Bitcoin apps risk massive fee drain, and 2 library bugs are blamed

Bitcoinjs-lib, a library used to build Bitcoin applications, has patched two bugs that can make software understate the miner fee a valid transaction would pay if broadcast and accepted.

The Oct. 26 security disclosures identify fixes in versions 5.2.2, 6.1.9 and 7.0.4 for the corresponding release lines.

The affected format is a partially signed Bitcoin transaction (PSBT), and BIP 174 defines it as a way to pass transaction information and signatures between clients. Signing, combining signatures, finalizing inputs, and extracting the transaction are separate functions, even when one application performs several of them.

The risk concerns applications that import these packages and trust bitcoinjs-lib’s fee calculation or excessive-fee safeguard without independently checking the outputs being spent. Maintainers need to review their dependency version and how they validate imported PSBTs.

Why valid signatures can accompany misleading fees

A Bitcoin transaction’s fee is the difference between the value of its inputs and its outputs, so understating an input makes the calculated fee look smaller.

In the first flaw, signing and fee accounting can use different values for the same input. Signing uses the full previous transaction, while fee accounting prefers a conflicting record containing a smaller value. As a result, the vulnerable software can authorize the real transaction while evaluating the wrong fee.

The advisory describes a demonstration on bitcoinjs-lib 7.0.1 in which the actual fee was 900,000,000 satoshi, but the library reported 200 satoshi. The signature verified, and extraction returned without the default fee-rate warning.

The second advisory describes finalized inputs with both input-value records missing. The calculator counts those inputs as zero, and an already-signed PSBT imported from another party can reach this calculation without needing another signing operation.

Its hypothetical example has a true fee of 91,000 satoshi but a reported fee of 1,000 satoshi. Finalized scripts and signatures alone do not establish the missing input’s value.

Actual loss requires an authorized, valid transaction to be broadcast and accepted by the network. These defects do not create signatures, and excess value becomes a miner fee.

For conflicting records, affected releases are 5.2.0 through 5.2.1, 6.0.0 through 6.1.8 including 6.1.0-rc.0, and 7.0.0-rc.0 through 7.0.3. The missing-record flaw affects the same v6 and v7 ranges, plus 5.1.0 through 5.2.1 in the v5 line.

The remediation gives signing and accounting a shared method for resolving previous outputs, rejects conflicting values or scripts, and requires an amount for every input during fee calculation. It also clears cached fees and extracted transactions after relevant metadata changes or combinations.

Maintainers unable to upgrade should independently verify referenced output values. Reject conflicting records before signing or trusting fees, and verify every input value before trusting fees or extracting a transaction.