bitcoindevkit / bitcoindevkit/bdk_wallet

Missing MAX_STANDARD_TX_WEIGHT check produces unrelayable txs

Open
#543 1 comment 0 reactions 0 assignees View on GitHub
bug good first issue
Dominant language
Rust
Stars
59
Forks
105
Avg merge
10d 9h
Merged PRs (30d)
1

Description

**Describe the bug**

Neither `create_tx` nor `create_psbt` path checks the final transaction weight against the 400,000 wu standardness limit. Output-side standardness is enforced (dust check, `OutputBelowDustLimit`).

A wallet with enough UTXOs can drain into a fully signed, finalized PSBT over 400,000 wu, which every standardness-enforcing mempool rejects.

**To Reproduce**

1. Fund a wallet with ~1,500 small P2WPKH UTXOs.
2. `build_tx().drain_wallet().drain_to(addr).finish()` → `Ok(psbt)`; `wallet.sign(...)` → `Ok(true)`. Extracted tx ≈406,000 wu; broadcast rejected.

**Expected behavior**

After assembling the transaction (`complete_transaction` and `create_psbt` path), reject when final weight exceeds `MAX_STANDARD_TX_WEIGHT` with a dedicated error, symmetric to the existing `OutputBelowDustLimit` check.

**Build environment**
- BDK tag/commit: `49f7955c` (master, ≤ 3.1.0)

**Which backend(s) are relevant (if any)?**
- [x] None / not backend-related

**Is this blocking production use?**
- [x] No

**Additional context**

Availability/UX footgun: An oversized tx cannot enter a mempool, but returning `Ok(true)` from signing is a misleading success signal.

Contributor guide

Open the contributing guide

Research direction

Start by tracing the create_tx and create_psbt entry points through complete_transaction, comparing where output-side standardness and OutputBelowDustLimit are enforced. Reproduce the large-wallet case with roughly 1,500 small P2WPKH UTXOs, then verify that both paths reject a finalized transaction above MAX_STANDARD_TX_WEIGHT instead of returning a successful signing result.

Written by the indexing model from the issue text.

Assessment

Tech stack
rust
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Active
Clarity
Clearly specified
Newbie friendliness
72/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.