Internal bug detected: FinalizeAndExtractPSBT(psbtx

ekrembal commented at 1:57 pm on July 1, 2025: none

Is there an existing issue for this?

I have searched the existing issues

Current behaviour

0bitcoin-cli -testnet4 descriptorprocesspsbt cHNidP8BAF4CAAAAAfrAU8xRZDY7er/kAUGzVtup++LN4otxeOtANj9Tw8xYAAAAAAD9////AeAPlwAAAAAAIlEgmQIRpk7kW78uK6z/DBX37H4Pi4OLy3Fau0pXquQSXLUAAAAAAAEBK4CWmAAAAAAAIlEg5cugS+vKVwm3OSTEr0sIVU/ahEJzIS6iXjsvWNwJ0VUBAwSDAAAAAQhDAUFATOMkSjzzD+7k1AnzZgJ+G+sDZXX5ob0tlQ9mZIseDe73u4fU6SPKdtxve2Wm/mVNrRIP5cPEnkcMv0BJ2iIWgyEWtJa/uuFJh4F8U9WSvgqmbEXHuURDwfdFUTc/nONNI0YZAP/2NCNWAACAAAAAgAAAAIAAAAAAAAAAAAEXILSWv7rhSYeBfFPVkr4KpmxFx7lEQ8H3RVE3P5zjTSNGAAA= "[\"tr([fff63423/86'/0'/0']tpubDDfvptb1GNdu4TRUUNf9bwsFFpHADAmwaB3uoC8ukv5JMsYPzEc3E6yg4w8t49Wq7jtL8LC3VPmuhXoSJxpamWDPfphAz3Fioki3WerwH3Y/0/0)#twc4a4lc\"]"
1error code: -1
2error message:
3Internal bug detected: FinalizeAndExtractPSBT(psbtx_copy, mtx)
4rpc/rawtransaction.cpp:1986 (operator())
5Bitcoin Core v29.0.0
6Please report this issue here: https://github.com/bitcoin/bitcoin/issues

Expected behaviour

This should give an error maybe stating that the signature inside the final_scriptwitness is an invalid schnorr signature. Please note that the signature inside the psbt uses SIGHASH_SINGLE | ANYONECANPAY flag

Steps to reproduce

The same command should work on any local regtest or testnet4.

Relevant log output

No response

How did you obtain Bitcoin Core

Pre-built binaries

What version of Bitcoin Core are you using?

v29.0.0

Operating system and version

macOS Sequoia 15.1.1

Machine specifications

No response

maflcko commented at 5:55 am on July 2, 2025: member

uploaded to oss-fuzz (https://issues.oss-fuzz.com/issues/429003360) to get a regression range: https://github.com/bitcoin/bitcoin/compare/b000ed5ee54438efb72e190262faeb535489d35d...ac9fa6ec78158e41006d621ee62e44dec0f934c0 (exists since the beginning, when the line was added)

maflcko added the label Bug on Jul 2, 2025

maflcko added the label RPC/REST/ZMQ on Jul 2, 2025

b-l-u-e commented at 7:48 am on July 5, 2025: none

Hi @ekrembal,

I’ve analyzed this issue. The “Internal bug detected” error occurs because descriptorprocesspsbt uses PSBTInputSigned() which only checks for signature presence, not validity.

Root Cause

In src/rpc/rawtransaction.cpp around lines 2092-2094:

0bool complete = true;
1for (const auto& input : psbtx.inputs) {
2    complete &= PSBTInputSigned(input);  // ❌ Only checks presence, not validity
3}

When complete is true, the code calls CHECK_NONFATAL(FinalizeAndExtractPSBT(...)), but FinalizeAndExtractPSBT eventually fails signature verification, causing the internal bug.

Suggestion fix

Replace with PSBTInputSignedAndVerified to actually verify signatures:

0bool complete = true;
1const PrecomputedTransactionData txdata = PrecomputePSBTData(psbtx);
2for (unsigned int i = 0; i < psbtx.inputs.size(); ++i) {
3    complete &= PSBTInputSignedAndVerified(psbtx, i, &txdata);
4}

Test Results

After implementing the fix, the problematic PSBT returns:

0{
1  "psbt": "cHNidP8BAF4CAAAAAfrAU8xRZDY7er/kAUGzVtup++LN4otxeOtANj9Tw8xYAAAAAAD9////AeAPlwAAAAAAIlEgmQIRpk7kW78uK6z/DBX37H4Pi4OLy3Fau0pXquQSXLUAAAAAAAEBK4CWmAAAAAAAIlEg5cugS+vKVwm3OSTEr0sIVU/ahEJzIS6iXjsvWNwJ0VUBCEMBQUBM4yRKPPMP7uTUCfNmAn4b6wNldfmhvS2VD2Zkix4N7ve7h9TpI8p23G97Zab+ZU2tEg/lw8SeRwy/QEnaIhaDAAA=",
2  "complete": false
3}

Internal bug detected: FinalizeAndExtractPSBT(psbtx_copy, mtx) #32849