[PastaPastaPasta]

Issue being fixed or feature implemented

Governance validation looks up each proposal's collateral transaction through the transaction index. Without -txindex, every proposal fails validation with "Invalid proposal collateral". Until v23.1.0 dashd refused to start with governance enabled and -txindex=0 outside regtest:

Transaction index can't be disabled with governance validation enabled. Either start with -disablegovernance command line switch or enable transaction index.

Commit 91129d4 ("refactor: drop dead code with ERROR_TXINDEX_DISABLED_WHEN_GOV_ENABLED", merged in #7008) removed this check from LoadChainstate. Its commit message says governance is now force-disabled in this case and the "governance validation disabled" warning is shown instead. That is not the case: only -prune soft-sets -disablegovernance. An explicit -txindex=0 on a non-pruned mainnet, testnet or devnet node that is not a masternode now starts quietly with governance enabled and no transaction index. That node then rejects every proposal it is asked to submit or receives from peers, and adds misbehavior score to each peer that relays one.

Why this is a real problem

Code path at c14104b:

• The only parameter interaction that turns governance off is the -prune one: src/init.cpp#L1083-L1091. The txindex requirement applies only to masternodes (src/init.cpp#L1398-L1400), the warning fires only when -disablegovernance is set (src/init.cpp#L1442-L1447), and governance is enabled based solely on -disablegovernance (src/init.cpp#L1732).
• CGovernanceObject::IsCollateralValid finds the collateral only through g_txindex and fails with "Can't find collateral tx" when it is null: src/governance/object.cpp#L796-L806. Proposals then fail IsValidLocally (src/governance/object.cpp#L738-L741), and ProcessObject returns false (src/governance/governance.cpp#L266-L269).
• For a proposal received from a peer, a false return from ProcessObject adds 20 misbehavior points to that peer: src/governance/net_governance.cpp#L193-L198. After five proposals the peer reaches the discouragement threshold and, unless it is a manual or noban connection, is disconnected and its address discouraged: src/net_processing.cpp#L5833-L5869.

The reproductions below ran against an unfixed dashd: Parts A and B against c14104b, Part C against the branch rebased on 8819507 with the src/init.cpp hunk reversed (nothing between those two commits touches C++). They are small BitcoinTestFramework scripts. Part A uses devnet because regtest is exempt from the check. The framework cannot mine the devnet genesis block, so Parts B and C show the effects on regtest, where -txindex=0 with governance is allowed on every revision. The collateral lookup and peer scoring are the same on every network.

Part A (devnet): a node with -txindex=0 starts with governance enabled and no warning

$ DASH_WORKTREE=<worktree> python3 repro_a_devnet_startup.py --configfile=<worktree>/test/config.ini
TestFramework (INFO): Start a devnet node with -txindex=0 (governance not disabled)
TestFramework (INFO): RESULT: dashd started; stderr: ''
TestFramework (INFO): getindexinfo: {}
TestFramework (INFO): debug.log: ... Command-line arg: txindex="0"
TestFramework (INFO): debug.log: ... [flat-database.h:194] [Store] Verifying governance.dat format...
TestFramework (INFO): debug.log: ... [flat-database.h:200] [Store] Writing info to governance.dat...
TestFramework (INFO): debug.log: ... [flat-database.h:71] [CoreWrite]      Governance Objects: 0 (Proposals: 0, Triggers: 0, Other: 0; Erased: 0)
TestFramework (INFO): debug.log: ... [governance/governance.cpp:1105] [UpdatedBlockTip] [gobject] CGovernanceManager::UpdatedBlockTip -- nCachedBlockHeight: 0
TestFramework (INFO): Start a devnet node with -txindex=0 -disablegovernance
TestFramework (INFO): RESULT: dashd started
TestFramework (INFO): RESULT: stderr was the governance-disabled warning
TestFramework (INFO): Tests successful

Part B (regtest): with governance enabled and -txindex=0, a valid proposal is rejected; the same node accepts it with -txindex=1

$ DASH_WORKTREE=<worktree> python3 repro_b_regtest_proposal.py --configfile=<worktree>/test/config.ini
TestFramework (INFO): Node started with -txindex=0; getindexinfo: {}
TestFramework (INFO): Collateral 246c979b734f002c8f7d1f472fe159f2a1541472e00fd44b6682134b36327da6 confirmations: 6
TestFramework (INFO): RESULT (-txindex=0): gobject submit rejected: Governance object is not valid - 6926f935aa79335ddac0cf52ca7665a15dc58cda80c89af9dcd22501a819fe63 - Invalid proposal collateral (-32603)
TestFramework (INFO): debug.log: ... [governance/object.cpp:804] [IsCollateralValid] CGovernanceObject::IsCollateralValid -- Can't find collateral tx 246c979b734f002c8f7d1f472fe159f2a1541472e00fd44b6682134b36327da6
TestFramework (INFO): gobject count: {'objects_total': 0, 'proposals': 0, 'triggers': 0, 'other': 0, 'erased': 0, 'votes': 0}
TestFramework (INFO): Restart the same node with -txindex=1 and submit the same proposal
TestFramework (INFO): RESULT (-txindex=1): gobject submit accepted: 6926f935aa79335ddac0cf52ca7665a15dc58cda80c89af9dcd22501a819fe63
TestFramework (INFO): gobject count: {'objects_total': 1, 'proposals': 1, 'triggers': 0, 'other': 0, 'erased': 0, 'votes': 0}
TestFramework (INFO): Tests successful

Part C (regtest): the -txindex=0 node scores 20 misbehavior points per valid proposal relayed by a peer and disconnects it after five

node0 (-txindex=1) connects to node1 (-txindex=0, governance enabled), so node1 sees node0 as an ordinary inbound peer. node0 then submits five valid proposals. Because node0 is on a local address, node1 disconnects it without adding the address to the discouragement list; a non-local peer is disconnected and discouraged.

$ DASH_WORKTREE=<worktree> python3 repro_c_peer_misbehaving.py --configfile=<worktree>/test/config.ini
TestFramework (INFO): node0 getindexinfo: {'txindex': {'synced': True, 'best_block_height': 0}}
TestFramework (INFO): node1 getindexinfo: {}
TestFramework (INFO): node1 sees node0 as peer=0 inbound=True connection_type=inbound permissions=[]
TestFramework (INFO): node0 accepted proposal b23bc414c1e0b465070af792c669ab4eabc529f2deee560ef4593458f01a499e
TestFramework (INFO): node0 accepted proposal c81ae2dd9fe14ac2c13eea80ad52a87df586e7be6e317a6540b240a940678ab4
TestFramework (INFO): node0 accepted proposal e6a890d8da141a791fb5cb5b4dfbde92da3e423f7258b383cc3f8e9fa1620c7b
TestFramework (INFO): node0 accepted proposal 9e7706395cfacfdbb9aad6e3762abece051a60e5db0ebbec219a9e1201284c54
TestFramework (INFO): node0 accepted proposal 499abad8125b978ba13ec4b6e19bb2bab9d9d63a5475f6e8c37bbc739e8780e3
TestFramework (INFO): node0 gobject count: {'objects_total': 5, 'proposals': 5, 'triggers': 0, 'other': 0, 'erased': 0, 'votes': 0}
TestFramework (INFO): node1 gobject count: {'objects_total': 0, 'proposals': 0, 'triggers': 0, 'other': 0, 'erased': 0, 'votes': 0}
TestFramework (INFO): node1 peers after relay: 0
TestFramework (INFO): node1 debug.log: ... [governance/governance.cpp:268] [ProcessObject] [gobject] MNGOVERNANCEOBJECT -- Governance object is invalid - Invalid proposal collateral
TestFramework (INFO): node1 debug.log: ... [net_processing.cpp:1954] [Misbehaving] [net] Misbehaving: peer=0 (0 -> 20)
TestFramework (INFO): node1 debug.log: ... [governance/governance.cpp:268] [ProcessObject] [gobject] MNGOVERNANCEOBJECT -- Governance object is invalid - Invalid proposal collateral
TestFramework (INFO): node1 debug.log: ... [net_processing.cpp:1954] [Misbehaving] [net] Misbehaving: peer=0 (20 -> 40)
TestFramework (INFO): node1 debug.log: ... [governance/governance.cpp:268] [ProcessObject] [gobject] MNGOVERNANCEOBJECT -- Governance object is invalid - Invalid proposal collateral
TestFramework (INFO): node1 debug.log: ... [net_processing.cpp:1954] [Misbehaving] [net] Misbehaving: peer=0 (40 -> 60)
TestFramework (INFO): node1 debug.log: ... [governance/governance.cpp:268] [ProcessObject] [gobject] MNGOVERNANCEOBJECT -- Governance object is invalid - Invalid proposal collateral
TestFramework (INFO): node1 debug.log: ... [net_processing.cpp:1954] [Misbehaving] [net] Misbehaving: peer=0 (60 -> 80)
TestFramework (INFO): node1 debug.log: ... [governance/governance.cpp:268] [ProcessObject] [gobject] MNGOVERNANCEOBJECT -- Governance object is invalid - Invalid proposal collateral
TestFramework (INFO): node1 debug.log: ... [net_processing.cpp:1954] [Misbehaving] [net] Misbehaving: peer=0 (80 -> 100) DISCOURAGE THRESHOLD EXCEEDED
TestFramework (INFO): node1 debug.log: ... [net_processing.cpp:5860] [MaybeDiscourageAndDisconnect] [net] Warning: disconnecting but not discouraging local peer 0!
TestFramework (INFO): Tests successful

Why it matters

This only affects operators who explicitly set -txindex=0 (the default is 1) on a non-pruned node that is not a masternode. Nothing at startup tells them anything is wrong, and:

• gobject list/count, the governance view in the GUI and proposal vote tracking stay empty or incomplete, and gobject submit fails with an unhelpful collateral error.
• The node does not relay proposals.
• Every honest peer that relays five or more proposals to it, which on mainnet includes any peer it syncs governance objects from, reaches the discouragement threshold and is disconnected; non-local peers are also discouraged. This applies to its outbound peers as well as inbound ones, so the misconfigured node keeps losing its own connections.

Trigger and superblock validation do not use the transaction index, so block validation is not affected.

The regression was introduced in v23.1.0. It is not a v24.0.0 release-candidate regression.

What was done?

Restored the check in AppInitParameterInteraction, next to the other governance and masternode parameter checks. Outside regtest, if governance validation is enabled and -txindex is disabled, dashd now fails to start with the original error message.

Added feature_governance_txindex_devnet.py. It runs on devnet, because regtest is exempt, and checks two things: -txindex=0 alone is refused with that error, and -txindex=0 -disablegovernance still starts with the governance-disabled warning.

Why this is the correct minimal fix

• It brings back the behavior from before 91129d4: the same condition, the same translatable message and the same regtest exemption. It is a parameter check, so it lives with the other parameter checks instead of going back into LoadChainstate. That needs no changes to the LoadChainstate signature or to ChainstateLoadingError, and it fails before the block index is loaded.
• The regtest exemption is kept on purpose. Many regtest functional tests run with -txindex=0 and governance enabled (feature_reindex.py, rpc_blockchain.py, rpc_misc.py, feature_unsupported_utxo_db.py), as they did before the check was removed.
• The alternative is to do what the 91129d4 commit message describes: soft-set -disablegovernance when -txindex=0. That would change behavior instead of restoring it, and it would quietly turn governance off for an operator who may simply have forgotten the index. A clear startup error matches how the neighbouring incompatible combinations are handled, such as -prune with -disablegovernance=false. If reviewers prefer the soft-set, it is an equally small change.
• Unchanged: -prune still soft-sets -disablegovernance/-txindex=0 and keeps its own error for -disablegovernance=false. A masternode with -txindex=0 still gets the existing "Masternode must have transaction index enabled" error first, because the masternode block runs before the new check. The peer scoring in net_governance.cpp is left as is; with the check restored, a node that would score honest peers for valid proposals can no longer start outside regtest.

How Has This Been Tested?

Built on macOS arm64 (--enable-debug --without-gui --enable-werror).

• New regression test against the unfixed dashd: test/functional/test_runner.py feature_governance_txindex_devnet.py fails. The node does not exit and keeps running with -txindex=0: dashd should have exited within 60s with expected error Error: Transaction index can't be disabled with governance validation enabled. ....
• The same test with the fix: passes (2-3 s), before and after rebasing onto 8819507.
• Reproduction Part A with the fix: dashd refused to start (exit 1); stderr: Error: Transaction index can't be disabled with governance validation enabled. Either start with -disablegovernance command line switch or enable transaction index. -txindex=0 -disablegovernance still starts with the warning. Parts B and C are regtest-only and are unaffected by the fix, as intended.
• Related existing functional tests with the fix, all passed: feature_config_args.py, feature_governance_objects.py, feature_masternode_params_devnet.py, p2p_connect_to_devnet.py, feature_reindex.py, rpc_blockchain.py (v1 and v2 transport), rpc_misc.py, wallet_import_rescan.py --legacy-wallet. feature_unsupported_utxo_db.py was skipped locally (it needs previous-release binaries and Linux).
• Lint: lint-whitespace.py, lint-python.py, lint-files.py, lint-tests.py, lint-format-strings.py, lint-python-dead-code.py, lint-qt-translation.py are clean. The C++ hunk is formatted with contrib/devtools/clang-format-diff.py.

Breaking Changes

Outside regtest, a node started with -txindex=0 and without -disablegovernance now refuses to start, as it did before v23.1.0. Such a node could not validate proposals anyway. To keep running without the index, operators add -disablegovernance. The same applies to -reindex-chainstate runs, which already require -txindex=0.

Checklist:

• I have performed a self-review of my own code
• I have made corresponding changes to the documentation
• I have assigned this pull request to a milestone (for repository code-owners and collaborators only)

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

Next included review available in 34 minutes.

Check out review usage here.

View limit details

Limit details: You’ve used all 4 included reviews currently available.

Learn how review limits work.

Review configuration:

⚙️ Run configuration

• Configuration used: Repository UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 27c56bf4-68c6-4d1d-ad2c-b5313ba5ab7e

📥 Commits

Reviewing files that changed from the base of the PR and between 8819507 and d77f357.

📒 Files selected for processing (3)

• src/init.cpp
• test/functional/feature_governance_txindex_devnet.py
• test/functional/test_runner.py

• Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[thepastaclaw]

✅ Final review complete — no blockers (commit d77f357) · triage: low · Phase 2 only (queue backlog)

[thepastaclaw]

Final validation — Phase 2 only (queue backlog)

The restored startup check matches the original governance/txindex condition and regtest exemption, preserves existing masternode and pruning checks, and has a registered devnet test covering both rejection and the governance-disabled alternative. The reviewed range contains one coherent commit with no unrelated changes or confirmed in-scope defects. Verification was static only: the supplied CI snapshot shows successful formatting and container preparation checks, two queued manifest jobs, and a PR-title validation failure consistent with the workflow excluding the init scope; independent build and functional-test results are not available in that snapshot.

Review provenance

Source: reviewer 1: gpt-6.1-sol (agent: phase2-reviewer, role: general); reviewer 2: gpt-6.1-sol (agent: phase2-reviewer, role: dash-core-commit-history); final verifier: gpt-6.1-sol (agent: sol-verifier, role: final-verifier)

• Triage: low by gpt-6.1-sol (effort low) — The diff restores a small, well-contained startup parameter check in src/init.cpp and adds a focused functional regression test without changing governance validation or peer-handling logic.
• Phase 1 reviewers: not run (skipped for throughput: 20 PRs queued, above the 10 limit)
• Fresh verifier: gpt-6.1-sol — final-verifier; agent sol-verifier
• Phase 2 reviewers: gpt-6.1-sol — general (completed, effort medium); agent phase2-reviewer, gpt-6.1-sol — dash-core-commit-history (completed, effort medium); agent phase2-reviewer

[knst]

utACK d77f357

[knst]

nit: I'd move this scenario to test/functional/p2p_connect_to_devnet.py or test/functional/feature_masternode_params_devnet.py but that's fine for now