fix(engine): correct UTXO-mode scans (real confirmations + ownership context) - #33
Merged
Conversation
UTXO-mode scans hardcoded confirmations to zero, blinding the age detectors, and recognized only the scanned outputs' own addresses, so a user's own batch payment read as an exchange withdrawal. - confirmations now come from the fetched parent transaction - EngineSettings gains ownership_descriptors: descriptors (or xpubs) whose derived addresses seed is_ours(), suppressing the exchange-origin and dust-attack false positives on the user's own sends First integration tests covering ScanTarget::Utxos: age spread with real confirmations, and the own-batch false positive with and without ownership context.
--utxos may now be combined with --descriptors, and the API accepts utxos plus descriptors in one body: the descriptors act as ownership context for the UTXO scan instead of a separate scan target.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
UTXO-mode scans (
ScanTarget::Utxos, the txid:vout input path) had two correctness gaps found during the scantxoutset evaluation. Neither the CLI nor the API had any integration test covering this path until now.Confirmations were hardcoded to zero, so the UTXO-age detectors (age spread, dormant) were effectively blind on this path. They now come from the fetched parent transaction.
The scan only knew the addresses of the UTXOs handed to it, so a user's own batch payment read as an exchange withdrawal (and dust escalated as an attack) because the engine could not tell the user was the sender.
EngineSettingsgainsownership_descriptors: descriptors or xpubs whose derived addresses seedis_ours(), suppressing the exchange-origin and dust-attack false positives on the user's own sends. The CLI accepts--utxoscombined with--descriptors, and the API accepts autxos+descriptorsbody, treating the descriptors as ownership context rather than a separate scan target.Tests: first integration tests for
ScanTarget::Utxoson regtest — age spread with real confirmations, and the own-batch false positive asserted both with and without ownership context (the test documents that the FP fires without context and is suppressed with it). Full workspace suite green, clippy -D warnings clean. Test-first throughout.🤖 Generated with Claude Code