bitcoinjs-lib Fixes Two PSBT Bugs That Could Hide High Bitcoin Fees

Bitcoinjs-lib disclosed two high-severity bugs Oct. 26 that can make some applications report Bitcoin (BTC) transaction fees far below the true amount when processing partially signed Bitcoin transactions (PSBTs). The risk is limited to apps that accept untrusted PSBTs and rely on bitcoinjs-lib’s fee calculation or fee-rate check. In one flaw, signing could use the actual previous transaction while the fee calculation used a smaller, conflicting value in a witnessUtxo record. In a demonstration with version 7.0.1, the true fee was 900,000,000 satoshis, but the library calculated 200.