Bitcoinjs-lib library bugs cause fee calculation errors in PSBT transactions
Current overview (not historical)
Two vulnerabilities in the bitcoinjs-lib library cause fee calculation errors in Partially Signed Bitcoin Transactions (PSBT). Signing uses full transaction inputs while fee accounting prefers conflicting records, allowing transactions to be authorized with significantly higher actual fees than reported. A disclosed example shows actual fees of 900,000,000 satoshi versus the library's reported 200 satoshi. Signatures verify successfully without triggering rate warnings. The issue affects specific PSBT operations. Patches were released in versions 5.2.2, 6.1.9, and 7.0.4 on Oct. 26.
Written with AI from the reporting · updated 10/28/2026
Expand the detailed fact route and sources
Story route
A station-by-station route from the first public evidence onward; every station carries its own evidence and uncertainty.
- 1Unclassified fact stationOct 26, 00:00recorded Oct 28, 13:48single sourcerevised
Bitcoinjs-lib库两处漏洞导致费用计算错误
Read original source ↗ CryptoSlateReplay this moment in the explorerEvidence & revisions · 1 source records
- Subject：
- bitcoinjs-lib
- Action：
- 发布安全补丁修复两处费用计算漏洞
- Object：
- Bitcoinjs-lib库
- Occurred (fact side)：
- Oct 26, 00:00
- Published (valid side)：
- Oct 28, 13:30
- First seen (known side)：
- Oct 28, 13:48
Fact stationSingle source · one-sided claimRevisedCopy may have been revised later; time replay is bounded. Layer labels group reading only, not causation between layers.
Uncertainty marks flag where to check the sources; they are not proven causation.
Report timeline
Explore every side through dated source reports.
- CryptoSlateRelated fact: single sourceSource report revisedBitcoinjs-lib library bugs could understate miner fees and bypass safety checks
Report first recorded Oct 28, 13:48
Two vulnerabilities in the bitcoinjs-lib library could cause Bitcoin applications to understate miner fees. The first flaw allows signing and fee accounting to use conflicting input values, making calculated fees appear much lower than actual amounts. The second flaw counts missing input values as zero in finalized transactions. Patched versions 5.2.2, 6.1.9 and 7.0.4 are available; applications relying on the library's fee calculation without independent verification are at risk.
Read original source ↗
Event activity trend
- Latest comparable
- 3
- Comparable peak
- 10Oct 28, 14:00
- 24h change
- -51%
The chart compares consistently observed participants only. Hover or tap to inspect each hour; use arrow keys to move between observations.
Event discussion
Reader opinions are hosted on GitHub Discussions; posting requires a GitHub account. Comments are not verified facts.