, 29 Oct 2026 12:42:54 +0700
Subject: [PATCH 47/51] fix: keep flat-file positions 64-bit clean at the
 remaining raw seek/tell sites

bitcoin#36669 widens FlatFilePos::nPos to 64 bits, but Dash still captures
the write position in WriteBlockToDisk and UndoWriteToDisk through a 32-bit
`long ftell()` and then narrows it with `(unsigned int)`. That cast is where
a position past 4 GiB wraps, and the `long` return is where Windows fails
past 2 GiB, so the widened field alone changes nothing at the write site.
Upstream dropped these lines when AutoFile started caching its position
(bitcoin#30884, bitcoin#31490), which Dash has not backported.

TxIndex::FindTx still seeks with a raw `fseek()` where upstream now goes
through AutoFile::seek(), itself a FileSeek64() wrapper.

Route both through FileTell64()/FileSeek64() and assign the position
without narrowing.

(cherry picked from commit 58b9bce32692f37f3da18378586a28c5c96cf951)

v24.0.x adaptation: FileSeek64/FileTell64 are declared in util/fs_helpers.h on
this branch, so txindex.cpp and blockstorage.cpp include it, and txindex.cpp
keeps this branch's LogError() + return false error path.
BlockFilterIndex::LookupFilterRange, which exists only on this branch, seeks on
a FlatFilePos the same way and is routed through FileSeek64() too.
---
 src/index/blockfilterindex.cpp | 2 +-
 src/index/txindex.cpp          | 3 ++-
 src/node/blockstorage.cpp      | 9 +++++----
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/index/blockfilterindex.cpp b/src/index/blockfilterindex.cpp
index a2229c6667a6..3116594eb9cc 100644
--- a/src/index/blockfilterindex.cpp
+++ b/src/index/blockfilterindex.cpp
@@ -492,7 +492,7 @@ bool BlockFilterIndex::LookupFilterRange(int start_height, const CBlockIndex* st
         if (!file || entry.pos.nFile != file_num) {
             file = std::make_unique<AutoFile>(m_filter_fileseq->Open(entry.pos, true));
             file_num = entry.pos.nFile;
-        } else if (fseek(file->Get(), entry.pos.nPos, SEEK_SET) != 0) {
+        } else if (FileSeek64(file->Get(), entry.pos.nPos, SEEK_SET) != 0) {
             LogError("%s: unable to seek to position %u in filter file %d\n",
                      __func__, entry.pos.nPos, entry.pos.nFile);
             return false;
diff --git a/src/index/txindex.cpp b/src/index/txindex.cpp
index 7cb5069f43e1..000b8ebe2cc7 100644
--- a/src/index/txindex.cpp
+++ b/src/index/txindex.cpp
@@ -6,6 +6,7 @@
 
 #include <index/disktxpos.h>
 #include <node/blockstorage.h>
+#include <util/fs_helpers.h>
 #include <util/system.h>
 #include <validation.h>
 
@@ -87,7 +88,7 @@ bool TxIndex::FindTx(const uint256& tx_hash, uint256& block_hash, CTransactionRe
     CBlockHeader header;
     try {
         file >> header;
-        if (fseek(file.Get(), postx.nTxOffset, SEEK_CUR)) {
+        if (FileSeek64(file.Get(), postx.nTxOffset, SEEK_CUR)) {
             LogError("%s: fseek(...) failed\n", __func__);
             return false;
         }
diff --git a/src/node/blockstorage.cpp b/src/node/blockstorage.cpp
index 1f2680fa0a6c..ff04bdb8ab2a 100644
--- a/src/node/blockstorage.cpp
+++ b/src/node/blockstorage.cpp
@@ -15,6 +15,7 @@
 #include <streams.h>
 #include <undo.h>
 #include <util/fs.h>
+#include <util/fs_helpers.h>
 #include <util/system.h>
 #include <validation.h>
 #include <walletinitinterface.h>
@@ -520,12 +521,12 @@ static bool UndoWriteToDisk(const CBlockUndo& blockundo, FlatFilePos& pos, const
     fileout << messageStart << nSize;
 
     // Write undo data
-    long fileOutPos = ftell(fileout.Get());
+    const int64_t fileOutPos{FileTell64(fileout.Get())};
     if (fileOutPos < 0) {
         LogError("%s: ftell failed\n", __func__);
         return false;
     }
-    pos.nPos = (unsigned int)fileOutPos;
+    pos.nPos = fileOutPos;
     fileout << blockundo;
 
     // calculate & write checksum
@@ -759,12 +760,12 @@ static bool WriteBlockToDisk(const CBlock& block, FlatFilePos& pos, const CMessa
     fileout << messageStart << nSize;
 
     // Write block
-    long fileOutPos = ftell(fileout.Get());
+    const int64_t fileOutPos{FileTell64(fileout.Get())};
     if (fileOutPos < 0) {
         LogError("WriteBlockToDisk: ftell failed\n");
         return false;
     }
-    pos.nPos = (unsigned int)fileOutPos;
+    pos.nPos = fileOutPos;
     fileout << block;
 
     return true;

From 37593978ae7337d7a2e809997e2b1cd0013f6168 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Thu, 8 Oct 2026 18:59:54 -0500
Subject: [PATCH 48/51] Merge #7833: fix: gate signing intake before quorum
 retrieval

438708e9cf885b5ff20b8c5751c464ad305bb7ad fix: gate signing intake before quorum retrieval (pasta)

Pull request description:

  ## Issue being fixed or feature implemented
  Signing-session announcements (`QSIGSESANN`) and direct sig shares (`QSIGSHARE`) resolved the referenced quorum before checking whether it belongs to the retained active signing set. A peer could therefore make a node build or load historical quorums, and an announcement for a stale quorum created a receiving session. The reachable admission defect is reproduced; CPU/exhaustion magnitude is unmeasured.

  ## What was done?
  Run the existing active-quorum predicate (`IsQuorumActive`) before quorum retrieval in `ProcessMessageSigSesAnn` and `ProcessMessageSigShare`. The per-peer session capacity check under the session mutex is unchanged. `PreVerifySigShareQuorum` keeps its own active-quorum check on purpose, because the batched path depends on it. This is a Dash-specific change with no corresponding Bitcoin backport.

  ## How Has This Been Tested?
  On macOS arm64 with the existing depends configuration, `make` of `dashd`, `dash-cli`, `dash-wallet` and `test_dash`; the full `llmq_utils_tests` suite, include lint, circular dependency lint and `git diff --check` passed. `feature_llmq_signing.py` (both variants), `feature_llmq_is_retroactive.py` and `p2p_quorum_data.py` passed. No dedicated unit test is included: the change only reorders an existing active-quorum check ahead of quorum retrieval. No CPU benchmark, sanitizer stress or operational exhaustion demonstration is claimed.

  ## Breaking Changes
  None. Existing active-quorum policy and wire formats are preserved.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

  No user-facing documentation change is required.

Top commit has no ACKs.

Tree-SHA512: 2490d8320f21e71fff1b55a6b7785843960c0027a7e91f922e474df835ecce4b649f34b9bd7d919d16c76a3d654fadeb2667ea3439bff3a6a29b2464322a3b70
(cherry picked from commit 18de2e580f68eb8291996dd0d0e8dbd7b11e569c)
---
 src/llmq/signing_shares.cpp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/src/llmq/signing_shares.cpp b/src/llmq/signing_shares.cpp
index 8d1a123e0452..cf9f62e02d1b 100644
--- a/src/llmq/signing_shares.cpp
+++ b/src/llmq/signing_shares.cpp
@@ -261,6 +261,10 @@ bool CSigSharesManager::ProcessMessageSigSesAnn(const CNode& pfrom, const CSigSe
 
     LogPrint(BCLog::LLMQ_SIGS, "CSigSharesManager::%s -- ann={%s}, node=%d\n", __func__, ann.ToString(), pfrom.GetId());
 
+    if (!IsQuorumActive(llmqType, qman, ann.getQuorumHash())) {
+        return true;
+    }
+
     auto quorum = qman.GetQuorum(llmqType, ann.getQuorumHash());
     if (!quorum) {
         // TODO should we ban here?
@@ -440,6 +444,10 @@ bool CSigSharesManager::ProcessMessageBatchedSigShares(const CNode& pfrom, const
 
 bool CSigSharesManager::ProcessMessageSigShare(NodeId fromId, const CSigShare& sigShare)
 {
+    if (!IsQuorumActive(sigShare.getLlmqType(), qman, sigShare.getQuorumHash())) {
+        return true;
+    }
+
     auto quorum = qman.GetQuorum(sigShare.getLlmqType(), sigShare.getQuorumHash());
     if (!quorum) {
         return true;

From 18073dd794150c14f7324d974c4e8f5af7f2b98a Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Sat, 10 Oct 2026 17:50:58 -0500
Subject: [PATCH 49/51] Merge #7850: perf: let CHECKDATASIG use the signature
 cache
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

344f05d7d0d85570ef07c91f26b0947515621d77 perf: let CHECKDATASIG use the signature cache (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  `CHECKDATASIG` / `CHECKDATASIGVERIFY` verify their ECDSA signature by calling `CPubKey::Verify` directly from the interpreter. Transaction signatures instead go through `GenericTransactionSignatureChecker::VerifySignature`, which `CachingTransactionSignatureChecker` overrides to consult the salted signature cache. As a result, a data signature that was already verified at mempool admission is verified again when the block connects, and a script full of data signatures gets no help from the cache.

  ## What was done?

  - New virtual `BaseSignatureChecker::CheckDataSig(sig, message, pubkey)`. The base implementation keeps today's behaviour: the raw signature, `SHA256(message)` and `CPubKey::Verify`. Checkers without a transaction (`BaseSignatureChecker`, `DummySignatureChecker`, the fuzz checker) are therefore unchanged.
  - `GenericTransactionSignatureChecker` implements it through its virtual `VerifySignature`. Like `CheckSig`, it first rejects a public key that `CPubKey` considers invalid. An invalid key contributes no bytes to a signature cache entry, so without that check `(hash, <invalid key>, key || sig)` would alias the cached entry for `(hash, key, sig)`. `CPubKey::Verify` already returns false for an invalid key, so results don't change. `CachingTransactionSignatureChecker` then stores and looks up data signatures as it does any other (hash, signature, public key) triple. `DeferringSignatureChecker` forwards the call.
  - The interpreter keeps its encoding checks, empty-signature handling (an empty signature never reaches the checker) and NULLFAIL handling. It now asks the checker instead of calling `CPubKey::Verify` itself.

  Sharing the cache is safe: an entry records that `CPubKey::Verify(hash, sig)` succeeded for that public key. The data-signature path makes the same call with the same arguments it would make without the cache, so a hit is exactly as strong as the verification it replaces. A transaction signature and a data signature can only share an entry if they share the hash, signature and key, and then both verify anyway.

  Two side effects. Block connection looks up entries without storing, and a hit marks the entry discardable. An identical data signature repeated across several transactions may therefore be verified again once its entry is evicted, exactly as for transaction signatures. Data signatures now also take signature cache slots. Each one is a verification the node already performs.

  ## How Has This Been Tested?

  macOS arm64, depends build, `make -j1`.

  - The existing `checkdatasig_tests/checkdatasig_test` matrix now runs every case through `BaseSignatureChecker`, `TransactionSignatureChecker` and `CachingTransactionSignatureChecker` (storing). The matrix covers pubkey encodings, high-S, non-DER, NULLFAIL, empty signatures, and no flags versus standard flags. All three checkers give identical results.
  - New `checkdatasig_signature_cache_controls`: after a storing caching checker accepts a valid data signature, a lookup-only checker still accepts it. It rejects the same signature with a changed message or a different public key, and rejects a corrupted signature, including after the corrupted one has gone through the storing checker. It then moves the public key into the signature (`key || sig`) and passes an empty, 1-byte or truncated public key. Each must be rejected even with the valid entry freshly stored. Without the `IsValid` check, these aliases hit the cached entry and verify.
  - `./src/test/test_dash --run_test='checkdatasig_tests:dip0020opcodes_tests:script_tests:script_p2sh_tests:transaction_tests:txvalidationcache_tests:multisig_tests:sigopcount_tests'`: 40 cases, no errors.
  - `git diff --check`, `lint-whitespace.py`, `lint-circular-dependencies.py`, `lint-includes.py`, `lint-logs.py`: clean.

  Limits:
  - The cache is internal, so a cache hit is not observed directly. The tests show that the cache path is reached and that it never accepts anything the direct check would reject.
  - No benchmark was run.

  ## Breaking Changes

  None. Script results are unchanged. Data signatures are now cached like transaction signatures.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

ACKs for top commit:
  knst:
    utACK 344f05d7d0d85570ef07c91f26b0947515621d77

Tree-SHA512: e7825cc356f970e50b208e8ebd82d8fc08c974e7357bc17b9916f1fedeaf7007f2672e7853a83782cbb4d447eff7beb04820d90fd88205eeb90944c38475da12
(cherry picked from commit 0981a582f524d514a3dbe8a8d1e8f6d572c9f6fd)
---
 src/script/interpreter.cpp      | 31 +++++++++--
 src/script/interpreter.h        | 11 ++++
 src/test/checkdatasig_tests.cpp | 99 ++++++++++++++++++++++++++++-----
 3 files changed, 123 insertions(+), 18 deletions(-)

diff --git a/src/script/interpreter.cpp b/src/script/interpreter.cpp
index 4206676612f5..f997090edd62 100644
--- a/src/script/interpreter.cpp
+++ b/src/script/interpreter.cpp
@@ -1063,11 +1063,7 @@ bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript&
 
                     bool fSuccess = false;
                     if (vchSig.size()) {
-                        valtype vchHash(32);
-                        CSHA256()
-                            .Write(vchMessage.data(), vchMessage.size())
-                            .Finalize(vchHash.data());
-                        fSuccess = CPubKey(vchPubKey).Verify(uint256(vchHash), vchSig);
+                        fSuccess = checker.CheckDataSig(vchSig, vchMessage, vchPubKey);
                     }
 
                     if (!fSuccess && (flags & SCRIPT_VERIFY_NULLFAIL) && vchSig.size()) {
@@ -1533,12 +1529,37 @@ uint256 SignatureHash(const CScript& scriptCode, const T& txTo, unsigned int nIn
 template uint256 SignatureHash<CMutableTransaction>(const CScript& scriptCode, const CMutableTransaction& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache);
 template uint256 SignatureHash<CTransaction>(const CScript& scriptCode, const CTransaction& txTo, unsigned int nIn, int nHashType, const CAmount& amount, SigVersion sigversion, const PrecomputedTransactionData* cache);
 
+static uint256 DataSignatureHash(const std::vector<unsigned char>& vchMessage)
+{
+    uint256 hash;
+    CSHA256().Write(vchMessage.data(), vchMessage.size()).Finalize(hash.begin());
+    return hash;
+}
+
+bool BaseSignatureChecker::CheckDataSig(const std::vector<unsigned char>& vchSig, const std::vector<unsigned char>& vchMessage,
+                                        const std::vector<unsigned char>& vchPubKey) const
+{
+    return CPubKey(vchPubKey).Verify(DataSignatureHash(vchMessage), vchSig);
+}
+
 template <class T>
 bool GenericTransactionSignatureChecker<T>::VerifySignature(const std::vector<unsigned char>& vchSig, const CPubKey& pubkey, const uint256& sighash) const
 {
     return pubkey.Verify(sighash, vchSig);
 }
 
+template <class T>
+bool GenericTransactionSignatureChecker<T>::CheckDataSig(const std::vector<unsigned char>& vchSig,
+                                                         const std::vector<unsigned char>& vchMessage,
+                                                         const std::vector<unsigned char>& vchPubKey) const
+{
+    // An invalid key serializes to no bytes in the signature cache entry, so it must not reach the cache
+    const CPubKey pubkey(vchPubKey);
+    if (!pubkey.IsValid()) return false;
+    // Through the virtual VerifySignature, so CachingTransactionSignatureChecker caches the result
+    return VerifySignature(vchSig, pubkey, DataSignatureHash(vchMessage));
+}
+
 template <class T>
 bool GenericTransactionSignatureChecker<T>::CheckSig(const std::vector<unsigned char>& vchSigIn, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const
 {
diff --git a/src/script/interpreter.h b/src/script/interpreter.h
index df0b1548f414..e6ec7d3392aa 100644
--- a/src/script/interpreter.h
+++ b/src/script/interpreter.h
@@ -156,6 +156,10 @@ class BaseSignatureChecker
          return false;
     }
 
+    /** Verify vchSig as an ECDSA signature by vchPubKey over SHA256(vchMessage), as CHECKDATASIG does */
+    virtual bool CheckDataSig(const std::vector<unsigned char>& vchSig, const std::vector<unsigned char>& vchMessage,
+                              const std::vector<unsigned char>& vchPubKey) const;
+
     virtual ~BaseSignatureChecker() {}
 };
 
@@ -187,6 +191,8 @@ class GenericTransactionSignatureChecker : public BaseSignatureChecker
     bool CheckSig(const std::vector<unsigned char>& scriptSig, const std::vector<unsigned char>& vchPubKey, const CScript& scriptCode, SigVersion sigversion) const override;
     bool CheckLockTime(const CScriptNum& nLockTime) const override;
     bool CheckSequence(const CScriptNum& nSequence) const override;
+    bool CheckDataSig(const std::vector<unsigned char>& vchSig, const std::vector<unsigned char>& vchMessage,
+                      const std::vector<unsigned char>& vchPubKey) const override;
 };
 
 using TransactionSignatureChecker = GenericTransactionSignatureChecker<CTransaction>;
@@ -212,6 +218,11 @@ class DeferringSignatureChecker : public BaseSignatureChecker
     {
         return m_checker.CheckSequence(nSequence);
     }
+    bool CheckDataSig(const std::vector<unsigned char>& vchSig, const std::vector<unsigned char>& vchMessage,
+                      const std::vector<unsigned char>& vchPubKey) const override
+    {
+        return m_checker.CheckDataSig(vchSig, vchMessage, vchPubKey);
+    }
 };
 
 bool EvalScript(std::vector<std::vector<unsigned char> >& stack, const CScript& script, unsigned int flags, const BaseSignatureChecker& checker, SigVersion sigversion, ScriptError* error = nullptr);
diff --git a/src/test/checkdatasig_tests.cpp b/src/test/checkdatasig_tests.cpp
index 70e4544fc4a6..231d4323d8ee 100644
--- a/src/test/checkdatasig_tests.cpp
+++ b/src/test/checkdatasig_tests.cpp
@@ -3,7 +3,9 @@
 // file COPYING or http://www.opensource.org/licenses/mit-license.php.
 
 #include <policy/policy.h>
+#include <primitives/transaction.h>
 #include <script/interpreter.h>
+#include <script/sigcache.h>
 
 #include <test/lcg.h>
 #include <test/util/setup_common.h>
@@ -11,6 +13,7 @@
 #include <boost/test/unit_test.hpp>
 
 #include <array>
+#include <functional>
 
 typedef std::vector<uint8_t> valtype;
 typedef std::vector<valtype> stacktype;
@@ -36,27 +39,46 @@ struct KeyData {
     }
 };
 
+static CMutableTransaction SpendingTx()
+{
+    CMutableTransaction tx;
+    tx.vin.resize(1);
+    return tx;
+}
+
+//! Data signatures must behave the same with the plain, transaction and caching signature checkers
+static void ForEachChecker(const std::function<void(const BaseSignatureChecker&)>& check)
+{
+    const CTransaction tx{SpendingTx()};
+    PrecomputedTransactionData txdata;
+    check(BaseSignatureChecker{});
+    check(TransactionSignatureChecker{&tx, 0, 0, MissingDataBehavior::FAIL});
+    check(CachingTransactionSignatureChecker{&tx, 0, 0, txdata, /*storeIn=*/true});
+}
+
 static void CheckError(uint32_t flags, const stacktype& original_stack,
                        const CScript& script, ScriptError expected)
 {
-    BaseSignatureChecker sigchecker;
-    ScriptError err = ScriptError::SCRIPT_ERR_OK;
-    stacktype stack{original_stack};
-    bool r = EvalScript(stack, script, flags, sigchecker, SigVersion::BASE, &err);
-    BOOST_CHECK(!r);
-    BOOST_CHECK(err == expected);
+    ForEachChecker([&](const BaseSignatureChecker& sigchecker) {
+        ScriptError err = ScriptError::SCRIPT_ERR_OK;
+        stacktype stack{original_stack};
+        bool r = EvalScript(stack, script, flags, sigchecker, SigVersion::BASE, &err);
+        BOOST_CHECK(!r);
+        BOOST_CHECK(err == expected);
+    });
 }
 
 static void CheckPass(uint32_t flags, const stacktype& original_stack,
                       const CScript& script, const stacktype& expected)
 {
-    BaseSignatureChecker sigchecker;
-    ScriptError err = ScriptError::SCRIPT_ERR_OK;
-    stacktype stack{original_stack};
-    bool r = EvalScript(stack, script, flags, sigchecker, SigVersion::BASE, &err);
-    BOOST_CHECK(r);
-    BOOST_CHECK(err == ScriptError::SCRIPT_ERR_OK);
-    BOOST_CHECK(stack == expected);
+    ForEachChecker([&](const BaseSignatureChecker& sigchecker) {
+        ScriptError err = ScriptError::SCRIPT_ERR_OK;
+        stacktype stack{original_stack};
+        bool r = EvalScript(stack, script, flags, sigchecker, SigVersion::BASE, &err);
+        BOOST_CHECK(r);
+        BOOST_CHECK(err == ScriptError::SCRIPT_ERR_OK);
+        BOOST_CHECK(stack == expected);
+    });
 }
 
 /**
@@ -230,4 +252,55 @@ BOOST_AUTO_TEST_CASE(checkdatasig_test)
     }
 }
 
+static uint256 MessageHash(const valtype& message)
+{
+    uint256 hash;
+    CSHA256().Write(message.data(), message.size()).Finalize(hash.begin());
+    return hash;
+}
+
+// A cached valid data signature must not validate a different message, key or signature.
+BOOST_AUTO_TEST_CASE(checkdatasig_signature_cache_controls)
+{
+    KeyData kd;
+    const valtype message{0x03, 0x04};
+    valtype sig;
+    BOOST_REQUIRE(kd.privkeyC.Sign(MessageHash(message), sig));
+    const valtype pubkey{ToByteVector(kd.pubkeyC)};
+    CKey other_key;
+    other_key.MakeNewKey(/*fCompressed=*/true);
+    valtype bad_sig{sig};
+    bad_sig[bad_sig.size() - 1] ^= 0x01;
+
+    const CTransaction tx{SpendingTx()};
+    PrecomputedTransactionData txdata;
+    const CachingTransactionSignatureChecker storing{&tx, 0, 0, txdata, /*storeIn=*/true};
+    const CachingTransactionSignatureChecker lookup{&tx, 0, 0, txdata, /*storeIn=*/false};
+    const auto result = [](const BaseSignatureChecker& checker, const stacktype& args) {
+        stacktype stack{args};
+        ScriptError err;
+        BOOST_REQUIRE(EvalScript(stack, CScript() << OP_CHECKDATASIG, SCRIPT_VERIFY_NONE, checker, SigVersion::BASE, &err));
+        return stack == stacktype{{0x01}};
+    };
+
+    BOOST_CHECK(result(storing, {sig, message, pubkey}));
+    BOOST_CHECK(result(lookup, {sig, message, pubkey}));
+    BOOST_CHECK(!result(lookup, {sig, {0x03, 0x05}, pubkey}));
+    BOOST_CHECK(!result(lookup, {sig, message, ToByteVector(other_key.GetPubKey())}));
+    BOOST_CHECK(!result(lookup, {bad_sig, message, pubkey}));
+    BOOST_CHECK(!result(storing, {bad_sig, message, pubkey}));
+    BOOST_CHECK(!result(lookup, {bad_sig, message, pubkey}));
+
+    // An invalid public key adds no bytes to a cache entry, so moving the key into the signature must
+    // not match the cached (message, key, signature) entry
+    valtype alias{pubkey};
+    alias.insert(alias.end(), sig.begin(), sig.end());
+    for (const valtype& invalid_pubkey : {valtype{}, valtype{0x02}, valtype(pubkey.begin(), pubkey.end() - 1)}) {
+        // A lookup-only hit marks its entry discardable, so store the valid one again to keep it
+        BOOST_REQUIRE(result(storing, {sig, message, pubkey}));
+        BOOST_CHECK(!result(storing, {alias, message, invalid_pubkey}));
+        BOOST_CHECK(!result(lookup, {alias, message, invalid_pubkey}));
+    }
+}
+
 BOOST_AUTO_TEST_SUITE_END()

From 25d7c858f70fa1920609c9b1684ad6ef97f53d16 Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 14 Oct 2026 21:50:47 -0500
Subject: [PATCH 50/51] Merge #7826: fix: skip repeated authenticated Platform
 bans
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

2039964234da7a29c0d6433e8003b6ddcf40d00e fix: skip repeated authenticated Platform bans (pasta)

Pull request description:

  ## Issue being fixed or feature implemented
  Direct Platform ban messages repeat signature verification, handler logging and relay work even when the same authenticated context is already cached. Identical same-height ban updates also report a successful metadata transition. A sender needs a legitimate recent ban for an existing EvoNode to trigger this redundant work; no throughput loss or node outage is claimed.

  ## What was done?
  Check the existing authenticated-object cache before handler logging and verification, while preserving request bookkeeping. Make identical same-height bans idempotent and remember authenticated contexts even when a newer metadata watermark rejects the update, including after restart. Unknown contexts still pass all target, height, quorum and signature checks. Unsolicited first-hop ingress, historical quorum acceptance, newer-height watermark advancement and same-height ban precedence are preserved.

  ## How Has This Been Tested?
  On macOS arm64, `p2p_platform_ban.py` passed. A legitimate signed ban still propagates and affects the next quorum. Resending one identical direct message produces no new `PLATFORMBAN -- hash:` handler log, and a service update revives the EvoNode. This check would fail on develop, where the handler logs before any cache check.

  No replay throughput benchmark, log-amplification measurement or outage demonstration was performed. The skipped BLS work follows from the early return being placed before verification.

  ## Breaking Changes
  None

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [ ] I have assigned this pull request to a milestone

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

Top commit has no ACKs.

Tree-SHA512: 0b0d7e8f508e2ad3302d885a2f105822504dff3b344a83b660f59c63096d254cb3dfce71383b7b00ce6ba37762c76a202fc9857f6a8046609d71601a8fcb8a43
(cherry picked from commit ea1b30ff4737882521298cbf2b7bd6e61f2c2b52)
---
 src/masternode/meta.cpp             | 9 ++++-----
 src/masternode/meta.h               | 2 +-
 src/net_processing.cpp              | 8 ++++++--
 test/functional/p2p_platform_ban.py | 5 +++++
 4 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/src/masternode/meta.cpp b/src/masternode/meta.cpp
index 2c7a67e0d221..d1a37f3d5f44 100644
--- a/src/masternode/meta.cpp
+++ b/src/masternode/meta.cpp
@@ -200,11 +200,10 @@ bool CMasternodeMetaMan::SetPlatformBan(const uint256& inv_hash, PlatformBanMess
 
     const uint256& protx_hash = ban_msg.m_protx_hash;
 
-    bool ret = GetMetaInfo(protx_hash).SetPlatformBan(true, ban_msg.m_requested_height);
-    if (ret) {
-        m_seen_platform_bans.emplace(inv_hash, std::move(ban_msg));
-    }
-    return ret;
+    const bool changed = GetMetaInfo(protx_hash).SetPlatformBan(true, ban_msg.m_requested_height);
+    // Remember authenticated messages even when newer metadata supersedes them.
+    m_seen_platform_bans.emplace(inv_hash, std::move(ban_msg));
+    return changed;
 }
 
 bool CMasternodeMetaMan::AlreadyHavePlatformBan(const uint256& inv_hash) const
diff --git a/src/masternode/meta.h b/src/masternode/meta.h
index 2e51680b740a..552ff2d14e62 100644
--- a/src/masternode/meta.h
+++ b/src/masternode/meta.h
@@ -75,7 +75,7 @@ class CMasternodeMetaInfo
         if (height < m_platform_ban_updated) {
             return false;
         }
-        if (height == m_platform_ban_updated && !is_banned) {
+        if (height == m_platform_ban_updated && (!is_banned || m_platform_ban)) {
             return false;
         }
         m_platform_ban = is_banned;
diff --git a/src/net_processing.cpp b/src/net_processing.cpp
index c41876bc606c..93754ee7d20b 100644
--- a/src/net_processing.cpp
+++ b/src/net_processing.cpp
@@ -3850,14 +3850,18 @@ MessageProcessingResult PeerManagerImpl::ProcessPlatformBanMessage(NodeId node,
 
     const uint256 hash = ban_msg.GetHash();
 
-    LogPrintf("PLATFORMBAN -- hash: %s protx_hash: %s height: %d peer=%d\n", hash.ToString(), ban_msg.m_protx_hash.ToString(), ban_msg.m_requested_height, node);
-
     // NOTE: deliberately no solicitation gate here, unlike the other GETDATA-only object types.
     // PLATFORMBAN has no local ingress (no RPC, no internal producer): the originating Dash
     // Platform node injects the ban by pushing the message straight to a Dash Core peer, so the
     // first hop is always unsolicited by design. See p2p_platform_ban.py.
     MessageProcessingResult ret{};
     ret.m_to_erase = CInv{MSG_PLATFORM_BAN, hash};
+    if (m_mn_metaman.AlreadyHavePlatformBan(hash)) {
+        return ret;
+    }
+
+    LogPrintf("PLATFORMBAN -- hash: %s protx_hash: %s height: %d peer=%d\n", hash.ToString(),
+              ban_msg.m_protx_hash.ToString(), ban_msg.m_requested_height, node);
 
     const auto list = m_dmnman.GetListAtChainTip();
     auto dmn = list.GetMN(ban_msg.m_protx_hash);
diff --git a/test/functional/p2p_platform_ban.py b/test/functional/p2p_platform_ban.py
index bec6960051ec..405d6e7866f6 100755
--- a/test/functional/p2p_platform_ban.py
+++ b/test/functional/p2p_platform_ban.py
@@ -73,6 +73,11 @@ def run_test(self):
         wait_until_helper(lambda: p2p_node2.message_count["platformban"] > 0, timeout=10, lock=p2p_lock)
         p2p_node2.message_count["platformban"] = 0
 
+        self.log.info("An already verified Platform ban skips handler work")
+        ban_inv_hash = hash256(msg.serialize()[:-96])[::-1].hex()
+        with self.mninfo[2].get_node(self).assert_debug_log([], unexpected_msgs=[f"PLATFORMBAN -- hash: {ban_inv_hash}"]):
+            p2p_node2.send_and_ping(msg)
+
         assert not self.check_banned(self.mninfo[0])
 
         mninfos_valid = self.mninfo.copy()[1:]

From 11ea306e7165284121efb8763fb2c252ed158bef Mon Sep 17 00:00:00 2001
From: pasta <pasta@dashboost.org>
Date: Wed, 28 Oct 2026 11:20:21 -0500
Subject: [PATCH 51/51] Merge #7947: fix: stop quorum key warming from stalling
 DKG on 2-core masternodes
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

540202e6ab4347be6096813d2eec1fe847a785c0 fix(llmq): start the quorum cache warming thread after the quorum DB migration (pasta)
5a20db3ebab068db19502219b45d5d2be5583429 Revert "perf: warm quorum public key shares on the BLS worker pool" (pasta)

Pull request description:

  ## Issue being fixed or feature implemented

  Since the move to v24 release candidates, testnet masternodes on 2-vCPU hosts have been getting PoSe-banned. Roughly every two days one of them drops out of a DKG round. It was the only invalid member of that quorum, and a node that sits in several quorums of the round is banned by that single miss. All of these hosts were synced, connected and otherwise healthy. On 23.1.8 the same hosts had no such misses.

  With `llmq-dkg` logging on, the missed round shows the node's own DKG work waiting for the BLS worker:

  ```
  11:30:12 SleepBeforePhase -- llmq_100_67 qi[0] - starting sleep for 5850 ms, curPhase=2
  11:31:33 verified 32 pending contributions. time=77155
  11:31:33 generating contributions
  11:31:34 sending contributions
  11:31:39 ... did not send any contribution / sending complaint
  ```

  That step usually takes 130–200 ms. Here it took 77 s, and on another node in the same round our own `GenerateContributions` started 55 s late. The contribution phase lasted only about 80 s because blocks came quickly, so both nodes sent their contributions after it closed and were marked invalid.

  The cause is 756fc4fbc7ba from #7659, which moved quorum public key share warming from its own `q-cache` thread onto the `CBLSWorker` pool. Warming computes a share for every member of a quorum, `members * (threshold - 1)` G1 scalar multiplications, in one job. The pool has `clamp(cores / 2, 1, 4)` threads, so a 2-core node has a single FIFO worker shared with `GenerateContributions` and `VerifyContributionShares`, both of which wait on that pool's futures. Per-thread CPU sampling on three affected nodes shows the 2-vCPU worker at 100% for about 4 s while a new `llmq_100_67` quorum (100 × 67) is warmed, at the same moment on every node. Swap-in was close to zero. Testnet also has `llmq_400_60` and `llmq_400_85` (400 × 240 and 400 × 340 multiplications), which explains stalls of tens of seconds. Mainnet has the same 400-member quorum types and many 2-core masternodes.

  ## What was done?

  - Reverted 756fc4fbc7ba, so warming runs on its own `q-cache` thread again and competes for CPU through the OS scheduler instead of queueing in front of DKG jobs. The only conflict was in `quorumsman.h`, where develop's `EXCLUSIVE_LOCKS_REQUIRED(::cs_main, !cs_db)` on `MigrateOldQuorumDB` is kept.
  - Started that thread after `MigrateOldQuorumDB` in the `CQuorumManager` constructor. The old order, also in 23.1.8, leaves a joinable `std::thread` when the migration throws, so `std::terminate` runs instead of a normal init error.

  The memory saving in #7659 came mainly from its test-only defaults (`-par=2 -parbls=2 -rpcthreads=2`, `-maxsigcachesize=1`), which are untouched. This gives back one thread's BLS context, which that commit put at about 0.9 MB per node.

  A possible follow-up, kept out of this release fix: keep warming on the pool but split it into short self-requeueing jobs, and compute shares with multi-scalar multiplication instead of Horner's rule, which runs `threshold - 1` sequential scalar multiplications per share.

  ## How Has This Been Tested?

  - macOS arm64 build, `--enable-debug --enable-werror`, clang with `-Wthread-safety`: clean.
  - `test_dash` suites `bls_tests`, `llmq_*`, `evo_*` and `quorum_proofs_tests` pass.
  - Functional tests `feature_llmq_signing.py` (with and without `--spork21`), `feature_llmq_simplepose.py` (with and without `--disable-spork23`), `feature_llmq_rotation.py` and `feature_llmq_dkgerrors.py` pass.
  - `feature_llmq_data_recovery.py` passed 10 of 12 runs on this branch and 13 of 13 on develop. Both failures came in the first four runs, at line 198, the ChainLock check after recovery; the last eight branch runs, interleaved with eight develop runs, all passed. In the failure I traced, block 192 arrived at .273, the node failed to create its sig share at .283 (`we don't have our skShare`), and its recovered skShare arrived via QDATA at .439. Only 2 of the 3 needed members signed that block, which the test then waits on. In this test warming takes 0–11 ms and isn't on that path, so this looks like an existing race in the test rather than a result of this change.
  - The diagnosis above comes from testnet masternodes running v24.0.0-rc.1/rc.2, using `llmq-dkg` logs and 1 Hz per-thread CPU sampling of `dashd`. The fix itself has not yet run on those nodes. The signal to watch there is `verified N pending contributions` staying under a second while new quorums are warmed.

  ## Breaking Changes

  None.

  ## Checklist:
  - [x] I have performed a self-review of my own code
  - [ ] I have made corresponding changes to the documentation
  - [x] I have assigned this pull request to a milestone _(for repository code-owners and collaborators only)_

  🤖 Generated with [Claude Code](https://claude.com/claude-code)

Top commit has no ACKs.

Tree-SHA512: 68fe175ab183966309fbf70237fb11d994611fe5d31b82c72b43d0dfb97a7a4ade7aaa259d211c8bb78d9b7bfe139418b71c85ca1f00052f68352fb8cc1d1c3a
(cherry picked from commit ecf3669a974d986911a2df885f9543f4c17327e8)
---
 src/bls/bls_worker.cpp  |  5 ----
 src/bls/bls_worker.h    |  1 -
 src/llmq/context.cpp    |  1 -
 src/llmq/quorumsman.cpp | 54 ++++++++++++++++++++++++++++++++---------
 src/llmq/quorumsman.h   | 32 +++++++++++++-----------
 5 files changed, 60 insertions(+), 33 deletions(-)

diff --git a/src/bls/bls_worker.cpp b/src/bls/bls_worker.cpp
index 4df462755953..aeae68b1ed3b 100644
--- a/src/bls/bls_worker.cpp
+++ b/src/bls/bls_worker.cpp
@@ -70,11 +70,6 @@ void CBLSWorker::Stop()
     workerPool.stop(true);
 }
 
-void CBLSWorker::PushJob(std::function<void()> job)
-{
-    workerPool.push([job = std::move(job)](int) { job(); });
-}
-
 #ifndef BUILD_BITCOIN_INTERNAL
 bool CBLSWorker::GenerateContributions(int quorumThreshold, Span<CBLSId> ids, BLSVerificationVectorPtr& vvecRet, std::vector<CBLSSecretKey>& skSharesRet)
 {
diff --git a/src/bls/bls_worker.h b/src/bls/bls_worker.h
index 7e57df6e964c..369058a9591a 100644
--- a/src/bls/bls_worker.h
+++ b/src/bls/bls_worker.h
@@ -56,7 +56,6 @@ class CBLSWorker
 
     void Start(int16_t worker_count);
     void Stop();
-    void PushJob(std::function<void()> job);
 
 #ifndef BUILD_BITCOIN_INTERNAL
     bool GenerateContributions(int threshold, Span<CBLSId> ids, BLSVerificationVectorPtr& vvecRet, std::vector<CBLSSecretKey>& skSharesRet);
diff --git a/src/llmq/context.cpp b/src/llmq/context.cpp
index c94cf1cfa106..b961a0a7ec89 100644
--- a/src/llmq/context.cpp
+++ b/src/llmq/context.cpp
@@ -28,6 +28,5 @@ LLMQContext::LLMQContext(CDeterministicMNManager& dmnman, CEvoDB& evo_db, Chains
 
 LLMQContext::~LLMQContext()
 {
-    qman->InterruptWarming();
     bls_worker->Stop();
 }
diff --git a/src/llmq/quorumsman.cpp b/src/llmq/quorumsman.cpp
index 985aa583bbc8..92f02d9fd987 100644
--- a/src/llmq/quorumsman.cpp
+++ b/src/llmq/quorumsman.cpp
@@ -22,6 +22,7 @@
 #include <chainparams.h>
 #include <dbwrapper.h>
 #include <logging.h>
+#include <util/thread.h>
 #include <util/time.h>
 #include <validation.h>
 
@@ -41,9 +42,17 @@ CQuorumManager::CQuorumManager(CBLSWorker& _blsWorker, CDeterministicMNManager&
     AssertLockHeld(::cs_main);
     mapQuorumsCache.Init(m_chainman.GetConsensus(), /*limit_by_connections=*/false);
     MigrateOldQuorumDB(_evoDb);
+    m_cache_interrupt.reset();
+    m_cache_thread = std::thread(&util::TraceThread, "q-cache", [this] { CacheWarmingThreadMain(); });
 }
 
-CQuorumManager::~CQuorumManager() = default;
+CQuorumManager::~CQuorumManager()
+{
+    if (m_cache_thread.joinable()) {
+        m_cache_interrupt();
+        m_cache_thread.join();
+    }
+}
 
 bool CQuorumManager::GetEncryptedContributions(Consensus::LLMQType llmq_type, const CBlockIndex* block_index,
                                                const std::vector<bool>& valid_members, const uint256& protx_hash,
@@ -620,29 +629,50 @@ void CQuorumManager::WriteContributions(const CQuorumPtr& quorum) const
     quorum->WriteContributions(*db);
 }
 
-void CQuorumManager::QueueQuorumForWarming(CQuorumCPtr pQuorum) const
+void CQuorumManager::CacheWarmingThreadMain() const
 {
-    if (!pQuorum->HasVerificationVector()) {
-        return;
-    }
-    // The job may reference this manager: ~LLMQContext stops the worker pool before destroying it.
-    blsWorker.PushJob([this, pQuorum = std::move(pQuorum)]() {
+    while (!m_cache_interrupt) {
+        CQuorumCPtr pQuorum;
+        {
+            LOCK(m_cache_cs);
+            if (!m_cache_queue.empty()) {
+                pQuorum = std::move(m_cache_queue.front());
+                m_cache_queue.pop_front();
+            };
+        }
+
+        if (!pQuorum) {
+            m_cache_interrupt.sleep_for(std::chrono::milliseconds(100));
+            continue;
+        }
+
         cxxtimer::Timer t(true);
-        LogPrint(BCLog::LLMQ, "CQuorumManager::QueueQuorumForWarming -- type=%d height=%d hash=%s start\n",
+        LogPrint(BCLog::LLMQ, "CQuorumManager::%s -- type=%d height=%d hash=%s start\n", __func__,
                  std23::to_underlying(pQuorum->params.type), pQuorum->m_quorum_base_block_index->nHeight,
                  pQuorum->m_quorum_base_block_index->GetBlockHash().ToString());
+
+        // when then later some other thread tries to get keys, it will be much faster
         for (const auto i : util::irange(pQuorum->members.size())) {
-            if (m_warming_interrupted) {
-                return;
+            if (m_cache_interrupt) {
+                break;
             }
             if (pQuorum->qc->validMembers[i]) {
                 pQuorum->GetPubKeyShare(i);
             }
         }
-        LogPrint(BCLog::LLMQ, "CQuorumManager::QueueQuorumForWarming -- type=%d height=%d hash=%s done. time=%d\n",
+
+        LogPrint(BCLog::LLMQ, "CQuorumManager::%s -- type=%d height=%d hash=%s done. time=%d\n", __func__,
                  std23::to_underlying(pQuorum->params.type), pQuorum->m_quorum_base_block_index->nHeight,
                  pQuorum->m_quorum_base_block_index->GetBlockHash().ToString(), t.count());
-    });
+    }
+}
+
+void CQuorumManager::QueueQuorumForWarming(CQuorumCPtr pQuorum) const
+{
+    if (pQuorum->HasVerificationVector()) {
+        LOCK(m_cache_cs);
+        m_cache_queue.push_back(std::move(pQuorum));
+    }
 }
 
 // TODO: remove in v23
diff --git a/src/llmq/quorumsman.h b/src/llmq/quorumsman.h
index 86d06ae275d9..2955796d41f9 100644
--- a/src/llmq/quorumsman.h
+++ b/src/llmq/quorumsman.h
@@ -14,12 +14,14 @@
 #include <llmq/types.h>
 #include <saltedhasher.h>
 #include <sync.h>
+#include <util/threadinterrupt.h>
 
 #include <gsl/pointers.h>
 
-#include <atomic>
+#include <deque>
 #include <map>
 #include <memory>
+#include <thread>
 
 class CBLSSignature;
 class CBLSWorker;
@@ -94,7 +96,10 @@ class CQuorumManager final
     mutable Uint256LruHashMap<const CBlockIndex*, /*max_size=*/128> quorumBaseBlockIndexCache
         GUARDED_BY(cs_quorumBaseBlockIndexCache);
 
-    std::atomic<bool> m_warming_interrupted{false};
+    mutable Mutex m_cache_cs;
+    mutable std::deque<CQuorumCPtr> m_cache_queue GUARDED_BY(m_cache_cs);
+    mutable CThreadInterrupt m_cache_interrupt;
+    mutable std::thread m_cache_thread;
 
 public:
     CQuorumManager() = delete;
@@ -131,20 +136,20 @@ class CQuorumManager final
 
     // all these methods will lock cs_main for a short period of time
     CQuorumCPtr GetQuorum(Consensus::LLMQType llmqType, const uint256& quorumHash) const
-        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps);
+        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps, !m_cache_cs);
     CQuorumCPtr GetQuorum(Consensus::LLMQType llmqType, const uint256& quorumHash, const CChain& chain) const
-        EXCLUSIVE_LOCKS_REQUIRED(::cs_main, !cs_db, !m_cs_maps);
+        EXCLUSIVE_LOCKS_REQUIRED(::cs_main, !cs_db, !m_cs_maps, !m_cache_cs);
     std::vector<CQuorumCPtr> ScanQuorums(Consensus::LLMQType llmqType, size_t nCountRequested) const
-        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps);
+        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps, !m_cache_cs);
 
     // this one is cs_main-free
     std::vector<CQuorumCPtr> ScanQuorums(Consensus::LLMQType llmqType, gsl::not_null<const CBlockIndex*> pindexStart,
                                          size_t nCountRequested) const
-        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps);
+        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps, !m_cache_cs);
     std::vector<CQuorumCPtr> ScanQuorums(Consensus::LLMQType llmqType,
                                          gsl::not_null<const CBlockIndex*> pindexStart,
                                          size_t nCountRequested, const CChain& chain) const
-        EXCLUSIVE_LOCKS_REQUIRED(::cs_main, !cs_db, !m_cs_maps);
+        EXCLUSIVE_LOCKS_REQUIRED(::cs_main, !cs_db, !m_cs_maps, !m_cache_cs);
 
     std::vector<CFinalCommitment> ScanCommitments(Consensus::LLMQType llmqType, size_t nCountRequested) const
         EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps);
@@ -177,30 +182,29 @@ class CQuorumManager final
     CQuorumPtr GetCachedMutableQuorum(Consensus::LLMQType llmqType, const uint256& quorumHash) const
         EXCLUSIVE_LOCKS_REQUIRED(!m_cs_maps);
     void WriteContributions(const CQuorumPtr& quorum) const EXCLUSIVE_LOCKS_REQUIRED(!cs_db);
-    void QueueQuorumForWarming(CQuorumCPtr pQuorum) const;
-    /** Make queued and running warming jobs return; call before stopping the BLS worker pool */
-    void InterruptWarming() { m_warming_interrupted = true; }
+    void QueueQuorumForWarming(CQuorumCPtr pQuorum) const EXCLUSIVE_LOCKS_REQUIRED(!m_cache_cs);
 
 private:
     // all private methods here are cs_main-free
     std::vector<CQuorumCPtr> ScanQuorums(Consensus::LLMQType llmqType,
                                          gsl::not_null<const CBlockIndex*> pindexStart,
                                          size_t nCountRequested, const CChain* chain) const
-        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps);
+        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps, !m_cache_cs);
     bool BuildQuorumContributions(const CFinalCommitmentPtr& fqc, const std::shared_ptr<CQuorum>& quorum) const;
 
     CQuorumPtr BuildQuorumFromCommitment(Consensus::LLMQType llmqType,
                                          gsl::not_null<const CBlockIndex*> pQuorumBaseBlockIndex,
                                          bool populate_cache) const
-        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps);
+        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps, !m_cache_cs);
 
     CQuorumCPtr GetQuorum(Consensus::LLMQType llmqType, gsl::not_null<const CBlockIndex*> pindex,
                           bool populate_cache = true) const
-        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps);
+        EXCLUSIVE_LOCKS_REQUIRED(!cs_db, !m_cs_maps, !m_cache_cs);
     CQuorumCPtr GetQuorum(Consensus::LLMQType llmqType, gsl::not_null<const CBlockIndex*> pindex,
                           const CChain& chain, bool populate_cache = true) const
-        EXCLUSIVE_LOCKS_REQUIRED(::cs_main, !cs_db, !m_cs_maps);
+        EXCLUSIVE_LOCKS_REQUIRED(::cs_main, !cs_db, !m_cs_maps, !m_cache_cs);
 
+    void CacheWarmingThreadMain() const EXCLUSIVE_LOCKS_REQUIRED(!m_cache_cs);
     void MigrateOldQuorumDB(CEvoDB& evoDb) const EXCLUSIVE_LOCKS_REQUIRED(::cs_main, !cs_db);
 };