AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 25 Bitcoin

rpc: fix initialization-order-fiasco by lazy-init of decodepsbt_inputs

Public commit record

What the developer wrote

Authored by Eugene Siegel

73/100 · Adequate
rpc: fix initialization-order-fiasco by lazy-init of decodepsbt_inputs

Prior to this commit, decodepsbt_inputs would call TxDoc during initialization
which lives in another TLU. TxDoc relies on CURRENCY_UNIT to be initialized when
it may not have been (note this is different from the TLU containing
decodepsbt_inputs which also has a CURRENCY_UNIT). Fix this by lazy initializing
decodepsbt_inputs.

Prevent the issue from occurring in the future by also doing the same for
decodepsbt_outputs and getblock_vin.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes a subtle startup bug in Bitcoin Core's RPC help system. Some help text for commands like 'decodepsbt' and 'getblock' was being built before all global constants were ready, which could cause crashes or garbled output when the program starts. The fix delays building that help text until it is actually needed. It is a reliability fix, not a remote attack vector.

Recommended action

Treat as a low-severity hardening/reliability fix. Reviewers should verify that all other RPCResult objects constructed with TxDoc or CURRENCY_UNIT across the codebase use the same lazy-init pattern, and run startup tests on builds with non-deterministic translation-unit ordering.

Security signals we found

01

Static initialization order fiasco (SIOF) in RPC help metadata construction

02

Cross-translation-unit dependency on CURRENCY_UNIT global constant

03

Lazy initialization via function-local static used as fix pattern

04

Potential crash or undefined behavior during process startup

Risk score

Why this scored 25/100

Our methodology →
Potential impact 5/30
Exploitability 2/25
Stealth signal 3/15
Affected reach 4/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.