{
 "number": 35358,
 "input_hash": "baeb32308b623813",
 "model": "openrouter/google/gemini-3.8-flash",
 "batch": false,
 "created": "2026-09-17T15:52:50+00:00",
 "provider": "Google",
 "stop_reason": "end_turn",
 "usage": {
  "input_tokens": 17956,
  "cache_creation_input_tokens": 0,
  "cache_read_input_tokens": 0,
  "output_tokens": 3470
 },
 "cost_usd": 0.0264795,
 "error": null,
 "result": {
  "display": {
   "goal": [
    "Ensure external hardware signers return the exact requested outputs and safe sighashes before accepting a signed PSBT."
   ],
   "reviewability": [
    "Author inactive for 118 days, and Sjors absorbed this work into #36114.",
    "Reviewers should evaluate #36114 instead."
   ],
   "agreement": [
    "Lukewarm concept approval noting signers are already largely trusted (achow101)",
    "Technical question on ANYONECANPAY resolved in favor of the current design (junbyjun1238, achow101)",
    "Superseded by a broader signer test revamp (Sjors)"
   ],
   "categories": [
    {
     "name": "wallet",
     "why": [
      "P3 because it provides defense-in-depth against buggy or rogue signer bridges altering transaction outputs or sighash flags.",
      "Hardware signers already display outputs on screen, so the failure mode is narrow."
     ]
    }
   ]
  },
  "summary": "Adds a post-signing validation pass in `ExternalSigner::SignTransaction` that compares the signed PSBT against the original PSBT before accepting it. It checks that output counts, amounts, and scripts match, and verifies that no unsafe sighash types (such as SIGHASH_NONE or SIGHASH_SINGLE) were introduced. It also adds mock and functional test coverage in `wallet_signer.py` and `rpc_signer.py`.",
  "problem": "Bitcoind previously accepted signed PSBTs returned by external signers without checking whether outputs were modified or whether weak sighash flags were attached, leaving users vulnerable to rogue or buggy signer software altering transaction details.",
  "discussion": {
   "open_concerns": [],
   "resolved_concerns": [
    "junbyjun1238 asked whether SIGHASH_ANYONECANPAY combined with SIGHASH_ALL should be permitted; achow101 clarified that it remains safe because the wallet's inputs and outputs remain committed to."
   ],
   "author_status": "silent since 2026-05-22"
  },
  "reviewability": {
   "state": "Stale",
   "label": "Review #36114 instead",
   "reason": "The author has been inactive for 118 days, exceeding the 60-day project staleness threshold, and Sjors has absorbed the patch into #36114."
  },
  "agreement": {
   "state": "Positive",
   "summary": "Positive; achow101 gave mild concept support, and Sjors absorbed the change into #36114",
   "reason": "achow101 offered concept approval with mild skepticism about the threat model, while Sjors adopted the implementation directly into PR #36114.",
   "evidence": [
    "achow101 commented: 'Concept OK I guess... I think we generally assume an external signer to be more trusted/secure, so we don't really do checks on their output.'",
    "Sjors commented: 'I absorbed this into #36114, which revamps the external signer mock in a way that makes this stuff easier to test.'"
   ]
  },
  "dependencies": {
   "depends_on": [],
   "enables": [
    "#36114"
   ]
  },
  "categories": [
   {
    "name": "wallet",
    "member": true,
    "evidence": "Touches external signer transaction verification in `src/external_signer.cpp` and wallet signer tests.",
    "band": "P3",
    "reason_tag": "fund safety",
    "score": 0.35,
    "factors": {
     "security_stability": 1,
     "bug_severity": 0,
     "performance": 0,
     "user_value": 1,
     "leverage": 0
    },
    "rationale": "Verifying that external signers did not mutate outputs or inject weak sighash flags provides defense-in-depth against malicious or buggy external signer software. It is ranked P3 because hardware signers are generally trusted to present output data on-device, making this a secondary safety invariant rather than a fix for an active vulnerability."
   },
   {
    "name": "rpc",
    "member": false,
    "evidence": "Does not touch RPC endpoints or RPC infrastructure; changes in `rpc_signer.py` only use existing RPCs to test external signer invariants.",
    "band": "Unranked",
    "reason_tag": "",
    "score": 0,
    "factors": {
     "security_stability": 0,
     "bug_severity": 0,
     "performance": 0,
     "user_value": 0,
     "leverage": 0
    },
    "rationale": "Excluded because no RPC behavior or code is modified."
   }
  ],
  "confidence": "high",
  "uncertainties": [],
  "needs": [],
  "card": "Adds output and sighash invariant validation in ExternalSigner::SignTransaction to ensure external signers cannot alter outputs or attach SIGHASH_NONE. Protects wallet users utilizing hardware or external signers from buggy or rogue signer bridges. achow101 provided concept support noting signers are already considered trusted, while Sjors integrated the patch into #36114. Further review on this PR is unnecessary because the author is inactive and the code has been absorbed into #36114."
 },
 "raw_text": null
}