qml: fix FeePolicy regression ref 840243e0290e1550927d7d91b8c62dc00e40dede
What the developer wrote
Authored by Sander van Grieken
qml: fix FeePolicy regression
ref 840243e0290e1550927d7d91b8c62dc00e40dede
What changed, and why it matters
This commit fixes a regression in Electrum's QML (mobile/lightweight) user interface where creating a 'sweep' transaction accidentally ignored the user's chosen fee policy and passed no fee settings at all. The fix restores the intended behavior so the transaction respects whatever fee policy the user selected. The actual security impact is moderate and mostly user-facing: users might have gotten unexpectedly slow confirmations or unexpectedly high fees, rather than a direct theft-of-funds bug.
Users relying on the QML interface for sweeping private keys should update to a version containing this commit. Reviewers should verify that all other call sites of make_unsigned_transaction were updated consistently after the fee_policy refactor, and consider adding a regression test for sweep fee policy behavior.
Security signals we found
API regression: a parameter rename left one call site passing the old fee=None, so the new fee_policy logic was bypassed
User fee preference ignored for sweep transactions, which can lead to underpayment or overpayment of miner fees
No input validation, memory safety, or cryptographic flaw visible in the diff
No explicit security wording in commit title or message
Evidence from the diff
In electrum/gui/qml/qetxfinalizer.py, the QETxSweepFinalizer.sweep() method was calling make_unsigned_transaction() with the keyword argument fee=None instead of fee_policy=self._fee_policy. The referenced prior commit (840243e0290e1550927d7d91b8c62dc00e40dede) apparently changed the API from fee to fee_policy, and this call site was missed, causing the user’s fee policy to be discarded for sweep transactions. The patch simply replaces fee=None with fee_policy=self._fee_policy and reformats the call across two lines.
Changed components
electrum/gui/qml/qetxfinalizer.pyQML sweep-transaction finalizerFee policy handling for sweep transactionsInspect captured patch +2 / −1
diff --git a/electrum/gui/qml/qetxfinalizer.py b/electrum/gui/qml/qetxfinalizer.py
index 2f74c7e..0d776e6 100644
--- a/electrum/gui/qml/qetxfinalizer.py
+++ b/electrum/gui/qml/qetxfinalizer.py
@@ -1010,7 +1010,8 @@ class QETxSweepFinalizer(QETxFinalizer):
coins, keypairs = copy.deepcopy(self._txins)
outputs = [PartialTxOutput.from_address_and_value(address, value='!')]
- tx = self._wallet.wallet.make_unsigned_transaction(coins=coins, outputs=outputs, fee=None, rbf=self._rbf, is_sweep=True)
+ tx = self._wallet.wallet.make_unsigned_transaction(
+ coins=coins, outputs=outputs, fee_policy=self._fee_policy, rbf=self._rbf, is_sweep=True)
self._logger.debug('fee: %d, inputs: %d, outputs: %d' % (tx.get_fee(), len(tx.inputs()), len(tx.outputs())))
tx.sign(keypairs)
Why this scored 40/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.