Bitcoin apps risk massive fee drain, and 2 library bugs are blamed

Bitcoinjs-lib, a library used to build Bitcoin applications, has patched two bugs that can make software understate the miner fee a valid transaction would pay if broadcast and accepted. The Oct. 26 security disclosures identify fixes in versions 5.2.2, 6.1.9 and 7.0.4 for the corresponding release lines. The affected format is a partially signed Bitcoin transaction (PSBT), and BIP 174 defines it as a way to pass transaction information and signatures between clients. Signing, combining signatures, finalizing inputs, and extracting the transaction are separate functions, even when one application performs several of them.