AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 20 Bitcoin

Implement PSBTv2 AddInput and AddOutput

Public commit record

What the developer wrote

Authored by Ava Chow

45/100 · Thin
Implement PSBTv2 AddInput and AddOutput
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
The short version

What changed, and why it matters

This commit finishes implementing the 'AddInput' and 'AddOutput' methods for PSBT version 2 in Bitcoin Core. PSBTs are files used to collaboratively build or sign Bitcoin transactions offline. Previously, adding inputs/outputs to a PSBTv2 would silently fail (return false). The change now properly checks version compatibility, respects the 'modifiable' flags that say whether inputs/outputs may be added, and handles time-lock consistency when new inputs are appended. It is a feature-completion patch with defensive checks, not a fix for an active vulnerability.

Recommended action

Review as normal feature completion. Verify that the locktime logic matches BIP 370 exactly, especially the interaction with SIGHASH_SINGLE (bit 2 of m_tx_modifiable), which the commit message notes is intentionally skipped because inputs are only appended. Consider adding unit/functional tests for the new failure paths (version mismatch, modifiable-flag denial, locktime conflict with existing signatures).

Security signals we found

01

Defensive version-mismatch guard added to AddInput/AddOutput

02

Respects PSBTv2 modifiable flags before mutating inputs/outputs

03

Locktime consistency check prevents adding inputs that would invalidate existing signatures

04

New HasSignatures helper used to guard locktime mutation

05

No memory-unsafe operations, no deserialization changes, no network exposure visible

Risk score

Why this scored 20/100

Our methodology →
Potential impact 3/30
Exploitability 2/25
Stealth signal 2/15
Affected reach 3/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.