AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 32 Bitcoin

wallet: ensure COutput added in set are unique

Public commit record

What the developer wrote

Authored by stratospher

76/100 · Adequate
wallet: ensure COutput added in set are unique

before #25806, set<COutput> was used and would not
contain same COutputs in the set.

now we use set<shared_ptr<COutput>> and it might be
possible for 2 distinct shared_ptr (different pointer
address but same COutputs) to be added into the set.

so preserve previous behaviour by making sure values
in the set are also distinct
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This Bitcoin Core change fixes a subtle bug in how the wallet keeps track of selected coins. Previously, the wallet used a set of coin objects directly, which automatically prevented duplicates. After a recent refactor, it started using a set of pointers to coin objects, where the default behavior only prevents duplicate pointer addresses—not duplicate coins. This meant two different pointers representing the same coin could both end up in the selection, potentially causing the wallet to try to spend the same coin twice or miscalculate fees and change. The fix makes the set compare the actual coin data, not just pointer addresses, restoring the old duplicate-prevention behavior.

Recommended action

Treat as a wallet correctness fix worth backporting to affected releases. Review whether any released code path could actually produce duplicate shared_ptr<COutput> values in practice, and add regression tests that explicitly insert duplicate-value pointers into OutputSet to verify deduplication.

Security signals we found

01

Duplicate coin selection could lead to double-spend attempts or invalid transactions

02

Set uniqueness semantics changed by pointer indirection refactor

03

Custom comparator restores value-based deduplication

04

Wallet coin-selection correctness bug, not a remote code execution vulnerability

Risk score

Why this scored 32/100

Our methodology →
Potential impact 8/30
Exploitability 4/25
Stealth signal 5/15
Affected reach 6/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.