Bug #1 — Multi-input: non-first sender invisible · High
fromAddr is always taken from getFirstInputAddress (input[0] only). If a monitored wallet is at Vin[1+], its outgoing transfer is never emitted.
File: internal/indexer/bitcoin.go:296
Bug #2 — Input-address-also-receives filtered as change · Medium
With IndexChangeOutput=false, any output to an address that also appears in the input set is dropped — even if it is a genuine payment, not change.
File: internal/indexer/bitcoin.go:324
Bug #3 — Bare multisig (P2MS): only first address captured · Low
GetOutputAddress returns Addresses[0] only. Participants at index 1+ are missed.
File: internal/rpc/bitcoin/tx.go:51
Bug #4 — Taproot (P2TR) NormalizeBTCAddress returns error · Low
bech32.Decode from btcutil v1.0.2 predates BIP-350 and rejects bc1p…/tb1p… addresses. Transfers are not lost (graceful fallback to raw address), but validation is broken.
File: internal/rpc/bitcoin/utils.go:24
Fix: upgrade btcutil/bech32 to a version with bech32m support.
Bug #5 — Partial prevout resolution: only Vin[0] checked · Medium
convertBlockWithPrevoutResolution only queues a transaction for prevout resolution when Vin[0].PrevOut == nil. If Vin[0] is already resolved but Vin[1+] are not, those inputs stay unresolved — yielding empty FromAddress and an understated fee.
File: internal/indexer/bitcoin.go:111
Bug #1 — Multi-input: non-first sender invisible · High
fromAddris always taken fromgetFirstInputAddress(input[0] only). If a monitored wallet is atVin[1+], its outgoing transfer is never emitted.File:
internal/indexer/bitcoin.go:296Bug #2 — Input-address-also-receives filtered as change · Medium
With
IndexChangeOutput=false, any output to an address that also appears in the input set is dropped — even if it is a genuine payment, not change.File:
internal/indexer/bitcoin.go:324Bug #3 — Bare multisig (P2MS): only first address captured · Low
GetOutputAddressreturnsAddresses[0]only. Participants at index 1+ are missed.File:
internal/rpc/bitcoin/tx.go:51Bug #4 — Taproot (P2TR)
NormalizeBTCAddressreturns error · Lowbech32.Decodefrombtcutil v1.0.2predates BIP-350 and rejectsbc1p…/tb1p…addresses. Transfers are not lost (graceful fallback to raw address), but validation is broken.File:
internal/rpc/bitcoin/utils.go:24Fix: upgrade
btcutil/bech32to a version with bech32m support.Bug #5 — Partial prevout resolution: only
Vin[0]checked · MediumconvertBlockWithPrevoutResolutiononly queues a transaction for prevout resolution whenVin[0].PrevOut == nil. IfVin[0]is already resolved butVin[1+]are not, those inputs stay unresolved — yielding emptyFromAddressand an understated fee.File:
internal/indexer/bitcoin.go:111