Security context
What an agent needs to avoid regressing past fixes and find the next vuln in this repo.
btcsuite/btcutil
master @ 27c39e0
2
Fixes
0
CVEs
HIGH
Peak severity
Highlights
Cryptographic Issues: 1 prior fix. Scrutinize any change in this area.
psbt/signer.go: most-fixed (1 issue). Treat as high-risk during review.
1 high-severity fix in this history; regressions here are high-impact.
Recurring patterns
The bug types that recur here, drawn from past fixes, not open vulnerabilities.
Signature Verification Bypass: Inconsistent processing of transaction inputs allowed attackers to bypass witness UTXO validation checks when dual-set UTXOs (both witness and non-witness fields populated) were processed during partial signature additions. This could lead to accepting invalid signatures.
Cryptographic Issues: Stripping or failing to retain non-witness UTXOs for SegWit v0 inputs in PSBT packets exposes transaction signers (specifically offline hardware wallets) to fee-spoofing attacks, where a malicious coordinator can misrepresent input values.