Message-Id: <1491690851.2490976.938672304.0FD56767@webmail.messagingengine.com>
From: Tomas <tomas@tomasvdw.nl>
To: Gregory Maxwell <greg@xiph.org>, Johnson Lau <jl2012@xbt.hk>
MIME-Version: 1.0
Content-Transfer-Encoding: 7bit
Content-Type: text/plain; charset="utf-8"
Date: Sun, 09 Apr 2017 00:34:11 +0200
References: <1491516747.3791700.936828232.69F82904@webmail.messagingengine.com>
	<CAAS2fgTJ8xOj8zCmBq1LN9OdMV-tDfSjVUPhLpO98cR1w-QAoA@mail.gmail.com>
	<CA+KqGko0cDY29bhznMxJJ7yAUTuB6GaDDNGBRwzssJUxM_53xQ@mail.gmail.com>
	<1491599691.1245876.937920664.6EBA20DC@webmail.messagingengine.com>
	<CAAS2fgTWyX5M-xcELC2vDvGfs01tbGYkpZJCSeNbvn_p4Ecjqg@mail.gmail.com>
	<1491636528.2474173.938219072.54C44183@webmail.messagingengine.com>
	<6F1E6FB6-1342-4BD6-BF83-A160C1A7CD34@xbt.hk>
	<1491681378.2454247.938587616.7199D633@webmail.messagingengine.com>
	<DF7A05F0-4EA7-4CB3-A9BE-491BDA209EF7@xbt.hk>
	<CAAS2fgSueiF51cg2zotwg5FdZQf_jcUgoBgVr5kiHafxXhc6jQ@mail.gmail.com>
In-Reply-To: <CAAS2fgSueiF51cg2zotwg5FdZQf_jcUgoBgVr5kiHafxXhc6jQ@mail.gmail.com>
Cc: bitcoin-dev <bitcoin-dev@lists.linuxfoundation.org>
Subject: Re: [bitcoin-dev] Using a storage engine without UTXO-index
Precedence: list


On Sun, Apr 9, 2017, at 00:12, Gregory Maxwell wrote:
> In Bitcoin Core the software _explicitly_ and intentionally does not
> exploit mempool pre-validation because doing that very easily leads to
> hard to detect consensus faults and makes all mempool code consensus
> critical when it otherwise is not. There have been bugs in the past
> which would have split the network if this optimization had been used.
> 
> (in particular, I believe I recall one related to correctly removing
> coinbase spends from the mempool during reorganization that made them
> immature; and with the optimization and without the CNB post-test
> would have resulted in nodes that saw the reorg creating and accepting
> an invalid block, while nodes that didn't rejecting it; but because of
> prudent design it was largely harmless).

Although I don't quite follow the details (CNB post-test? Connect block
I assume?), the risks you are describing seem to be rather specific to
Core's implementation. For one, bitcrust does not or use need reorgs at
all.

Do you argue (or can you further explain) that the idea of splitting
script validation (or what you call mempool pre-validation), and order
validation is introducing risks  inherent to the protocol? 

Thanks,
Tomas