Bitcoin Library Flaws Expose Risk of Excessive Fees

Two critical bugs in the bitcoinjs-lib library were identified and patched in October. The flaws affect fee calculations in Partially Signed Bitcoin Transactions known as PSBT. Applications relying on this tool may fail to validate actual mining costs.

The first flaw occurs when the signing system and the accounting system use divergent values for the same input. The software can authorize a real transaction while evaluating a fee much lower than what the network actually charges. In tests, a fee of 900 million satoshis was erroneously reported as just 200 satoshis.

The second issue involves finalized inputs with missing value records. In these cases, the calculation treats the value of these inputs as zero. This allows transactions signed by third parties to bypass security checks without triggering automatic warnings about high fees.

Developers using the library must update immediately to versions 5.2.2, 6.1.9, or 7.0.4. The flaw requires application maintainers to review how they validate imported transactions. Blind trust in library calculations without independent verification of output data poses the greatest danger to users.

These vulnerabilities in open-source infrastructure increase operational uncertainty and the risk of unexpected financial losses in Bitcoin transactions. Technical instability in network tools may raise institutional caution regarding the custody and processing of digital assets.