This audit follows how VTA treats coinbase maturity, transaction structure, UTXO availability, mempool conflicts and input/script validation. The diagram below is an inline SVG so the validation path is visible on desktop and mobile.
main.h defines COINBASE_MATURITY = 8.
CMerkleTx::GetBlocksToMaturity() uses (COINBASE_MATURITY + 1) minus main-chain depth, bounded at zero.
The maturity calculation is applied only when the transaction is coinbase; normal transactions return zero blocks-to-maturity.
CheckTransaction() requires the coinbase scriptSig to be 2–100 bytes.
Non-coinbase inputs with a null prevout are rejected.
CheckTransaction() tracks COutPoint values and rejects duplicate inputs.
AcceptToMemoryPool() uses the coin view and HaveInputs(tx); already-spent inputs are rejected.
pool.mapNextTx is checked for an existing transaction spending the same outpoint; replacement is disabled in this path.
The transaction path calculates input and output values and rejects transactions that fail input/script validation before mempool admission.
CheckInputs() is invoked after the cheaper checks, with P2SH and strict-encoding script flags.
AcceptToMemoryPool() explicitly rejects a coinbase transaction as an individual transaction.
CMerkleTx checks that its block index entry exists and is contained in chainActive before returning confirmation depth.
The source path is verified, but this site has not run a controlled conflicting-transaction experiment against a live VTA network.
The 8-block rule is source-verified; no current network-wide dataset is used to claim observed maturity timing.
main.h. GetBlocksToMaturity() returns max(0, (COINBASE_MATURITY+1) - GetDepthInMainChain()) for coinbase transactions. This is a source-level rule; it should not be converted into a claim about current network activity.VTA main.h defines the 8-block coinbase maturity rule. main.cpp verifies transaction structure, rejects duplicate inputs, excludes coinbase from the mempool, checks missing/spent inputs through the coin view, detects mempool outpoint conflicts, and invokes CheckInputs() for script/signature validation.