Skip to content

Validate UTXO data for build_fee_bump #51

Open
@notmandatory

Description

@notmandatory

"In build_fee_bump when getting the original utxos the function assumes the previous transaction's output list does contain the output referred by each input of the transaction to be bumped. It will crash otherwise. Although it generally holds, it doesn't necessarily."

"Utxo::txout() will crash if prev_tx.output does not contain its prevout. The only place where a Utxo::Foreign is created without checking whether the outpoint's index is within the bounds of prev_tx.output is in build_fee_bump, where BDK would have crashed earlier (L1653) if it wasn't the case."

Metadata

Metadata

Assignees

No one assigned

    Labels

    auditSuggested as result of external code audit

    Type

    No type

    Projects

    Status

    Discussion

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions