ensure marked used UTXOs do not get included in frost txn
What the developer wrote
Authored by Julian
ensure marked used UTXOs do not get included in frost txn
What changed, and why it matters
This commit fixes a bug in Stack Wallet's Bitcoin FROST wallet where coins that had already been spent (marked as 'used') could still be selected for new transactions. This could cause the wallet to attempt to spend the same coin twice, leading to failed or invalid transactions. The fix adds a filter to exclude any UTXOs that are marked as used or have an unclear used status.
Review whether other wallet implementations have the same missing used filter, add regression tests for UTXO selection in FROST wallets, and verify that the used flag is reliably set when UTXOs are consumed.
Security signals we found
Double-spend risk: used UTXOs could be selected again
Transaction construction bug in FROST wallet
Missing filter on UTXO spent state
Potential wallet error or failed broadcast
Evidence from the diff
In lib/wallets/wallet/impl/bitcoin_frost_wallet.dart, the UTXO selection query for FROST transactions previously only filtered out blocked UTXOs (isBlockedEqualTo(false)) but did not exclude UTXOs already marked as spent/used. The patch adds .group((q) => q.usedEqualTo(false).or().usedIsNull()) to the Isar query, ensuring only unspent UTXOs (used == false or used == null) are selected. This prevents double-spend attempts and transaction construction failures in the FROST signing flow.
Changed components
lib/wallets/wallet/impl/bitcoin_frost_wallet.dartFROST UTXO selection queryBitcoin FROST wallet transaction builderInspect captured patch +1 / −0
diff --git a/lib/wallets/wallet/impl/bitcoin_frost_wallet.dart b/lib/wallets/wallet/impl/bitcoin_frost_wallet.dart
index 00537b1..28f53e3 100644
--- a/lib/wallets/wallet/impl/bitcoin_frost_wallet.dart
+++ b/lib/wallets/wallet/impl/bitcoin_frost_wallet.dart
@@ -125,6 +125,7 @@ class BitcoinFrostWallet<T extends FrostCurrency> extends Wallet<T>
.getUTXOs(walletId)
.filter()
.isBlockedEqualTo(false)
+ .group((q) => q.usedEqualTo(false).or().usedIsNull())
.findAll();
if (utxos.isEmpty) {
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.