dawnbass68/maddcash: api/xpub.go; 25 LoC

Found a possible issue in [dawnbass68/maddcash](https://www.github.com/dawnbass68/maddcash) at [api/xpub.go](https://github.com/dawnbass68/maddcash/blob/c91c12cb36e5191b232bfbde598649fec2e1c993/api/xpub.go#L415-L439)

Below is the message reported by the analyzer for this snippet of code. Beware that the analyzer only reports the first issue it finds, so please do not limit your consideration to the contents of the below message.

>

[Click here to see the code in its original context.](https://github.com/dawnbass68/maddcash/blob/c91c12cb36e5191b232bfbde598649fec2e1c993/api/xpub.go#L415-L439)

Click here to show the 25 line(s) of Go which triggered the analyzer.

```go
for _, txid := range newTxids {
// the same tx can have multiple addresses from the same xpub, get it from backend it only once
tx, foundTx := txmMap[txid.txid]
if !foundTx {
tx, err = w.GetTransaction(txid.txid, false, false)
// mempool transaction may fail
if err != nil || tx == nil {
glog.Warning("GetTransaction in mempool: ", err)
continue
}
txmMap[txid.txid] = tx
}
// skip already confirmed txs, mempool may be out of sync
if tx.Confirmations == 0 {
if !foundTx {
unconfirmedTxs++
}
uBalSat.Add(&uBalSat, tx.getAddrVoutValue(ad.addrDesc))
uBalSat.Sub(&uBalSat, tx.getAddrVinValue(ad.addrDesc))
// mempool txs are returned only on the first page, uniquely and filtered
if page == 0 && !foundTx && (txidFilter == nil || txidFilter(&txid, ad)) {
mempoolEntries = append(mempoolEntries, bchain.MempoolTxidEntry{Txid: txid.txid, Time: uint32(tx.Blocktime)})
}
}
}

```

Click here to show extra information the analyzer produced.

```
No path was found through the callgraph that could lead to a function which writes a pointer argument.

No path was found through the callgraph that could lead to a function which passes a pointer to third-party code.

root signature {txidFilter 2} was not found in the callgraph; reference was passed directly to third-party code
```

Leave a reaction on this issue to contribute to the project by classifying this instance as a **Bug** :-1:, **Mitigated** :+1:, or **Desirable Behavior** :rocket:
See the descriptions of the classifications [here](https://github.com/github-vet/rangeclosure-findings#how-can-i-help) for more information.

commit ID: c91c12cb36e5191b232bfbde598649fec2e1c993

Read api/xpub.go around lines 415-439 at commit c91c12cb36e5191b232bfbde598649fec2e1c993, then inspect the linked maddcash context. Determine whether a range-loop value or pointer can escape to third-party code, using the analyzer details as evidence. Done means leaving the appropriate Bug, Mitigated, or Desirable Behavior reaction.

Written by the indexing model from the issue text.