diff options
author | moneromooo-monero <moneromooo-monero@users.noreply.github.com> | 2016-04-17 14:43:16 +0100 |
---|---|---|
committer | moneromooo-monero <moneromooo-monero@users.noreply.github.com> | 2016-04-17 14:46:17 +0100 |
commit | 70c86561af6de764e117774fe207bb6aafd7728c (patch) | |
tree | 3cb55fe17282f7b0d64a83ed99ac0551430dfe25 /src | |
parent | blockchain: update cumulative block limit when popping a block (diff) | |
download | monero-70c86561af6de764e117774fe207bb6aafd7728c.tar.xz |
blockchain: add missing overflow check for already generated coins
When reaching the tail emission phase, the amount of coins will
eventually go over MONEY_SUPPLY, overflowing 64 bits. There was
a check added to blockchain_storage, but this was not ported to
the blockchain DB version.
Reported by smooth.
Diffstat (limited to 'src')
-rw-r--r-- | src/cryptonote_core/blockchain.cpp | 6 |
1 files changed, 5 insertions, 1 deletions
diff --git a/src/cryptonote_core/blockchain.cpp b/src/cryptonote_core/blockchain.cpp index 0569e748f..88ecb2dad 100644 --- a/src/cryptonote_core/blockchain.cpp +++ b/src/cryptonote_core/blockchain.cpp @@ -2713,7 +2713,11 @@ leave: // populate various metadata about the block to be stored alongside it. block_size = cumulative_block_size; cumulative_difficulty = current_diffic; - already_generated_coins = already_generated_coins + base_reward; + // In the "tail" state when the minimum subsidy (implemented in get_block_reward) is in effect, the number of + // coins will eventually exceed MONEY_SUPPLY and overflow a uint64. To prevent overflow, cap already_generated_coins + // at MONEY_SUPPLY. already_generated_coins is only used to compute the block subsidy and MONEY_SUPPLY yields a + // subsidy of 0 under the base formula and therefore the minimum subsidy >0 in the tail state. + already_generated_coins = base_reward < (MONEY_SUPPLY-already_generated_coins) ? already_generated_coins + base_reward : MONEY_SUPPLY; if(m_db->height()) cumulative_difficulty += m_db->get_block_cumulative_difficulty(m_db->height() - 1); |