Skip to content

docs(core): document hashbrown feature's fixed-key hashing - #2354

Open
Romansage6 wants to merge 2 commits into
bitcoindevkit:masterfrom
Romansage6:doc/hashbrown-predictable-hashing
Open

Romansage6 wants to merge 2 commits into
bitcoindevkit:masterfrom
Romansage6:doc/hashbrown-predictable-hashing

Conversation

@Romansage6

Copy link
Copy Markdown

Description

The hashbrown feature pulls in hashbrown with default-features = false
and neither its runtime-rng nor compile-time-rng feature enabled, so its
ahash hasher falls back to fixed, publicly known keys. Every hash map built
on it (e.g. TxGraph keyed by Txid, SpkTxOutIndex keyed by ScriptBuf)
therefore hashes identically across processes, machines, and builds. With
untrusted high-volume input (e.g. a chain source returning crafted entries)
this permits worst-case quadratic insertion, which can stall a sync. This
tradeoff wasn't documented anywhere.

Notes to the reviewers

Documented as a crate-level "Feature flags" rustdoc section in bdk_core,
where the feature is actually defined (crates/core/src/lib.rs), rather than
in the one-line README.md or in the collections module (which is
#[doc(hidden)] and wouldn't render). Also notes the mitigation: depend on
hashbrown directly with runtime-rng/compile-time-rng enabled, which
Cargo's feature unification propagates into this crate's internal use.

Changelog notice

  • Document that the hashbrown feature uses fixed hash keys, making hashing
    deterministic and exposing untrusted high-volume input to worst-case
    quadratic hash-map insertion.

Checklists

All Submissions:

  • I followed the contribution guidelines

Bugfixes:

  • This pull request breaks the existing API
  • I've added tests to reproduce the issue which are now passing
  • I'm linking the issue being fixed by this PR

Fixes #2342

The `hashbrown` feature pulls in `hashbrown` with `default-features =
false` and neither its `runtime-rng` nor `compile-time-rng` enabled,
so its `ahash` hasher falls back to fixed, publicly known keys. Hash
maps built on it (e.g. `TxGraph` keyed by `Txid`, `SpkTxOutIndex`
keyed by `ScriptBuf`) therefore hash identically across processes,
machines, and builds. With untrusted high-volume input this lets an
attacker force worst-case quadratic insertion and stall a sync.

This tradeoff was undocumented. Add a crate-level "Feature flags"
rustdoc section to bdk_core, where the feature is defined, so users
can make an informed choice before enabling it.

Fixes bitcoindevkit#2342

Co-Authored-By: Claude Sonnet 5 <[email protected]>
@codecov

codecov Bot commented Oct 9, 2026

Copy link
Copy Markdown

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.84%. Comparing base (2c89f60) to head (93ac7c3).
⚠️ Report is 1 commits behind head on master.

Additional details and impacted files
@@           Coverage Diff           @@
##           master    #2354   +/-   ##
=======================================
  Coverage   78.84%   78.84%           
=======================================
  Files          31       31           
  Lines        6060     6060           
  Branches      288      288           
=======================================
  Hits         4778     4778           
  Misses       1203     1203           
  Partials       79       79           
Flag Coverage Δ
rust 78.84% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

Comment thread crates/core/src/lib.rs
Comment thread crates/core/src/lib.rs
Address review on bitcoindevkit#2354: `hashbrown` takes precedence over `std`, not
just the `no_std` `BTreeMap`/`BTreeSet` fallback — enabling it drops
`std`'s per-process `RandomState` seeding too. Make that explicit, and
list the crate's other feature flags (`std`, `serde`) alongside it so
`hashbrown` isn't documented in isolation.

Co-Authored-By: Claude Sonnet 5 <[email protected]>
@Romansage6
Romansage6 requested a review from a team as a code owner October 10, 2026 03:46
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Triage

Development

Successfully merging this pull request may close these issues.

Document the predictable-hashing behavior of the hashbrown feature

2 participants