Bitcoin Core #36535 sums package weight in int64_t, closing a 32-bit wrap in the size check
Victoria Shinder2 min readBitcoin Core merged pull request #36535, "policy: sum package weight in int64_t", on 16 October 2026. It changes one line in IsWellFormedPackage, the function that rejects a transaction package as package-too-large when its combined weight exceeds MAX_PACKAGE_WEIGHT.
The bug. The function adds up the weights of the transactions in a package with std::accumulate, starting from a plain 0. As an earlier pull request on the same issue explains, std::accumulate takes its accumulator type from the initial value, so the running total was an int: the 64-bit result of each addition was narrowed back to 32 bits on every step. A package whose real combined weight exceeded INT_MAX would therefore wrap to a small or negative number and pass the package-weight check. According to that earlier pull request, this is the only place MAX_PACKAGE_WEIGHT is enforced, and the two neighbouring weight and fee sums on the package-acceptance path already start from a 64-bit value.
The fix. The sum now starts from int64_t{0}, the same way the virtual-size sum in validation.cpp already does. The author, fametrano, took the one-line change from #35473, which had been closed with an invitation to do so. No test was added, because the test proposed in #35473 had been turned down. Instead, the author describes a throwaway local check: putting one transaction of 88 million weight units into a package 25 times. Before the fix the package was rejected as package-contains-duplicates; after it, as package-too-large.
How serious it was. Both pull requests describe the impact as limited and policy-only, not a consensus issue. The author of #36535 notes that no package that large reaches the check today: RPC request bodies are capped at 32 MiB and P2P messages at 4 MB, so the change is defence in depth. #35473 adds that oversized transactions would still have been rejected one by one by the per-transaction weight and standardness checks that run later, so the effect would only have been that the early package-level rejection failed to fire and the node did more work before refusing the package; it named the submitpackage RPC as a way to reach the check.
Also merged the same day. #35724 improves logging of compact-block reconstruction: at debuglevel=trace it records every missing transaction in a received cmpctblock and every missing transaction requested from the node, and it logs sizes and counts of transactions taken from the prefill, the mempool and the extra pool, plus redundant transactions in the prefill section. It was split out of a larger series on compact-block prefilling.
Source: bitcoin/bitcoin pull request #36535 — https://github.com/bitcoin/bitcoin/pull/36535 ; earlier discussion: https://github.com/bitcoin/bitcoin/pull/35473