Bitcoin apps risk massive fee drain, and 2 library bugs are blamed

Bitcoinjs-lib, a library used to build Bitcoin applications, has patched two bugs that can make software understate the miner fee a valid transaction would pay if broadcast and accepted. 26 security disclosures identify fixes in versions 5.2.2, 6.1.9 and 7.0.4 for the corresponding release lines. The affected format is a partially signed Bitcoin transaction (PSBT), and BIP 174 defines it as a way to pass transaction information and signatures between clients.

Signing, combining signatures, finalizing inputs, and extracting the transaction are separate functions, even when one application performs several of them. The risk concerns applications that import these packages and trust bitcoinjs-lib's fee calculation or excessive-fee safeguard without independently checking the outputs being spent. Maintainers need to review their dependency version and how they validate imported PSBTs.