Audit report AR-40

Reported privately in an independent security review, 2026-09-19.

Report date

2026-09-19

Kind

Docs

Status on master

Present

Proposed issue state

Open

Summary

A comment on BlockCreateOptions::coinbase_output_script in src/node/mining_types.h still refers to coinbase_max_additional_weight, a field that was renamed to block_reserved_weight. The report is correct. Comment-only fix, mergeable.

The report

The comment on coinbase_output_script says that the script's size and sigops "are not checked against coinbase_max_additional_weight and coinbase_output_max_additional_sigops". The first field was replaced by block_reserved_weight, but this comment kept the old name. The stale identifier obscures which option reserves weight for the block header, transaction count and coinbase transaction; the sigops field named beside it is still current.

The report finds the stale name in v32.0rc1, v32.0rc2 and the development branch. It can mislead callers of the mining interface and reviewers, but changes nothing about template construction, reserve enforcement, consensus or node behaviour. It gives no test.

Proposed change

      * The size and sigops are not checked against
-     * coinbase_max_additional_weight and coinbase_output_max_additional_sigops.
+     * block_reserved_weight and coinbase_output_max_additional_sigops.
      */
     CScript coinbase_output_script{CScript() << OP_TRUE};

Assessment

Present on Bitcoin Core master (line 84). The fix is correct. Comment only, no runtime effect; outside the survey's scope.

Status

Present on master. Next step: a one-line Bitcoin Core PR. No public PR yet.

Reported privately in an independent security review on 2026-09-19.