davide
c8ba2294f2
After connecting, the Send tab offers Fast/Normal/Economy rates from the server's fee estimates (never below the relay fee, implausible values ignored). A manual rate below the relay fee is refused before building and a fee above 1% of the amount is flagged in the preview. See ADR 0039.
2.5 KiB
2.5 KiB
0039. Server fee estimates, relay floor and a high-fee warning
- Status: Accepted
- Area: Wallet
- Recorded: 2026-11-03
Context
EstimateFeeAsync and RelayFeeAsync existed but nothing called them. The default fee rate was the constant 1 sat/vB and the only validation was "greater than zero" (and the F-01 upper bound). A rate below the node's minimum relay fee built a transaction that was rejected only at broadcast, with a generic server error, and a congested chain gave no guidance. ADR 0017 chose a single manual fee rate; this extends it without replacing the manual field.
Decision
- After connecting, the ViewModel asks the server for
blockchain.relayfeeandblockchain.estimatefeewith targets 2, 6 and 24 blocks (FeePolicy.FetchAsync,Core/Wallet/FeePolicy.cs). Each call is optional: an error or a malformed answer leaves that value empty. - Values are converted from coin/kB to sat/vB (× 100,000,000 / 1,000), rounded to 2 decimals.
-1(no estimate), zero, negative, or aboveCoinAmount.MaxFeeRate(1000 sat/vB) is discarded as implausible. An estimate is raised to the relay fee if lower. - The Send form offers Fast, Normal and Economy buttons and a hint line with the numbers; Normal is preselected only if the user has not typed a rate. Without usable estimates the presets are hidden and the manual field keeps the 1 sat/vB default.
- A manual rate below the known relay fee is refused before building, with a message naming the minimum. Donate follows the same rules.
- The estimate is untrusted input, so the absolute fee is always shown, and the preview adds a warning when the fee exceeds 1% of the amount sent (
FeePolicy.IsHighFee). The warning is advisory, not blocking.
Consequences
- A rate the node would reject is caught locally with a clear message; the default follows the network instead of a constant.
- A malicious server can still suggest a high-but-plausible rate (up to 1000 sat/vB); the bound, the visible absolute fee and the 1% warning limit the damage, and the user can always type a rate.
- Presets fetched once per connection are not refreshed during a long session; reconnecting refreshes them.
- The relay-fee check relies on a value from the same server; a server that reports a high relay fee can only make the wallet more conservative, not less.
References
src/Core/Wallet/FeePolicy.cssrc/App/ViewModels/MainWindowViewModel.Send.cstests/PalladiumWallet.Tests/Wallet/FeePolicyTests.cs- Related: 0017