Probabilistic disconnections could make it quite hard to debug protocol implementations and increases the risk of flaky behaviour in the wild significantly. I don&#39;t see why a simpler solution isn&#39;t better.<br><div>
<br></div><div>The most likely failure mode of this is not an attack but the same as previous breakages - scaling or legitimate version skew that causes problems as the network evolves. </div><div><br></div><div>Agree with Luke that non-standard transactions should not be considered an attack.</div>
<div><br></div><div>If you stay with the scoring system I&#39;d be tempted to have a flag (defaults to 100) that sets a minimum threshold for the badness scores and ignores any below that. Attacks based on sending transactions that aren&#39;t syntactically valid don&#39;t seem likely to me, this isn&#39;t a good way to DoS somebody because discarding them is so cheap. If it turns out later there is a problem, people under attack could flip the flag until a new version is released.</div>
<div><br></div><div>The formula for the DoS score in the case of invalid signatures/merkle roots seem unnecessarily elaborate. An invalid signature should never occur and could always result in immediate disconnection.</div>
<div><br></div><div>Treating a block with too many sigops as invalid means legitimate relayers might be treated as an attacker if/when the constant changes in future. I&#39;d suggest not treating this as an attacking situation at all.</div>
<div><br></div><div>Why use a mutable field with a const setter?</div><div><br></div><div>Unit tests that rely on sleeps like this can be flaky because the OS delay isn&#39;t always precise, not to mention slow/irritating to run. It&#39;s better if tests can override the clock, eg, if GetTime() did something like</div>
<div><br></div><div>   if (nMockTime) { return nMockTime} else { ... }</div><div><br></div><div>then unit tests could reliably modify and advance the clock in a fast/efficient manner.</div>