bcoin 5-MOAD Scan

Target: bcoin (JavaScript Bitcoin full node implementation) Source: ~/git/bcoin Date: 2026-03-31

MOAD-0001 (CWE-407): 1 DEFECT

bcoin-0001: RPC gettxoutproof Block.hasTX linear scan O(H*T)

File: lib/node/rpc.js:1035-1040
Pattern: for (hash of hashes) { block.hasTX(hash) } where hasTX calls Block.indexOf which linearly scans block.txs
Complexity: O(H*T) where H = user-provided txids, T = transactions in block
Severity: LOW-MEDIUM (RPC method, auth-gated, H typically small)
Ratio: 48.3x at T=4000, H=100
Fix: Build BufferSet from block.txs before loop, O(H+T)

Other indexOf/includes sites examined and cleared:

rpc.js:1440 deps.indexOf(dep): deps is per-tx, bounded by input count (1-5 typical)
rpc.js:1482/1491/1579 rules.indexOf(name): rules is user-provided deploy names (handful)
descriptor/*.js .includes(): constant enum arrays (2-3 elements)
block.js:269 hasTX(hash): only called in loop at rpc.js:1035 (patched above)
merkleblock.js:118 hasTX: uses Map internally, O(1)
mtx.js:597 prev.indexOf(ring.publicKey): Script.indexOf, single call per ring
All net/pool, mempool, blockchain, wallet, mining use BufferSet/BufferMap/Map

MOAD-0002 (Intertangle): CLEAN

Node base class has chain/mempool/pool/miner properties, but they are assembled by FullNode constructor with proper dependency injection. Each subsystem receives its dependencies through constructor options (chain passed to mempool, mempool passed to pool). Standard composition pattern, not shared mutable global state.

MOAD-0003 (Leaked Context): CLEAN

No AsyncLocalStorage, cls-hooked, or domain-based context usage found anywhere in the codebase. Request context is handled through explicit req/res parameters in HTTP handlers.

MOAD-0004 (Logged Secret): CLEAN

Auth logging in node/http.js and wallet/http.js only logs socket.host and wallet ID on success/failure. API keys are hashed before comparison, never logged. RPC request logging only logs method and path, not headers or body content. No verbatim header or credential logging found.

MOAD-0005 (Thundering Herd): CLEAN

Node.js is single-threaded, so traditional thundering herd on cache population does not apply. The SigCache (script/sigcache.js) uses BufferMap for O(1) lookups. ChainDB uses LRU caches with proper get-then-fetch patterns. The blockchain locker (bmutex Lock) serializes concurrent access to chain state. Pool uses BufferSet for block/tx dedup maps. No unguarded cache-miss-compute-put patterns found.

2.5 KiB Raw Permalink Blame History