@exodus/bitcoin-api 4.9.3 → 4.9.4

package/CHANGELOG.md

@@ -3,6 +3,24 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.9.4](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.9.3...@exodus/bitcoin-api@4.9.4) (2026-02-10)
+
+
+### Bug Fixes
+
+
+* fix(bitcoin-api): Fix empty UTXO selection in BTC sends (#7370)
+
+* fix(bitcoin-api): Gate send-all RBF eligibility (#7373)
+
+* fix(bitcoin-api): Refine bump UTXO selection controls (#7372)
+
+* fix(bitcoin-api): Replace changeAddress with internalOutputs (#7378)
+
+* fix(bitcoin-api): Tighten RBF send-all replacement eligibility (#7371)
+
+
+
 ## [4.9.3](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.9.2...@exodus/bitcoin-api@4.9.3) (2026-01-30)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/bitcoin-api",
-  "version": "4.9.3",
+  "version": "4.9.4",
   "description": "Bitcoin transaction and fee monitors, RPC with the blockchain node, other networking code.",
   "type": "module",
   "main": "src/index.js",
@@ -61,5 +61,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "536e8318e84aa9a812191ff81f3ddd70a518885e"
+  "gitHead": "b4d4b4bf36591dca5c82bfacfbac80db41805e02"
 }

package/src/fee/can-bump-tx.js

@@ -80,8 +80,13 @@ const _canBumpTx = ({
     return { errorMessage: 'already confirmed' }
   }
 
-  // Can't bump an rbf tx if change is already spent
-  if (bumpTx && bumpTx.data.changeAddress && changeUtxos.size === 0) {
+  // Can't RBF-bump if any internal output is already spent.
+  // Replacing would conflict with the child tx that spent the original output.
+  if (
+    bumpTx &&
+    ((bumpTx.data.internalOutputs && bumpTx.data.internalOutputs.length > changeUtxos.size) ||
+      (bumpTx.data.changeAddress && changeUtxos.size === 0))
+  ) {
     return {
       errorMessage: 'already spent',
     }
@@ -100,25 +105,30 @@ const _canBumpTx = ({
       utxosDescendingOrder,
       taprootInputWitnessSize,
       changeAddressType,
+      isBumpTx: true,
     })
     if (replaceTx) return { bumpType: BumpType.RBF, bumpFee: fee.sub(replaceTx.feeAmount) }
   }
 
-  const { fee } = selectUtxos({
+  const { selectedUtxos, fee } = selectUtxos({
     asset,
     usableUtxos,
     feeRate,
     receiveAddress: changeAddressType,
     getFeeEstimator,
-    mustSpendUtxos: changeUtxos,
+    spendUtxos: changeUtxos,
+    forceSpendUtxos: true,
     allowUnconfirmedRbfEnabledUtxos,
     unconfirmedTxAncestor,
     utxosDescendingOrder,
     taprootInputWitnessSize,
     changeAddressType,
+    isBumpTx: true,
   })
 
-  return fee ? { bumpType: BumpType.CPFP, bumpFee: fee } : { errorMessage: 'insufficient funds' }
+  return selectedUtxos?.size
+    ? { bumpType: BumpType.CPFP, bumpFee: fee }
+    : { errorMessage: 'insufficient funds' }
 }
 
 const validateIsNumber = (number, name) => {

package/src/fee/utxo-selector.js

@@ -18,6 +18,19 @@ const getBestReceiveAddresses = ({ asset, receiveAddress }) => {
   return ['bitcoin', 'bitcoinregtest', 'bitcointestnet'].includes(asset.name) ? 'P2WSH' : 'P2PKH'
 }
 
+// Send-all replacement is limited to a single replaceable tx in this implementation.
+// Multi-tx RBF is possible, but we don't implement it here due to complexity.
+// We also require all unconfirmed UTXOs to belong to that tx to avoid leftover
+// unconfirmed balance.
+const canReplaceSendAll = ({ isSendAll, usableUtxos, confirmedUtxosArray, replaceableTxs }) => {
+  if (!isSendAll) return true
+  if (!replaceableTxs || replaceableTxs.length !== 1) return false
+
+  const unconfirmedUtxoCount = usableUtxos.size - confirmedUtxosArray.length
+  const replaceableTxUtxoCount = usableUtxos.getTxIdUtxos(replaceableTxs[0].txId).size
+  return unconfirmedUtxoCount === replaceableTxUtxoCount
+}
+
 export const selectUtxos = ({
   asset,
   utxosDescendingOrder,
@@ -30,7 +43,9 @@ export const selectUtxos = ({
   isSendAll,
   getFeeEstimator,
   disableReplacement = false,
-  mustSpendUtxos,
+  spendUtxos,
+  forceSpendUtxos = false,
+  isBumpTx = false,
   allowUnconfirmedRbfEnabledUtxos,
   unconfirmedTxAncestor,
   taprootInputWitnessSize,
@@ -53,20 +68,53 @@ export const selectUtxos = ({
   const { currency } = asset
   if (!amount) amount = currency.ZERO
 
-  // We can only replace for a sendAll if only 1 replaceable tx and no unconfirmed utxos
   const confirmedUtxosArray = getConfirmedUtxos({ asset, utxos: usableUtxos }).toArray()
   const canReplace =
-    !mustSpendUtxos &&
+    !forceSpendUtxos &&
     !disableReplacement &&
     replaceableTxs &&
-    (!isSendAll ||
-      (replaceableTxs.length === 1 && confirmedUtxosArray.length === usableUtxos.size - 1))
+    canReplaceSendAll({ isSendAll, usableUtxos, confirmedUtxosArray, replaceableTxs })
 
   if (canReplace) {
     for (const tx of replaceableTxs) {
+      // We do not RBF‑replace transactions with no external (sent) outputs (self‑sends).
+      //
+      // Reason: if the original replaceable tx was created outside this wallet,
+      // we do not have the original intent metadata that tells us which internal
+      // output was the user’s destination and which output was wallet‑generated
+      // change.
+      //
+      // This ambiguity is real:
+      // - A user can intentionally self‑send to a change address, and the wallet
+      //   can still add another change output, resulting in multiple change outputs.
+      // - In single‑address mode, receive and change resolve to the same address,
+      //   so outputs are indistinguishable.
+      //
+      // If we keep all internal outputs (change and self send outputs) during replacement, the tx grows, fees
+      // increase, and the user sees multiple internal outputs (confusing UX).
+      // If we treat any internal output as change via heuristics, we can violate user intent.
+      //
+      // Our solution:
+      // To avoid incorrect behavior and confusing UX, we do not RBF‑replace
+      // self‑send transactions. We instead attempt to fee‑bump them via chaining
+      // (CPFP) when possible.
+      //
+      // During replacement, internal outputs are removed and their output values are treated
+      // as inputs of the new transaction;
+      if (tx.data.sent.length === 0) continue
+
       const changeUtxos = usableUtxos.getTxIdUtxos(tx.txId)
-      // Don't replace a tx that has already been spent
-      if (tx.data.changeAddress && changeUtxos.size === 0) continue
+
+      // Do not replace a tx if any of its UTXOs were already spent by another tx.
+      // Replacing would conflict with the child tx that spent the original output.
+      // Use changeAddress as a legacy fallback for txs created before internalOutputs were introduced.
+      if (
+        (tx.data.internalOutputs && tx.data.internalOutputs.length > changeUtxos.size) ||
+        (tx.data.changeAddress && changeUtxos.size === 0)
+      ) {
+        continue
+      }
+
       const feePerKB =
         tx.data.feePerKB + MIN_RELAY_FEE > feeRate.toBaseNumber()
           ? currency.baseUnit(tx.data.feePerKB + MIN_RELAY_FEE)
@@ -125,7 +173,7 @@ export const selectUtxos = ({
         }
       }
 
-      if (isSendAll || replaceTxAmount.add(additionalUtxos.value).gte(amount.add(fee))) {
+      if (replaceTxAmount.add(additionalUtxos.value).gte(amount.add(fee))) {
         const chainOutputs = isSendAll ? receiveAddresses : [...receiveAddresses, changeAddressType]
         const chainFee = feeEstimator({
           inputs: changeUtxos.union(additionalUtxos),
@@ -133,8 +181,11 @@ export const selectUtxos = ({
           taprootInputWitnessSize,
         })
         // If batching is same or more expensive than chaining, don't replace
-        // Unless we are accelerating a changeless tx, then we must replace because it can't be chained
-        if ((!amount.isZero || tx.data.changeAddress) && fee.sub(tx.feeAmount).gte(chainFee)) {
+        // Unless we are accelerating a tx with no internal outputs, then we must replace because it can't be chained
+        if (
+          (!isBumpTx || tx.data.internalOutputs?.length || tx.data.changeAddress) &&
+          fee.sub(tx.feeAmount).gte(chainFee)
+        ) {
           continue
         }
 
@@ -143,13 +194,19 @@ export const selectUtxos = ({
     }
   }
 
-  if (!mustSpendUtxos) mustSpendUtxos = UtxoCollection.createEmpty({ currency })
+  // For bumping: if RBF is not possible, the only valid path is CPFP,
+  // and only if spendUtxos are available.
+  if (isBumpTx && !spendUtxos?.size) {
+    return { selectedUtxos: undefined, fee: undefined, replaceTx: undefined }
+  }
+
+  if (!spendUtxos) spendUtxos = UtxoCollection.createEmpty({ currency })
 
   // We can still spend our rbf utxos, but put them last
   let ourRbfUtxos = UtxoCollection.createEmpty({ currency })
   if (replaceableTxs) {
     for (const tx of replaceableTxs) {
-      if (!tx.data.changeAddress) continue
+      if (!tx.data.internalOutputs?.length && !tx.data.changeAddress) continue
       const changeUtxos = usableUtxos.getTxIdUtxos(tx.txId)
       ourRbfUtxos = ourRbfUtxos.union(changeUtxos)
     }
@@ -181,14 +238,14 @@ export const selectUtxos = ({
   }
 
   // quickly add utxos to get to amount before starting to figure out fees, the minimum place to start is as much as the amount
-  const selectedUtxosArray = mustSpendUtxos.toArray()
+  const selectedUtxosArray = spendUtxos.toArray()
   let selectedUtxosValue = selectedUtxosArray.reduce(
     (total, utxo) => total.add(utxo.value),
     currency.ZERO
   )
   const remainingUtxosArray = _toPriorityOrderedArray({
     utxosDescendingOrder,
-    utxos: spendableUtxos.union(ourRbfUtxos).difference(mustSpendUtxos),
+    utxos: spendableUtxos.union(ourRbfUtxos).difference(spendUtxos),
   })
 
   while (selectedUtxosValue.lte(amount) && remainingUtxosArray.length > 0) {
@@ -238,7 +295,8 @@ export const getUtxosData = ({
   isSendAll,
   getFeeEstimator,
   disableReplacement,
-  mustSpendUtxos,
+  spendUtxos,
+  forceSpendUtxos,
   allowUnconfirmedRbfEnabledUtxos,
   unconfirmedTxAncestor,
   utxosDescendingOrder,
@@ -259,7 +317,8 @@ export const getUtxosData = ({
     isSendAll,
     getFeeEstimator,
     disableReplacement,
-    mustSpendUtxos,
+    spendUtxos,
+    forceSpendUtxos,
     allowUnconfirmedRbfEnabledUtxos,
     unconfirmedTxAncestor,
     utxosDescendingOrder,
@@ -280,7 +339,7 @@ export const getUtxosData = ({
 
   const spendableBalance = spendableUtxos.value
 
-  const extraFeeCpfp = selectedUtxos
+  const extraFeeCpfp = selectedUtxos?.size
     ? asset.currency.baseUnit(
         getExtraFee({
           asset,

package/src/tx-create/create-tx.js

@@ -90,24 +90,26 @@ function processAddress({ asset, toAddress }) {
 // Determine strategy for transaction bumping (RBF vs CPFP)
 function determineBumpStrategy({ bumpTxId, replaceableTxs, usableUtxos }) {
   if (!bumpTxId) {
-    return { replaceableTxs, utxosToBump: undefined }
+    return { replaceableTxs, utxosToBump: undefined, forceUtxosToBump: false }
   }
 
+  const utxosToBump = usableUtxos.getTxIdUtxos(bumpTxId)
+
   // Check if we can use RBF (Replace-By-Fee)
   const bumpTx = replaceableTxs.find(({ txId }) => txId === bumpTxId)
 
   if (bumpTx) {
-    // Use RBF: replace the transaction directly
-    return { replaceableTxs: [bumpTx], utxosToBump: undefined }
+    // Use RBF: replace the transaction directly.
+    // If CPFP is cheaper, then we will use that instead of RBF.
+    return { replaceableTxs: [bumpTx], utxosToBump, forceUtxosToBump: false }
   }
 
-  // Otherwise try CPFP (Child-Pays-For-Parent) by spending the transaction's outputs
-  const utxosToBump = usableUtxos.getTxIdUtxos(bumpTxId)
+  // Otherwise only option is to try CPFP (Child-Pays-For-Parent) by spending the transaction's outputs
   if (utxosToBump.size === 0) {
     throw new Error(`Cannot bump transaction ${bumpTxId}`)
   }
 
-  return { replaceableTxs: [], utxosToBump }
+  return { replaceableTxs: [], utxosToBump, forceUtxosToBump: true }
 }
 
 // Prepare parameters for UTXO selection
@@ -387,7 +389,11 @@ const transferHandler = {
     let replaceableTxs = findUnconfirmedSentRbfTxs(context.txSet)
 
     // Determine bumping strategy (RBF or CPFP)
-    const { replaceableTxs: updatedReplaceableTxs, utxosToBump } = determineBumpStrategy({
+    const {
+      replaceableTxs: updatedReplaceableTxs,
+      utxosToBump,
+      forceUtxosToBump,
+    } = determineBumpStrategy({
       bumpTxId,
       replaceableTxs,
       usableUtxos: context.usableUtxos,
@@ -418,7 +424,9 @@ const transferHandler = {
       isSendAll: utxoParams.resolvedIsSendAll,
       getFeeEstimator: (asset, { feePerKB, ...options }) =>
         getFeeEstimator(asset, feePerKB, options),
-      mustSpendUtxos: utxosToBump,
+      spendUtxos: utxosToBump,
+      forceSpendUtxos: forceUtxosToBump,
+      isBumpTx: !!bumpTxId,
       allowUnconfirmedRbfEnabledUtxos,
       unconfirmedTxAncestor: context.unconfirmedTxAncestor,
       utxosDescendingOrder,
@@ -426,7 +434,7 @@ const transferHandler = {
       changeAddressType,
     })
 
-    if (!selectedUtxos && !replaceTx) {
+    if (!selectedUtxos?.size && !replaceTx) {
       throw new Error('Not enough funds.')
     }
 
@@ -435,7 +443,7 @@ const transferHandler = {
     // then something is wrong because we can't actually bump the tx.
     // This shouldn't happen but might due to either the tx confirming before accelerate was
     // pressed, or if the change was already spent from another wallet.
-    if (bumpTxId && (!selectedUtxos || (replaceTx && replaceTx.txId !== bumpTxId))) {
+    if (bumpTxId && (!selectedUtxos?.size || (replaceTx && replaceTx.txId !== bumpTxId))) {
       throw new Error(`Unable to bump ${bumpTxId}`)
     }
 

package/src/tx-log/bitcoin-monitor-scanner.js

@@ -455,6 +455,7 @@ export class BitcoinMonitorScanner {
           feePerKB: txItem.fees ? (txItem.fees / txItem.vsize) * 1000 * 1e8 : null,
           rbfEnabled: txItem.rbf,
           blocksSeen: 0,
+          internalOutputs: [],
           ...(isCoinbase ? { isCoinbase: true } : undefined),
         },
         currencies: { [assetName]: currency },
@@ -565,10 +566,24 @@ export class BitcoinMonitorScanner {
           txLogItem.addresses.push(address)
         }
 
+        // keeping this for backwards compatibility to not risk breaking any unknown code that depends on the change address being present
         if (isSent && isChangeAddress(address)) {
           txLogItem.data.changeAddress = address
         }
 
+        // Internal outputs are any outputs that pay into this wallet.
+        // For sent txs, that includes change and self‑send outputs.
+        // For incoming txs, it includes normal receive outputs.
+        //
+        // We do not try to infer which internal output is the user’s intent
+        // vs wallet change, because it is ambiguous:
+        // - Users can self‑send to a change address and still get an extra change output.
+        // - In single‑address mode, receive and change outputs have same address.
+        txLogItem.data.internalOutputs.push({
+          address,
+          amount: currency.defaultUnit(vout.value).toBaseString(),
+        })
+
         if (this.#ordinalsEnabled && vout.inscriptions) {
           txLogItem.data.receivedInscriptions.push(
             ...vout.inscriptions.map((i) => ({

package/src/tx-send/batch-tx.js

@@ -58,7 +58,7 @@ export const getCreateBatchTransaction = ({
       allowUnconfirmedRbfEnabledUtxos,
     })
 
-    if (!selectedUtxos) throw new Error('Not enough funds.')
+    if (!selectedUtxos?.size) throw new Error('Not enough funds.')
 
     const addressPathsMap = selectedUtxos.getAddressPathsMap()
 

package/src/tx-send/index.js

@@ -266,6 +266,7 @@ export const sendTxFactory = ({
       rbfEnabled,
       toAddress,
       sendAmount,
+      changeAmount,
       bumpTxId,
       size,
     })

package/src/tx-send/update-state.js

@@ -2,6 +2,109 @@ import { Address } from '@exodus/models'
 
 import { serializeCurrency } from '../fee/fee-utils.js'
 
+const normalizeAddressObject = (asset, value) => {
+  const address =
+    value instanceof Address
+      ? value
+      : Address.create(value.address ?? value, value.meta ?? Object.create(null))
+
+  return asset.address.toLegacyAddress
+    ? Address.create(asset.address.toLegacyAddress(String(address)), address.meta)
+    : address
+}
+
+// internalOutputs are deterministically derivable while scanning while change address is not
+// internalOutput.address is an Address object, so platform can re-derive complete Address object from the tx log
+const buildInternalOutputs = ({
+  asset,
+  walletAddressObjects,
+  internalAddressSet,
+  amountToSerialize,
+  toAddress,
+  changeOutput,
+  ourAddress,
+  changeAmount,
+}) => {
+  const internalOutputs = []
+  if (amountToSerialize && toAddress) {
+    const normalizedToAddress = normalizeAddressObject(asset, toAddress)
+    const normalizedToAddressString = String(normalizedToAddress)
+    if (internalAddressSet.has(normalizedToAddressString)) {
+      const internalAddress =
+        walletAddressObjects.find((address) => String(address) === normalizedToAddressString) ??
+        normalizedToAddress
+      internalOutputs.push({
+        address: internalAddress,
+        amount: amountToSerialize.toBaseString(),
+      })
+    }
+  }
+
+  if (changeOutput && ourAddress && changeAmount) {
+    const changeAddressObject = normalizeAddressObject(asset, ourAddress)
+    internalOutputs.push({
+      address: changeAddressObject,
+      amount: changeAmount.toBaseString(),
+    })
+  }
+
+  return internalOutputs
+}
+
+const getWalletAddressObjects = async ({
+  asset,
+  assetClientInterface,
+  assetName,
+  walletAccount,
+  chainIndex,
+  multisigDataLength,
+}) => {
+  const purposes = await assetClientInterface.getSupportedPurposes({
+    assetName,
+    walletAccount,
+  })
+
+  const unusedAddressIndexes = await assetClientInterface.getUnusedAddressIndexes({
+    assetName,
+    walletAccount,
+    highestUnusedIndexes: true,
+  })
+
+  const addresses = []
+  const addressSet = new Set()
+
+  for (const purpose of purposes) {
+    const chainIndexes = unusedAddressIndexes.find((entry) => entry.purpose === purpose)?.chain || [
+      0, 0,
+    ]
+    // users can switch between multi address mode and single address mode, so we need to use the highest unused address index irrespective of current mode
+    const endAddressIndex = chainIndexes[chainIndex] ?? 0
+    const dataLength = multisigDataLength ?? 1
+
+    for (let addressIndex = 0; addressIndex <= endAddressIndex; addressIndex++) {
+      for (let multisigDataIndex = 0; multisigDataIndex < dataLength; multisigDataIndex++) {
+        const address = await assetClientInterface.getAddress({
+          assetName,
+          walletAccount,
+          purpose,
+          chainIndex,
+          addressIndex,
+          ...(multisigDataLength ? { multisigDataIndex } : Object.create(null)),
+        })
+
+        const addressObject = normalizeAddressObject(asset, address)
+        const addressKey = String(addressObject)
+        if (addressSet.has(addressKey)) continue
+
+        addressSet.add(addressKey)
+        addresses.push(addressObject)
+      }
+    }
+  }
+
+  return addresses
+}
+
 export async function updateAccountState({
   assetClientInterface,
   assetName,
@@ -71,6 +174,7 @@ export async function updateTransactionLog({
   rbfEnabled,
   toAddress,
   sendAmount,
+  changeAmount,
 }) {
   const assetName = asset.name
 
@@ -80,22 +184,54 @@ export async function updateTransactionLog({
     walletAccount,
   })
 
-  const walletAddressObjects = await assetClientInterface.getReceiveAddresses({
+  const multisigDataLength = config?.multisigDataLength
+
+  const walletReceiveAddressObjects = await getWalletAddressObjects({
+    asset,
+    assetClientInterface,
+    assetName,
     walletAccount,
+    chainIndex: 0,
+    multisigDataLength,
+  })
+  const walletChangeAddressObjects = await getWalletAddressObjects({
+    asset,
+    assetClientInterface,
     assetName,
-    multiAddressMode: config?.multiAddressMode ?? true,
+    walletAccount,
+    chainIndex: 1,
+    multisigDataLength,
   })
 
+  const walletAddressObjects = [...walletReceiveAddressObjects, ...walletChangeAddressObjects]
+
+  const internalAddressSet = new Set(walletAddressObjects.map(String))
+  const normalizedToAddressString = toAddress
+    ? String(normalizeAddressObject(asset, toAddress))
+    : undefined
+
   // There are two cases of bumping, replacing or chaining a self-send.
   // If we have a bumpTxId, but we aren't replacing, then it is a self-send.
+  // If the user sent to a receive or change address of this wallet, it is a self-send.
   const selfSend = bumpTxId
     ? !replaceTx
-    : walletAddressObjects.some((receiveAddress) => String(receiveAddress) === String(toAddress))
+    : Boolean(normalizedToAddressString && internalAddressSet.has(normalizedToAddressString))
 
   const displayReceiveAddress = asset.address.displayAddress?.(toAddress) || toAddress
 
   const amountToSerialize = sendAmount.isZero ? undefined : sendAmount
 
+  const internalOutputs = buildInternalOutputs({
+    asset,
+    walletAddressObjects,
+    internalAddressSet,
+    amountToSerialize,
+    toAddress,
+    changeOutput,
+    ourAddress,
+    changeAmount,
+  })
+
   // Build receivers list
   const receivers = bumpTxId
     ? replaceTx
@@ -134,8 +270,10 @@ export async function updateTransactionLog({
         selfSend,
         data: {
           sent: selfSend ? [] : receivers,
+          internalOutputs,
           rbfEnabled,
           feePerKB: size ? fee.div(size / 1000).toBaseNumber() : undefined,
+          // keeping this for backwards compatibility to not risk breaking any unknown code that depends on the change address being present
           changeAddress: changeOutput ? ourAddress : undefined,
           blockHeight,
           blocksSeen: 0,