psbt: require that all psbt bytes are consumed when parsing
What the developer wrote
Authored by Jon Griffiths
psbt: require that all psbt bytes are consumed when parsing
What changed, and why it matters
This commit tightens how Blockstream Jade verifies a Bitcoin transaction file (PSBT) before signing. It now requires that every byte in the file is part of the transaction, with no leftover or trailing data allowed. Previously, extra bytes at the end could have been ignored, which might let a malicious or malformed PSBT hide unexpected content or influence how the device interprets what it is signing.
Treat this as a security hardening fix for the PSBT parser. Users should upgrade firmware to a version containing this commit. Developers should review whether any other parsers in the codebase accept trailing data and consider applying similar strict parsing elsewhere.
Security signals we found
Parsing now rejects trailing/unconsumed bytes in PSBT input
Change is in the signing code path, directly affecting what the hardware wallet will sign
Use of stricter libwally-core parse flag (COMPLETE) indicates parser hardening
No explicit bug or CVE mentioned by the vendor in the commit
Evidence from the diff
The change adds WALLY_PSBT_PARSE_FLAG_COMPLETE to the PSBT parsing flags in parse_psbt_bytes(). Previously only WALLY_PSBT_PARSE_FLAG_STRICT was used. The COMPLETE flag tells libwally-core to reject PSBTs that contain unconsumed trailing bytes after the parsed structure. This prevents the signer from accepting a buffer that appends extra data to an otherwise valid PSBT.
Changed components
main/process/sign_psbt.cparse_psbt_bytes()PSBT signing flowInspect captured patch +1 / −1
### main/process/sign_psbt.c
@@ -1140,7 +1140,7 @@ static bool parse_psbt_bytes(void* ctx)
JADE_ASSERT(ctx);
psbt_parse_data_t* data = (psbt_parse_data_t*)ctx;
data->psbt_out = NULL;
- const uint32_t flags = WALLY_PSBT_PARSE_FLAG_STRICT;
+ const uint32_t flags = WALLY_PSBT_PARSE_FLAG_STRICT | WALLY_PSBT_PARSE_FLAG_COMPLETE;
const int wret = wally_psbt_from_bytes(data->bytes, data->bytes_len, flags, &data->psbt_out);
return wret == WALLY_OK && data->psbt_out != NULL;
}Why this scored 59/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.