qt: add_to_coincontrol: assert that coins are in self._utxo_dict
What the developer wrote
Authored by ThomasV
qt: add_to_coincontrol: assert that coins are in self._utxo_dict
What changed, and why it matters
This commit adds a safety check (an assertion) in the Electrum wallet's coin-selection feature. It ensures that any coins being added to manual coin control actually belong to the wallet's known list of coins. The change is defensive and likely follows a reported bug (issue 10206), but the commit itself does not explain whether the bug had security consequences.
Treat as a low-severity defensive hardening commit. Review issue 10206 for context to determine whether the missing assertion could have led to incorrect transaction construction, privacy leaks, or denial-of-service. Consider replacing the assertion with graceful error handling if user-triggerable.
Security signals we found
Defensive assertion added to coin-control logic
References issue 10206, suggesting prior bug report
Prevents UTXOs not in wallet's known set from being selected for spending
Partial patch: only adds assertion, does not show root cause or full fix
Evidence from the diff
In electrum/gui/qt/utxo_list.py, the add_to_coincontrol() method now asserts that every coin’s prevout string exists in self._utxo_dict before proceeding. This prevents out-of-wallet or stale UTXOs from entering the _spend_set via the Qt GUI’s coin control path. The assertion is a hard failure (will crash the GUI in debug/development builds if violated) rather than a silent filter. The commit references ‘issue 10206’ but no details are supplied.
Changed components
electrum/gui/qt/utxo_list.pyUTXOList.add_to_coincontrol()Qt GUI coin control / manual coin selectionInspect captured patch +1 / −0
diff --git a/electrum/gui/qt/utxo_list.py b/electrum/gui/qt/utxo_list.py
index ea98e13..778b1bd 100644
--- a/electrum/gui/qt/utxo_list.py
+++ b/electrum/gui/qt/utxo_list.py
@@ -191,6 +191,7 @@ class UTXOList(MyTreeView):
return all([utxo.prevout.to_str() in self._spend_set for utxo in coins])
def add_to_coincontrol(self, coins: List[PartialTxInput]):
+ assert all(utxo.prevout.to_str() in self._utxo_dict for utxo in coins) # see issue 10206
coins = self._filter_frozen_coins(coins)
for utxo in coins:
self._spend_set.add(utxo.prevout.to_str())
Why this scored 27/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.