#CriticalVulnerability
đ¨ Attention $BTC application developers: critical vulnerability in âbitcoinjs-libâ
Two serious bugs have been fixed in the popular `bitcoinjs-lib` library. These flaws could cause applications to catastrophically underreport miner fees for fully valid, signed PSBT (Partially Signed Bitcoin Transaction) transactions.
What is the issue?
In Bitcoin, the fee is the difference between the sum of the inputs and the sum of the outputs. Two distinct logic errors caused the library to report a minimal fee (e.g., 200 or 1,000 satoshis), while the actual amount deducted from the wallet and paid to miners could be as high as nearly 1 BTC (900 million satoshis).
1. Conflicting Input Values: The signing process utilized the full data from the previous transaction, whereas the fee calculation module relied on a conflicting record with a lower value. While the signature remained valid, the fee calculation was incorrect.
2. Missing Input-Value Records: For finalized inputs where the amount was not specified, the library treated the value as "0." This allowed a massive actual fee to be hidden within imported transactions.
Which versions are affected? v5 series: fixed in
âĄď¸ 5.2.2 (vulnerable: 5.1.0 â 5.2.1)
âĄď¸ v6 series: fixed in 6.1.9 (vulnerable: 6.0.0 â 6.1.8)
âĄď¸ v7 series: fixed in 7.0.4 (vulnerable: 7.0.0-rc.0 â 7.0.3)
What should you do?
âĄď¸ Update to the patched versions (5.2.2, 6.1.9, 7.0.4).
âĄď¸ If updating is not currently possible, implement independent verification of input values ââand reject any inconsistent entries before signing or calculating fees.
The security of your application depends on whether you blindly trust libraries or verify every single satoshi. đĄď¸
đ¨ Attention $BTC application developers: critical vulnerability in âbitcoinjs-libâ
Two serious bugs have been fixed in the popular `bitcoinjs-lib` library. These flaws could cause applications to catastrophically underreport miner fees for fully valid, signed PSBT (Partially Signed Bitcoin Transaction) transactions.
What is the issue?
In Bitcoin, the fee is the difference between the sum of the inputs and the sum of the outputs. Two distinct logic errors caused the library to report a minimal fee (e.g., 200 or 1,000 satoshis), while the actual amount deducted from the wallet and paid to miners could be as high as nearly 1 BTC (900 million satoshis).
1. Conflicting Input Values: The signing process utilized the full data from the previous transaction, whereas the fee calculation module relied on a conflicting record with a lower value. While the signature remained valid, the fee calculation was incorrect.
2. Missing Input-Value Records: For finalized inputs where the amount was not specified, the library treated the value as "0." This allowed a massive actual fee to be hidden within imported transactions.
Which versions are affected? v5 series: fixed in
âĄď¸ 5.2.2 (vulnerable: 5.1.0 â 5.2.1)
âĄď¸ v6 series: fixed in 6.1.9 (vulnerable: 6.0.0 â 6.1.8)
âĄď¸ v7 series: fixed in 7.0.4 (vulnerable: 7.0.0-rc.0 â 7.0.3)
What should you do?
âĄď¸ Update to the patched versions (5.2.2, 6.1.9, 7.0.4).
âĄď¸ If updating is not currently possible, implement independent verification of input values ââand reject any inconsistent entries before signing or calculating fees.
The security of your application depends on whether you blindly trust libraries or verify every single satoshi. đĄď¸
