Low 29 Bitcoin Committed Aug 5, 2026 · 10:31 UTC

Merge bitcoin/bitcoin#35582: rpc: reject null for optional parameters

3db96eb5 View source ↗

Public commit record

What the developer wrote

Authored by merge-script

81/100 · Strong

Merge bitcoin/bitcoin#35582: rpc: reject null for optional parameters

aeca0610865ede44004b42a16ef6318245fe0644 rpc: reject null for optional parameters (Ruslan Kasheparov)

Pull request description:

Treat explicitly passed `null` as missing for optional RPC parameters that are required in certain contexts.

ACKs for top commit:
achow101:
ACK aeca0610865ede44004b42a16ef6318245fe0644
maflcko:
review ACK aeca0610865ede44004b42a16ef6318245fe0644 🥚
sedited:
ACK aeca0610865ede44004b42a16ef6318245fe0644

Tree-SHA512: 60f146085fd20e532ba3cbefdb76d430938168621706a20b2b62a34318499fd72a8c934b08f690f9b72d19ed26581094517a0986586f95bc4b23fa8743b24d11

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference

The short version

What changed, and why it matters

This Bitcoin Core change tightens how three RPC commands (scantxoutset, scanblocks, deriveaddresses) handle the value null when it is passed for optional parameters. Previously, explicitly passing null could be treated differently from simply omitting the parameter, which could lead to unexpected behavior or errors. The patch makes null equivalent to 'not provided' for these specific cases and adds tests to confirm the new behavior. There is no direct evidence in the commit of a security vulnerability being exploited, but the change removes a potential source of confusion and misuse.

Recommended action

Review the RPC parameter handling changes for correctness and ensure that all optional-but-contextually-required parameters across the RPC interface are consistently handled. No immediate security response appears necessary, but operators should upgrade to include this hardening once it is released.

Security signals we found

RPC parameter validation change

Null value handling change

Addition of explicit error checks for missing required contextual parameters

Functional test coverage added for null parameter behavior

Technical analysis

Evidence from the diff

The commit modifies RPC parameter handling in src/rpc/blockchain.cpp and src/rpc/output_script.cpp to use self.MaybeArg() instead of checking request.params.size() or request.params[i].isNull(). For scantxoutset and scanblocks, the ‘scanobjects’ parameter is now fetched via MaybeArg, and if it is missing or null, an explicit RPC_MISC_ERROR is thrown. For deriveaddresses, the ‘range’ parameter is fetched via MaybeArg, so null is treated as absent. The change also updates validation logic: un-ranged descriptors reject a present range, and ranged descriptors require a present range. Functional tests are added to assert that null is rejected or treated as missing appropriately.

Changed components

src/rpc/blockchain.cpp (scantxoutset, scanblocks RPC methods)src/rpc/output_script.cpp (deriveaddresses RPC method)test/functional/rpc_deriveaddresses.pytest/functional/rpc_scanblocks.pytest/functional/rpc_scantxoutset.py

Inspect captured patch +18 / −7

### src/rpc/blockchain.cpp
@@ -2408,7 +2408,8 @@ static RPCMethod scantxoutset()
             throw JSONRPCError(RPC_INVALID_PARAMETER, "Scan already in progress, use action \"abort\" or \"status\"");
         }
 
-        if (request.params.size() < 2) {
+        const UniValue* scanobjects = self.MaybeArg<UniValue>("scanobjects");
+        if (!scanobjects) {
             throw JSONRPCError(RPC_MISC_ERROR, "scanobjects argument is required for the start action");
         }
 
@@ -2417,7 +2418,7 @@ static RPCMethod scantxoutset()
         CAmount total_in = 0;
 
         // loop through the scan objects
-        for (const UniValue& scanobject : request.params[1].get_array().getValues()) {
+        for (const UniValue& scanobject : scanobjects->get_array().getValues()) {
             FlatSigningProvider provider;
             auto scripts = EvalDescriptorStringOrObject(scanobject, provider);
             for (CScript& script : scripts) {
@@ -2604,6 +2605,10 @@ static RPCMethod scanblocks()
         if (!reserver.reserve()) {
             throw JSONRPCError(RPC_INVALID_PARAMETER, "Scan already in progress, use action \"abort\" or \"status\"");
         }
+        const UniValue* scanobjects = self.MaybeArg<UniValue>("scanobjects");
+        if (!scanobjects) {
+            throw JSONRPCError(RPC_MISC_ERROR, "scanobjects argument is required for the start action");
+        }
         auto filtertype_name{self.Arg<std::string_view>("filtertype")};
 
         BlockFilterType filtertype;
@@ -2648,7 +2653,7 @@ static RPCMethod scanblocks()
 
         // loop through the scan objects, add scripts to the needle_set
         GCSFilter::ElementSet needle_set;
-        for (const UniValue& scanobject : request.params[1].get_array().getValues()) {
+        for (const UniValue& scanobject : scanobjects->get_array().getValues()) {
             FlatSigningProvider provider;
             std::vector<CScript> scripts = EvalDescriptorStringOrObject(scanobject, provider);
             for (const CScript& script : scripts) {

### src/rpc/output_script.cpp
@@ -306,8 +306,9 @@ static RPCMethod deriveaddresses()
             int64_t range_begin = 0;
             int64_t range_end = 0;
 
-            if (request.params.size() >= 2 && !request.params[1].isNull()) {
-                std::tie(range_begin, range_end) = ParseDescriptorRange(request.params[1]);
+            const UniValue* range = self.MaybeArg<UniValue>("range");
+            if (range) {
+                std::tie(range_begin, range_end) = ParseDescriptorRange(*range);
             }
 
             FlatSigningProvider key_provider;
@@ -317,11 +318,11 @@ static RPCMethod deriveaddresses()
                 throw JSONRPCError(RPC_INVALID_ADDRESS_OR_KEY, error);
             }
             auto& desc = descs.at(0);
-            if (!desc->IsRange() && request.params.size() > 1) {
+            if (!desc->IsRange() && range) {
                 throw JSONRPCError(RPC_INVALID_PARAMETER, "Range should not be specified for an un-ranged descriptor");
             }
 
-            if (desc->IsRange() && request.params.size() == 1) {
+            if (desc->IsRange() && !range) {
                 throw JSONRPCError(RPC_INVALID_PARAMETER, "Range must be specified for a ranged descriptor");
             }
 

### test/functional/rpc_deriveaddresses.py
@@ -35,6 +35,7 @@ def run_test(self):
         assert_raises_rpc_error(-8, "Range should not be specified for an un-ranged descriptor", self.nodes[0].deriveaddresses, descsum_create("wpkh(tprv8ZgxMBicQKsPd7Uf69XL1XwhmjHopUGep8GuEiJDZmbQz6o58LninorQAfcKZWARbtRtfnLcJ5MQ2AtHcQJCCRUcMRvmDUjyEmNUWwx8UbK/1/1/0)"), [0, 2])
 
         assert_raises_rpc_error(-8, "Range must be specified for a ranged descriptor", self.nodes[0].deriveaddresses, descsum_create("wpkh(tprv8ZgxMBicQKsPd7Uf69XL1XwhmjHopUGep8GuEiJDZmbQz6o58LninorQAfcKZWARbtRtfnLcJ5MQ2AtHcQJCCRUcMRvmDUjyEmNUWwx8UbK/1/1/*)"))
+        assert_raises_rpc_error(-8, "Range must be specified for a ranged descriptor", self.nodes[0].deriveaddresses, descsum_create("wpkh(tprv8ZgxMBicQKsPd7Uf69XL1XwhmjHopUGep8GuEiJDZmbQz6o58LninorQAfcKZWARbtRtfnLcJ5MQ2AtHcQJCCRUcMRvmDUjyEmNUWwx8UbK/1/1/*)"), None)
 
         assert_raises_rpc_error(-8, "End of range is too high", self.nodes[0].deriveaddresses, descsum_create("wpkh(tprv8ZgxMBicQKsPd7Uf69XL1XwhmjHopUGep8GuEiJDZmbQz6o58LninorQAfcKZWARbtRtfnLcJ5MQ2AtHcQJCCRUcMRvmDUjyEmNUWwx8UbK/1/1/*)"), 10000000000)
 

### test/functional/rpc_scanblocks.py
@@ -134,6 +134,9 @@ def run_test(self):
         # test invalid command
         assert_raises_rpc_error(-8, "Invalid action 'foobar'", node.scanblocks, "foobar")
 
+        # test that null scanobjects is rejected for start
+        assert_raises_rpc_error(-1, "scanobjects argument is required for the start action", node.scanblocks, "start", None)
+
 
 if __name__ == '__main__':
     ScanblocksTest(__file__).main()

### test/functional/rpc_scantxoutset.py
@@ -134,6 +134,7 @@ def run_test(self):
 
         # Check that second arg is needed for start
         assert_raises_rpc_error(-1, "scanobjects argument is required for the start action", self.nodes[0].scantxoutset, "start")
+        assert_raises_rpc_error(-1, "scanobjects argument is required for the start action", self.nodes[0].scantxoutset, "start", None)
 
         # Check that invalid command give error
         assert_raises_rpc_error(-8, "Invalid action 'invalid_command'", self.nodes[0].scantxoutset, "invalid_command")

Risk score

Why this scored 29/100

Our methodology →

Potential impact 5/30

Exploitability 5/25

Stealth signal 3/15

Affected reach 5/15

Confidence 7/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 29/100

Community notes

Related watches

Merge bitcoin/bitcoin#35895: refactor: Enable clang-tidy rule to reject anon namespace in header

Merge bitcoin/bitcoin#35630: test: Add importdescriptors rpc error test coverage

Merge bitcoin/bitcoin#35180: coins: group private cache helpers