Audit report AR-39
Reported privately in an independent security review, 2026-09-18.
- Report date
- 2026-09-18
- Kind
- Docs
- Status on master
- Present
- Proposed issue state
- Open
Summary
The getblocktemplate RPC help for the fee field of each entry in transactions still explains what the value means "for coinbase transactions", but that array never contains the coinbase. The report is correct. The stale clause can mislead authors of mining clients; it is RPC help text only, not IPC. Doc fix, mergeable.
The report
The getblocktemplate result documents transactions as the non-coinbase transactions to include in the next block, and the implementation emits only those. The fee description still says: "for coinbase transactions, this is a negative Number of the total collected block fees (ie, not including the block subsidy)". The report traces this to a dummy coinbase element that was once in the parallel fee vector and later removed; the RPC never emitted it, so the clause describes a result shape clients cannot receive.
It notes the stale help can mislead mining client authors about the transactions array, and that nothing about the RPC response, templates, fees, node state or consensus changes. It gives no test; the result schema and the emit loop show the mismatch.
Proposed change
Remove the coinbase-only clause, keeping the description of ordinary fees and of a missing key:
- {RPCResult::Type::NUM, "fee", "difference in value between transaction inputs and outputs (in satoshis); for coinbase transactions, this is a negative Number of the total collected block fees (ie, not including the block subsidy); if key is not present, fee is unknown and clients MUST NOT assume there isn't one"},
+ {RPCResult::Type::NUM, "fee", "difference in value between transaction inputs and outputs (in satoshis). If key is not present, fee is unknown and clients MUST NOT assume there isn't one"},
Assessment
Present on Bitcoin Core master (line 706). The fix is correct. It concerns the RPC interface, not IPC, and has no runtime effect; outside the survey's scope.
Status
Present on master. Next step: a one-line Bitcoin Core PR. No public PR yet.
Reported privately in an independent security review on 2026-09-18.