transaction: fix return value of already_has_some_signatures()
What changed, and why it matters
A one-line fix changes a function so it always returns a true/false value instead of returning the raw list of signatures. The commit message says this is harmless in how Electrum currently uses it. It is a code-correctness bug, not an obvious security vulnerability.
Accept the patch as a correctness fix; no urgent security action is indicated by the available evidence. If maintaining a fork, audit any callers that might have relied on the non-bool return value.
Security signals we found
Return-type contract violation in a signature-related helper
Commit message downplays security relevance ('harmless in current usage')
No explicit security framing by vendor
Evidence from the diff
already_has_some_signatures() is documented to return a bool, but previously returned self.sigs_ecdsa (a list) in the first disjunct of an ‘or’ chain. In Python, a non-empty list is truthy, so callers using the result in a boolean context behaved correctly; callers expecting an actual bool could receive a list. The patch wraps self.sigs_ecdsa in bool(). The commit message explicitly states this is ‘harmless in current usage’.
Changed components
electrum/transaction.py:already_has_some_signatures()Inspect captured patch +1 / −1
### electrum/transaction.py
@@ -2059,7 +2059,7 @@ def is_taproot(self) -> Optional[bool]:
def already_has_some_signatures(self) -> bool:
"""Returns whether progress has been made towards completing this input."""
- return (self.sigs_ecdsa
+ return (bool(self.sigs_ecdsa)
or self.tap_key_sig is not None
or self.script_sig is not None
or self.witness is not None)Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.