Integrate PSBT fee and amount validation
What the developer wrote
Authored by Jack
Integrate PSBT fee and amount validation
What changed, and why it matters
This commit adds a test fixture flag called witness_utxo to a fake PSBT input object used in unit tests, and documents a changelog entry about marking network fees as 'unverified' when a PSBT input's UTXO data cannot be verified. The actual production code that performs this validation is not shown in the diff, so we can only see the test scaffolding and release-note mention. It likely relates to preventing a hardware wallet from trusting a transaction's claimed fee when the input amounts are not provable, which could stop a malicious co-signer or host from hiding or inflating fees.
Review the companion production-code commit(s) that consume the new witness_utxo attribute and implement the 'unverified fee' logic. Verify that the device refuses to sign or clearly warns when non-witness UTXOs are missing and the fee cannot be independently computed. Ensure the unit tests cover both witness and non-witness UTXO cases, as well as adversarial PSBTs that lie about input amounts.
Security signals we found
PSBT fee/amount validation
unverifiable inputs flagged as unverified
witness UTXO handling
hardware wallet transaction signing safety
Evidence from the diff
The diff is minimal: CHANGELOG.md adds a line ‘Identify network fees from unverifiable PSBT inputs as unverified’, and ports/stm32/boards/Passport/modules/tests/unit/psbt_amounts.py adds self.witness_utxo = False to a mock PSBT input class. The mock class already had attributes such as value, num_our_keys, required_key, and is_segwit, plus a has_utxo() method returning True. The new witness_utxo attribute suggests production code now inspects a witness_utxo field on PSBT inputs to decide whether the UTXO amount is verifiable. Without the corresponding production-code diff, we cannot see the validation logic, the conditions that trigger the warning, or how ‘unverified’ fees are surfaced to the user. The change appears defensive: it reduces trust in PSBT-supplied input values when only the witness UTXO (or no UTXO) is present, mitigating fee/amount manipulation attacks.
Changed components
PSBT signing/validation module (production code not in diff)ports/stm32/boards/Passport/modules/tests/unit/psbt_amounts.pyInspect captured patch +2 / −0
### CHANGELOG.md
@@ -5,6 +5,7 @@ SPDX-License-Identifier: GPL-3.0-or-later
-->
## Head
+- Identify network fees from unverifiable PSBT inputs as unverified
- Validate the complete local xpub when importing multisig wallets
- Require confirmation before using PSBT-proposed multisig wallets with temporary seeds,
and cancel signing if import is declined
### ports/stm32/boards/Passport/modules/tests/unit/psbt_amounts.py
@@ -37,6 +37,7 @@ def __init__(self, value):
self.num_our_keys = 1
self.required_key = b'key'
self.is_segwit = False
+ self.witness_utxo = False
def has_utxo(self):
return TrueWhy this scored 36/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.