AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Moderate 60 Bitcoin

Merge bitcoin/bitcoin#35797: psbt: support output metadata updates before inputs are added

Public commit record

What the developer wrote

Authored by merge-script

100/100 · Strong
Merge bitcoin/bitcoin#35797: psbt: support output metadata updates before inputs are added

c0792889673da175661f29138a318614b33636cd psbt: update output metadata without inputs (Lőrinc)
4f5712476a3cf66d3b4f225b883eeca2deee657b test: characterize P2WSH miniscript output (Lőrinc)
e24e8fa2a689d7479262540dba6da3f3e21fbaa8 test: characterize PSBT output metadata (Lőrinc)

Pull request description:

**Problem:** PSBTv2 permits outputs to be added before inputs.
An authenticated `descriptorprocesspsbt` request can abort the node while updating metadata for one of those outputs because `UpdatePSBTOutput()` traverses the output script with a signature creator for input index 0.
ECDSA signing or a miniscript timelock check can then access the missing input.

**Fix:** Make `UpdatePSBTOutput()` traverse output scripts with a temporary one-input transaction while continuing to take the output from the PSBT's unsigned transaction.
`MutableTransactionSignatureCreator` continues to require a valid input index.
Output metadata traversal still records scripts and key origins, allowing outputs to be updated before inputs are added.

ACKs for top commit:
jeanpablojp:
tACK c0792889673da175661f29138a318614b33636cd
achow101:
ACK c0792889673da175661f29138a318614b33636cd
w0xlt:
ACK c0792889673da175661f29138a318614b33636cd
polespinasa:
ACK c0792889673da175661f29138a318614b33636cd

Tree-SHA512: 0d8cda74b8a56c0f4713b2669e5a3e5b0551ecda4fdfceb38a80e5b98a9d208d447f2045a1cc9fee74fe33b2fc8f7a60997cd60b2961de5cea871f53831895fe
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
The short version

What changed, and why it matters

This commit fixes a crash bug in Bitcoin Core's PSBT (Partially Signed Bitcoin Transaction) handling. When a user created a PSBT that had outputs but no inputs yet—a valid situation in the newer PSBTv2 format—and then asked the node to update output metadata using the `descriptorprocesspsbt` RPC, the node could crash. The crash happened because the code tried to use input index 0 of a transaction that had no inputs. The fix creates a temporary one-input transaction just for safely walking through the output script, while still taking the actual output data from the PSBT itself. It is a denial-of-service class bug, not a theft-of-funds bug, and requires an authenticated RPC caller to trigger.

Recommended action

Apply the patch. It is a targeted, low-risk fix with regression tests. Node operators running versions affected by this bug should upgrade, especially if they expose descriptorprocesspsbt to authenticated wallet users. No immediate broader network impact is expected.

Security signals we found

01

Denial-of-service via authenticated RPC (descriptorprocesspsbt)

02

Null/invalid input access when PSBT has zero inputs

03

PSBTv2 output-before-input semantics

04

Miniscript timelock check path reachable during metadata update

05

Crash abort in node process

Risk score

Why this scored 60/100

Our methodology →
Potential impact 18/30
Exploitability 12/25
Stealth signal 8/15
Affected reach 10/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.