Bitcoin apps risk massive fee drain, and 2 library bugs are blamed
Two critical bugs in Bitcoinjs-lib could understate miner fees by billions of satoshi, allowing valid transactions to bypass safety checks.
Bitcoinjs-lib, a library used to build Bitcoin applications, has patched two bugs that can make software understate the miner fee a valid transaction would pay if broadcast and accepted. The Oct. 26 security disclosures identify fixes in versions 5.2.2, 6.1.9 and 7.0.4 for the corresponding release lines.
Fee Calculation Flaws
The affected format is a partially signed Bitcoin transaction (PSBT), defined by BIP 174 as a way to pass transaction information and signatures between clients. The risk concerns applications that trust bitcoinjs-lib's fee calculation without independently checking the outputs being spent.
In the first flaw, signing and fee accounting use different values for the same input. Signing uses the full previous transaction, while fee accounting prefers a conflicting record containing a smaller value. The advisory describes a demonstration where the actual fee was 900,000,000 satoshi, but the library reported 200 satoshi.
Conflicting or missing input-value records can understate miner fees and defeat safeguards when applications trust the vulnerable library's accounting.
Missing Input Values
The second flaw concerns finalized inputs with both input-value records missing. The calculator counts those inputs as zero, and an already-signed PSBT imported from another party can reach this calculation without needing another signing operation.
A hypothetical example shows a true fee of 91,000 satoshi but a reported fee of 1,000 satoshi. Finalized scripts and signatures alone do not establish the missing input's value. The remediation requires every value to be present during fee calculation.
Developer Response
Affected releases include versions 5.2.0 through 5.2.1, 6.0.0 through 6.1.8, and 7.0.0-rc.0 through 7.0.3 for the first flaw. The missing-record flaw affects the same v6 and v7 ranges, plus 5.1.0 through 5.2.1 in the v5 line.
Maintainers unable to upgrade should independently verify referenced output values. They must reject conflicting records before signing or trusting fees, and verify every input value before trusting fees or extracting a transaction. Actual loss requires an authorized, valid transaction to be broadcast and accepted by the network.
Related
