finalize external inputs in cross-wallet psbts to avoid empty witnesses
What the developer wrote
Authored by Craig Raw
finalize external inputs in cross-wallet psbts to avoid empty witnesses
What changed, and why it matters
This commit fixes a problem where Sparrow Wallet did not properly 'finalize' transaction inputs that belong to another wallet when creating or handling cross-wallet PSBTs (Partially Signed Bitcoin Transactions). Without finalization, those inputs could end up with empty witness data, which may cause a signed transaction to be rejected by the Bitcoin network or to behave unexpectedly. In practical terms, this could affect multi-party or multi-wallet transactions where one wallet provides inputs it does not fully control.
Users who create or sign cross-wallet PSBTs should upgrade to a Sparrow version that includes this commit. Developers should review the finalization path for external inputs and add tests covering multi-wallet PSBT scenarios, especially where inputs are provided by a separate wallet or party.
Security signals we found
Empty witness data in finalized PSBTs can lead to invalid or non-broadcastable Bitcoin transactions
Cross-wallet / external-input PSBTs are commonly used in multi-signature and collaborative transaction flows
Improper finalization may cause transaction signing failures or unexpected behavior when combining PSBTs from different wallets
Small, targeted patch in PSBT finalization path
Evidence from the diff
The change is titled ‘finalize external inputs in cross-wallet psbts to avoid empty witnesses’. In Bitcoin PSBT workflows, finalization converts signatures and scripts into the actual witness data needed for a transaction to be valid. External inputs are UTXOs controlled by a different party or wallet. The commit suggests that Sparrow previously did not finalize these external inputs, leaving witnesses empty. The fix touches two files, ‘drongo’ and ‘lark’, with a net change of only two lines, indicating a targeted adjustment to the finalization logic for cross-wallet PSBTs.
Changed components
Sparrow Wallet PSBT finalization logicCross-wallet PSBT handlingExternal input processingInspect captured patch +2 / −2
Diff not available from the source API.Why this scored 55/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.