add_info_from_network: do not swallow exceptions
What the developer wrote
Authored by ThomasV
add_info_from_network: do not swallow exceptions
An attacker can provide a witness_utxo whose value disagrees with
the real previous transaction. That would raise PSBTInputConsistencyFailure,
which is swallowed because it is not a NetworkException.
This would lead us to sign a tx with the wrong input amount.
(no fund loss: the tx is invalid under BIP143)
What changed, and why it matters
Electrum's transaction builder had a bug where it would ignore certain consistency errors when fetching extra transaction data from the network. A malicious or misbehaving server could supply a wrong input amount, and Electrum would silently continue and sign the transaction with that wrong amount. The resulting transaction would be invalid and not accepted by the Bitcoin network, so no funds could be lost, but it could cause confusion, failed payments, or be used to probe wallet behavior.
Apply the patch and ensure that any consistency failure during transaction input enrichment is surfaced to the user rather than logged and ignored. Review related exception-handling paths for similar swallowing of non-network errors.
Security signals we found
Swallowed exception leading to use of attacker-controlled input value
PSBT input consistency check bypassed
Potential malicious Electrum server influence on transaction signing
Transaction invalidity under BIP143 limits fund-loss impact
Evidence from the diff
In transaction.py, add_info_from_network() wrapped network lookups in a broad try/except. The original logic only re-raised exceptions that were NetworkException instances when ignore_network_issues was False. PSBTInputConsistencyFailure (raised when a provided witness_utxo value conflicts with the actual previous transaction output value) is not a NetworkException, so it was swallowed. The patch changes the condition so that any exception is re-raised unless it is both a NetworkException and ignore_network_issues is True. This prevents silently signing a transaction with an incorrect input amount, although BIP143 signature validation means such a transaction would be invalid on-chain.
Changed components
electrum/transaction.pyadd_info_from_network()TxInput handlingPSBT signing flowInspect captured patch +1 / −1
### electrum/transaction.py
@@ -1302,7 +1302,7 @@ async def add_info_to_txin(txin: TxInput):
except Exception as e:
has_errored = True
_logger.error(f"tx.add_info_from_network() got exc: {e!r}")
- if isinstance(e, NetworkException) and not ignore_network_issues:
+ if not (isinstance(e, NetworkException) and ignore_network_issues):
raise
finally:
has_finished = TrueWhy this scored 61/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.