Did I find a bug in the Bitcoin Core wallet?

[walletrecovery]

Sometimes I check the balance of many others wallets.
This is my wallet: https://ibb.co/Ydbzbs2 (3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X)
After syncing with other wallet,
I saw this: https://ibb.co/XDNdkmQ (1BSmyTdYpsHA5JhLS9azGmVADuJRiLWE5Z)
or this: https://ibb.co/hD1fP4J (17w8w8ZHdqkSYFkhAMfHJaEqCHgHm9egKv)
Is this a bug in the wallet program or should it be?

But if I downloading this wallet: https://ibb.co/CtN2N4X - no problem
or this: https://ibb.co/QnYSgX1 - no problem

Maybe wallets with 70 and 78 coins are fake? Did one client send them to me.
Is the wallet program showing strange transactions for this reason?

+ new info:
This is natural fake wallet with 150 BTC, but without private keys https://ibb.co/cytgVyN
after I trying send coins to my wallet we can see this screen: https://ibb.co/R37WnmB
and we wil see this anomaly again, fake wallets have transaction inheritance. Yes or No?

[1714993444]

1714993444

[1714993444]

1714993444

[1714993444]

1714993444

[1714993444]

1714993444

[1714993444]

1714993444

[1714993444]

1714993444

[mocacinno]

Am i missing something?

You're checking 2 different wallets and you see 2 different history's?

[walletrecovery]

Am i missing something?

You're checking 2 different wallets and you see 2 different history's?

Everything is fine in the explorer, but there is some mistake in the wallet program (Bitcoin Core version v0.20.1).

[mocacinno]

--snip--
Everything is fine in the explorer, but there is some mistake in the wallet program (Bitcoin Core version v0.20.1).

You've just shown 2 screenshots of the qt wallet, these screenshots look 100% fine...
It's impossible for us to check any explorer since the screenshot doesn't show addresses or tx id's, so we're unable to tell you if you found a bug or not...

However, it would supprise me if something was wrong... >95% chance either your wallet file was messed with, something went wrong during synchronisation or the explorer you used messed up (some explorers have quite a lot of bugs).

[achow101]

Everything is fine in the explorer, but there is some mistake in the wallet program (Bitcoin Core version v0.20.1).

What is the mistake? All the addresses you listed match with the screenshots.

[AB de Royse777]

I see some amounts on the address on explorer
https://blockchair.com/bitcoin/address/3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X
https://blockchair.com/bitcoin/address/1BSmyTdYpsHA5JhLS9azGmVADuJRiLWE5Z
https://blockchair.com/bitcoin/address/17w8w8ZHdqkSYFkhAMfHJaEqCHgHm9egKv

But I really do not understand what OP is asking here.

[walletrecovery]

I see some amounts on the address on explorer
https://blockchair.com/bitcoin/address/3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X
https://blockchair.com/bitcoin/address/1BSmyTdYpsHA5JhLS9azGmVADuJRiLWE5Z
https://blockchair.com/bitcoin/address/17w8w8ZHdqkSYFkhAMfHJaEqCHgHm9egKv

But I really do not understand what OP is asking here.

the problem is that the wallet program is not working correctly.
when I replacing the wallet.dat file, the program shows transactions that were not actually on the network.
it is possible that when replacing a file, the program needs to clear some cache or something, I don't know.

[walletrecovery]

Everything is fine in the explorer, but there is some mistake in the wallet program (Bitcoin Core version v0.20.1).

What is the mistake? All the addresses you listed match with the screenshots.

I've done more research and updated the problem description.

[achow101]

when I replacing the wallet.dat file, the program shows transactions that were not actually on the network.

Which transactions? What are the txids? Just posting screenshots is not helpful; we don't know what they are supposed to look like. We don't know what's in your wallet and nothing about the screenshots indicate that there is anything wrong. Furthermore, the balances are correct.

You are probably just being confusing by the transaction timestamp that Bitcoin Core reports. There is confusing behavior around the timestamp reporting which can result in incorrect and misleading timestamps. However the all of the transactions you see should be found in block explorers unless marked otherwise (i.e. they are conflicted or abandoned). Check the transaction ids, not the timestamps.

it is possible that when replacing a file, the program needs to clear some cache or something, I don't know.

Nope.

[HCP]

Sometimes I check the balance of many others wallets.
This is my wallet: https://ibb.co/Ydbzbs2 (3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X)

After syncing with other wallet,
I saw this: https://ibb.co/XDNdkmQ (1BSmyTdYpsHA5JhLS9azGmVADuJRiLWE5Z)
or this: https://ibb.co/hD1fP4J (17w8w8ZHdqkSYFkhAMfHJaEqCHgHm9egKv)
Is this a bug in the wallet program or should it be?

It would appear that everyone here, including myself, is a bit confused as to what you think is "wrong". You say that "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" is an address from your wallet, yet it is showing for "other wallets" (here and here). Is that what the issue is? Are you saying that the "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" transaction should NOT be showing when you are looking at the wallets with 70 and 78 BTC?

[walletrecovery]

It would appear that everyone here, including myself, is a bit confused as to what you think is "wrong". You say that "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" is an address from your wallet, yet it is showing for "other wallets" (here and here). Is that what the issue is? Are you saying that the "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" transaction should NOT be showing when you are looking at the wallets with 70 and 78 BTC?


[/quote]

Yes, you are right, that is exactly what I want to say.

[mocacinno]

Ok, you updated your OP since i last posted and gave some extra information that make things a bit clearer.

Where did you get these wallet files from? I followed the link in your signature, and it seems you're trying to sell a collection of "hacked" or "lost" encrypted wallets with big balances in them.
Is this one of these wallets? Some of them are known to be edited... Some of these wallets are edited in such a way the seller can provide nice screenshots to his victims clients and sell them worthless wallets for a big premium by manually changing the wallet files.

[HCP]

It would appear that everyone here, including myself, is a bit confused as to what you think is "wrong". You say that "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" is an address from your wallet, yet it is showing for "other wallets" (here and here). Is that what the issue is? Are you saying that the "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" transaction should NOT be showing when you are looking at the wallets with 70 and 78 BTC?

Yes, you are right, that is exactly what I want to say.

Ok, that clarifies things slightly... OK, so how exactly are you opening the "other" wallet.dats? Do you shut down Bitcoin Core, then rename/move your wallet.dat and then put the "70BTC" wallet.dat in the datadir, then restart Bitcoin Core?

Or are you using the "multi-wallet" functionality in Bitcoin Core and simply opening the 2nd wallet file from within the Bitcoin Core GUI using "File->Open wallet..."

or are you doing something else?

[walletrecovery]

Ok, you updated your OP since i last posted and gave some extra information that make things a bit clearer.

Where did you get these wallet files from? I followed the link in your signature, and it seems you're trying to sell a collection of "hacked" or "lost" encrypted wallets with big balances in them.
Is this one of these wallets? Some of them are known to be edited... Some of these wallets are edited in such a way the seller can provide nice screenshots to his victims clients and sell them worthless wallets for a big premium by manually changing the wallet files.

These wallets were sent to me by different people, some for free, and some for money.

[BitMaxz]

we are moving further and further away from the problem.
I just want to understand why the wallet program displays incorrect information that is not contained in the downloaded wallet.dat file
why does the wallet program inherit information from the previous wallet?
because we know that there is no such transaction on the network and the wallet.dat file has been replaced.

If that transaction is not showing on any online block explorer possible the user who gives this wallet.dat might have some fake transaction.

Can you try to run Bitcoin with "-zapwallettxes" but before you run it with zapwallettxes delete the mempool.dat it might be solve your issue.
Read the guide from this post How do I get rid of an unconfirmed transaction on Bitcoin Core

Maybe wallets with 70 and 78 coins are fake? Did one client send them to me.
Is the wallet program showing strange transactions for this reason?

Possible it might be a fake transaction that includes addresses/transactions which is not belong to that wallet.dat.
There are many scammers out there selling wallet.dat that includes fake transaction and balances so the client might be created this wallet.dat for you or maybe that wallet file was shared by someone in public for free which is many from some download sites like 4shared.

[HCP]

I just want to understand why the wallet program displays incorrect information that is not contained in the downloaded wallet.dat file
why does the wallet program inherit information from the previous wallet?
because we know that there is no such transaction on the network and the wallet.dat file has been replaced.

I'm not sure why it is showing a transaction from your wallet when you are loading a completely different wallet.dat... Are you sure you stopped Bitcoin Core first, and then replaced the wallet.dat? If you swapped the file first, then restarted Bitcoin Core, it might have done some "weird" things (like writing cached transactions etc to the replacement wallet.dat when you shut down Bitcoin Core and then restarted it), but I would expect that it would most likely just corrupt the wallet.dat and it would fail to load.

Either that, or you've somehow managed to accidentally import your address or private key into the other wallet.dat(s) by mistake.

The only other thing I can think of, is that mempool.dat is somehow holding onto "your transaction", and when you start up with a different wallet, it adds that transaction to that wallet, thinking that it is "yours"? But that is just pure speculation...

Maybe do as BitMaxz said, delete the mempool.dat when you change the wallet.dat files and see if that stops it from happening.

Maybe wallets with 70 and 78 coins are fake? Did one client send them to me.
Is the wallet program showing strange transactions for this reason?

That is, the program works correctly, but if the wallet is fake, then we will see this or another anomaly.

It's quite possible that a fake wallet would show "weird things", depending on how it was modified... it's also possible it's NOT a BTC wallet, but an altcoin wallet (like LTC or DOGE etc) and is showing "non-existent" transactions because of that... the transaction doesn't exist on BTC blockchain, but it exists on a different blockchain and was stored in the wallet.dat history.


However, that doesn't really explain why these wallets are showing a transaction that you say is from your wallet.dat!!?!

[walletrecovery]

the experiment is that two wallets, which are probably fake, show the inheritance of the transaction from my wallet, and the other two wallets, which were also in the experiment, do not inherit the transaction from my wallet.
From this experiment, I concluded that when loading fake wallets into the program, there is an abnormal display of transactions. the wallet program does not check the wallet for authenticity.

[HCP]

The "wallet program" (ie. Bitcoin Core) is simply showing transactions relating to the "public keys" that it finds in a wallet file (ie. a wallet.dat).

It is possible to modify a wallet.dat file such that it contains a certain public key, but does not actually have the matching private key. This is the case with most (if not all) of the wallet.dat files that are "for sale". Scammers insert a public key that current contains a large amount of BTC, then add some dummy data that is encrypted with a ridiculously long and random password in the place of the private key.

Bitcoin Core will read and display information based on the public key... but obviously you cannot spend any coins because:
1. Tthe password is unknown
and
b. Even if the password was known, the wallet doesn't actually have the private key matching the public key showing as having coins.


However, that still doesn't explain why loading one of those wallets was showing transactions for a public key that they shouldn't have (ie. a public key from your wallet). Either the scammer knows your address and was using it to troll you or Bitcoin Core did indeed pickup some cached transaction from somewhere and included it with the "new" (fake) wallet.dat info.

Have you tried using -zapwallettxes on one of the fake wallets yet?

[achow101]

However, that still doesn't explain why loading one of those wallets was showing transactions for a public key that they shouldn't have (ie. a public key from your wallet). Either the scammer knows your address and was using it to troll you or Bitcoin Core did indeed pickup some cached transaction from somewhere and included it with the "new" (fake) wallet.dat info.

It is possible for a wallet to contain transactions which do not pertain to the keys in the wallet. This cannot happen under normal operation, but a scammer who is directly modifying the file can cause this to happen. There is no caching nor any bug here, OP has "fake" wallet.dat files.

Even though there are unrelated transactions in the wallet, the balance remains "correct" because the balance is computed by searching every transaction and counting up the values of the outputs that pass the IsMine check.

[HCP]

It is possible for a wallet to contain transactions which do not pertain to the keys in the wallet. This cannot happen under normal operation, but a scammer who is directly modifying the file can cause this to happen. There is no caching nor any bug here, OP has "fake" wallet.dat files.

In which case, I can only conclude that the "scammer" has purposely included a transaction from one of the addresses in the OPs personal wallet in an attempt to troll them

[walletrecovery]

In which case, I can only conclude that the "scammer" has purposely included a transaction from one of the addresses in the OPs personal wallet in an attempt to troll them
[/quote]

See "+ new info:" I added research information in the topic.

[achow101]

Can you explain exactly what you do when you replace the wallet file? And by exactly, I mean every step, including shutting down Bitcoin Core, copying the file in, any other files you copy, and any files you delete.

For example:
1. Shutdown with File > Exit
2. Open data directory
3. Delete wallet.dat file
4. Copy new wallet.dat file
5. Start Bitcoin Core by double clicking shortcut.

Can you also upload the entire debug.log file (the entire thing, not just a snippet, and not just a screenshot). You can copy and paste it in, or if it is too big, upload the file somewhere or copy it's contents to a paste site like pastebin, then provide the link.


If you are shutting down and replacing the file incorrectly, it is possible that some database stuff from one wallet ends up in another wallet because the database system that the wallet uses creates more files than just the wallet.dat file. However a clean shutdown will cleanup and remove them, so there shouldn't be any problems there. Note that if this is the problem, there isn't really anything that Bitcoin Core can do other than stop using this DB system, which we are in the process of doing. In that case, there isn't a bug, just a really strange edge case and you should doing things properly to not run into it.

[walletrecovery]

This is 100% thrue algo:

For example:
1. Shutdown with File > Exit
2. Open data directory
3. Delete wallet.dat file
4. Copy new wallet.dat file
5. Start Bitcoin Core by double clicking shortcut.

and I have debug.log (i cute it since 10.18.2020) = 1,12mb
but file contains some lines like this, I replace data to "*":
Discover: User-PC - ****:*:****:****:****:****:****:****
AddLocal([****:*:****:****:***:****:****:****]:****,*)
You can take this file from: https://dropmefiles.com/B0Hsm
6 days left...

[achow101]

The log file indicates that each of the wallets that has the transaction in question contains it because it matches against the wallet. The lines that say

Code:

AddToWallet 7b12e1df59224bfbc9b0b8f29085f9b1364ca0bd06379a2a9bb7e751aab86bb7  new

indicate that.

Would you be willing to send me the wallet.dat files so I can investigate this further?


It looks like all of these wallets contain the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs which also paid you, which is why you see the same 2 transactions show up in both. I think what is happening is that all of the fake wallets were made from the same base wallet that had send you money.

[walletrecovery]

The log file indicates that each of the wallets that has the transaction in question contains it because it matches against the wallet. The lines that say

Code:

AddToWallet 7b12e1df59224bfbc9b0b8f29085f9b1364ca0bd06379a2a9bb7e751aab86bb7  new

indicate that.

Would you be willing to send me the wallet.dat files so I can investigate this further?


It looks like all of these wallets contain the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs which also paid you, which is why you see the same 2 transactions show up in both. I think what is happening is that all of the fake wallets were made from the same base wallet that had send you money.

I have one address only: https://ibb.co/LgFR58B
I don’t know anything about this address: https://blockchain.com/btc/address/3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs
Maybe this is my client who once paid for a collection of wallets through the satoshidisk.com service, I no longer use this service and deleted all links.
Here are the two files that started my research: https://dropmefiles.com/eK4Hy
6 days left...

[achow101]

The log file indicates that each of the wallets that has the transaction in question contains it because it matches against the wallet. The lines that say

Code:

AddToWallet 7b12e1df59224bfbc9b0b8f29085f9b1364ca0bd06379a2a9bb7e751aab86bb7  new

indicate that.

Would you be willing to send me the wallet.dat files so I can investigate this further?


It looks like all of these wallets contain the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs which also paid you, which is why you see the same 2 transactions show up in both. I think what is happening is that all of the fake wallets were made from the same base wallet that had send you money.

I have one address only: https://ibb.co/LgFR58B
I don’t know anything about this address: https://blockchain.com/btc/address/3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs
Maybe this is my client who once paid for a collection of wallets through the satoshidisk.com service, I no longer use this service and deleted all links.
Here are the two files that started my research: https://dropmefiles.com/eK4Hy
6 days left...

Yes, it is as I thought.

Both wallets are almost identical. Each wallet has 203 keys, of which 202 of them are identical. One of those keys that are the same is for the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs. This address has also sent money to you at 3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X. Because both of these wallets contain the key for 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs, both wallets also contain the transaction made to you, thus you see them.

What likely happened is that whoever gave these wallets to you started from the same base wallet. From this wallet file, they then inserted extra records for the addresses that have the balance that you care about. At some point they sent money to you from the base wallet, perhaps to prove that the wallets have money. Regardless, the wallets are nearly identical and the reason that the transaction appears in these wallets and in your wallet is because they all contain keys involved in that particular transaction.

Therefore there is no bug and you are working with maliciously crafted wallets.

[walletrecovery]

Yes, it is as I thought.

Both wallets are almost identical. Each wallet has 203 keys, of which 202 of them are identical. One of those keys that are the same is for the address 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs. This address has also sent money to you at 3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X. Because both of these wallets contain the key for 3ABxGuyibTGH4n1Y3NMKNWP8477VBGTjCs, both wallets also contain the transaction made to you, thus you see them.

What likely happened is that whoever gave these wallets to you started from the same base wallet. From this wallet file, they then inserted extra records for the addresses that have the balance that you care about. At some point they sent money to you from the base wallet, perhaps to prove that the wallets have money. Regardless, the wallets are nearly identical and the reason that the transaction appears in these wallets and in your wallet is because they all contain keys involved in that particular transaction.

Therefore there is no bug and you are working with maliciously crafted wallets.

You are just a genius person, I haven’t studied bitcoin that deeply, because I am not a programmer.
Thank you very much for your answer, now we can put an end to this story and I close the topic.
Thanks to everyone who took part in the discussion.