You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
TxGraph doesn't index null-prevout spends of non-coinbase txs, so their conflicts go undetected #2286
TxGraph::insert_tx skips every null previous output when indexing spends. A malformed transaction with a null prevout and a second input is not coinbase, but its null input is still skipped. Two such transactions sharing only the null prevout are therefore missed by direct_conflicts, and both remain in CanonicalView after recording their last-seen timestamps.
This requires consensus-invalid transaction data.
This issue was found by AI.
To Reproduce
Add this as crates/chain/tests/test_null_outpoint.rs, then run cargo test -p bdk_chain --test test_null_outpoint:
changed the title [-]Canonical view admits conflicting transactions with null prevouts[/-][+]TxGraph doesn't index null-prevout spends of non-coinbase txs, so their conflicts go undetected[/+]on Oct 26, 2026
Closing as not planned. The repro is accurate: insert_tx skips any null prevout, not just a coinbase's. But it only bites on consensus-invalid transactions (bad-txns-prevout-null). No node relays those and no block contains them, so a wallet only sees one from a broken or hostile chain source, which we treat as trusted (see #2371). Fixing it would add special-casing to TxGraph for data that can't occur on a real network.
Thanks @noahjoeris for the clear report and repro, and @AlphaSparrow for the fix attempt in #2435 (and the MSRV CI fix that came with it). If you find a way to hit this with valid transactions, please reopen.
Activity
fix(chain): track spends and conflicts on null prevout for non-coinba…
[-]Canonical view admits conflicting transactions with null prevouts[/-][+]TxGraph doesn't index null-prevout spends of non-coinbase txs, so their conflicts go undetected[/+]evanlinjin commentedon Oct 26, 2026
Closing as not planned. The repro is accurate:
insert_txskips any null prevout, not just a coinbase's. But it only bites on consensus-invalid transactions (bad-txns-prevout-null). No node relays those and no block contains them, so a wallet only sees one from a broken or hostile chain source, which we treat as trusted (see #2371). Fixing it would add special-casing toTxGraphfor data that can't occur on a real network.Thanks @noahjoeris for the clear report and repro, and @AlphaSparrow for the fix attempt in #2435 (and the MSRV CI fix that came with it). If you find a way to hit this with valid transactions, please reopen.