{"id":15004,"date":"2026-10-28T05:33:49","date_gmt":"2026-10-28T05:33:49","guid":{"rendered":"https:\/\/cryptonews.uk.com\/?p=15004"},"modified":"2026-10-28T05:33:49","modified_gmt":"2026-10-28T05:33:49","slug":"bitcoin-apps-risk-massive-fee-drain-and-2-library-bugs-are-blamed","status":"publish","type":"post","link":"https:\/\/cryptonews.uk.com\/?p=15004","title":{"rendered":"Bitcoin apps risk massive fee drain, and 2 library bugs are blamed"},"content":{"rendered":"

<\/p>\n

\n

Bitcoinjs-lib, a library used to build Bitcoin applications, has patched two bugs that can make software understate the miner fee a valid transaction would pay if broadcast and accepted.<\/p>\n

The Oct. 26 security disclosures identify fixes in versions 5.2.2, 6.1.9 and 7.0.4 for the corresponding release lines.<\/p>\n

The affected format is a partially signed Bitcoin transaction (PSBT), and BIP 174 defines it as a way to pass transaction information and signatures between clients. Signing, combining signatures, finalizing inputs, and extracting the transaction are separate functions, even when one application performs several of them.<\/p>\n

The risk concerns applications that import these packages and trust bitcoinjs-lib’s fee calculation or excessive-fee safeguard without independently checking the outputs being spent. Maintainers need to review their dependency version and how they validate imported PSBTs.<\/p>\n

Why valid signatures can accompany misleading fees<\/h2>\n

A Bitcoin transaction’s fee is the difference between the value of its inputs and its outputs, so understating an input makes the calculated fee look smaller.<\/p>\n

In the first flaw, signing and fee accounting can use different values for the same input. Signing uses the full previous transaction, while fee accounting prefers a conflicting record containing a smaller value. As a result, the vulnerable software can authorize the real transaction while evaluating the wrong fee.<\/p>\n

The advisory describes a demonstration on bitcoinjs-lib 7.0.1 in which the actual fee was 900,000,000 satoshi, but the library reported 200 satoshi. The signature verified, and extraction returned without the default fee-rate warning.<\/p>\n

\n

Related Reading<\/span><\/p>\n

Eclair merges fixes for Lightning flaws that could burn Bitcoin in fees<\/h3>\n<\/p>\n

<\/span> <\/div>\n

The second advisory describes finalized inputs with both input-value records missing. The calculator counts those inputs as zero, and an already-signed PSBT imported from another party can reach this calculation without needing another signing operation.<\/p>\n