Bitcoinjs-lib Patches Two Bugs Affecting Miner Fee Calculations

Bitcoinjs-lib has patched two bugs that could lead to incorrect miner fee calculations in Bitcoin applications. The security updates, released on Oct. 26, are included in versions 5.2.2, 6.1.9, and 7.0.4. The issues primarily affect partially signed Bitcoin transactions (PSBTs), which are defined by BIP 174 for sharing transaction information and signatures. Applications using these libraries may miscalculate fees if they trust bitcoinjs-lib's calculations without independent verification. The first flaw allows signing and fee accounting to use different input values, leading to significant discrepancies. For instance, a demonstration showed a real fee of 900,000,000 satoshi reported as only 200 satoshi. The second flaw involves missing input-value records, causing the fee calculator to treat those inputs as zero, resulting in misleading fee reports. An example indicated a true fee of 91,000 satoshi reported as 1,000 satoshi. The patched versions now require a value for every input during fee calculation and reject conflicting records. Affected releases include versions 5.2.0 to 5.2.1, 6.0.0 to 6.1.8, and 7.0.0 to 7.0.3. Users unable to upgrade should verify output values independently and reject conflicting records before signing.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.