For discussion: limit transaction size to mitigate CVE-2013-2292



Summary:

On July 20, 2015, Gavin Andresen via bitcoin-dev suggested that after deployment, the maximum serialized size of a transaction allowed in a block shall be 100,000 bytes. This could render transactions with a locktime in the future as unspendable; however, it is unlikely to happen since no one has created a >100kB locked transaction. Nonetheless, this violates the principle that no fork should render someone's coins unspendable. To address this, the rule could be made to apply only to version 2 transactions at the cost of weakening the protection. The specifications were proposed, which include increasing the transaction version to version two and requiring all coinbase transactions to be version two or higher. If any of its parent transactions are version two or higher, then the transaction must be version two or higher. The maximum serialized size of a version two transaction allowed in a block is 100,000 bytes. As time passes, more and more of the UTXO set will be from version two transactions, making it difficult for an attacker to launch an attack because they need a historical UTXO entry. Standard software would create version two transactions even if all inputs were version one. The rule could be applied to all transactions most of the time and have daily blocks that allow legacy transactions. This rule shall apply to version 1 transactions too unless the block height is a multiple of 100. In addition, if the transaction size is limited, it would be useful to limit the size of all its inputs to help with fraud proofs and offline signing. Therefore, the maximum of the total serialized size of a version two transaction and all of its parents allowed in a block shall be 200,000 bytes.


Updated on: 2023-06-10T03:01:44.815926+00:00