@exodus/bitcoin-api 4.9.5 → 4.9.6

package/CHANGELOG.md

@@ -3,6 +3,16 @@
 All notable changes to this project will be documented in this file.
 See [Conventional Commits](https://conventionalcommits.org) for commit guidelines.
 
+## [4.9.6](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.9.5...@exodus/bitcoin-api@4.9.6) (2026-03-02)
+
+
+### Bug Fixes
+
+
+* fix(bitcoin-api): normalize witnessUtxo values for PSBT input (#7497)
+
+
+
 ## [4.9.5](https://github.com/ExodusMovement/assets/compare/@exodus/bitcoin-api@4.9.4...@exodus/bitcoin-api@4.9.5) (2026-02-14)
 
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@exodus/bitcoin-api",
-  "version": "4.9.5",
+  "version": "4.9.6",
   "description": "Bitcoin transaction and fee monitors, RPC with the blockchain node, other networking code.",
   "type": "module",
   "main": "src/index.js",
@@ -61,5 +61,5 @@
     "type": "git",
     "url": "git+https://github.com/ExodusMovement/assets.git"
   },
-  "gitHead": "8c4fcde522beb978df6a5099e0fa9e34bb4a7e04"
+  "gitHead": "04dc4d08ec82b0405ec1ec3a52d682ef11451914"
 }

package/src/psbt-builder.js

@@ -6,6 +6,7 @@ import { SubType, writePsbtGlobalField, writePsbtOutputField } from './psbt-prop
 import {
   getAddressType,
   getPurposeXPubs,
+  normalizeWitnessUtxoValue,
   setPsbtVersionIfNotBitcoin,
   validatePurpose,
 } from './psbt-utils.js'
@@ -112,7 +113,7 @@ function createPsbtInput({
 
   if (isWrappedSegwitAddress || isSegwitAddress || isTaprootAddress) {
     psbtInput.witnessUtxo = {
-      value: input.value,
+      value: normalizeWitnessUtxoValue(input.value),
       script: Buffer.from(input.script, 'hex'),
     }
   }
@@ -132,7 +133,7 @@ function createPsbtInput({
       // vendor forks, malformed historical data). When that happens we fall back to a
       // witness-only record and rely on the signer to opt-in to __UNSAFE_SIGN_NONSEGWIT.
       psbtInput.witnessUtxo = {
-        value: input.value,
+        value: normalizeWitnessUtxoValue(input.value),
         script: Buffer.from(input.script, 'hex'),
       }
     }

package/src/psbt-utils.js

@@ -132,6 +132,39 @@ export async function withUnsafeNonSegwit({ psbt, fn, unsafe = true }) {
   }
 }
 
+export function normalizeWitnessUtxoValue(value) {
+  if (typeof value === 'number') {
+    if (!Number.isSafeInteger(value)) {
+      throw new TypeError('witnessUtxo value does not fit in a safe integer')
+    }
+
+    return value
+  }
+
+  if (typeof value === 'bigint') {
+    if (!Number.isSafeInteger(Number(value))) {
+      throw new TypeError('witnessUtxo value does not fit in a safe integer')
+    }
+
+    return Number(value)
+  }
+
+  if (Buffer.isBuffer(value)) {
+    if (value.length !== 8) {
+      throw new Error(`Unexpected witnessUtxo value buffer size: ${value.length}`)
+    }
+
+    const parsed = value.readBigUInt64LE(0)
+    if (parsed > BigInt(Number.MAX_SAFE_INTEGER)) {
+      throw new Error('witnessUtxo value does not fit in a safe integer')
+    }
+
+    return Number(parsed)
+  }
+
+  throw new TypeError(`Unsupported witnessUtxo value type: ${typeof value}`)
+}
+
 export function setPsbtVersionIfNotBitcoin(psbt, assetName) {
   if (!['bitcoin', 'bitcoinregtest', 'bitcointestnet'].includes(assetName)) psbt.setVersion(1)
 }

package/src/tx-sign/default-prepare-for-signing.js

@@ -2,7 +2,7 @@ import { Psbt as DefaultPsbt, Transaction as DefaultTransaction } from '@exodus/
 import assert from 'minimalistic-assert'
 
 import { writePsbtBlockHeight } from '../psbt-proprietary-types.js'
-import { setPsbtVersionIfNotBitcoin } from '../psbt-utils.js'
+import { normalizeWitnessUtxoValue, setPsbtVersionIfNotBitcoin } from '../psbt-utils.js'
 import { getMaximumFeeRate } from './maximum-fee-rates.js'
 
 /**
@@ -115,7 +115,10 @@ function createPsbtFromTxData({
 
     if (isSegwitAddress || isTaprootAddress) {
       // taproot outputs only require the value and the script, not the full transaction
-      txIn.witnessUtxo = { value, script: Buffer.from(script, 'hex') }
+      txIn.witnessUtxo = {
+        value: normalizeWitnessUtxoValue(value),
+        script: Buffer.from(script, 'hex'),
+      }
     }
 
     const rawTx = (rawTxs || []).find((t) => t.txId === txId)
@@ -130,7 +133,10 @@ function createPsbtFromTxData({
         // temp fix for https://exodusio.slack.com/archives/CP202D90Q/p1671014704829939 until bitcoinjs could parse a mweb tx without failing
         console.warn(`Setting psbt.__CACHE.__UNSAFE_SIGN_NONSEGWIT = true for asset ${assetName}`)
         psbt.__CACHE.__UNSAFE_SIGN_NONSEGWIT = true
-        txIn.witnessUtxo = { value, script: Buffer.from(script, 'hex') }
+        txIn.witnessUtxo = {
+          value: normalizeWitnessUtxoValue(value),
+          script: Buffer.from(script, 'hex'),
+        }
       }
     }