Skip to content

Validate UTXO data for build_fee_bump #51

@notmandatory

Description

@notmandatory

"In build_fee_bump when getting the original utxos the function assumes the previous transaction's output list does contain the output referred by each input of the transaction to be bumped. It will crash otherwise. Although it generally holds, it doesn't necessarily."

"Utxo::txout() will crash if prev_tx.output does not contain its prevout. The only place where a Utxo::Foreign is created without checking whether the outpoint's index is within the bounds of prev_tx.output is in build_fee_bump, where BDK would have crashed earlier (L1653) if it wasn't the case."

Metadata

Metadata

Assignees

Labels

auditSuggested as result of external code audit

Type

No type

Projects

Status

Done

Milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions