doc: replace stale signtransaction wording with current signtx flow
What changed, and why it matters
This commit only updates documentation and a code comment to match how external (hardware) signers actually work in current Bitcoin Core. It does not change any executable code, RPC behavior, or security logic. There is no security vulnerability here.
No action needed; this is a documentation-only clarification.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff is purely cosmetic: doc/external-signer.md and src/external_signer.h are updated to replace outdated references to a ‘signtransaction’ subcommand and to ‘sendtoaddress/sendmany’ with the current ‘signtx’ flow used by ‘send’/’sendall’/’bumpfee’. No functional code is modified.
Changed components
doc/external-signer.mdsrc/external_signer.hInspect captured patch +4 / −5
diff --git a/doc/external-signer.md b/doc/external-signer.md
index d777871d..de5e5b5a 100644
--- a/doc/external-signer.md
+++ b/doc/external-signer.md
@@ -67,7 +67,7 @@ Replace `<address>` with the result of `getnewaddress`.
Under the hood this uses a [PSBT (Partially Signed Bitcoin Transaction)](psbt.md).
```sh
-bitcoin-cli -rpcwallet=<walletname> sendtoaddress <address> <amount>
+bitcoin rpc -rpcwallet=<walletname> send outputs='{"<address>": <amount>}'
```
This constructs a PSBT and prompts your external signer to sign (will fail if it's not connected). If successful, Bitcoin Core finalizes and broadcasts the transaction.
@@ -218,6 +218,4 @@ It then imports descriptors for all supported address types, in a BIP44/49/84/86
The `walletdisplayaddress` RPC reuses some code from `getaddressinfo` on the provided address and obtains the inferred descriptor. It then calls `<cmd> --fingerprint=00000000 displayaddress --desc=<descriptor>`.
-For external-signer wallets, spending uses `send` or `sendall`. Bitcoin Core builds a PSBT, calls the signer via stdin with `signtx`, and if signatures are sufficient, finalizes and broadcasts the transaction. If the signer is not connected or cancels, the call fails with an error. For fee-bumping on such wallets, use `psbtbumpfee` to involve an external signer.
-
-`sendtoaddress` and `sendmany` check `inputs->bip32_derivs` to see if any inputs have the same `master_fingerprint` as the signer. If so, it calls `<cmd> --fingerprint=00000000 signtransaction <psbt>`. It waits for the device to return a (partially) signed psbt, tries to finalize it and broadcasts the transaction.
+For external-signer wallets, spending uses `send` or `sendall`, and fee-bumping uses `bumpfee`. Bitcoin Core builds a PSBT, adds key origin information, checks whether any input key origin fingerprint matches the signer, calls `<cmd> --stdin --fingerprint 00000000 --chain <name>`, and sends `signtx <psbt>` over stdin. If signatures are sufficient, it finalizes the transaction and, for broadcasting RPCs, broadcasts it. If signing cannot complete, the call fails with an error. For manual fee-bumping, use `psbtbumpfee` to obtain a PSBT for signing.
diff --git a/src/external_signer.h b/src/external_signer.h
index 87fbbf0b..a6f16e8e 100644
--- a/src/external_signer.h
+++ b/src/external_signer.h
@@ -58,7 +58,8 @@ public:
UniValue GetDescriptors(int account);
//! Sign PartiallySignedTransaction on the device.
- //! Calls `<command> signtransaction` and passes the PSBT via stdin.
+ //! Calls `<command> --stdin --fingerprint <fingerprint> --chain <chain>` and passes the
+ //! `signtx` command and PSBT via stdin.
//! @param[in,out] psbt PartiallySignedTransaction to be signed
bool SignTransaction(PartiallySignedTransaction& psbt, std::string& error);
};
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.