fix!: address Ironwood review findings across mempool, consensus, rpc, and state - #10884
Merged
Conversation
jvff
reviewed
Jul 2, 2026
arya2
previously approved these changes
Jul 2, 2026
7 tasks
…od pool NU6.3+ routes shielded coinbase value into the Ironwood pool, but `decrypts_successfully` only iterated the Sapling and Orchard bundles, so the all-zero-OVK coinbase decryptability rule (ZIP-213) was never applied to Ironwood coinbase outputs. Add the Ironwood arm using `IronwoodDomain`.
`VerifiedSet` tracked sprout/sapling/orchard nullifiers but not Ironwood, so two mempool txs revealing the same Ironwood nullifier were both admitted, and `reject_and_remove_same_effects` never evicted a mempool tx double-spending a just-mined Ironwood nullifier. Either lets `getblocktemplate` build a block template that every node then rejects. Mirror the Orchard handling for the Ironwood pool.
…batch error The `RestrictionUnsupportedByKey` arm called `unreachable!` inside the shared, long-lived halo2 verifier service, so a future routing change or new `#[non_exhaustive]` `BatchError` variant would crash the node instead of rejecting one proof. Collapse it into the existing graceful per-item arm; the routing invariant is kept as a comment.
…exing `value_pool_metrics`/`chain_supply.total` omitted the Ironwood pool, so total supply under-reported it every block post-NU6.3; and the `indexer` back-fill's spend-sampling chain skipped Ironwood-only v6 txs. Add the Ironwood gauge, the supply sum term, and Ironwood to the sampled spends.
`getrawtransaction <txid> 1` / `getblock <hash> 2` serialized an `orchard` section but no `ironwood` one, so v6 Ironwood bundles (including Zebra's own Ironwood coinbase) were invisible to explorers and wallets. Add an `ironwood` field reusing the Orchard-shaped object, and factor the shared construction into `orchard_shaped_object` (also dropping an incidental O(n^2) action scan).
…paths Ironwood reuses the Orchard tree and bundle types, so `update_ironwood_note_commitment_tree` now delegates to the Orchard version (re-tagging only the error variant), and `verify_orchard_v6_bundle` / `verify_orchard_bundle` share a `queue_orchard_bundle` helper. No behavior change.
The ZIP-235 burn validation and its tests were removed, but the `zip235` `cfg` value and `SubsidyError::InvalidZip233Amount` (gated on it) remained, so a `--cfg zcash_unstable="zip235"` build compiled yet enforced nothing. Drop both; they can return with the NU7 NSM implementation.
…ackfill `ironwood_tree_by_height` panicked when the Ironwood column family was still empty, which happens in the brief window after a v27->v28 upgrade before the background `add_ironwood_tree` migration backfills genesis. That window is always pre-NU6.3, when the Ironwood tree at every height is in fact empty, so return the empty tree instead of panicking.
…e logic
`add_/remove_{orchard,ironwood}_tree_and_anchor` were verbatim copies over
identically-typed field triples, including the reorg `RevertPosition::Root`
invariant-restoration. Extract shared `add_/remove_note_commitment_tree_and_anchor`
helpers parameterized on the target fields and a pool label. No behavior change
(non-finalized-state prop + reorg tests pass).
The history-tree functions took `sapling_root`, `orchard_root`, and `ironwood_root` as adjacent positional arguments; the Orchard and Ironwood roots reuse the same `orchard::tree::Root` type, so a swapped pair compiled cleanly and would silently corrupt the ZIP-221 chain-history commitment. Group them in a named `BlockCommitmentTreeRoots` struct so a swap can't happen.
The Ironwood tree-range, subtree-list, subtree-for-tip, tree-create, and subtree-insert accessors were verbatim copies of their Orchard counterparts, differing only in the column-family name (both pools reuse the `orchard::tree` types). Route them through CF-parameterized private helpers; the public signatures are unchanged.
upbqdn
force-pushed
the
ironwood-review-fixes
branch
from
July 2, 2026 18:02
48a3ac0 to
433c3d3
Compare
7 tasks
conradoplg
approved these changes
Jul 2, 2026
conradoplg
changed the title
Contributor
Merge Queue Status
This pull request spent 44 minutes 11 seconds in the queue, including 33 minutes 14 seconds running CI. Required conditions to merge
|
41 tasks
jvff
approved these changes
Jul 2, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
A multi-agent review of #10762 surfaced a set of Ironwood gaps — mostly in the pool-enumeration sites that must be updated in lockstep for each new shielded pool (mempool, RPC, metrics, indexer) — plus two panic/robustness issues, a latent type-safety fragility, and leftover ZIP-235 dead code. This fixes them and deduplicates the Orchard→Ironwood copy-paste.
Solution
Correctness:
VerifiedSetandreject_and_remove_same_effects, so conflicting Ironwood spends can't co-exist in a template that every node then rejects.unreachable!-panicking the shared halo2 verifier on an unexpectedBatchError.indexerspend index; fall back to the empty Ironwood tree during the brief post-v27→v28, pre-genesis-backfill window instead of panicking.ironwoodsection in verbosegetrawtransaction/getblock.zip235cfg +SubsidyError::InvalidZip233Amountvariant (no build enforced it).Type safety:
sapling_root/orchard_root/ironwood_rootas adjacent positional arguments; the Orchard and Ironwood roots reuse the sameorchard::tree::Roottype, so a swapped pair compiled cleanly and would silently corrupt the ZIP-221 commitment. Group them in a namedBlockCommitmentTreeRootsstruct so a swap can't happen.Refactor (no behavior change):
update_ironwood_note_commitment_treeto the Orchard version; sharequeue_orchard_bundle(verifier resolved lazily, only when a bundle is present); shareorchard_shaped_objectin the RPC layer; shareadd_/remove_note_commitment_tree_and_anchorfor the reorg paths; route the Orchard/Ironwood note-commitment DB accessors through CF-parameterized helpers (public signatures unchanged).Tests
Full local gate green:
fmt --check,clippy --all-features -D warnings,check --locked,cargo +nightly udeps,doc -D warnings,cargo vet, and the CI-profile nextest (1069/1069). The reorg-method and history-tree refactors are covered by the existingnon_finalized_stateprop + reorg andhistory_treevector suites. Changelog entries drafted fromziff --changelog.Specifications & References
Follow-up Work
None outstanding.
AI Disclosure
PR Checklist