qt: utxo_list: add asserts to helper methods that coins are selected
What the developer wrote
Authored by SomberNight
qt: utxo_list: add asserts to helper methods that coins are selected
- otherwise they default to selecting all coins, which is unlikely to be what the user intends
- prev commit makes sure this should never happen
What changed, and why it matters
This commit adds safety checks (assert statements) to three helper methods in Electrum's Qt wallet interface. These helpers perform actions like swapping coins, opening a Lightning channel, or paying to a clipboard address. The new checks ensure that at least one coin is selected before proceeding, because otherwise the code would silently default to using all available coins. The commit message says a previous change should prevent this from happening, so these asserts are a defensive backup rather than a fix for an active bug.
Treat as routine defensive hardening. Review the preceding commit referenced in the message to confirm the primary guard is in place, and verify that the assertions do not crash the GUI in legitimate edge cases (e.g., empty selection paths that should be disabled by UI logic). No urgent security response is indicated by the available evidence.
Security signals we found
Defensive assertion added to prevent unintended coin selection
Commit message frames issue as user-intent failure, not security vulnerability
No CVE, advisory, or vendor security disclosure supplied
No exploit or incident evidence in diff or references
Evidence from the diff
In electrum/gui/qt/utxo_list.py, the methods swap_coins(), open_channel_with_coins(), and pay_to_clipboard_address() now assert that the passed coins list is non-empty. The methods already call add_to_coincontrol(coins); if coins were empty, the prior behavior could fall back to selecting all UTXOs, which is described as unlikely to be user-intended. The patch also adds type hints (list[PartialTxInput]) and return-type annotations. It is a hardening change, not a patch for a demonstrated vulnerability.
Changed components
electrum/gui/qt/utxo_list.pyUTXO list context-menu actions (swap, open channel, pay to clipboard address)Inspect captured patch +7 / −4
diff --git a/electrum/gui/qt/utxo_list.py b/electrum/gui/qt/utxo_list.py
index a5aef66..f55d4d8 100644
--- a/electrum/gui/qt/utxo_list.py
+++ b/electrum/gui/qt/utxo_list.py
@@ -253,7 +253,8 @@ class UTXOList(MyTreeView):
return False
return True
- def swap_coins(self, coins):
+ def swap_coins(self, coins: list[PartialTxInput]) -> None:
+ assert coins, "no coins selected?"
#self.clear_coincontrol()
self.add_to_coincontrol(coins)
self.main_window.run_swap_dialog(is_reverse=False, recv_amount_sat_or_max='!')
@@ -265,7 +266,8 @@ class UTXOList(MyTreeView):
value = sum(x.value_sats() for x in coins)
return value >= MIN_FUNDING_SAT and value <= self.config.LIGHTNING_MAX_FUNDING_SAT
- def open_channel_with_coins(self, coins):
+ def open_channel_with_coins(self, coins: list[PartialTxInput]) -> None:
+ assert coins, "no coins selected?"
# todo : use a single dialog in new flow
#self.clear_coincontrol()
self.add_to_coincontrol(coins)
@@ -279,11 +281,12 @@ class UTXOList(MyTreeView):
d.run()
self.clear_coincontrol()
- def clipboard_contains_address(self):
+ def clipboard_contains_address(self) -> bool:
text = self.main_window.app.clipboard().text()
return is_address(text)
- def pay_to_clipboard_address(self, coins):
+ def pay_to_clipboard_address(self, coins: list[PartialTxInput]) -> None:
+ assert coins, "no coins selected?"
if not self.clipboard_contains_address():
self.main_window.show_error(_('Clipboard doesn\'t contain a valid address'))
return
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.