fuzz: Use CAmount for storing best_waste
What the developer wrote
Authored by Ava Chow
fuzz: Use CAmount for storing best_waste
Waste is a CAmount, which is an int64_t. This will overflow an int, so
`best_waste` should also be a `CAmount`.
What changed, and why it matters
This is a one-line fix in a fuzz test (automated randomized test) for Bitcoin Core's coin selection logic. It changes a variable that tracks the 'best waste' amount from a 32-bit signed integer to a 64-bit signed integer type, matching the actual CAmount type. The change prevents a possible integer overflow inside the fuzz test itself, not in the production wallet code that handles real Bitcoin transactions. It does not appear to be a security vulnerability in live Bitcoin Core software.
No urgent action. Treat as a normal test-quality fix. If backporting, include it only for fuzzing infrastructure hygiene; it is not a security patch for production nodes.
Security signals we found
Integer overflow risk in test harness variable
Type mismatch between production CAmount and test int
Fuzz test-only change (src/wallet/test/fuzz/coinselection.cpp)
No change to consensus, wallet, or P2P production code
Evidence from the diff
In src/wallet/test/fuzz/coinselection.cpp, the fuzz target bnb_finds_min_waste compares brute-force coin-selection results against the Branch-and-Bound (BnB) solver. The variable best_waste was declared as int and initialized with std::numeric_limits
Changed components
src/wallet/test/fuzz/coinselection.cppFuzz target: bnb_finds_min_wasteInspect captured patch +1 / −1
diff --git a/src/wallet/test/fuzz/coinselection.cpp b/src/wallet/test/fuzz/coinselection.cpp
index 8b30423c..42a53a83 100644
--- a/src/wallet/test/fuzz/coinselection.cpp
+++ b/src/wallet/test/fuzz/coinselection.cpp
@@ -275,7 +275,7 @@ FUZZ_TARGET(bnb_finds_min_waste)
// Brute force optimal solution (lowest waste, but cannot be superset of another solution)
std::vector<uint32_t> solutions;
- int best_waste{std::numeric_limits<int>::max()};
+ CAmount best_waste{std::numeric_limits<int64_t>::max()};
int best_weight{std::numeric_limits<int>::max()};
for (uint32_t pattern = 1; (pattern >> num_groups) == 0; ++pattern) {
// BnB does not permit adding more inputs to a solution, i.e. a superset of a solution cannot ever be a solution.
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.