wallet: [rpc] Assert hit when re-processing nonce-less MuSig2 PSBT #35250

issue maflcko opened this issue on May 9, 2026

maflcko commented at 5:45 AM on May 9, 2026: member

I haven't tested this myself, but according to #35155#issue-4325462881 this can be reproduced :

On master (2d5ab09f0d at the time of testing):

# In regtest with wallet support:
# 1. create two descriptor wallets (musig_p0, musig_p1)
# 2. import tr(musig(priv0/<0;1>/*,pub1/<2;3>/*)) into wallet 0
# 3. fund the musig address and confirm
# 4. walletcreatefundedpsbt -> nonce-less MuSig2 PSBT
# 5. walletprocesspsbt $PSBT        # first call: complete=false, stores secnonce
# 6. walletprocesspsbt $PSBT        # second call on original PSBT: Assert(inserted), process aborts

Found by Claude during an automated review conducted by Anthropic; manually validated and patched by Trail of Bits. Reference: ANT-2026-05771.

maflcko added the label Wallet on May 9, 2026
maflcko added the label RPC/REST/ZMQ on May 9, 2026

Contributors

maflcko

Labels

Wallet RPC/REST/ZMQ

Linked (view graph)

#35155 wallet: allow re-processing nonce-less MuSig2 PSBT