Bitcoin apps risk massive fee drain, and 2 library bugs are blamed
Summary
Bitcoinjs-lib disclosed and patched two PSBT fee-calculation bugs in releases 5.2.2, 6.1.9 and 7.0.4. Conflicting input records or missing values could make software report a much lower miner fee than a valid signed transaction would pay, bypassing excessive-fee warnings. One demonstration showed a real fee of 900 million satoshi reported as 200 satoshi. Loss would require the transaction to be broadcast and accepted; the flaws do not create signatures, and excess value goes to miners. Maintainers should upgrade or independently verify every input’s value and reject conflicting records.
