bitcoinjs-lib Fixes Two PSBT Bugs That Could Hide High Bitcoin Fees

Bitcoinjs-lib disclosed two high-severity bugs Oct. 26 that can make some applications report Bitcoin (BTC) transaction fees far below the true amount when processing partially signed Bitcoin transactions (PSBTs). The risk is limited to apps that accept untrusted PSBTs and rely on bitcoinjs-lib’s fee calculation or fee-rate check.

In one flaw, signing could use the actual previous transaction while the fee calculation used a smaller, conflicting value in a witnessUtxo record. In a demonstration with version 7.0.1, the true fee was 900,000,000 satoshis, but the library calculated 200. The signature verified, and the transaction was extracted without the default fee-rate warning.

A second flaw could make a finalized input count as having zero value if its PSBT lacked both witnessUtxo and nonWitnessUtxo records. In the example, inputs worth 10,000 and 90,000 satoshis funded outputs totaling 9,000 satoshis. The actual fee was 91,000 satoshis; the calculator showed 1,000.

The examples demonstrate miscalculations, not confirmed losses or active exploitation. The flaw alone does not transfer excess value to the PSBT author: that value becomes a miner fee, and a loss requires a valid transaction to be broadcast and accepted. The fee-accounting issue is separate from Electrum’s fee-bump flaw, which involved malicious servers redirecting payments.

Bitcoinjs-lib lists versions 5.2.2, 6.1.9 and 7.0.4 as fixes. Apps that cannot upgrade should verify each input’s referenced output value and reject conflicting records.