diff --git a/docs/release-notes/release-notes-0.15.0.md b/docs/release-notes/release-notes-0.15.0.md index 2358cc8e9..140908d69 100644 --- a/docs/release-notes/release-notes-0.15.0.md +++ b/docs/release-notes/release-notes-0.15.0.md @@ -106,6 +106,8 @@ * [Add ForAll implementation for etcd to speed up graph cache at startup](https://github.com/lightningnetwork/lnd/pull/6136) +* [Improve validation of a PSBT packet when handling a request to finalize it.](https://github.com/lightningnetwork/lnd/pull/6217) + ## Documentation * Improved instructions on [how to build lnd for mobile](https://github.com/lightningnetwork/lnd/pull/6085). diff --git a/lnrpc/walletrpc/walletkit_server.go b/lnrpc/walletrpc/walletkit_server.go index da952a743..15f2bd798 100644 --- a/lnrpc/walletrpc/walletkit_server.go +++ b/lnrpc/walletrpc/walletkit_server.go @@ -1254,8 +1254,7 @@ func (w *WalletKit) FinalizePsbt(_ context.Context, account = req.Account } - // Parse the funded PSBT. No additional checks are required at this - // level as the wallet will perform all of them. + // Parse the funded PSBT. packet, err := psbt.NewFromRawBytes( bytes.NewReader(req.FundedPsbt), false, ) @@ -1263,6 +1262,12 @@ func (w *WalletKit) FinalizePsbt(_ context.Context, return nil, fmt.Errorf("error parsing PSBT: %v", err) } + // The only check done at this level is to validate that the PSBT is + // not complete. The wallet performs all other checks. + if packet.IsComplete() { + return nil, fmt.Errorf("PSBT is already fully signed") + } + // Let the wallet do the heavy lifting. This will sign all inputs that // we have the UTXO for. If some inputs can't be signed and don't have // witness data attached, this will fail.