Did I find a bug in the Bitcoin Core wallet?

[walletrecovery]

Sometimes I check the balance of many others wallets.
This is my wallet: https://ibb.co/Ydbzbs2 (3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X)
After syncing with other wallet,
I saw this: https://ibb.co/XDNdkmQ (1BSmyTdYpsHA5JhLS9azGmVADuJRiLWE5Z)
or this: https://ibb.co/hD1fP4J (17w8w8ZHdqkSYFkhAMfHJaEqCHgHm9egKv)
Is this a bug in the wallet program or should it be?

But if I downloading this wallet: https://ibb.co/CtN2N4X - no problem
or this: https://ibb.co/QnYSgX1 - no problem

Maybe wallets with 70 and 78 coins are fake? Did one client send them to me.
Is the wallet program showing strange transactions for this reason?

+ new info:
This is natural fake wallet with 150 BTC, but without private keys https://ibb.co/cytgVyN
after I trying send coins to my wallet we can see this screen: https://ibb.co/R37WnmB
and we wil see this anomaly again, fake wallets have transaction inheritance. Yes or No?

[1714126080]

1714126080

[1714126080]

1714126080

[1714126080]

1714126080

[1714126080]

1714126080

[1714126080]

1714126080

[1714126080]

1714126080

[mocacinno]

Am i missing something?

You're checking 2 different wallets and you see 2 different history's?

[walletrecovery]

Am i missing something?

You're checking 2 different wallets and you see 2 different history's?

Everything is fine in the explorer, but there is some mistake in the wallet program (Bitcoin Core version v0.20.1).

[mocacinno]

--snip--
Everything is fine in the explorer, but there is some mistake in the wallet program (Bitcoin Core version v0.20.1).

You've just shown 2 screenshots of the qt wallet, these screenshots look 100% fine...
It's impossible for us to check any explorer since the screenshot doesn't show addresses or tx id's, so we're unable to tell you if you found a bug or not...

However, it would supprise me if something was wrong... >95% chance either your wallet file was messed with, something went wrong during synchronisation or the explorer you used messed up (some explorers have quite a lot of bugs).

[achow101]

Everything is fine in the explorer, but there is some mistake in the wallet program (Bitcoin Core version v0.20.1).

What is the mistake? All the addresses you listed match with the screenshots.

[AB de Royse777]

I see some amounts on the address on explorer
https://blockchair.com/bitcoin/address/3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X
https://blockchair.com/bitcoin/address/1BSmyTdYpsHA5JhLS9azGmVADuJRiLWE5Z
https://blockchair.com/bitcoin/address/17w8w8ZHdqkSYFkhAMfHJaEqCHgHm9egKv

But I really do not understand what OP is asking here.

[walletrecovery]

I see some amounts on the address on explorer
https://blockchair.com/bitcoin/address/3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X
https://blockchair.com/bitcoin/address/1BSmyTdYpsHA5JhLS9azGmVADuJRiLWE5Z
https://blockchair.com/bitcoin/address/17w8w8ZHdqkSYFkhAMfHJaEqCHgHm9egKv

But I really do not understand what OP is asking here.

the problem is that the wallet program is not working correctly.
when I replacing the wallet.dat file, the program shows transactions that were not actually on the network.
it is possible that when replacing a file, the program needs to clear some cache or something, I don't know.

[walletrecovery]

Everything is fine in the explorer, but there is some mistake in the wallet program (Bitcoin Core version v0.20.1).

What is the mistake? All the addresses you listed match with the screenshots.

I've done more research and updated the problem description.

[achow101]

when I replacing the wallet.dat file, the program shows transactions that were not actually on the network.

Which transactions? What are the txids? Just posting screenshots is not helpful; we don't know what they are supposed to look like. We don't know what's in your wallet and nothing about the screenshots indicate that there is anything wrong. Furthermore, the balances are correct.

You are probably just being confusing by the transaction timestamp that Bitcoin Core reports. There is confusing behavior around the timestamp reporting which can result in incorrect and misleading timestamps. However the all of the transactions you see should be found in block explorers unless marked otherwise (i.e. they are conflicted or abandoned). Check the transaction ids, not the timestamps.

it is possible that when replacing a file, the program needs to clear some cache or something, I don't know.

Nope.

[HCP]

Sometimes I check the balance of many others wallets.
This is my wallet: https://ibb.co/Ydbzbs2 (3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X)

After syncing with other wallet,
I saw this: https://ibb.co/XDNdkmQ (1BSmyTdYpsHA5JhLS9azGmVADuJRiLWE5Z)
or this: https://ibb.co/hD1fP4J (17w8w8ZHdqkSYFkhAMfHJaEqCHgHm9egKv)
Is this a bug in the wallet program or should it be?

It would appear that everyone here, including myself, is a bit confused as to what you think is "wrong". You say that "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" is an address from your wallet, yet it is showing for "other wallets" (here and here). Is that what the issue is? Are you saying that the "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" transaction should NOT be showing when you are looking at the wallets with 70 and 78 BTC?

[walletrecovery]

It would appear that everyone here, including myself, is a bit confused as to what you think is "wrong". You say that "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" is an address from your wallet, yet it is showing for "other wallets" (here and here). Is that what the issue is? Are you saying that the "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" transaction should NOT be showing when you are looking at the wallets with 70 and 78 BTC?


[/quote]

Yes, you are right, that is exactly what I want to say.

[mocacinno]

Ok, you updated your OP since i last posted and gave some extra information that make things a bit clearer.

Where did you get these wallet files from? I followed the link in your signature, and it seems you're trying to sell a collection of "hacked" or "lost" encrypted wallets with big balances in them.
Is this one of these wallets? Some of them are known to be edited... Some of these wallets are edited in such a way the seller can provide nice screenshots to his victims clients and sell them worthless wallets for a big premium by manually changing the wallet files.

[HCP]

It would appear that everyone here, including myself, is a bit confused as to what you think is "wrong". You say that "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" is an address from your wallet, yet it is showing for "other wallets" (here and here). Is that what the issue is? Are you saying that the "3QjnBKZAdUK3MVfekycu2FhCpT3hvmYa5X" transaction should NOT be showing when you are looking at the wallets with 70 and 78 BTC?

Yes, you are right, that is exactly what I want to say.

Ok, that clarifies things slightly... OK, so how exactly are you opening the "other" wallet.dats? Do you shut down Bitcoin Core, then rename/move your wallet.dat and then put the "70BTC" wallet.dat in the datadir, then restart Bitcoin Core?

Or are you using the "multi-wallet" functionality in Bitcoin Core and simply opening the 2nd wallet file from within the Bitcoin Core GUI using "File->Open wallet..."

or are you doing something else?

[walletrecovery]

Ok, you updated your OP since i last posted and gave some extra information that make things a bit clearer.

Where did you get these wallet files from? I followed the link in your signature, and it seems you're trying to sell a collection of "hacked" or "lost" encrypted wallets with big balances in them.
Is this one of these wallets? Some of them are known to be edited... Some of these wallets are edited in such a way the seller can provide nice screenshots to his victims clients and sell them worthless wallets for a big premium by manually changing the wallet files.

These wallets were sent to me by different people, some for free, and some for money.

[BitMaxz]

we are moving further and further away from the problem.
I just want to understand why the wallet program displays incorrect information that is not contained in the downloaded wallet.dat file
why does the wallet program inherit information from the previous wallet?
because we know that there is no such transaction on the network and the wallet.dat file has been replaced.

If that transaction is not showing on any online block explorer possible the user who gives this wallet.dat might have some fake transaction.

Can you try to run Bitcoin with "-zapwallettxes" but before you run it with zapwallettxes delete the mempool.dat it might be solve your issue.
Read the guide from this post How do I get rid of an unconfirmed transaction on Bitcoin Core

Maybe wallets with 70 and 78 coins are fake? Did one client send them to me.
Is the wallet program showing strange transactions for this reason?

Possible it might be a fake transaction that includes addresses/transactions which is not belong to that wallet.dat.
There are many scammers out there selling wallet.dat that includes fake transaction and balances so the client might be created this wallet.dat for you or maybe that wallet file was shared by someone in public for free which is many from some download sites like 4shared.

[HCP]

I just want to understand why the wallet program displays incorrect information that is not contained in the downloaded wallet.dat file
why does the wallet program inherit information from the previous wallet?
because we know that there is no such transaction on the network and the wallet.dat file has been replaced.

I'm not sure why it is showing a transaction from your wallet when you are loading a completely different wallet.dat... Are you sure you stopped Bitcoin Core first, and then replaced the wallet.dat? If you swapped the file first, then restarted Bitcoin Core, it might have done some "weird" things (like writing cached transactions etc to the replacement wallet.dat when you shut down Bitcoin Core and then restarted it), but I would expect that it would most likely just corrupt the wallet.dat and it would fail to load.

Either that, or you've somehow managed to accidentally import your address or private key into the other wallet.dat(s) by mistake.

The only other thing I can think of, is that mempool.dat is somehow holding onto "your transaction", and when you start up with a different wallet, it adds that transaction to that wallet, thinking that it is "yours"? But that is just pure speculation...

Maybe do as BitMaxz said, delete the mempool.dat when you change the wallet.dat files and see if that stops it from happening.

Maybe wallets with 70 and 78 coins are fake? Did one client send them to me.
Is the wallet program showing strange transactions for this reason?

That is, the program works correctly, but if the wallet is fake, then we will see this or another anomaly.

It's quite possible that a fake wallet would show "weird things", depending on how it was modified... it's also possible it's NOT a BTC wallet, but an altcoin wallet (like LTC or DOGE etc) and is showing "non-existent" transactions because of that... the transaction doesn't exist on BTC blockchain, but it exists on a different blockchain and was stored in the wallet.dat history.


However, that doesn't really explain why these wallets are showing a transaction that you say is from your wallet.dat!!?!

[walletrecovery]

the experiment is that two wallets, which are probably fake, show the inheritance of the transaction from my wallet, and the other two wallets, which were also in the experiment, do not inherit the transaction from my wallet.
From this experiment, I concluded that when loading fake wallets into the program, there is an abnormal display of transactions. the wallet program does not check the wallet for authenticity.

[HCP]

The "wallet program" (ie. Bitcoin Core) is simply showing transactions relating to the "public keys" that it finds in a wallet file (ie. a wallet.dat).

It is possible to modify a wallet.dat file such that it contains a certain public key, but does not actually have the matching private key. This is the case with most (if not all) of the wallet.dat files that are "for sale". Scammers insert a public key that current contains a large amount of BTC, then add some dummy data that is encrypted with a ridiculously long and random password in the place of the private key.

Bitcoin Core will read and display information based on the public key... but obviously you cannot spend any coins because:
1. Tthe password is unknown
and
b. Even if the password was known, the wallet doesn't actually have the private key matching the public key showing as having coins.


However, that still doesn't explain why loading one of those wallets was showing transactions for a public key that they shouldn't have (ie. a public key from your wallet). Either the scammer knows your address and was using it to troll you or Bitcoin Core did indeed pickup some cached transaction from somewhere and included it with the "new" (fake) wallet.dat info.

Have you tried using -zapwallettxes on one of the fake wallets yet?

[achow101]

However, that still doesn't explain why loading one of those wallets was showing transactions for a public key that they shouldn't have (ie. a public key from your wallet). Either the scammer knows your address and was using it to troll you or Bitcoin Core did indeed pickup some cached transaction from somewhere and included it with the "new" (fake) wallet.dat info.

It is possible for a wallet to contain transactions which do not pertain to the keys in the wallet. This cannot happen under normal operation, but a scammer who is directly modifying the file can cause this to happen. There is no caching nor any bug here, OP has "fake" wallet.dat files.

Even though there are unrelated transactions in the wallet, the balance remains "correct" because the balance is computed by searching every transaction and counting up the values of the outputs that pass the IsMine check.

[HCP]

It is possible for a wallet to contain transactions which do not pertain to the keys in the wallet. This cannot happen under normal operation, but a scammer who is directly modifying the file can cause this to happen. There is no caching nor any bug here, OP has "fake" wallet.dat files.

In which case, I can only conclude that the "scammer" has purposely included a transaction from one of the addresses in the OPs personal wallet in an attempt to troll them