qml: don't catch-all when making tx for sweep finalizer
What the developer wrote
Authored by Sander van Grieken
qml: don't catch-all when making tx for sweep finalizer
What changed, and why it matters
This commit tightens error handling in Electrum's mobile/QML wallet when creating a transaction to sweep funds. Previously, the code caught every possible exception and only logged the error, which could hide unexpected failures and leave the user with a generic or misleading warning. Now it only catches two specific, expected errors (no fee estimates and insufficient funds) and lets other errors surface normally. This is a defensive hardening change, not a fix for a known active exploit.
No urgent action required. Treat as routine defensive hardening. If backporting, include this change to improve error visibility and user feedback in the QML/mobile sweep flow.
Security signals we found
Catch-all exception handler replaced with specific exception handling
Unexpected errors during transaction creation will no longer be silently swallowed
User-facing warning messages now localized and explicit for known failure modes
Evidence from the diff
In electrum/gui/qml/qetxfinalizer.py, QETxSweepFinalizer.sweep() replaced a broad except Exception around self.make_sweep_tx() with explicit handlers for NoDynamicFeeEstimates and NotEnoughFunds. The catch-all suppressed arbitrary exceptions, logged them, and set a generic warning. The new code imports NoDynamicFeeEstimates and emits localized, user-facing messages for the two expected failure modes while allowing unexpected errors to propagate. This improves debuggability and prevents silent swallowing of bugs or security-relevant failures during transaction construction.
Changed components
electrum/gui/qml/qetxfinalizer.pyQML/mobile GUI sweep transaction finalizerInspect captured patch +8 / −4
diff --git a/electrum/gui/qml/qetxfinalizer.py b/electrum/gui/qml/qetxfinalizer.py
index 0d776e6..afd8a95 100644
--- a/electrum/gui/qml/qetxfinalizer.py
+++ b/electrum/gui/qml/qetxfinalizer.py
@@ -11,7 +11,7 @@ from electrum.logging import get_logger
from electrum.i18n import _
from electrum.bitcoin import DummyAddress
from electrum.transaction import PartialTxOutput, PartialTransaction, Transaction, TxOutpoint
-from electrum.util import NotEnoughFunds, profiler, quantize_feerate, UserFacingException
+from electrum.util import NotEnoughFunds, profiler, quantize_feerate, UserFacingException, NoDynamicFeeEstimates
from electrum.wallet import CannotBumpFee, CannotDoubleSpendTx, CannotCPFP, BumpFeeStrategy, sweep_preparations
from electrum import keystore
from electrum.plugin import run_hook
@@ -1048,9 +1048,13 @@ class QETxSweepFinalizer(QETxFinalizer):
try:
# make unsigned transaction
tx = self.make_sweep_tx()
- except Exception as e:
- self._logger.error(str(e))
- self.warning = repr(e)
+ except NoDynamicFeeEstimates:
+ self.warning = _('No dynamic fee estimates available')
+ self._valid = False
+ self.validChanged.emit()
+ return
+ except NotEnoughFunds:
+ self.warning = _('Not enough funds')
self._valid = False
self.validChanged.emit()
return
Why this scored 22/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.