v2.3.4: dust limit, LRU eviction, ban expiry, block cache bound, sync stall timeout, ops limit, miner resilience, version check

- Add min_output_value to ChainParams (default 1 scar) to prevent UTXO set spam
- Replace _invalidate dict mass-clear with LRU eviction to prevent cache-flush DoS
- Add 24-hour expiry to misbehaviour-triggered bans (was permanent)
- Add byte limit (128 MB) to block cache alongside entry-count limit
- Re-assign stalled blocks from slow peers after 30s timeout during header sync
- Add MAX_SCRIPT_OPS (200) limit for defence-in-depth script execution bound
- Restart multiprocessing pool on worker crash instead of letting exception propagate
- Clarify mempool minimum_fee with math.ceil instead of opaque (x+999)//1000
- Add version check to all CLI tools and GUI apps (checks PyPI once per day)
- Bump version to 2.3.4

Author: alessio-ds

README.md

@@ -11,18 +11,18 @@ retargeting, halvings, a hard supply cap — with faster blocks and a modern
 feature set (BIP-39/32/44 wallets, P2SH multisig, replace-by-fee, encrypted
 P2P links).
 
-**Version 2.3.3 · Mainnet is live and mined · MIT licensed**
+**Version 2.3.4 · Mainnet is live and mined · MIT licensed**
 
 <div align="center">
 
-[![Download for Windows (64-bit)](https://img.shields.io/badge/Download-Windows_64--bit-0078D6?style=for-the-badge&logo=windows&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.3/ScarletCoin-2.3.3-win64.zip)
-[![Windows installer](https://img.shields.io/badge/Windows_Installer-.exe-0078D6?style=for-the-badge&logo=windows&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.3/ScarletCoin-Setup-2.3.3.exe)
+[![Download for Windows (64-bit)](https://img.shields.io/badge/Download-Windows_64--bit-0078D6?style=for-the-badge&logo=windows&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.4/ScarletCoin-2.3.4-win64.zip)
+[![Windows installer](https://img.shields.io/badge/Windows_Installer-.exe-0078D6?style=for-the-badge&logo=windows&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.4/ScarletCoin-Setup-2.3.4.exe)
 
-[![Download for Ubuntu](https://img.shields.io/badge/Download-Ubuntu-E95420?style=for-the-badge&logo=ubuntu&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.3/ScarletCoin-2.3.3-linux-x86_64.tar.gz)
-[![Download for Fedora](https://img.shields.io/badge/Download-Fedora-51A2DA?style=for-the-badge&logo=fedora&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.3/ScarletCoin-2.3.3-linux-fc44-x86_64.tar.gz)
+[![Download for Ubuntu](https://img.shields.io/badge/Download-Ubuntu-E95420?style=for-the-badge&logo=ubuntu&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.4/ScarletCoin-2.3.4-linux-x86_64.tar.gz)
+[![Download for Fedora](https://img.shields.io/badge/Download-Fedora-51A2DA?style=for-the-badge&logo=fedora&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.4/ScarletCoin-2.3.4-linux-fc44-x86_64.tar.gz)
 
-[![Download for macOS (Apple Silicon)](https://img.shields.io/badge/Download-macOS_Apple_Silicon-000000?style=for-the-badge&logo=apple&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.3/ScarletCoin-2.3.3-macos-arm64.tar.gz)
-[![Download for macOS (Intel)](https://img.shields.io/badge/Download-macOS_Intel-555555?style=for-the-badge&logo=apple&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.3/ScarletCoin-2.3.3-macos-x86_64.tar.gz)
+[![Download for macOS (Apple Silicon)](https://img.shields.io/badge/Download-macOS_Apple_Silicon-000000?style=for-the-badge&logo=apple&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.4/ScarletCoin-2.3.4-macos-arm64.tar.gz)
+[![Download for macOS (Intel)](https://img.shields.io/badge/Download-macOS_Intel-555555?style=for-the-badge&logo=apple&logoColor=white)](https://github.com/alessio-ds/ScarletCoin/releases/download/v2.3.4/ScarletCoin-2.3.4-macos-x86_64.tar.gz)
 
 **No Python. No dependencies. Download, extract, run.**
 

pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "scarletcoin"
-version = "2.3.3"
+version = "2.3.4"
 description = "ScarletCoin: a small but complete proof-of-work cryptocurrency with a real blockchain, peer-to-peer nodes, wallet and miner."
 readme = "README.md"
 license = { file = "LICENSE" }

src/scarletcoin/__init__.py

@@ -20,4 +20,4 @@
 
 __all__ = ["COIN", "NETWORKS", "__version__", "get_params"]
 
-__version__ = "2.3.3"
+__version__ = "2.3.4"

src/scarletcoin/cli_common.py

@@ -14,6 +14,7 @@
 
 from scarletcoin.core.params import get_params, network_names
 from scarletcoin.net.client import RpcClient
+from scarletcoin.version_check import check_version
 
 __all__ = [
     "DEFAULT_DATADIR",
@@ -26,6 +27,7 @@
     "load_connection",
     "local_url",
     "make_client",
+    "maybe_check_version",
     "read_rpc_token",
     "save_connection",
     "setup_logging",
@@ -230,3 +232,27 @@ def make_client(args: argparse.Namespace) -> RpcClient:
     url = args.rpc_url or local_url(args.network)
     token = args.rpc_token or read_rpc_token(args.datadir, args.network)
     return RpcClient(url, token=token, timeout=args.timeout)
+
+
+def maybe_check_version(datadir: str | Path) -> None:
+    """Log a warning when a newer ScarletCoin release is on PyPI.
+    
+    Called once at start-up by every CLI tool.  The check is cached for a day
+    and never blocks — a slow or unreachable PyPI is silently ignored.
+    """
+    import logging
+    
+    logger = logging.getLogger(__name__)
+    try:
+        latest = check_version(datadir)
+    except Exception:
+        return
+    if latest is not None:
+        from scarletcoin import __version__ as current
+        
+        logger.warning(
+            "ScarletCoin %s is available (you are running %s)."
+            " Upgrade with: pip install --upgrade scarletcoin",
+            latest,
+            current,
+        )

src/scarletcoin/core/block.py

@@ -216,7 +216,9 @@ def size(self) -> int:
         """Serialised size in bytes."""
         return len(self.serialize())
 
-    def check_sanity(self, *, pow_limit: int, max_block_size: int) -> None:
+    def check_sanity(
+        self, *, pow_limit: int, max_block_size: int, min_output_value: int = 0
+    ) -> None:
         """Validate the block without consulting the chain.
 
         Checks proof of work, size, the Merkle root, that exactly one coinbase is
@@ -238,7 +240,7 @@ def check_sanity(self, *, pow_limit: int, max_block_size: int) -> None:
             if tx.is_coinbase:
                 raise BlockError("block contains more than one coinbase transaction")
         for tx in self.transactions:
-            tx.check_sanity()
+            tx.check_sanity(min_output_value=min_output_value)
         txids = self.txids()
         if len(set(txids)) != len(txids):
             raise BlockError("block contains duplicate transactions")

src/scarletcoin/core/chain.py

@@ -23,6 +23,7 @@
 import statistics
 import threading
 import time
+from collections import OrderedDict
 from collections.abc import Iterable
 from dataclasses import dataclass, replace
 from enum import Enum
@@ -157,7 +158,7 @@ def __init__(self, storage: Storage, params: ChainParams) -> None:
         self.params = params
         self._lock = threading.RLock()
         self._listeners: list[ChainListener] = []
-        self._invalid: dict[bytes, str] = {}
+        self._invalid: OrderedDict[bytes, str] = OrderedDict()
         self._tip = self._load_or_create_genesis()
         self._stats_cache: dict | None = None
         self._stats_at = 0.0
@@ -179,7 +180,9 @@ def _load_or_create_genesis(self) -> BlockIndexEntry:
 
         genesis = self.params.genesis_block
         genesis.check_sanity(
-            pow_limit=self.params.pow_limit, max_block_size=self.params.max_block_size
+            pow_limit=self.params.pow_limit,
+            max_block_size=self.params.max_block_size,
+            min_output_value=0,
         )
         with self.storage.write():
             entry = self.storage.put_block(
@@ -678,7 +681,9 @@ def add_block(self, block: Block) -> AddBlockResult:
 
             try:
                 block.check_sanity(
-                    pow_limit=self.params.pow_limit, max_block_size=self.params.max_block_size
+                    pow_limit=self.params.pow_limit,
+                    max_block_size=self.params.max_block_size,
+                    min_output_value=self.params.min_output_value,
                 )
             except (BlockError, TransactionError) as exc:
                 self._invalid[block_hash] = str(exc)
@@ -791,9 +796,14 @@ def _best_candidate(self) -> BlockIndexEntry | None:
         return None
 
     def _invalidate(self, block_hash: bytes, reason: str) -> None:
-        """Mark a block and everything built on top of it as unusable."""
-        if len(self._invalid) > _MAX_REMEMBERED_INVALID:
-            self._invalid.clear()
+        """Mark a block and everything built on top of it as unusable.
+
+        When the cache fills up the oldest entries are evicted one at a time
+        rather than all at once, so an attacker who floods 5001 distinct
+        invalid blocks cannot flush the entire cache and force re-validation.
+        """
+        while len(self._invalid) >= _MAX_REMEMBERED_INVALID:
+            self._invalid.popitem(last=False)
         pending = [(block_hash, reason)]
         while pending:
             current, why = pending.pop()

src/scarletcoin/core/mempool.py

@@ -172,7 +172,7 @@ def add(self, transaction: Transaction) -> MempoolEntry:
             if txid in self._by_txid:
                 raise MempoolError("transaction is already in the mempool")
             try:
-                transaction.check_sanity()
+                transaction.check_sanity(min_output_value=self.params.min_output_value)
             except TransactionError as exc:
                 raise MempoolError(str(exc)) from exc
             if transaction.is_coinbase:
@@ -240,8 +240,14 @@ def _replace_conflicts(self, transaction: Transaction, fee: int, size: int, conf
             self.remove(txid)
 
     def minimum_fee(self, size: int) -> int:
-        """Return the smallest fee the node will relay for a transaction of ``size``."""
-        return max(1, (size * self.params.min_relay_fee_per_kb + 999) // 1000)
+        """Return the smallest fee the node will relay for a transaction of ``size``.
+        
+        Calculated as ``ceil(size * min_relay_fee_per_kb / 1000)``, clamped to at
+        least 1 scar so every transaction pays something.
+        """
+        from math import ceil
+        
+        return max(1, ceil(size * self.params.min_relay_fee_per_kb / 1000))
 
     def estimate_fee_rate(self, blocks: int = 1) -> int:
         """Roughly estimate the fee rate (scar/kB) needed to confirm in ``blocks``.

src/scarletcoin/core/params.py

@@ -94,6 +94,14 @@ class ChainParams:
     """Window used for the "greater than the median of the last N" timestamp rule."""
     min_relay_fee_per_kb: int = 1_000
     """Cheapest fee rate a node will relay or mine, in scar per kilobyte."""
+    min_output_value: int = 1
+    """Smallest output value the network will relay and mine, in scar.
+    
+    Outputs below this value are rejected by the mempool and by block validation,
+    which prevents an attacker from filling the UTXO set with millions of
+    sub-dust outputs.  The default of ``1`` (the smallest indivisible unit) keeps
+    every valid transaction spendable while closing the obvious spam vector.
+    """
 
     # BIP-0044
     bip44_coin_type: int = 0

src/scarletcoin/core/script.py

@@ -24,6 +24,7 @@
 
 __all__ = [
     "MAX_PUBKEYS",
+    "MAX_SCRIPT_OPS",
     "MAX_SCRIPT_SIZE",
     "OP_CHECKMULTISIG",
     "OP_CHECKSIG",
@@ -49,6 +50,14 @@
 MAX_STACK_ITEMS = 20
 """Largest stack a script may build."""
 
+MAX_SCRIPT_OPS = 200
+"""Most operations a single script execution may perform.
+
+Together with :data:`MAX_SCRIPT_SIZE` this bounds the worst-case cost of
+evaluating a redeem script.  Even a script built entirely of single-byte
+push operations cannot exceed this limit.
+"""
+
 OP_0 = 0x00
 OP_PUSHBYTES_MAX = 0x4B
 OP_PUSHDATA1 = 0x4C
@@ -211,7 +220,9 @@ def evaluate_script(script: bytes, arguments: list[bytes], digest: bytes) -> boo
     """
     try:
         stack = list(arguments)
-        for opcode, data in decode_ops(script):
+        for index, (opcode, data) in enumerate(decode_ops(script), 1):
+            if index > MAX_SCRIPT_OPS:
+                return False
             if opcode <= OP_PUSHBYTES_MAX or opcode in (OP_PUSHDATA1, OP_PUSHDATA2):
                 stack.append(data)
             elif OP_1 <= opcode <= OP_16:

src/scarletcoin/core/storage.py

@@ -58,6 +58,11 @@
 #: Blocks are immutable, so this is only a read cache; it is dropped on pruning.
 BLOCK_CACHE_SIZE = 1024
 
+#: Maximum total bytes the block cache may hold before the oldest entries are
+#: evicted.  A full-size (1 MB) block at the default entry count would take
+#: 1 GB of memory, so the byte limit is the stricter bound in practice.
+BLOCK_CACHE_MAX_BYTES = 128 * 1024 * 1024  # 128 MB
+
 _SCHEMA = """
 CREATE TABLE IF NOT EXISTS meta (
     key   TEXT PRIMARY KEY,
@@ -293,6 +298,7 @@ def __init__(self, path: str | Path) -> None:
         self._size_cache: dict | None = None
         self._size_measured_at = 0.0
         self._block_cache: OrderedDict[bytes, Block] = OrderedDict()
+        self._block_cache_bytes = 0
         self._connection = sqlite3.connect(
             str(self.path), check_same_thread=False, isolation_level=None, timeout=30.0
         )
@@ -555,8 +561,13 @@ def get_block(self, block_hash: bytes) -> Block | None:
         with self._lock:
             self._block_cache[block_hash] = block
             self._block_cache.move_to_end(block_hash)
-            while len(self._block_cache) > BLOCK_CACHE_SIZE:
-                self._block_cache.popitem(last=False)
+            self._block_cache_bytes += len(raw)
+            while (
+                len(self._block_cache) > BLOCK_CACHE_SIZE
+                or self._block_cache_bytes > BLOCK_CACHE_MAX_BYTES
+            ):
+                _, old = self._block_cache.popitem(last=False)
+                self._block_cache_bytes -= old.size()
         return block
 
     def set_in_chain(self, block_hash: bytes, in_chain: bool) -> None:
@@ -829,6 +840,7 @@ def prune_to(self, height: int) -> PruneResult:
             self.set_meta("prune_height", str(marker).encode())
             self._forget_sizes()
             self._block_cache.clear()
+            self._block_cache_bytes = 0
         return PruneResult(
             blocks=len(candidates),
             transactions=transactions,