fix(psbt): reject impossible fees, surface locktime, RBF and dust

Outputs adding up to more than the inputs cannot happen on chain, but the review screen clamped the fee to zero and then rendered no fee row at all, so a PSBT with an understated input or an inflated output showed no fee and no warning. It is now refused, guarded on every input having supplied an amount since a missing one counts as zero and produces the same shape honestly. Where that guard applies the absent fee is named rather than left blank.

nLockTime and nSequence appeared nowhere on the review screen, so a transaction that cannot be broadcast for years and one that is replaceable both read as ordinary. Outputs below the relay dust threshold were shown as ordinary spends; the threshold follows Bitcoin Core's GetDustThreshold, giving the familiar 294 / 330 / 546 values.

Found by running the psbt_faker signing-test suite against the review path.

Author: odudex

main/core/psbt.c

@@ -111,6 +111,7 @@ void psbt_audit_input_amounts(const struct wally_psbt *psbt,
 
   for (size_t i = 0; i < out->num_inputs; i++) {
     psbt_input_amount_t amount = psbt_get_input_amount(psbt, i);
+    out->total += amount.value;
     switch (amount.status) {
     case PSBT_AMOUNT_PROVEN:
       out->proven++;
@@ -136,6 +137,36 @@ uint64_t psbt_get_input_value(const struct wally_psbt *psbt, size_t index) {
   return psbt_get_input_amount(psbt, index).value;
 }
 
+/* 21 million BTC. libwally already rejects a transaction whose outputs exceed
+ * the supply, so this only backstops a total assembled some other way -- but
+ * it is what keeps the sum below from silently wrapping. */
+#define PSBT_MAX_SATOSHI (21000000ull * WALLY_SATOSHI_PER_BTC)
+
+bool psbt_total_output_value(const struct wally_psbt *psbt, uint64_t *out) {
+  if (!psbt || !out)
+    return false;
+  *out = 0;
+
+  struct wally_tx *tx = psbt_tx_alloc(psbt);
+  if (!tx)
+    return false;
+
+  uint64_t total = 0;
+  bool ok = true;
+  for (size_t i = 0; i < tx->num_outputs && ok; i++) {
+    uint64_t value = tx->outputs[i].satoshi;
+    if (value > PSBT_MAX_SATOSHI || total > PSBT_MAX_SATOSHI - value)
+      ok = false;
+    else
+      total += value;
+  }
+  wally_tx_free(tx);
+
+  if (ok)
+    *out = total;
+  return ok;
+}
+
 struct wally_tx *psbt_tx_alloc(const struct wally_psbt *psbt) {
   struct wally_tx *tx = NULL;
   if (!psbt ||
@@ -152,6 +183,29 @@ static bool psbt_is_v2(const struct wally_psbt *psbt) {
          version == WALLY_PSBT_VERSION_2;
 }
 
+/* Bitcoin Core's IsWitnessProgram: OP_0 or OP_1..OP_16, then a single push of
+ * 2..40 bytes making up the whole script. */
+static bool spk_is_witness_program(const unsigned char *spk, size_t spk_len) {
+  if (spk_len < 4 || spk_len > 42)
+    return false;
+  if (spk[0] != OP_0 && (spk[0] < OP_1 || spk[0] > OP_16))
+    return false;
+  return (size_t)spk[1] + 2 == spk_len;
+}
+
+uint64_t psbt_output_dust_threshold(const unsigned char *spk, size_t spk_len) {
+  if (!spk || !spk_len || spk[0] == OP_RETURN)
+    return 0; /* provably unspendable: never dust */
+
+  /* Core's GetDustThreshold: the serialized output plus the cheapest input
+   * that could spend it, priced at the 3000 sat/kvB dust relay fee. The input
+   * side is 67 bytes for a witness program (the witness is discounted) and
+   * 148 for everything else. Yields the familiar 294 / 330 / 546 thresholds. */
+  size_t size = 8 + 1 + spk_len; /* value + script length + script */
+  size += spk_is_witness_program(spk, spk_len) ? 67 : 148;
+  return (uint64_t)size * 3000u / 1000u;
+}
+
 bool psbt_sighash_is_supported(uint32_t sighash) {
   /* 0 is both the "no PSBT_IN_SIGHASH_TYPE field" encoding and taproot's
    * SIGHASH_DEFAULT; either way libwally signs with ALL semantics. */

main/core/psbt.h

@@ -108,6 +108,9 @@ typedef struct {
   size_t asserted;
   size_t invalid;
   size_t missing;
+  /* Sum of every input's resolved value. A MISSING input contributes 0, so
+   * this is only the real total when `missing` is 0. */
+  uint64_t total;
   /* Index of the first input in each non-proven category, or num_inputs when
    * that category is empty. Used to name a concrete input in the warning. */
   size_t first_unproven;
@@ -132,6 +135,11 @@ static inline bool psbt_amounts_are_proven(const psbt_amount_audit_t *audit) {
 // Get input value in satoshis
 uint64_t psbt_get_input_value(const struct wally_psbt *psbt, size_t index);
 
+// Sum of every output's value. False when the transaction cannot be read or
+// an amount is out of range, in which case nothing about the fee is knowable.
+KERN_WARN_UNUSED_RESULT bool
+psbt_total_output_value(const struct wally_psbt *psbt, uint64_t *out);
+
 // The transaction under review, for either PSBT version. v0 carries it as a
 // global field; v2 spreads the same information across per-input and
 // per-output fields and it has to be rebuilt, which also resolves BIP-370's
@@ -142,6 +150,12 @@ uint64_t psbt_get_input_value(const struct wally_psbt *psbt, size_t index);
 KERN_WARN_UNUSED_RESULT struct wally_tx *
 psbt_tx_alloc(const struct wally_psbt *psbt);
 
+// Bitcoin Core's dust threshold for an output paying `spk`: below this the
+// output costs more to spend than it holds and the transaction will not relay.
+// 0 for provably unspendable outputs, which Core never counts as dust.
+KERN_WARN_UNUSED_RESULT uint64_t
+psbt_output_dust_threshold(const unsigned char *spk, size_t spk_len);
+
 // Sighash flags the review screen can honestly describe. SIGHASH_ALL (and the
 // taproot SIGHASH_DEFAULT, which is 0 and also the "unset" encoding) commit to
 // every input and output, so what was displayed is what gets mined. Under

main/core/test/test_psbt_classify.c

@@ -1437,6 +1437,73 @@ static void test_fee_percent(void) {
     PASS();
 }
 
+static void test_dust_threshold(void) {
+  TEST("psbt_output_dust_threshold: Core's per-script-type values");
+
+  const uint8_t p2wpkh[22] = {0x00, 0x14};
+  const uint8_t p2wsh[34] = {0x00, 0x20};
+  const uint8_t p2tr[34] = {0x51, 0x20};
+  const uint8_t p2pkh[25] = {0x76, 0xa9, 0x14};
+  const uint8_t p2sh[23] = {0xa9, 0x14};
+  const uint8_t op_return[] = {0x6a, 0x02, 0xde, 0xad};
+
+  if (psbt_output_dust_threshold(p2wpkh, sizeof(p2wpkh)) != 294)
+    FAIL("p2wpkh should be 294");
+  else if (psbt_output_dust_threshold(p2wsh, sizeof(p2wsh)) != 330)
+    FAIL("p2wsh should be 330");
+  else if (psbt_output_dust_threshold(p2tr, sizeof(p2tr)) != 330)
+    FAIL("p2tr should be 330");
+  else if (psbt_output_dust_threshold(p2pkh, sizeof(p2pkh)) != 546)
+    FAIL("p2pkh should be 546");
+  else if (psbt_output_dust_threshold(p2sh, sizeof(p2sh)) != 540)
+    FAIL("p2sh should be 540");
+  else if (psbt_output_dust_threshold(op_return, sizeof(op_return)) != 0)
+    FAIL("OP_RETURN is unspendable, never dust");
+  else if (psbt_output_dust_threshold(NULL, 0) != 0)
+    FAIL("no script should be 0");
+  else
+    PASS();
+}
+
+static void test_total_output_value(void) {
+  TEST("psbt_total_output_value: sums outputs at either PSBT version");
+
+  struct wally_tx *tx = NULL;
+  if (wally_tx_init_alloc(2, 0, 1, 2, &tx) != WALLY_OK) {
+    FAIL("tx_init_alloc");
+    return;
+  }
+  uint8_t txid[32] = {0xaa};
+  wally_tx_add_raw_input(tx, txid, sizeof(txid), 0, 0xffffffff, NULL, 0, NULL,
+                         0);
+  wally_tx_add_raw_output(tx, 90000, REF_SPK_P2WPKH, sizeof(REF_SPK_P2WPKH), 0);
+  wally_tx_add_raw_output(tx, 5000, REF_SPK_P2WPKH, sizeof(REF_SPK_P2WPKH), 0);
+
+  struct wally_psbt *psbt = NULL;
+  int ret = wally_psbt_from_tx(tx, 0, 0, &psbt);
+  wally_tx_free(tx);
+  if (ret != WALLY_OK) {
+    FAIL("psbt_from_tx");
+    return;
+  }
+
+  uint64_t total = 0;
+  if (!psbt_total_output_value(psbt, &total))
+    FAIL("should read a v0 transaction");
+  else if (total != 95000)
+    FAIL("wrong v0 total");
+  else if (wally_psbt_set_version(psbt, 0, WALLY_PSBT_VERSION_2) != WALLY_OK)
+    FAIL("could not convert the fixture to v2");
+  else if (!psbt_total_output_value(psbt, &total))
+    FAIL("should read a v2 PSBT too");
+  else if (total != 95000)
+    FAIL("v2 total should match v0");
+  else
+    PASS();
+
+  wally_psbt_free(psbt);
+}
+
 /* An OWNED_SAFE single-sig fixture: p2wpkh input on the whitelisted BIP84
  * path, so the signing policy clears it with no opt-in. */
 static struct wally_psbt *make_safe_psbt(void) {
@@ -2438,6 +2505,8 @@ int main(void) {
   test_sighash_audit_flags_input();
   test_sign_refuses_unsupported_sighash();
   test_fee_percent();
+  test_dust_threshold();
+  test_total_output_value();
 
   printf("\n=== psbt_sign policy-gate tests ===\n\n");
 

main/pages/scan/psbt_sign_policy.c

@@ -236,6 +236,31 @@ static bool reject_unbuildable_tx(struct wally_psbt *psbt,
   return true;
 }
 
+/* sum(outputs) > sum(inputs) cannot happen on chain: the difference is the
+ * fee and it is never negative. Either an input amount is understated or an
+ * output amount is inflated, and both make every number on the review screen
+ * a lie. Only decidable when each input actually supplied an amount -- a
+ * MISSING one contributes 0, which produces the same shape honestly. */
+static bool reject_impossible_fee(struct wally_psbt *psbt,
+                                  const psbt_amount_audit_t *audit,
+                                  dialog_callback_t dismissed_cb) {
+  uint64_t total_output = 0;
+  if (audit->missing || !psbt_total_output_value(psbt, &total_output) ||
+      total_output <= audit->total)
+    return false;
+
+  char body[384];
+  snprintf(body, sizeof(body),
+           "The outputs add up to more than the inputs, which cannot happen: "
+           "the difference between them is the fee and it is never "
+           "negative.\n\n"
+           "Inputs total %llu sats, outputs total %llu sats. An amount in this "
+           "PSBT is wrong, so nothing it claims can be reviewed honestly.",
+           (unsigned long long)audit->total, (unsigned long long)total_output);
+  show_cannot_sign(body, dismissed_cb);
+  return true;
+}
+
 static bool reject_partial(const sign_policy_review_t *review,
                            dialog_callback_t dismissed_cb) {
   if (!review->any_input_external || settings_get_partial_signing())
@@ -296,6 +321,8 @@ bool psbt_sign_policy_allows_review(struct wally_psbt *psbt, bool is_testnet,
     return false;
   if (reject_invalid_amount(&audit, dismissed_cb))
     return false;
+  if (reject_impossible_fee(psbt, &audit, dismissed_cb))
+    return false;
   if (reject_expected_owned(&review, dismissed_cb, load_descriptor_cb))
     return false;
   if (reject_permissive(&review, dismissed_cb))

main/pages/scan/scan.c

@@ -66,6 +66,7 @@ typedef struct {
   uint64_t value;
   char *address;
   uint32_t address_index;
+  bool is_dust;  /* below the relay dust threshold for its script type */
   char path[80]; /* populated for OWNED_UNSAFE / EXPECTED_OWNED */
 } classified_output_t;
 
@@ -1199,6 +1200,16 @@ static bool create_psbt_info_display(void) {
   for (size_t i = 0; i < num_outputs; i++) {
     total_output_value += global_tx->outputs[i].satoshi;
   }
+
+  /* Both are read off the global tx, which is freed before the notes are
+   * rendered. BIP-125 opts a transaction into replaceability when any input's
+   * sequence is below 0xfffffffe. */
+  uint32_t locktime = global_tx->locktime;
+  bool signals_rbf = false;
+  for (size_t i = 0; i < global_tx->num_inputs; i++) {
+    if (global_tx->inputs[i].sequence < 0xfffffffeu)
+      signals_rbf = true;
+  }
   uint64_t fee = (total_input_value > total_output_value)
                      ? (total_input_value - total_output_value)
                      : 0;
@@ -1229,6 +1240,10 @@ static bool create_psbt_info_display(void) {
     classified_outputs[i].type = classify_output(
         i, &classified_outputs[i].address_index, classified_outputs[i].path,
         sizeof(classified_outputs[i].path));
+    classified_outputs[i].is_dust =
+        classified_outputs[i].value <
+        psbt_output_dust_threshold(global_tx->outputs[i].script,
+                                   global_tx->outputs[i].script_len);
   }
 
   size_t diagram_idx = 0;
@@ -1651,6 +1666,19 @@ static bool create_psbt_info_display(void) {
     }
   }
 
+  size_t dust_count = 0;
+  size_t first_dust = 0;
+  uint64_t first_dust_value = 0;
+  for (size_t i = 0; i < num_outputs; i++) {
+    if (!classified_outputs[i].is_dust)
+      continue;
+    if (!dust_count) {
+      first_dust = classified_outputs[i].index;
+      first_dust_value = classified_outputs[i].value;
+    }
+    dust_count++;
+  }
+
   for (size_t i = 0; i < num_outputs; i++) {
     if (classified_outputs[i].address) {
       if (strcmp(classified_outputs[i].address, "OP_RETURN") == 0) {
@@ -1720,6 +1748,62 @@ static bool create_psbt_info_display(void) {
     create_review_note(psbt_info_container, note, highlight_color());
   }
 
+  /* The gate refuses a PSBT whose outputs exceed the inputs, so reaching here
+   * that way means an input never supplied an amount and was counted as zero.
+   * The unproven-fee note above already says the numbers are not backed; name
+   * the missing fee too, because no fee row at all otherwise reads as "no
+   * fee". */
+  if (total_output_value > total_input_value) {
+    create_review_note(psbt_info_container,
+                       LV_SYMBOL_WARNING
+                       " Fee unknown: the outputs exceed the input amounts "
+                       "this PSBT supplied.",
+                       error_color());
+  }
+
+  /* Below the relay dust threshold an output costs more to spend than it
+   * holds, so the transaction is unlikely to propagate at all. */
+  if (dust_count) {
+    char note[192];
+    if (dust_count == 1)
+      snprintf(note, sizeof(note),
+               LV_SYMBOL_WARNING " Dust: output %zu holds only %llu sats, "
+                                 "below the amount needed to relay.",
+               first_dust, (unsigned long long)first_dust_value);
+    else
+      snprintf(note, sizeof(note),
+               LV_SYMBOL_WARNING " Dust: %zu outputs are below the amount "
+                                 "needed to relay.",
+               dust_count);
+    create_review_note(psbt_info_container, note, highlight_color());
+  }
+
+  /* Neither is visible anywhere else on this screen, and both change what
+   * signing actually commits to: a future locktime is not broadcastable yet,
+   * and an RBF-signalling transaction can be replaced before it confirms. */
+  if (locktime) {
+    char note[160];
+    if (locktime < 500000000u)
+      snprintf(note, sizeof(note),
+               LV_SYMBOL_WARNING " Locked until block %" PRIu32
+                                 ": not broadcastable before then.",
+               locktime);
+    else
+      snprintf(note, sizeof(note),
+               LV_SYMBOL_WARNING " Locked until unix time %" PRIu32
+                                 ": not broadcastable before then.",
+               locktime);
+    create_review_note(psbt_info_container, note, highlight_color());
+  }
+
+  if (signals_rbf) {
+    create_review_note(psbt_info_container,
+                       LV_SYMBOL_WARNING
+                       " Replaceable (RBF): this transaction can be replaced "
+                       "by a different one before it confirms.",
+                       secondary_color());
+  }
+
   create_sign_action_row(psbt_info_container, sign_button_cb);
 
   return true;