Don't want to trade it yourself?
Our desk runs DEX portfolios on profit share.
Two vulnerabilities have been found in Bitcoinjs-lib, a Bitcoin application development library, that could understate actual mining fees and bypass safeguards, CryptoSlate reported.
The flaws arise during the handling of partially signed Bitcoin transactions, or PSBTs, a method defined in BIP-174 for passing transaction data and signatures between clients. In a demonstration case, the actual fee was 900 million satoshis, but the library calculated it as 200 satoshis, and no default fee-rate warning was triggered during signature verification or transaction extraction. Another issue showed that if all amount records for confirmed inputs were missing, the fee calculator treated those inputs as zero. BitcoinJS has released patched versions 5.2.2, 6.1.9 and 7.0.4, and recommended that developers update the library and validate PSBT inputs.