Bitcoin apps risk fee drain due to two bitcoinjs-lib bugs

The bugs exist within Bitcoinjs-lib, a crucial resource for developing Bitcoin applications, allowing software to incorrectly calculate the fee a valid transaction would incur upon being sent and accepted. Security updates released on October 26 address these issues in versions 5.2.2, 6.1.9, and 7.0.4 across their respective release streams. The vulnerability pertains to a partially signed Bitcoin transaction (PSBT), which, as defined by BIP 174, serves as a mechanism for passing transaction data and digital signatures between different software clients.

While functions like extraction, finalizing inputs, combining signatures, and signing are distinct operations, even when a single application performs several of these tasks, the danger lies with applications that incorporate these packages and implicitly trust bitcoinjs-lib's safeguard against excessive fees or its fee calculations without performing their own checks on the spent outputs. Developers responsible for these applications must examine their dependency versions and how they validate imported PSBTs.

Since a transaction's cost is determined by the disparity between its input value and its output value, an underestimate of an input value will cause the computed fee to appear smaller than it truly is. The first defect arises because the signing process and the fee accounting mechanism might utilize different values for the identical input. Specifically, the signing process relies on the complete prior transaction, while the fee accounting mechanism favors a divergent record that shows a lesser value. This discrepancy allows the compromised software to approve the actual transaction while basing its evaluation on the incorrect fee. The advisory provides an illustration using bitcoinjs-lib 7.0.1, where the genuine fee amounted to 900,000,000 satoshi, yet the library reported only 200 satoshi; the signature passed verification, and the extraction proceeded without the standard warning regarding the fee rate.

The second security concern involves finalized inputs where records detailing the input values are absent. The calculator treats these missing inputs as having a value of zero, and an already-signed PSBT received from an external source can reach this calculation without necessitating another signing action. This hypothetical scenario shows a true fee of 91,000 satoshi being reported as just 1,000 satoshi. It is important to note that signatures and finalized scripts alone do not establish the value of a missing input; an actual financial loss only occurs when an authorized, legitimate transaction is transmitted and accepted by the network. Furthermore, these defects themselves do not generate signatures, and the excess value becomes the miner's fee.

Affected releases for the conflicting records flaw include 5.2.0 through 5.2.1, 6.0.0 through 6.1.8 (which encompasses 6.1.0-rc.0), and 7.0.0-rc.0 through 7.0.3. The issue related to missing records affects the same v6 and v7 ranges, along with the v5 line versions 5.1.0 through 5.2.1. The implemented fix provides signing and accounting with a uniform procedure for resolving previous outputs, it rejects values or scripts that conflict, and it mandates that a value must be present for every input during the fee calculation. Additionally, it purges cached fees and extracted transactions following modifications or combinations of relevant metadata.

For maintainers who cannot perform an upgrade, they must independently confirm the values of any referenced outputs. It is crucial to reject contradictory records before either signing or trusting the fees, and to verify every input value before accepting the fees or extracting a transaction.

Why it matters

Developers using bitcoinjs-lib must immediately review their dependencies to prevent software from miscalculating transaction costs. These vulnerabilities could lead to unexpected and significant losses when transactions are broadcast to the network.