@exodus/bitcoin-api 4.15.4 → 4.15.6

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.15.6](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.15.5...@exodus/bitcoin-api@4.15.6) (2026-06-03)
+
+
+### Bug Fixes
+
+
+* fix: remove stale stored UTXOs during refresh (#8184)
+
+
+
+## [4.15.5](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.15.4...@exodus/bitcoin-api@4.15.5) (2026-06-02)
+
+
+### Bug Fixes
+
+
+* fix: restrict unsafe non-segwit signing to internal LTC PSBTs (#8172)
+
+
+
 ## [4.15.4](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.15.3...@exodus/bitcoin-api@4.15.4) (2026-05-28)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/bitcoin-api",
-  "version": "4.15.4",
+  "version": "4.15.6",
   "description": "Bitcoin transaction and fee monitors, RPC with the blockchain node, other networking code.",
   "type": "module",
   "main": "src/index.js",
@@ -63,5 +63,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "a2a294de9468382e1c3bbdebf6db6eea2bea4b1c"
+  "gitHead": "c19821f0073cd61c5e2a6b07c962165e8ee77416"
 }

package/src/move-funds.js

@@ -162,6 +162,7 @@ export const moveFundsFactory = ({
       },
       txMeta: {
         addressPathsMap: utxos.getAddressPathsMap(),
+        psbtOrigin: 'internal',
       },
     }
     const nonWitnessTxs = await getNonWitnessTxs(

package/src/psbt-utils.js

@@ -118,10 +118,9 @@ export const createPsbtToUnsignedTx =
   }
 
 /**
- * Temporarily turns on __UNSAFE_SIGN_NONSEGWIT so we can sign or validate PSBTs
- * whose legacy inputs are missing nonWitnessUtxo.
+ * Temporarily sets __UNSAFE_SIGN_NONSEGWIT for explicitly allowed internal fallbacks.
  */
-export async function withUnsafeNonSegwit({ psbt, fn, unsafe = true }) {
+export async function withUnsafeNonSegwit({ psbt, fn, unsafe = false }) {
   const cache = psbt.__CACHE
   const prevValue = cache.__UNSAFE_SIGN_NONSEGWIT
   cache.__UNSAFE_SIGN_NONSEGWIT = unsafe

package/src/tx-create/create-tx.js

@@ -339,6 +339,7 @@ async function createUnsignedTx({
       Transaction,
     })
 
+    result.txMeta.psbtOrigin = 'internal'
     result.txData.psbtBuffer = psbt.toBuffer()
   }
 

package/src/tx-log/bitcoin-monitor-scanner.js

@@ -258,6 +258,14 @@ export class BitcoinMonitorScanner {
     // newChains moves receive to 7. The second loop then scans receive 8..12
     // and change 7..7. This keeps expanding until the fetched address batch has no txs.
     let allTxs = []
+    const scannedAddressSet = new Set()
+    const fetchStoredUtxoAddressTxs = async ({ storedUtxoAddresses }) => {
+      const storedOnlyAddresses = [...storedUtxoAddresses].filter(
+        (storedUtxoAddress) => !scannedAddressSet.has(storedUtxoAddress)
+      )
+      return fetchAllTxs(storedOnlyAddresses)
+    }
+
     for (let fetchCount = 0; ; fetchCount++) {
       const chainObjects = gapSearchParameters.flatMap(
         ({ purpose, chain, startAddressIndexes, endAddressIndexes }) => {
@@ -289,6 +297,7 @@ export class BitcoinMonitorScanner {
       }
 
       const addresses = await aggregateAddresses(chainObjects)
+      addresses.forEach((address) => scannedAddressSet.add(address))
 
       if (fetchCount === 0) {
         // in compatibility mode, the receive address could be different
@@ -299,6 +308,7 @@ export class BitcoinMonitorScanner {
         })
         if (!addresses.includes(receiveAddress.toString())) {
           addresses.push(receiveAddress.toString())
+          scannedAddressSet.add(receiveAddress.toString())
           addrMap[receiveAddress.toString()] = receiveAddress
         }
       }
@@ -370,6 +380,16 @@ export class BitcoinMonitorScanner {
     }
 
     allTxs = orderTxs(allTxs)
+    let storedUtxoAddressTxs = []
+    if (refresh) {
+      const storedUtxoAddresses = new Set(
+        storedUtxos
+          .toArray()
+          .map((utxo) => utxo.address?.toString())
+          .filter(Boolean)
+      )
+      storedUtxoAddressTxs = await fetchStoredUtxoAddressTxs({ storedUtxoAddresses })
+    }
 
     // post process TX data
     // NOTE: this can be optimized
@@ -379,6 +399,14 @@ export class BitcoinMonitorScanner {
     const newTxs = []
     const existingTxs = []
 
+    storedUtxoAddressTxs.forEach((txItem) => {
+      txItem.vin.forEach((vin) => {
+        if (Object.keys(vin).length === 0) return
+
+        vinTxids[`${vin.txid}-${vin.vout}`] = true
+      })
+    })
+
     allTxs.forEach((txItem) => {
       const isCoinbase = txItem.vin.length === 0
 

package/src/tx-sign/create-sign-with-wallet.js

@@ -14,6 +14,7 @@ export function createSignWithWallet({
   coinInfo,
   getKeyIdentifier,
   getPrivateKeyFromMap,
+  allowUnsafeNonSegwit = false,
 }) {
   const getKeyWithMetadata = createGetKeyWithMetadata({
     signer,
@@ -90,6 +91,7 @@ export function createSignWithWallet({
     await withUnsafeNonSegwit({
       psbt,
       fn: () => Promise.all(signingPromises.map((sign) => sign())),
+      unsafe: allowUnsafeNonSegwit,
     })
   }
 }

package/src/tx-sign/default-create-tx.js

@@ -12,6 +12,7 @@ export const signTxFactory = ({
   network,
   getKeyIdentifier,
   getPrivateKeyFromMap,
+  allowUnsafeNonSegwitSigning = false,
   Psbt = DefaultPsbt,
   Transaction = DefaultTransaction,
 }) => {
@@ -39,6 +40,8 @@ export const signTxFactory = ({
     const psbt = prepareForSigning({ unsignedTx })
 
     const inputsToSign = unsignedTx.txMeta.inputsToSign || unsignedTx.txData.inputs
+    const allowUnsafeNonSegwit =
+      allowUnsafeNonSegwitSigning && unsignedTx.txMeta.psbtOrigin === 'internal'
     const signWithWallet = createSignWithWallet({
       signer,
       hdkeys,
@@ -48,6 +51,7 @@ export const signTxFactory = ({
       addressPathsMap,
       coinInfo,
       network,
+      allowUnsafeNonSegwit,
       getKeyIdentifier: (args) => {
         assert(
           !('accountIndex' in args) || args.accountIndex === accountIndex,

package/src/tx-sign/default-prepare-for-signing.js

@@ -130,9 +130,7 @@ function createPsbtFromTxData({
       if (canParseTx(Transaction, rawTxBuffer)) {
         txIn.nonWitnessUtxo = rawTxBuffer
       } else {
-        // temp fix for https://exodusio.slack.com/archives/CP202D90Q/p1671014704829939 until bitcoinjs could parse a mweb tx without failing
-        console.warn(`Setting psbt.__CACHE.__UNSAFE_SIGN_NONSEGWIT = true for asset ${assetName}`)
-        psbt.__CACHE.__UNSAFE_SIGN_NONSEGWIT = true
+        console.warn(`Falling back to witnessUtxo for unparseable previous tx on ${assetName}`)
         txIn.witnessUtxo = {
           value: normalizeWitnessUtxoValue(value),
           script: Buffer.from(script, 'hex'),