wallet: load-time bounds and fee rescue selection (v26.06.7 security, 6/7) - #9512
Merged
Merged
Conversation
nGoline
force-pushed
the
port-26.06.7-wallet
branch
from
September 15, 2026 12:52
60e75ff to
42180ea
Compare
wallet_utxo_boost() picks the wallet inputs which fund anchor and HTLC fee rescue transactions. Ordinary coin selection filters immature coinbase outputs via deep_enough(); a rescue funded by one cannot confirm, so rescue selection needs the same filter. Give the closing node a single immature block reward as its only wallet output, and check that it declines to boost rather than selecting it. Marked xfail(strict=True) since the selector is not yet fixed; the next commit removes the marker. (cherry picked from commit daa5654)
wallet_utxo_boost() selects wallet-funded inputs for anchor and HTLC fee rescue transactions, but unlike ordinary coin selection it never applied the coinbase-maturity check. An immature coinbase could therefore be the sole rescue input, producing a consensus-invalid transaction that Bitcoin Core rejects as a premature coinbase spend. Apply the same utxo_is_immature() filter used by deep_enough()/ordinary selection. Since both call sites pass the live blockheight and rebuild on reorg/RBF, maturity is revalidated at construction and after reorgs. This makes test_anchorspend_ignores_immature_coinbase pass, so its xfail marker is dropped. Changelog-Fixed: Wallet: anchor and HTLC fee rescue no longer select immature coinbase outputs, which produced a transaction bitcoind rejects (cherry picked from commit 5e79baa)
Keep the loaded pos within the known[] array like the other defensive checks in the channel loader, so a malformed row fails loudly instead of indexing out of range. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Changelog-Fixed: wallet: an out-of-range shachain index in the database is now rejected at load instead of read out of bounds. (cherry picked from commit fdd7b11)
Return early for a NULL column like the sibling db_col_* helpers, and only parse and set the version when there is actual data to work with. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com> Changelog-None (cherry picked from commit d6f8cc3)
nGoline
force-pushed
the
port-26.06.7-wallet
branch
from
September 15, 2026 21:34
42180ea to
22fa10f
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sixth of seven PRs forward-porting the v26.06.7 security point release onto master.
Bounds checking on what the database hands back at load, and input selection for fee rescue.
4 commits:
tests: cover fee rescue input selection with an immature coinbasewallet: exclude immature coinbase outputs from fee rescue selectionwallet: bound-check shachain_known pos on loaddb: tidy db_col_psbt NULL handlingTwo
Changelog-Fixed: an out-of-range shachain index in the database is rejected at load instead of read out of bounds, and anchor and HTLC fee rescue no longer select immature coinbase outputs, which produced a transactionbitcoindrejects.For reviewers
The first two commits are a test-then-fix pair: the test lands marked
xfail(strict=True)and the next commit removes the marker.Applies cleanly to master with no conflicts, and every commit is byte-identical to its release-line original.