Skip to content

Validate tx signature before adding to wallet. - #2643

Merged
jrick merged 2 commits into
decred:masterfrom
jholdstock:drop-invalid
Aug 18, 2026
Merged

Validate tx signature before adding to wallet.#2643
jrick merged 2 commits into
decred:masterfrom
jholdstock:drop-invalid

Conversation

@jholdstock

Copy link
Copy Markdown
Member

Validate transactions which spend UTXOs owned by this wallet before adding them to the mempool/database. Disconnect peers violating the validation.

Closes #2633

@davecgh - to address your concern from #2642 (comment), AddTransaction was not previously capable of returning errors.ScriptFailure, so only the code newly added in this PR will lead to peers being disconnected.

Unmined transaction with inputs which reference UTXOs owned by this
wallet require extra scrutiny before the transaction is accepted into
the mempool/database. This is necessary because a malicious SPV peer
could relay a forged transaction which falsely claims to spend a UTXO
from this wallet.

Mined transactions do not need these extra checks because they have
already been validated by consensus.
@jholdstock jholdstock changed the title Drop invalid Validate tx signature before adding to wallet. Aug 5, 2026
@davecgh

davecgh commented Aug 5, 2026

Copy link
Copy Markdown
Member

to address your concern from #2642 (comment), AddTransaction was not previously capable of returning errors.ScriptFailure, so only the code newly added in this PR will lead to peers being disconnected.

I don't think that changes anything though. I'll explain offline to keep the details out of here.

A peer which relays a transaction with an invalid attempt to spend a
UTXO owned by this wallet is misbehaving, so drop the peer instead of
allowing it to keep announcing the invalid transaction.
@jholdstock

Copy link
Copy Markdown
Member Author

Updated so peers are only disconnected if they claim to be a full node.

@jrick
jrick merged commit ffc81a4 into decred:master Aug 18, 2026
2 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

SPV wallets should confirm tx signature

3 participants