AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 44 Bitcoin

Merge bitcoin/bitcoin#36284: wallet: don't double discard output groups with avoidpartialspends

Public commit record

What the developer wrote

Authored by Ava Chow

91/100 · Strong
Merge bitcoin/bitcoin#36284: wallet: don't double discard output groups with avoidpartialspends

719324977a41ab5132699d9c81032f8b2687f599 test: Check that ineligible output groups are discarded only once (Fabian Jahr)
20307f0ac0e17c6e478e2e11318dc7a9b18fc5d1 wallet: don't double count discarded output groups with avoidpartialspends (Fabian Jahr)

Pull request description:

With `-avoidpartialspends` or `avoid_reuse`, `GroupOutputs` puts every positive-value output into both the mixed and the positive-only map and runs `push_output_groups` on each, so a group rejected by the eligibility filters lands in `discarded_groups` twice. `AutomaticCoinSelection` then subtracts it twice and could fail with an insufficient funds error even when there would be enough confirmed coins to cover the payment.

Not a problem in a default wallet but it can happen with `sendtoaddress` from an `avoid_reuse` wallet, or with `-avoidpartialspends=1`.

The simplest possible fix is to record discards only from the mixed map pass, which contains every output anyway. Also adds a test that reproduces the issue.

ACKs for top commit:
achow101:
ACK 719324977a41ab5132699d9c81032f8b2687f599
pablomartin4btc:
ACK 719324977a41ab5132699d9c81032f8b2687f599
vicjuma:
ACK 719324977a41ab5132699d9c81032f8b2687f599
polespinasa:
code reviewed ACK 719324977a41ab5132699d9c81032f8b2687f599

Tree-SHA512: 3028f8feeacecc601aacfce757fc885b7bd25cf6ea2ad9d9b65c56b5da71096aa48d0d70ce04d80fc2b147d67109c47d190e5dc925d06c67dfcf33cf8cc715d8
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This is a wallet bug, not a theft or remote-code bug. When a Bitcoin Core user turns on the optional 'avoidpartialspends' or 'avoid_reuse' setting, an output group rejected during coin selection could be counted twice as 'discarded.' That double-counting could make the wallet wrongly believe there are not enough spendable coins and fail to create a transaction, even though the user actually has enough confirmed funds. The fix makes sure each rejected group is recorded only once, and adds tests to prove it.

Recommended action

No urgent security response required. Users relying on avoidpartialspends or avoid_reuse should upgrade to a release containing this fix to avoid spurious transaction-creation failures. Reviewers should verify the new tests reproduce the failure before the patch and pass after it.

Security signals we found

01

Logic error causing double-counting of discarded UTXO groups

02

Can trigger false 'insufficient funds' failure in coin selection

03

Affects avoidpartialspends / avoid_reuse wallets only

04

No memory corruption, remote execution, or key leakage

05

Fix includes both unit and functional regression tests

Risk score

Why this scored 44/100

Our methodology →
Potential impact 12/30
Exploitability 5/25
Stealth signal 8/15
Affected reach 7/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.