From: merge-script <hello@evanlinjin.me>
Date: Thu, 15 Oct 2026 03:42:01 +0000 (+0000)
Subject: Merge bitcoindevkit/bdk#2316: fix(rpc): verify fetched mempool txids before caching... 
X-Git-Url: http://internal-gitweb-vhost/-client-interface/src/example_cli/encode/database/struct.LegacySighash.html?a=commitdiff_plain;p=bdk

Merge bitcoindevkit/bdk#2316: fix(rpc): verify fetched mempool txids before caching and document trust assumption

0d6fb41ac4a268675193beee31050343331996f8 fix(rpc): verify fetched mempool tx txids (Vihiga Tyonum)

Pull request description:

  ### Description

  This PR adds a check in `Emitter::mempool_at`: when a mempool transaction is fetched with `get_raw_transaction`, its computed txid must match the txid that was requested before it goes into `mempool_snapshot`. This stops an RPC response with the wrong transaction body from being emitted or cached under the requested txid. It also adds module-level documentation stating that `bdk_bitcoind_rpc` assumes a connection to a trusted `bitcoind` node.

  This addresses only the missing txid-validation part of #2282, following discussions on #2283.

  ### Notes to the reviewers

  - On a mismatch the check returns the existing `Error::UnexpectedStructure`, so it is non-breaking. A single mismatch fails the whole poll; callers retry on the next call.
  - Only freshly fetched transactions are checked. Entries already in `mempool_snapshot` were checked when they were inserted.
  - A txid does not commit to witness data, so a transaction served with altered witnesses is not detected. This is documented on `mempool_at`.
  - Out of scope / possible follow-up: `next_block` does not verify that the returned block matches the requested hash, merkle root, or witness commitment.
  - The test uses a mock `RpcApi` that implements only `call`. `serde`/`serde_json` come from the `bitcoincore_rpc::jsonrpc` re-exports, so no new dependencies are added.

  ### Changelog notice

  - `Emitter::mempool`/`mempool_at`: when a mempool transaction is fetched from the node, check that its computed txid matches the requested txid. A mismatch is rejected with `Error::UnexpectedStructure`.
  - Document that `bdk_bitcoind_rpc` assumes a trusted `bitcoind` RPC connection.

  <!-- Notice the release manager should include in the release tag message changelog -->
  <!-- See https://keepachangelog.com/en/1.0.0/ for examples -->

  ### Checklists

  #### All Submissions:

  * [x] I followed the [contribution guidelines](https://github.com/bitcoindevkit/bdk/blob/master/CONTRIBUTING.md)

  #### New Features:

  * [x] I've added tests for the new feature
  * [x] I've added docs for the new feature

  #### Bugfixes:

  * [ ] This pull request breaks the existing API
  * [x] I've added tests to reproduce the issue which are now passing
  * [x] I'm linking the issue being fixed by this PR

ACKs for top commit:
  evanlinjin:
    ACK 0d6fb41ac4a268675193beee31050343331996f8

Tree-SHA512: 2910133931cb8e504c54e5465957e4674ee5ba0b98ee303db1409b643e34413ec17d9f2213883fe504632eb09c7114a2ebf7571b3f07d1a36daae6cb4f82909a
---

bc9e873995b830caa428adbb569085144a00218d