]> Untitled Git - bdk/commit
Merge bitcoindevkit/bdk#2188: fix(electrum): verify txid of server-returned transactions
authormerge-script <hello@evanlinjin.me>
Fri, 24 Apr 2026 04:35:57 +0000 (04:35 +0000)
committermerge-script <hello@evanlinjin.me>
Fri, 24 Apr 2026 04:35:57 +0000 (04:35 +0000)
commit8760d872f7c310c32533fbad779f8a353314a6f6
tree0350c4992821f1074276337571c70f71d6ad9a14
parent10d9333ab34a0c10912c732958a48b6269924e91
parentd101a0973bc19ac1b64809c0d9f0cd3516e263d8
Merge bitcoindevkit/bdk#2188: fix(electrum): verify txid of server-returned transactions

d101a0973bc19ac1b64809c0d9f0cd3516e263d8 fix(electrum): verify txid of server-returned transactions (Elias Rohrer)

Pull request description:

  ### Description

  An Electrum server could return an arbitrary transaction when `fetch_tx()` requests a specific txid. The returned transaction was cached and used without verifying that its computed txid matches the requested one.

  Add a verification check that `tx.compute_txid() == txid` after fetching from the server, returning an error on mismatch. Include a unit test with a mock Electrum client that exercises both the mismatch rejection and the matching-txid happy path.

ACKs for top commit:
  evanlinjin:
    ACK d101a0973bc19ac1b64809c0d9f0cd3516e263d8

Tree-SHA512: aecb729fd7d92bf75ec2877b1717eaeed824178d81a5c769a738314326d4a1acddeded3b37837f3af84ca6c69b7c73bff46d901697a8f2125ea1d4c34bef6096