Two library bugs put Bitcoin apps at risk of excessive fee payouts
A report says apps that import PSBTs can miscalculate miner fees and miss an excessive-fee warning when built on two vulnerable libraries.
Bitcoin applications that rely on two faulty libraries may be misjudging how much they pay in miner fees, according to a CryptoSlate report. The issue centres on software that accepts partially signed bitcoin transactions (PSBTs) from outside sources.
In the affected setup, the application's fee accounting produces an incorrect figure, and an existing safeguard meant to flag unusually large fees fails to trigger. The practical result is that a user or service could authorise a transaction paying far more in fees than intended without any warning appearing.
Where the problem sits
PSBTs are a standard format for passing a transaction between wallets, signing devices and coordinators before it is finalised and broadcast. Because the importing software often calculates the difference between inputs and outputs itself, errors in that accounting translate directly into fee mistakes.
- Two separate library bugs are blamed for the faulty behaviour
- Importing a PSBT can lead to an incorrect fee calculation
- The excessive-fee warning can be bypassed as a result
- Details on affected libraries, versions and patches were not included in the initial summary of the report
The report does not, in the material reviewed, quantify losses or identify which projects depend on the vulnerable code. Teams that handle PSBTs — wallet providers, coordinators and signing services — would need to audit their own dependencies to establish exposure.
Fee-handling bugs are consequential in Bitcoin because transactions are irreversible once confirmed. Security disclosures of this kind typically prompt maintainers to ship patches and downstream projects to pin or upgrade versions, though no remediation timeline has been confirmed here.