AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Moderate 64 Bitcoin

Merge bitcoin/bitcoin#36494: wallet: reject unknown options in sendall

Public commit record

What the developer wrote

Authored by merge-script

81/100 · Strong
Merge bitcoin/bitcoin#36494: wallet: reject unknown options in sendall

702ec9d40f84dfd0ca9bf73e37052c36f3802702 wallet: reject unknown options in sendall (Thomas)

Pull request description:

`sendall` silently ignores unknown keys in its `options` object, including misspelled ones: `input` instead of `inputs` spends all available UTXOs rather than the given ones, and a misspelled `add_to_wallet` or `psbt` can broadcast a transaction the caller asked not to broadcast.

Reject unknown options, like `send`, `fundrawtransaction`, `walletcreatefundedpsbt` and `bumpfee` already do.

ACKs for top commit:
maflcko:
review ACK 702ec9d40f84dfd0ca9bf73e37052c36f3802702 🐀
Zippo76:
tACK 702ec9d40f
polespinasa:
ACK 702ec9d40f84dfd0ca9bf73e37052c36f3802702

Tree-SHA512: b6a4b9c87014ddc4782f20c7053617cb7d52971a511e344ba9b35bd2cb2145a06489648802455f421fe712802b5ba8665d0aab77390df82bc3ebbc5661e78ed7
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This change fixes a bug in Bitcoin Core's `sendall` wallet command where misspelled or unknown options in the options object were silently ignored. For example, typing `input` instead of `inputs` would spend all coins instead of only the chosen ones, and misspelling `add_to_wallet` or `psbt` could broadcast a transaction the user did not want broadcast. The fix makes `sendall` reject unknown or wrongly typed options, matching other wallet commands.

Recommended action

Upgrade to a release containing this commit. Until then, users and applications calling `sendall` should carefully verify option spelling and types, especially `inputs`, `add_to_wallet`, and `psbt`, to avoid unintended broadcasts or full-wallet spends.

Security signals we found

01

Silent ignore of misspelled options can lead to unintended full-wallet sweep (`input` vs `inputs`)

02

Silent ignore of misspelled `add_to_wallet` or `psbt` can cause unwanted transaction broadcast

03

Fix aligns `sendall` with existing strict option validation in `send`, `fundrawtransaction`, `walletcreatefundedpsbt`, and `bumpfee`

04

Validation now occurs before coin selection, preventing side effects from malformed requests

Risk score

Why this scored 64/100

Our methodology →
Potential impact 18/30
Exploitability 12/25
Stealth signal 10/15
Affected reach 10/15
Confidence 9/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.