[RDY] Update Bcash to support native tokens and P2SH32 address type by mainnet-pat · Pull Request #1309 · trezor/blockbook

mainnet-pat · 2025-08-14T06:55:31Z

This pull request upgrades the Bcash to support new BCH network upgrades to include P2SH32 address type support and BCH native tokens (CashTokens) support.

bchutil package was updated but referenced as a replacement package. A separate PR for it is out of scope for this review, but can be filed immediately .

Blockbook's bcashparser.go was updated to support new P2SH32 addresses from bchutil and to support token info parsing from output locking bytecode. Extensive tests were added to bcashparser_tests.go

New token type structs were put into types_bcash_type.go

rocksdb.go function packAddressKey was updated to strip token info from AddressDescriptor for BCH case and store all CashToken utxos under the same key.

worker.go functions getTransactionFromBchainTx and GetTransactionFromMempoolTx were updated to return BCH specific token data.

txdetail.html template and public.go were updated to render CashTokens specific data with different token categories being color-coded accordingly as there are more than one different tokens allowed to be interacted with within a single transaction.

go.sum updates are unintentional and made by my IDE to compile the project, let me know if we can sort this out with minimal interventions.

This PR looks for repository's maintainer feedback regarding data structures and other general remarks which will update its quality.

This PR is marked as WIP, as currently the token metadata (ticker, name, decimals, etc.) lookup and rendering are not implemented, and will be worked on after the submission.

Deployment preview:

Current:

https://bch1.trezor.io/tx/d7ad5f6336cd2c80c86e241ab2deb7b981b7dd9234b68a5b42e304829e482fb2
https://bch1.trezor.io/api/v2/tx/d7ad5f6336cd2c80c86e241ab2deb7b981b7dd9234b68a5b42e304829e482fb2

This PR:
https://blockbook.pat.mn/tx/d7ad5f6336cd2c80c86e241ab2deb7b981b7dd9234b68a5b42e304829e482fb2
https://blockbook.pat.mn/api/v2/tx/d7ad5f6336cd2c80c86e241ab2deb7b981b7dd9234b68a5b42e304829e482fb2

MfG,
pat.

Add P2SH32 support Update txdetails template for BCH

etimofeeva · 2025-09-30T13:29:02Z

Thank you for the contribution, we will take a look and review it!

mainnet-pat · 2025-09-30T18:32:39Z

Thank you for the contribution, we will take a look and review it!

Thanks.

While working further on BCH native token support in blockbook I realized that I'd need to reapproach the way I handle them (will commit soon). CashTokens live in output's PubkeyScript prepending the classical addrDesc script like 76a914..88ac with ef..tokenData. So storing the full PubkeyScript with token data in addrDesc and parsing token info on the fly leads to overly complex situations. Instead, I decided to put token info in TxInput, TxOutput and Utxo to clearly separate the addrDesc from token data and index token outputs by the same holder address.

Might sound a bit too technical, if you need any extra info, DM me on TG or discord @mainnet_pat

Copilot

Pull Request Overview

This PR upgrades Bcash support to include native tokens (CashTokens) and P2SH32 address type support, implementing comprehensive token data parsing and rendering functionality for the Bitcoin Cash network.

Updates to bchutil package for P2SH32 address support
New token parsing infrastructure with comprehensive validation
Frontend updates to display CashTokens with color-coded categories

Reviewed Changes

Copilot reviewed 16 out of 17 changed files in this pull request and generated 6 comments.

Show a summary per file

File	Description
bchain/types_bcash_type.go	Defines new BCH-specific data structures for CashTokens and NFTs
bchain/coins/bch/bcashparser.go	Core token parsing implementation with full validation
db/rocksdb.go	Updates address key packing to handle token prefixes
api/worker.go	Integrates token parsing into transaction processing
server/public.go	Adds template function for token rendering with color-coding
static/templates/txdetail.html	Template updates to display token information
static/css/main.css	New CSS classes for token display styling

_{Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.}

Copilot · 2025-10-06T13:41:22Z

+/**
+ * Given a 32-byte hex-encoded token category, return a deterministic hue and
+ * saturation value to use in HSL colors representing the token category.
+ * Usage: `hsl(${ tokenCategory2HueSaturation(vout.tokenData.category) }, 50%)`


The documentation comment uses JavaScript-style template literal syntax in the usage example, but this is a Go function. The usage example should show Go template syntax instead.

Suggested change

* Usage: `hsl(${ tokenCategory2HueSaturation(vout.tokenData.category) }, 50%)`

* Usage: `hsl({{ tokenCategory2HueSaturation .Vout.TokenData.Category }}, 50%)`

Copilot · 2025-10-06T13:41:23Z

+// see original implementation: https://github.com/sickpig/bch-rpc-explorer/blob/85aed82dcae5b22050f26184bde229fe60a958b9/app/utils.js#L812
+func tokenCategory2HueSaturation(category string) string {
+	// Decode hex string to bytes
+	bin, _ := hex.DecodeString(category)


Error from hex.DecodeString is ignored. While this might be acceptable if the category is guaranteed to be valid hex, it's better practice to handle the error or add a comment explaining why it's safe to ignore.

Suggested change

bin, _ := hex.DecodeString(category)

bin, err := hex.DecodeString(category)

if err != nil {

// Return a default value if decoding fails

return "0,50%"

}

Copilot · 2025-10-06T13:41:23Z

+			// TODO: do not panic
+			panic(errors.Errorf("Cannot get script from address descriptor %s", addrDesc))


Using panic for error handling is generally not recommended in production code. Consider returning an error instead or implementing proper error handling.

Copilot · 2025-10-06T13:41:24Z

+	if br.Size() < 34 {
+		return nil, 0, fmt.Errorf("Invalid token prefix: insufficient length. The minimum possible length is 34. Missing bytes: %d", 34-br.Size())


The calculation 34-br.Size() is incorrect. Since br.ReadByte() was already called, br.Size() returns the original size, not the remaining size. This should be 34-len(script) or use br.Len() for remaining bytes.

Suggested change

if br.Size() < 34 {

return nil, 0, fmt.Errorf("Invalid token prefix: insufficient length. The minimum possible length is 34. Missing bytes: %d", 34-br.Size())

if br.Len() < 33 {

return nil, 0, fmt.Errorf("Invalid token prefix: insufficient length. The minimum possible length is 34. Missing bytes: %d", 33-br.Len())

Copilot · 2025-10-06T13:41:24Z

+				hueSat := tokenCategory2HueSaturation(t.Category)
+				tokenColor := "hsl(" + hueSat + ",40%)"
+
+				// outter div


Corrected spelling of 'outter' to 'outer'.

Copilot · 2025-10-06T13:41:24Z

+					rv.WriteString(`</div>`)
+
+				}
+				// outter div end


Corrected spelling of 'outter' to 'outer'.

mainnet-pat · 2025-10-08T13:15:24Z

I am glad to announce that I have finished the work on CashTokens support in blockbook. Token information is nicely parsed from outputs and stored in TxAddresses and AddressBalance tables and available in API calls. Furthermore, the BCMR standard for token metadata publishing is supported and token category and NFT metadata is stored in RocksDB for fast access from consumers. API and UI were updated to render both CashTokens core info as well as optional metadata (see attached images).

Final sync is being completed and is available at https://blockbook.pat.mn

Please let me know if you have any questions so we can finalize this PR towards the inclusion in the mainline.

Images

Address page:

Transaction info:

Token category page:

Token nft details page:

mainnet-pat · 2025-11-29T19:38:50Z

Thank you for the contribution, we will take a look and review it!

Look forward to get your feedback on the latest work

pragmaxim

That's a lot of great work here! I made a few comments, cheers

pragmaxim · 2026-01-17T10:52:09Z

+		if d.is.IsBCH() && len(buf[al:]) > 0 {
+			tokenLen, tl := unpackVarint(buf[al:])
+			al += tl
+			if tokenLen > 0 && len(buf[al:]) >= tokenLen {
+				bcashToken, ll, err := bch.UnpackTokenData(buf[al:])
+				if err == nil && ll == tokenLen {
+					al += ll
+					ti.BcashToken = bcashToken
+				}
+			}
+		}


Just fyi, this is not binary compatible and db must be resynced. DB format changes without a version bump will misparse existing DBs.

Why it matters: BCH nodes with an existing DB will read old txAddresses/addressBalance rows with the new token-length fields, leading to silent data corruption or misaligned reads.

Suggested fix (force reindex or migrate):
// db/rocksdb.go const dbVersion = 8
If you want a migration path, add a 7->8 migration in checkColumns (similar to 6->7) and gate token fields behind that version.

pragmaxim · 2026-01-17T10:54:32Z

 }

-func unpackAddrBalance(buf []byte, txidUnpackedLen int, detail AddressBalanceDetail) (*AddrBalance, error) {
+func (d *RocksDB) unpackAddrBalance(buf []byte, txidUnpackedLen int, detail AddressBalanceDetail) (*AddrBalance, error) {


I think that unpackAddrBalance leaks the previous token into subsequent non-token UTXOs.

Why it matters: a single token UTXO followed by a normal UTXO will cause the later UTXO to incorrectly carry the token metadata.

Suggested fix (reset token per loop):
for len(buf[l:]) >= txidUnpackedLen+3 { var bcashToken *bchain.BcashToken // ... parse fields ... if d.is.IsBCH() && len(buf[l:]) > 0 { // parse tokenLen/token data into bcashToken } u := Utxo{BcashToken: bcashToken, /* ... */ } // ... }

pragmaxim · 2026-01-17T10:55:35Z

+		if d.is.IsBCH() && len(buf[al:]) > 0 {
+			tokenLen, tl := unpackVarint(buf[al:])
+			al += uint(tl)
+			if tokenLen > 0 && len(buf[l:]) >= tokenLen {
+				bcashToken, ll, err := bch.UnpackTokenData(buf[al:])
+				if err == nil && ll == tokenLen {
+					al += uint(ll)
+					ti.BcashToken = bcashToken
+				}
+			}
+		}


BCH tx input decoding uses the wrong bounds check for token data in the non-extended path.

Why it matters: the len(buf[l:]) check can be true even when there is not enough data remaining, which can misalign the decoder on corrupted/partial rows (or after a failed migration).

Suggested fix:
if tokenLen > 0 && len(buf[al:]) >= tokenLen { // ... }

pragmaxim · 2026-01-17T10:56:41Z

+			if d.is.IsBCH() {
+				script, _ := hex.DecodeString(output.ScriptPubKey.Hex)
+				var l int
+				bcashToken, l, err = bch.UnpackTokenData(script)
+				if err == nil {
+					addrDesc = script[l:]
+				}
+			} else {
+				addrDesc, err = d.chainParser.GetAddrDescFromVout(output)
+			}


BCH output parsing skips P2PK normalization and ignores script decode errors.

Why it matters: P2PK outputs are no longer normalized to P2PKH when tokens are present, which changes address indexing behavior compared to legacy BCH handling.

Suggested fix (parse token + use parser normalization):
if d.is.IsBCH() { script, err := hex.DecodeString(output.ScriptPubKey.Hex) if err != nil { return err } bcashToken, _, err = bch.UnpackTokenData(script) if err != nil { return err } addrDesc, err = d.chainParser.GetAddrDescFromVout(output) }

pragmaxim · 2026-01-17T10:59:03Z

+	if len(metaQueue) > 0 {
+		serializedMetaQueue := make([][]byte, len(metaQueue))
+		for i, mq := range metaQueue {
+			serializedMetaQueue[i] = append(PackBcashTokenMetaQueueKey(mq, make([]byte, 34)), PackBcashTokenMetaQueue(mq, make([]byte, 9))...)
+		}
+		common.BcmrMetaQueueSignal <- serializedMetaQueue
+	}


processBcashTokens can block block processing on slow BCMR downloads.

Why it matters: the channel has a depth of 1 and the consumer performs synchronous HTTP fetches; this can stall indexing under load or provider latency.

Suggested fix (non-blocking send or decouple):
select { case common.BcmrMetaQueueSignal <- serializedMetaQueue: default: glog.Warning("BCMR queue signal dropped; downloader is busy") }

pragmaxim · 2026-01-17T11:01:57Z

+		categoryName := categoryHex
+		if token.Name != "" {
+			categoryName = token.Name
+		}
+
+		tokenCategoryImg := ""
+		if token.Icon != "" {
+			tokenCategoryImg = fmt.Sprintf(`<img onerror="this.style.display='none'" src="%s" alt="Token Icon" width="32px" height="32px"> `, token.Icon)
+		}


BCMR metadata is rendered into HTML without escaping, enabling XSS via token metadata.

Why it matters: token.Name, token.Icon, and NFT metadata are external inputs that can contain HTML/JS.

Suggested fix (escape user-controlled fields or avoid template.HTML):
categoryName := template.HTMLEscapeString(token.Name) tokenCategoryImg := template.HTMLEscapeString(token.Icon) // ... and avoid returning template.HTML for raw concatenated markup

pragmaxim · 2026-01-17T11:04:05Z

+	}
+}
+
+func Test_packAddrBalance_unpackAddrBalance_Bcash(t *testing.T) {


tests do not cover token UTXO followed by non-token UTXO in address balance decoding.

Why it matters: this gap would allow the token carry-over bug.

Suggested fix: add a test vector where a token UTXO is followed by a non-token UTXO and ensure the latter has BcashToken == nil.

mainnet-pat · 2026-01-17T11:47:30Z

Amazing review and findings, thank you. Glad you liked my work.

pragmaxim · 2026-06-23T10:29:06Z

@mainnet-pat I made review and you thanked me but did not react on the comments, now there are conflicts since the PR is stale, we were happy to merge this but you did not address the comments

Add BCH CashTokens support

726892d

Add P2SH32 support Update txdetails template for BCH

MiroslavProchazka requested review from Copilot, etimofeeva, grdddj and martinboehm October 6, 2025 13:39

Copilot AI reviewed Oct 6, 2025

View reviewed changes

mainnet-pat added 2 commits October 8, 2025 12:36

Add BCH CashTokens storage, metadata fetching, API and UI support

28fa4fb

Merge branch 'master' into cashtokens

c935d10

mainnet-pat changed the title ~~[WIP] Update Bcash to support native tokens and P2SH32 address type~~ [RDY] Update Bcash to support native tokens and P2SH32 address type Oct 8, 2025

CyberAshven mentioned this pull request Oct 9, 2025

Add BCH CashTokens support (Fulcrum v2.0+ backend client-side only) cake-tech/cake_wallet#2571

Open

Add token category rendering

661c477

pragmaxim requested changes Jan 17, 2026

View reviewed changes

This was referenced Jul 3, 2026

Fix BCH CashTokens review feedback mainnet-pat/blockbook#1

Closed

Fix BCH CashTokens review feedback mainnet-pat/blockbook#2

Open

	* Usage: `hsl(${ tokenCategory2HueSaturation(vout.tokenData.category) }, 50%)`
	* Usage: `hsl({{ tokenCategory2HueSaturation .Vout.TokenData.Category }}, 50%)`

-	bin, _ := hex.DecodeString(category)
+	bin, err := hex.DecodeString(category)
+	if err != nil {
+		// Return a default value if decoding fails
+		return "0,50%"
+	}

		// TODO: do not panic
		panic(errors.Errorf("Cannot get script from address descriptor %s", addrDesc))

		if br.Size() < 34 {
		return nil, 0, fmt.Errorf("Invalid token prefix: insufficient length. The minimum possible length is 34. Missing bytes: %d", 34-br.Size())

Uh oh!

Uh oh!

Conversation

mainnet-pat commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

etimofeeva commented Sep 30, 2025

Uh oh!

mainnet-pat commented Sep 30, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull Request Overview

Reviewed Changes

Uh oh!

Copilot AI Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Oct 6, 2025

Choose a reason for hiding this comment

Uh oh!

mainnet-pat commented Oct 8, 2025

Images

Uh oh!

mainnet-pat commented Nov 29, 2025

Uh oh!

pragmaxim left a comment

Choose a reason for hiding this comment

Uh oh!

pragmaxim Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

pragmaxim Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

pragmaxim Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

pragmaxim Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

pragmaxim Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

pragmaxim Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

pragmaxim Jan 17, 2026

Choose a reason for hiding this comment

Uh oh!

mainnet-pat commented Jan 17, 2026

Uh oh!

pragmaxim commented Jun 23, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

mainnet-pat commented Aug 14, 2025 •

edited

Loading

mainnet-pat commented Sep 30, 2025 •

edited

Loading