Two vulnerabilities in bitcoinjs-lib can understate the fees paid to miners by a valid Bitcoin transaction. The first occurs when signing and fee calculation use conflicting values for the same input, while the second arises when finalized inputs contain no value. A demonstration on version 7.0.1 presented a transaction with 900,000,000 satoshis in fees, but the library calculated only 200 satoshis, while another example reports 91,000 satoshis instead of 1,000. Fixes are available in versions 5.2.2, 6.1.9 and 7.0.4, and maintainers must update the library or independently verify every input value before signing or extracting a transaction. Actual loss requires an authorized, valid transaction to be broadcast and accepted by the network.
Source: Read the original article
