@exodus/bitcoin-api 4.15.2 → 4.15.4

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.15.4](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.15.3...@exodus/bitcoin-api@4.15.4) (2026-05-28)
+
+
+### Bug Fixes
+
+
+* fix: fail fast on mismatched PSBT non-witness UTXOs (#8148)
+
+
+
+## [4.15.3](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.15.2...@exodus/bitcoin-api@4.15.3) (2026-05-27)
+
+
+### Bug Fixes
+
+
+* fix: reject duplicate keys with swapped polarity for P2TR multisig (#8124)
+
+
+
 ## [4.15.2](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.15.1...@exodus/bitcoin-api@4.15.2) (2026-05-27)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/bitcoin-api",
-  "version": "4.15.2",
+  "version": "4.15.4",
   "description": "Bitcoin transaction and fee monitors, RPC with the blockchain node, other networking code.",
   "type": "module",
   "main": "src/index.js",
@@ -63,5 +63,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "c5d3a519f291e17f6b95cb0804e6d86d71be1dd8"
+  "gitHead": "a2a294de9468382e1c3bbdebf6db6eea2bea4b1c"
 }

package/src/multisig-address.js

@@ -39,10 +39,6 @@ export const createEncodeMultisigContract =
       throw new Error(`asset.encodeMultisigContract supports from 1 to ${MAX_PUBKEYS} pubKeys`)
     }
 
-    if (new Set(publicKeys.map((k) => k.toString('hex'))).size !== publicKeys.length) {
-      throw new Error('publicKeys must not contain any duplicates')
-    }
-
     if (!Number.isSafeInteger(version)) {
       throw new TypeError('asset.encodeMultisigContract requires meta.version to be an integer')
     }
@@ -62,17 +58,23 @@ export const createEncodeMultisigContract =
       throw new Error('threshold must be <= publicKeys.length')
     }
 
+    const publicKeysXOnly = publicKeys.map(toXOnly)
+
+    if (new Set(publicKeysXOnly.map((k) => k.toString('hex'))).size !== publicKeysXOnly.length) {
+      throw new Error('publicKeys must not contain any duplicates')
+    }
+
     // Sort according to BIP67 https://github.com/bitcoin/bips/blob/master/bip-0067.mediawiki
-    publicKeys.sort((a, b) => Buffer.compare(toXOnly(a), toXOnly(b)))
+    publicKeysXOnly.sort((a, b) => Buffer.compare(a, b))
 
     // Create multisig redeem script https://github.com/bitcoin/bips/blob/master/bip-0342.mediawiki#cite_note-5
     const OPS = bitcoinjsLib.script.OPS
     const chunks = []
-    const keysIter = publicKeys[Symbol.iterator]()
+    const keysXOnlyIter = publicKeysXOnly[Symbol.iterator]()
 
-    chunks.push(toXOnly(keysIter.next().value), OPS.OP_CHECKSIG)
-    for (const key of keysIter) {
-      chunks.push(toXOnly(key), OPS.OP_CHECKSIGADD)
+    chunks.push(keysXOnlyIter.next().value, OPS.OP_CHECKSIG)
+    for (const key of keysXOnlyIter) {
+      chunks.push(key, OPS.OP_CHECKSIGADD)
     }
 
     chunks.push(Buffer.from([threshold]), OPS.OP_NUMEQUAL)

package/src/psbt-parser.js

@@ -14,6 +14,14 @@ import { getUsableUtxos, getUtxos } from './utxos-utils.js'
 function extractInputUtxoData(psbtInput, txInput, index, Transaction) {
   if (psbtInput.nonWitnessUtxo) {
     const prevTx = Transaction.fromBuffer(psbtInput.nonWitnessUtxo)
+    const prevoutHash = txInput.hash
+    const utxoHash = prevTx.getHash()
+    if (!prevoutHash.equals(utxoHash)) {
+      throw new Error(
+        `Non-witness UTXO hash for input #${index} doesn't match the hash specified in the prevout`
+      )
+    }
+
     const prevOutput = prevTx.outs[txInput.index]
 
     return {