wallet: reject input_weights for outpoints not in transaction #34947

1. 
   instagibbs commented at 11:31 pm on March 28, 2026: member

   fundrawtransaction, send, and walletcreatefundedpsbt accept an input_weights parameter that sets the weight for transaction inputs. SetInputWeight uses map::operator[] which silently creates entries in the coin control selection set for outpoints not in the transaction, causing unintended UTXOs to be spent.

   Validate that each input_weights entry corresponds to an actual input in the transaction before setting the weight.

2. wallet: reject input_weights for outpoints not in transaction

   fundrawtransaction, send, and walletcreatefundedpsbt accept an
   input_weights parameter that sets the weight for transaction inputs.
   SetInputWeight uses map::operator[] which silently creates entries
   in the coin control selection set for outpoints not in the
   transaction, causing unintended UTXOs to be spent.
   
   Validate that each input_weights entry corresponds to an actual
   input in the transaction before setting the weight.

   3ded1e5bfb
3. DrahtBot added the label Wallet on Mar 28, 2026
4. 
   DrahtBot commented at 11:31 pm on March 28, 2026: contributor

   The following sections might be updated with supplementary metadata relevant to reviewers and maintainers.

   Reviews

   See the guideline for information on the review process. A summary of reviews will appear here.

5. instagibbs closed this on Mar 28, 2026

   ---

Contributors
instagibbs DrahtBot

Labels
Wallet