Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[PSBT] TX modifying methods don't throw when finalized #1438

Closed
junderw opened this issue Jul 23, 2019 · 0 comments · Fixed by #1439
Closed

[PSBT] TX modifying methods don't throw when finalized #1438

junderw opened this issue Jul 23, 2019 · 0 comments · Fixed by #1439

Comments

@junderw
Copy link
Member

junderw commented Jul 23, 2019

Currently, PSBT checks if setVersion, setLocktime, setInputSequence, addInput, addOutput can be performed by checking the existence of partialSigs, and what sighash they use.

However, after running finalizeAllInputs but BEFORE running extractTransaction, you can change the transaction, and it will extract an invalid transaction (since the transaction changed since the signature)...

Some ways to fix this:

  1. fail partialSig check if final* attributes are present.
  2. if no partialSig but final* exists, parse final* and search for any signatures and check the sighash (simple fix, but very performance intensive (it checks all inputs every time))

1 seems simple, but there might be a use case where someone wants to pass around PSBTs with only SOME finalized inputs that have SIGHASH_ANYONECANPAY etc. and want to allow other people to add more inputs etc.

In which case 2 is more correct.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

1 participant