b3chain / Testing & Verification / Phase 11 Security Audit

Phase 11 Security Audit (master checklist)

A structured self-audit of every b3chain-specific change on top of Bitcoin Core 30.2.0. Every row is backed by an automated script in contrib/testing/audit/ and a detail page on this site.

Status: all PASS Items: 15 Source: doc/SECURITY-AUDIT.md

1. Summary

CategoryItemsPassedFailedPending
Consensus invariants4400
Hash function isolation (incl. B3PoW-Scratch sub-checks)4400
Network isolation1100
Wallet & address safety2200
Build / regression2200
Attack simulation1100
Operator tools (M-14 + monitoring)1100
Total151500

2. Checklist

IDItemScriptStatusDetail
C-1Block subsidy halves at every 210 000 blocksaudit-supply-cap.pyPASSpage
C-2Total supply caps at 20 999 999.97690000 B3Caudit-supply-cap.pyPASSpage
C-3Subsidy returns 0 after halving 64audit-supply-cap.pyPASSpage
C-4Difficulty retarget enforces 4× boundsaudit-supply-cap.pyPASSpage
H-1PoW / Block-ID hash isolation (B3PoW-Scratch v1.1.1 vs SHA-256d)audit-b3pow-isolation.pyPASSpage
H-1.1B3PoW verifier wall-clock budget enforcement (BLOCK_POW_BUDGET → Misbehaving)audit-b3pow-budget.pyPASSpage
H-1.2LRU scratchpad cache wiring (b3pow::Cache & b3pow_cache_tests)audit-b3pow-cache.pyPASSpage
H-1.3MAX_B3POW_VERIFY_PER_BATCH HEADERS-cap enforcementaudit-b3pow-headers-cap.pyPASSpage
N-1Bitcoin magic / DNS seed isolationaudit-network-isolation.pyPASSpage
W-1Bitcoin address rejection (36 samples)audit-address-rejection.pyPASSpage
W-2HD wallet BIP44 coin_type 9333audit-hd-coin-type.pyPASSpage
B-1BLAKE3 primitive determinism (SIMD vs portable C)audit-simd-blake3.pyPASSpage
B-2Rebranding regression scanaudit-rebranding.shPASSpage
A-151% attack live regtest demoaudit-51-attack-sim.pyDEMOpage
A-10M-14 operator-pinned chain-recovery RPCs (finalizeblock, unfinalizeblock, parkblock, unparkblock, getfinalizedblockhash) — persistence + bypass-path coveragesrc/rpc/blockchain.cpp, src/validation.cpp, src/node/blockstorage.cppPASSpage

3. Run the whole suite

cd b3chain
bash contrib/testing/audit/run-all.sh

Every audit script prints AUDIT RESULT: PASS or AUDIT RESULT: FAIL on its final line. The wrapper exits with the worst status it observed.

4. Findings & remediation (first run)

The first end-to-end run caught real regressions left over from the rebranding pass. They were fixed in the same commit set as the audit framework. Full table in doc/SECURITY-AUDIT.md.

  • 5 leftover Qt tr() strings still said "Bitcoin" instead of "B3Chain" — fixed.
  • One RPC error message in src/rpc/rawtransaction_util.cpp still said "Invalid Bitcoin address" — fixed.
  • doc/Doxyfile.in still set PROJECT_NAME = "Bitcoin Core" — fixed.
  • ~30 references to bitcoind / bitcoin-cli in contrib/*/README.md — bulk-renamed.

5. Source files