qml: rbf/cancel: abort update if adding tx info fails
What the developer wrote
Authored by f321x
qml: rbf/cancel: abort update if adding tx info fails
Early return the update() methods of QETxRbfFeeBumper and QETxCanceller
if it fails to fetch missing tx information from the Network to prevent
an exception in `Abstract_Wallet.bump_fee()` and
`Abstract_Wallet.dscancel()`. See
https://github.com/spesmilo/electrum/issues/5502#issuecomment-40213084270
What changed, and why it matters
This commit fixes a crash in Electrum's mobile-style QML user interface when users try to speed up (RBF) or cancel a transaction while the app hasn't finished downloading all the transaction details from the network. Previously the app would throw an exception; now it shows a warning and stops gracefully. It is a robustness fix, not a security vulnerability that lets an attacker steal funds.
Treat as a normal bug/crash-fix commit. No urgent security response required. Users on affected versions may experience UI crashes when bumping/cancelling transactions offline or before network sync; updating removes that crash.
Security signals we found
Crash/DoS hardening in QML fee-bumping flow
Missing network data handled defensively instead of raising exception
No cryptographic, authentication, or permission bypass observed
Evidence from the diff
The patch adds an early return in QETxRbfFeeBumper.update() and QETxCanceller.update() before calling Abstract_Wallet.bump_fee() or Abstract_Wallet.dscancel(). It calls add_info_from_wallet_and_network() on the original transaction; if that fails (e.g., missing prevouts while network data is unavailable), it marks the finalizer invalid, emits validChanged, sets a warning, and returns. This prevents an exception inside the wallet’s fee-bumping/dscancel logic when transaction inputs are incomplete.
Changed components
electrum/gui/qml/qetxfinalizer.pyQETxRbfFeeBumper.update()QETxCanceller.update()Abstract_Wallet.bump_fee() callersAbstract_Wallet.dscancel() callersInspect captured patch +13 / −0
diff --git a/electrum/gui/qml/qetxfinalizer.py b/electrum/gui/qml/qetxfinalizer.py
index 1d09dca..b320b81 100644
--- a/electrum/gui/qml/qetxfinalizer.py
+++ b/electrum/gui/qml/qetxfinalizer.py
@@ -758,6 +758,13 @@ class QETxRbfFeeBumper(TxFeeSlider, TxMonMixin):
self.validChanged.emit()
self.warning = _("The new fee rate needs to be higher than the old fee rate.")
return
+
+ if not self._orig_tx.add_info_from_wallet_and_network(wallet=self._wallet.wallet, show_error=self._logger.error):
+ self._valid = False
+ self.validChanged.emit()
+ self.warning = _("Transaction is missing info from network")
+ return
+
try:
self._tx = self._wallet.wallet.bump_fee(
tx=self._orig_tx,
@@ -877,6 +884,12 @@ class QETxCanceller(TxFeeSlider, TxMonMixin):
self.warning = messages.MSG_RELAYFEE
return
+ if not self._orig_tx.add_info_from_wallet_and_network(wallet=self._wallet.wallet, show_error=self._logger.error):
+ self._valid = False
+ self.validChanged.emit()
+ self.warning = _("Transaction is missing info from network")
+ return
+
try:
self._tx = self._wallet.wallet.dscancel(
tx=self._orig_tx,
Why this scored 31/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.