fuzz: populate wallet TXO index in wallet_create_transaction
What the developer wrote
Authored by frankomosh
fuzz: populate wallet TXO index in wallet_create_transaction
The setup loop inserts transactions through raw mapWallet.emplace(),
which does not populate m_txos. Since AvailableCoins and
FetchSelectedInputs now look up coins through m_txos, coin
selection is structurally unreachable.
Call RefreshTXOsFromTx after each insertion so the wallet's
TXO index reflects the inserted outputs.
What changed, and why it matters
This is a fix to a Bitcoin Core fuzz test (an automated testing harness), not to the main wallet code that real users run. The test was inserting fake wallet transactions in a way that skipped updating an internal index called m_txos. Because newer coin-selection code reads from that index, the fuzz test could no longer actually exercise coin selection, making the test less useful. The patch calls a refresh function after each insertion so the test's fake wallet state is consistent. There is no indication this affects live wallets, consensus, or network security.
No production action required. Merge as a normal fuzz-test maintenance fix. Optionally verify that the fuzz target now reaches coin-selection code paths in coverage reports.
Security signals we found
Test-only change in fuzz harness
Fixes internal test-state consistency, not production wallet behavior
No validation, consensus, or P2P networking changes
No cryptographic or permission-boundary changes
Evidence from the diff
In src/wallet/test/fuzz/spend.cpp, the fuzz target wallet_create_transaction builds a wallet state by directly emplacing CWalletTx objects into mapWallet. That bypasses the normal transaction-loading path that populates m_txos (the wallet’s per-output index). AvailableCoins and FetchSelectedInputs now query m_txos, so without this index the fuzz target’s coin-selection paths were effectively dead code. The patch adds RefreshTXOsFromTx(ret.first->second) after each emplace so m_txos is synchronized with the inserted transactions. This is a test-only correctness fix that restores fuzz coverage.
Changed components
src/wallet/test/fuzz/spend.cppwallet_create_transaction fuzz targetInspect captured patch +1 / −0
diff --git a/src/wallet/test/fuzz/spend.cpp b/src/wallet/test/fuzz/spend.cpp
index f60f4573..35a05c9e 100644
--- a/src/wallet/test/fuzz/spend.cpp
+++ b/src/wallet/test/fuzz/spend.cpp
@@ -72,6 +72,7 @@ FUZZ_TARGET(wallet_create_transaction, .init = initialize_setup)
auto txid{tx.GetHash()};
auto ret{fuzzed_wallet.wallet->mapWallet.emplace(std::piecewise_construct, std::forward_as_tuple(txid), std::forward_as_tuple(MakeTransactionRef(std::move(tx)), TxStateConfirmed{chainstate.m_chain.Tip()->GetBlockHash(), chainstate.m_chain.Height(), /*index=*/0}))};
assert(ret.second);
+ fuzzed_wallet.wallet->RefreshTXOsFromTx(ret.first->second);
}
std::vector<CRecipient> recipients;
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.