Watchonly descriptor wallets classifying funds as `mine`, are "spendable" #21104

<!-- This issue tracker is only for technical issues related to Bitcoin Core. General bitcoin questions and/or support requests are best directed to the Bitcoin StackExchange at https://bitcoin.stackexchange.com. For reporting security issues, please read instructions at https://bitcoincore.org/en/contact/. If the node is "stuck" during sync or giving "block checksum mismatch" errors, please ensure your hardware is stable by running memtest and observe CPU temperature with a load-test tool such as linpack before creating an issue! -->

<!-- Describe the issue -->

Expected behavior

I'd expect funds in a watchonly wallet to be shown as "watchonly", be unspendable.

Actual behavior

Funds are shown as "mine" in getbalances, can be "spent" (sendtoaddress completes without error, however transaction is unspent and fails to enter mempool. Balance is incorrectly decremented)

To reproduce

Make a watchonly descriptor wallet.

bitcoin-cli createwallet w2 true true "" true true false 

Load up a descriptor that's got some funds on it.

$ bitcoin-cli -rpcwallet=w2 importdescriptors '[{"desc":"wpkh(tpubD6NzVbkrYhZ4Wh1z2cvkzQsM12k9kvyMMrGXi7rdk5eyUYUFND1qhB1zEZ3pJwSSSGLYsKfZLKNvs4L7oqNb8vJj3zJTvxMRCKWsNhX9JXQ/*)#86kup682", "timestamp":"now","active":true,"range":100}]'

See the balance.

$ bitcoin-cli -rpcwallet=w2 getbalances
{
  "mine": {
    "trusted": 3.00000000,
    "untrusted_pending": 3.00000000,
    "immature": 0.00000000,
    "used": 0.00000000
  }
}

Spend the balance.

$ bitcoin-cli -rpcwallet=w2 sendtoaddress bcrt1qnk09yy5ayyhwvfydg2x58zwy443pjx5uesg9gw 3.0 "" "" true
90bce182f476376e6cf3552e234c686ce5bfee4d47739081f5cba90de374156b

See the balance update.

$ bitcoin-cli -rpcwallet=w2 getbalances
{
  "mine": {
    "trusted": 0.00000000,
    "untrusted_pending": 0.00000000,
    "immature": 0.00000000,
    "used": 3.00000000
  }
}

Not in the mempool though

$ bitcoin-cli getmempoolentry 90bce182f476376e6cf3552e234c686ce5bfee4d47739081f5cba90de374156b
error code: -5
error message:
Transaction not in mempool

System information

Bitcoin Core version v0.21.0

<!-- What version of Bitcoin Core are you using, where did you get it (website, self-compiled, etc)? -->

<!-- What type of machine are you observing the error on (OS/CPU and disk type)? -->

<!-- GUI-related issue? What is your operating system and its version? If Linux, what is your desktop environment and graphical shell? -->

<!-- Any extra information that might be useful in the debugging process. -->

<!--- This is normally the contents of a `debug.log` or `config.log` file. Raw text or a link to a pastebin type site are preferred. -->

cc @achow101

I've started reading wallet code in order to hopefully fix this, but if it is or becomes urgent then someone who already knows how should do it instead.

I believe that the fact that the funds are listed as spendable is expected (descriptor wallets don't distinguish between watchonly and spendable funds; if you want separate balances, create separate wallets). I can't explain why sending doesn't error, or reduces available funds, though.

ping @achow101

The funds being shown as spendable is intended behavior. However sendtoaddress (and sendmany) should not actually be creating a transaction when private keys are not available. #21201 should fix this.

@achow101 What if you have a wallet that doesn't have private keys disabled, but has a descriptor without private keys (or with insufficient private keys) imported. Is there a risk that sendtoaddress would still "succeed"?

@sipa it shouldn't be possible to import a descriptor without private keys to a wallet with private keys enabled.