Community Trust ScoreVerified
Bitcoinjs-lib maintainers issued security disclosures on October 26 identifying two bugs that can cause software to understate the miner fee a valid Bitcoin transaction would pay if broadcast and accepted. The fixes are included in versions 5.2.2, 6.1.9, and 7.0.4 for their respective release lines.
PSBT Fee Calculation Flaws
The affected transaction format is the partially signed Bitcoin transaction (PSBT). BIP 174 defines PSBT as a method to pass transaction information and signatures between clients. Within the library, signing, combining signatures, finalizing inputs, and extracting the transaction are distinct functions, even when a single application performs several of them.
The risk applies to applications that import these packages and trust bitcoinjs-lib’s fee calculation or excessive-fee safeguards without independently checking the outputs being spent. A Bitcoin transaction’s fee is calculated as the difference between the value of its inputs and its outputs. Therefore, understating an input value makes the calculated fee appear smaller than the actual amount.
The first flaw involves signing and fee accounting using different values for the same input. In this scenario, the signing process uses the full previous transaction, while the fee accounting logic prefers a conflicting record containing a smaller value. This allows vulnerable software to authorize the real transaction while evaluating the wrong fee.
The advisory describes a demonstration on bitcoinjs-lib 7.0.1 where the actual fee was 900,000,000 satoshi, but the library reported only 200 satoshi. In this demonstration, the signature verified successfully, and the extraction process returned without triggering the default fee-rate warning.
The second flaw involves finalized inputs where both input-value records are missing. When these records are absent, the calculator counts those inputs as zero. An already-signed PSBT imported from another party can trigger this calculation without requiring a new signing operation. A hypothetical example for this flaw showed a true fee of 91,000 satoshi reported as 1,000 satoshi. Finalized scripts and signatures alone do not establish the value of a missing input.
Remediation and Affected Versions
Actual financial loss requires an authorized, valid transaction to be broadcast and accepted by the network. The defects do not create signatures; instead, excess value is paid as a miner fee. The conflicting records flaw affects releases 5.2.0 through 5.2.1, 6.0.0 through 6.1.8 (including 6.1.0-rc.0), and 7.0.0-rc.0 through 7.0.3. The missing-record flaw affects the same v6 and v7 ranges, plus v5 releases 5.1.0 through 5.2.1.
The remediation provides a shared method for resolving previous outputs for both signing and accounting. It rejects conflicting values or scripts and requires an amount for every input during fee calculation. Additionally, the fix clears cached fees and extracted transactions after relevant metadata changes or combinations.
Maintainers unable to upgrade should independently verify referenced output values. They should reject conflicting records before signing or trusting fees, and verify every input value before trusting fees or extracting a transaction. The disclosures do not indicate whether specific applications have been compromised, but maintainers are advised to review their dependency versions and how they validate imported PSBTs.
Frequently Asked Questions
Which versions of bitcoinjs-lib contain the fee accounting fixes?
The fixes are included in versions 5.2.2, 6.1.9, and 7.0.4 for the v5, v6, and v7 release lines, respectively.
Do these bugs allow attackers to create unauthorized signatures?
No, the defects do not create signatures. Actual loss requires an authorized, valid transaction to be broadcast and accepted by the network, where excess value is paid as a miner fee.
