spesmilo / electrumx

Alternative implementation of spesmilo/electrum-server
MIT License
441 stars 353 forks source link

Bug in RPC command `getaddressbalance` #167

Closed cculianu closed 2 years ago

cculianu commented 2 years ago

There is a bug in the daemon RPC command getaddressbalance which ultimately calls into protocol command blockchain.scripthash.get_balance.

This check here in interface.py get_balance_for_scripthash asserts that the 'unconfirmed' balance cannot be negative. This is wrong. It most certainly can be negative. See for reference ElectrumX server implementaton here:

Steps to reproduce:

  1. Get an address that has confirmed coins on it only (no mempool coins) initially.
  2. Check its balance first using RPC getaddressbalance XXX. You should see some nonzero value in 'confirmed' and 0 in 'unconfirmed'.
  3. Next, spend all of the confirmed coins to another address
  4. Then, quickly, before the block confirms, run electrum RPC command getaddressbalance XXX for that first address again. The server returns a negative value in 'unconfirmed' now.
  5. Observe the RPC fail on that assertion that unconfirmed balance cannot be negative (which it now is, of course).

Suggest: relax the assertion that it can be negative, here.

cculianu commented 2 years ago

Oops. Wrong repository. Sorry! This should be in the electrum .. not electrumX repo. Closing here and re-opening there. Sorry!