CAmount: A Stronger Money Type (Bitcoin Core Dev Tech, May 2026)

Bitcoin Core represents money as typedef int64_t CAmount, which permits error-prone mixing with booleans, floats, and unsigned sizes. Motivated by a recent bug that mixed a boolean with a CAmount, this presentation explored replacing the typedef with an Amount class (and a separate unsigned UAmount) that disallows dangerous operations, requires an explicit initial value, and could introduce user-defined literals such as 500_sats or _BTC for tests.

The talk also surfaced numeric subtleties — for example std::numeric_limits defaulting to zero rather than a compile error for a naive custom type, and unsigned-times-signed multiplication producing different results on 32- versus 64-bit platforms. Feedback favored a gradual rollout and noted that leaning on compiler warnings and Clang-tidy need not be an either/or against a new type; the presenter reported that existing tooling (UBSAN and tests) already does a remarkable job and that no major bugs had been uncovered yet, suggesting this area of the code is in good shape.