LeaveVTXOs duplicate outpoints can strand VTXOs

Imported from Codex security findings CSV codex-security-findings-2026-05-12T19-29-42.462Z.csv.

Triage status: imported scanner finding, not yet validated by a human.

Scanner Metadata

• Finding URL: https://chatgpt.com/codex/cloud/security/findings/aaaf762dae008191a292fc1fbe1cd931
• Repository: lightninglabs/darepo-client
• Severity: medium
• Scanner status: new
• Detected at: 2026-05-12T16:51:06.638725Z
• Commit: 7a16f843f0499b39d1fcfde4b3482a12300046c3
• Committed at: 2026-04-25 15:36:41 -0700
• Author email: laolu32@gmail.com
• Has patch: false
• Configured scan ID: user-SFHXEfRY6GFhQZ5usE2FvSk3:github-1095286530

Relevant Paths

• darepod/rpc_server.go
• wallet/wallet.go
• vtxo/manager.go
• round/transitions.go

Original Finding

Original Title

LeaveVTXOs duplicate outpoints can strand VTXOs

Original Description

The newly exposed LeaveVTXOs handler parses the requested outpoints into a slice but never rejects duplicates. It then sends that slice directly to wallet.LeaveVTXOsRequest. The wallet builds one forfeit and one leave output for every target entry, so duplicate targets create duplicate full-value leave outputs. The VTXO manager deduplicates the reservation outpoints, so the duplicate does not fail at admission. Later, the round FSM deduplicates forfeits by VTXO outpoint but blindly appends all leave outputs. This creates one input and multiple full-value outputs for the same VTXO, causing the later balance check to fail. Because the wallet releases reservations only when RegisterIntentMsg immediately returns an error, an asynchronous FSM failure can leave the VTXO stuck in PendingForfeit until manual recovery/unroll/expiry handling. A local caller, exposed RPC client, or buggy agent can therefore cause a fund-liveness denial of service by submitting the same outpoint twice, or by submitting an already queued outpoint again before round registration.

Original CSV Row

finding_url: https://chatgpt.com/codex/cloud/security/findings/aaaf762dae008191a292fc1fbe1cd931
repository: lightninglabs/darepo-client
repository_url: https://github.com/lightninglabs/darepo-client
title: LeaveVTXOs duplicate outpoints can strand VTXOs
description: The newly exposed LeaveVTXOs handler parses the requested outpoints into a slice but never rejects duplicates. It then sends that slice directly to wallet.LeaveVTXOsRequest. The wallet builds one forfeit and one leave output for every target entry, so duplicate targets create duplicate full-value leave outputs. The VTXO manager deduplicates the reservation outpoints, so the duplicate does not fail at admission. Later, the round FSM deduplicates forfeits by VTXO outpoint but blindly appends all leave outputs. This creates one input and multiple full-value outputs for the same VTXO, causing the later balance check to fail. Because the wallet releases reservations only when RegisterIntentMsg immediately returns an error, an asynchronous FSM failure can leave the VTXO stuck in PendingForfeit until manual recovery/unroll/expiry handling. A local caller, exposed RPC client, or buggy agent can therefore cause a fund-liveness denial of service by submitting the same outpoint twice, or by submitting an already queued outpoint again before round registration.
severity: medium
status: new
detected_at: 2026-05-12T16:51:06.638725Z
committed_at: 2026-04-25 15:36:41 -0700
author_email: laolu32@gmail.com
assignee_name: 
assignee_email: 
has_patch: false
configured_scan_id: user-SFHXEfRY6GFhQZ5usE2FvSk3:github-1095286530
commit_hash: 7a16f843f0499b39d1fcfde4b3482a12300046c3
relevant_paths: darepod/rpc_server.go | wallet/wallet.go | vtxo/manager.go | round/transitions.go
resolution_reason: 

Start in darepod/rpc_server.go and trace LeaveVTXOs through wallet/wallet.go, vtxo/manager.go, and round/transitions.go. Verify how duplicate outpoints move through reservation and round registration, then confirm completion by checking that duplicate requests cannot produce stranded VTXOs. The finding is unvalidated and no test location is provided, so inspect existing LeaveVTXOs and round tests before making changes.