Repository navigation
Respect PSBT_GLOBAL_TX_MODIFIABLE in PSBT2.CoinJoin - #1364
Merged
NicolasDorier merged 1 commit intoOct 27, 2026
Merged
Conversation
BIP 370 requires a Constructor to check PSBT_GLOBAL_TX_MODIFIABLE before adding inputs or outputs. PSBT2.CoinJoin added both without checking, so it could merge into a PSBT whose flags say it is closed, for example after a SIGHASH_ALL signature. CoinJoin now throws when it would add inputs and Inputs Modifiable is clear, or add outputs and Outputs Modifiable is clear, with the same messages as AddInput and AddOutput. As in those methods, a PSBT without the field is not restricted. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
BIP 370 says a Constructor must check
PSBT_GLOBAL_TX_MODIFIABLEbefore adding inputs or outputs.PSBT2.CoinJoinadds both without checking, so it can merge into a PSBT whose flags say it is closed, for example after aSIGHASH_ALLsignature.CoinJoinnow throws when it would add inputs while Inputs Modifiable is clear, or add outputs while Outputs Modifiable is clear. It uses the same messages asAddInputandAddOutput. Only the side that is actually added to is checked, so merging a PSBT with outputs but no inputs works when only outputs are open.As in
AddInputandAddOutput, a PSBT without the field is not restricted. BIP 370 allows that field to be omitted both while a single Constructor is still adding and to mark a PSBT closed, so I kept NBitcoin's existing reading. TheSIGHASH_SINGLEpairing rule (bit 2) is not handled here.New tests cover each flag and the case where nothing is added to the closed side. The PSBT, Miniscript and Taproot tests pass on net10.0, except the ones that download bitcoind, which fail the same way without this change.
🤖 Generated with Claude Code