WARNING: Double check your transactions even when you only bump the fee (RBF)

[ultrloa]

This is a good habit to get into.
Every time you want to sign a transaction, double check, triple check everything before you click sign and enter your password. Your inputs, outputs, fee, ... see which coins you are spending and where are those coins going (the receiver's address and the change address). Check everything before you sign and click broadcast. Even if it was an existing tx you had already signed and sent (unconfirmed), and now you just want to bump its fee using RBF.

It is also better that you sign and broadcast separately and double check after signing and before broadcasting. For example Electrum has this option: you set the fee, preview, sign, then click broadcast.

Electrum just fixed a vulnerability: https://github.com/spesmilo/electrum/security/advisories/GHSA-6jp4-8v48-cc5v
so upgrade to 4.8.3 already.

In this exploit a malicious Electrum server would receive the user's tx and refuse to propagate it; then while it remains unconfirmed according to that server alone, it returns a modified tx where the output is the attacker's address.
Now this modified tx shows up in the user's wallet software and shows as unconfirmed. Since it remains unconfirmed, the user may decide to bump the fee. In which case they'd sign this new transaction that is paying the attacker not the destination the user wanted to.

So you can see the importance of that good habit. It can effectively prevent this attack from affecting those who have this habit and double check everything.

For sure many people didn't care much about this, also you are 100% right about people should do double check before they do transaction. Because verifying all of those thing could help us protect people to commit mistake and avoid exploit just like the current situation happening on Electrum.

Doing upgrade to new version which is the one pointed out is very essential.

Also it can add another extra protection. Then thanks for pointing that situation, because it remind people to be vigilant towards doing good updates on their wallets.

I also want to share another article about the issue you raised here.

https://en.spaziocrypto.com/ethereum/electrum-4-8-3-critical-fee-bump-bitcoin-vulnerability-fix

https://finance.biggo.com/news/edc0bf6a-6465-46ea-ae55-0ab36a8250fb

[hosemary]

I don’t understand, why does Electrum need to verify the signatures?  I think it should suffice to verify that the tx matches the txid (and the signatures themselves can be verified by the known wtxid).

Because Electrum gets the entire transaction history from the servers. That's why when you make a transaction with Electrum, it's added to your transaction histoy after the server reports it back to your wallet, not immediately after you create it.
Therefore, the server can give you any transaction associated with your address, and if Electrum doesn't verify the signature, it can give you an invalid transaction.

[nullius]

Thank you for explaining.  This is a design flaw:

Electrum gets the entire transaction history from the servers. That's why when you make a transaction with Electrum, it's added to your transaction histoy after the server reports it back to your wallet, not immediately after you create it.

The logical way, and the secure-by-default way is for a light wallet to store the newly-created transaction and its txid, and then ask the server for its status by txid.^*

What does Electrum do, if the untrusted server discards or otherwise loses the transaction without broadcasting (and if necessary, re-broadcasting) it on the P2P network?  Rely on the user to notice the missing tx, and recreate it from scratch?  How would the user know that it’s really gone forever?  What if they’re in a hurry to meet the expiry deadline of an online invoice, and they make mistakes in haste?  If the user accidentally chooses different input to redo a seemingly missing tx, and the first tx then shows up, they could double-pay the recipient; failure to keep a record of the original tx can thus cause loss of funds.

Whenever the light wallet needs to gain its first knowledge of a tx from the server, it obviously needs to verify all signature(s) and other internal evidence of potential validity.  This is a mundane application of the tautological programming rule, “Don’t trust untrusted inputs.”  Are there any cases where Electrum still isn’t verifying the signatures?  My out-of-context skim of the security patch’s diff suggests there may be, though I could be wrong about that.

Therefore, the server can give you any transaction associated with your address, and if Electrum doesn't verify the signature, it can give you an invalid transaction.

If there are any remaining cases where Electrum isn’t verifying all signature(s), I can think of interesting attacks...

^* A complete design also needs to keep track of wtxid, and be aware of potential variations in valid signatures.  I don’t immediately see how this could have an impact on transactions originated by the wallet—but DTRT here protects against unforeseen corner cases.  Anyway, Electrum still supports pre-Segwit txes—so it should (?) have code paths to handle malleation in all cases.  Proper design of databasing one P2WPKH tx by txid and potentially multiple wtxid(s) suggests design of the proper data model and codepaths to mitigate Bitcoin’s pre-Segwit design flaw in txids.

[CryptSafe]

Thank you for this information. Immediately I finished reading this post, I dashed for my electrum update via Google Play and did the needful. For sometime now I have been noticing some funny observations whenever I want to do transaction via the electrum app but I could detect what exactly was wrong. I checked for update and nothing there to update but I am happy I found this post and immediately I finished reading, I updated my app. This post finally cleared my doubt that something was wrong with the old version of the electrum app and now I know exactly where and what the problem is all about.

[Zaguru12]

Thank you for this information. Immediately I finished reading this post, I dashed for my electrum update via Google Play and did the needful. For sometime now I have been noticing some funny observations whenever I want to do transaction via the electrum app but I could detect what exactly was wrong. I checked for update and nothing there to update but I am happy I found this post and immediately I finished reading, I updated my app. This post finally cleared my doubt that something was wrong with the old version of the electrum app and now I know exactly where and what the problem is all about.

My advice is do not go directly to goggle play store to actually download or update your electrum app or any other wallet rather the best option is to go directly to the main website; https://electrum.org/#download to download the application which gives you the ability to verify even the signatures there. Becareful they are lots of fake electrum apps out there

What was the funny observations you found out earlier.

[CryptSafe]

Thank you for this information. Immediately I finished reading this post, I dashed for my electrum update via Google Play and did the needful. For sometime now I have been noticing some funny observations whenever I want to do transaction via the electrum app but I could detect what exactly was wrong. I checked for update and nothing there to update but I am happy I found this post and immediately I finished reading, I updated my app. This post finally cleared my doubt that something was wrong with the old version of the electrum app and now I know exactly where and what the problem is all about.

My advice is do not go directly to goggle play store to actually download or update your electrum app or any other wallet rather the best option is to go directly to the main website; https://electrum.org/#download to download the application which gives you the ability to verify even the signatures there. Becareful they are lots of fake electrum apps out there

What was the funny observations you found out earlier.

I actually did updated my electrum via google play store and it synced with my electrum app which shows it's genuine source because I remembered that I did installed the app via the website when I first heard about the electrum app.

I will suggest if it would be possible for the electrum app team to put up the update option on the app under the about so that anybody who visits there can be able to quickly do update their apps whenever a new version is released. At least this would give users of the platform a sense of security because they are upgrading their apps internally via the app and there would be no room for scammers to take advantage of users of the app.

As for my observations, I keep seeing errors in transaction and on few occasions I noticed discrepancies in receiving wallet address which made me formatted my phone then.

[Frankolala]

Immediately, I saw this news from Electrum official site on X, was the moment I upgraded my Electrum wallet to the latest version that fix these bugs. It's alarming how hackers are so much focused on attacking crypto wallets these days. I don't recheck the receiving address that I do send funds to when using RBF because I believe that's the same address which I pasted but henceforth, I will always do a thorough check and recheck before broadcasting any transaction.

[pooya87]

This is a design flaw:

It is not "Electrum design's" flaw, it is "SPV design's" flaw.

The logical way, and the secure-by-default way is for a light wallet to store the newly-created transaction and its txid, and then ask the server for its status by txid.

The idea is that the SPV client does not know what transactions belong to it since it neither has the blockchain nor a mempool.
You sometimes receive a tx, in which case you do not know the txid beforehand to request based on that.
The tx may also be a double spend (eg. RBF bump) and different servers may have different versions of your (sent/received) tx therefore different txids. If the wallet starts storing txids then you'll have to add more complications to the code to handle that conflict.

Whenever the light wallet needs to gain its first knowledge of a tx from the server, it obviously needs to verify all signature(s) and other internal evidence of potential validity.  This is a mundane application of the tautological programming rule, “Don’t trust untrusted inputs.”  Are there any cases where Electrum still isn’t verifying the signatures?

Lets not forget that we are discussing a SPV client not a full node. By definition a SPV client was never expected to verify signatures of any transaction since it does not have a UTXO set. Every workaround that is added to "force-verify" signatures will first contradict the "Simplified" part and second will come with its own load of issues which would require more workarounds that will contradict the "Simplified" part of SPV even more.

I'm not saying it is impossible but it adds a lot of complication to the code and that's a weakness itself.
Bottom line is:
Unconfirmed transactions are not trusted.
Unconfirmed transactions when you use a SPV client are even less trusted.
When you choose a SPV client instead of a full node, you are giving up a lot. You need to keep that in mind.
Double check what you can double check to reduce the risks.

[nullius]

It is not "Electrum design's" flaw, it is "SPV design's" flaw.

Is Electrum SPV?  I thought that Electrum used the Electrum protocol; I’ve never heard it referred to as SPV.  I just double-checked the Electrum wiki article (current version permalink), Ctrl-F “SPV” and “simpli”; if Electrum is actually SPV, that information should probably be added to the article by an Electrum topical expert.

The logical way, and the secure-by-default way is for a light wallet to store the newly-created transaction and its txid, and then ask the server for its status by txid.

The idea is that the SPV client does not know what transactions belong to it since it neither has the blockchain nor a mempool.

Non sequitur.  “Doesn’t know that a transaction that it created belongs to it” does not follow from “has neither the blockchain nor a mempool”.

It would follow from “completely stateless”, but Electrum is not stateless.  It has some sort of a tx database.  And I don’t think a useful wallet ever could be stateless.

You sometimes receive a tx, in which case you do not know the txid beforehand to request based on that.

That’s orthogonal to the case where you do know the txid.

Lets not forget that we are discussing a SPV client not a full node. By definition a SPV client was never expected to verify signatures of any transaction since it does not have a UTXO set.

In my opinion, a light client should always verify what it reasonably can.  Choosing not to verify the internal validity of a transaction, within its four corners, means blindly trusting the server not to hand you any garbage—with the results seen here, in this high-severity security bug!

Although a light client by definition cannot validate all blockchain consensus rules, it can easily validate a transaction within its four corners to assure that it’s not facially invalid.

(To my understanding, ever since Satoshi’s whitepaper, SPV clients have always been expected to validate the transaction from block headers, through a Merkle proof.  I think that this level of validation reasonably implies also checking the transaction’s internal validity, within its four corners.  This level of validation is still vulnerable to some potential attacks, but absolutely nothing like what is seen here.)

Every workaround that is added to "force-verify" signatures will first contradict the "Simplified" part and second will come with its own load of issues which would require more workarounds that will contradict the "Simplified" part of SPV even more.

How hard is it to verify a signature?  It is an operation that takes milliseconds even on an embedded CPU, and it easily can be done from stack buffers with no dynamic memory allocation.  Simple.

I think that to begin with, the code should be designed to validate untrusted data.  If properly designed, there is no “every workaround”; validity checks occur naturally, at every point on the network security boundary where the client says, “Okay, an untrusted party on the network just handed me a bag of bits; what is it?”  If no such boundary is well-defined at the design stage, then that, itself, is a security problem.

Personal note:  This is of peculiar interest to me, as I’ve been slowly drafting a topic OP about my urgent need for a new light wallet.  Electrum wasn’t under consideration anyway, as I’m hoping for a BIP 157/158 wallet with TUI written in C or Rust.  I will add to my list of requirements, “The wallet must never in any circumstance accept facially invalid transactions from the network.”

[hosemary]

Is Electrum SPV?  I thought that Electrum used the Electrum protocol; I’ve never heard it referred to as SPV.

When you use Electrum, you only download the block headers and don't need to download the entire blockchain. I think this is enough to call Electrum an SPV wallet. Isn't it?

I just double-checked the Electrum wiki article (current version permalink), Ctrl-F “SPV” and “simpli”; if Electrum is actually SPV, that information should probably be added to the article by an Electrum topical expert.

From Electrum's official website:

[pooya87]

Is Electrum SPV?

You are overthinking the terminology. Light[weight] client, Thin client and SPV client are terms used to describe the same concept. That is a wallet software that relies on block headers, merkle trees and PoW security.
By definition Electrum is one even if the wiki article doesn't use that exact term (their website and docs both do).

P.S. You have very good points in your comments and I'm not arguing against what should happen but it is different from what can happen. However, you could always open a PR and contribute to Electrum project to help fix the issues you think can be fixed.

[NefiSwap]

One thing nobody mentioned yet, from the side of the service that receives the coins.

When you bump the fee with RBF, the txid changes and the old one will never confirm. So if you sent to an exchange or a merchant and support asks for your txid, take it from your wallet history or a block explorer after the bump, not the one you copied before. Otherwise they look up a tx that has been replaced, and it looks like your coins disappeared.

On the receiving end, since Bitcoin Core 28.0 full-RBF is on by default. Any unconfirmed tx can be replaced, whether it signals RBF or not. That's why a service shouldn't credit a deposit at 0 confirmations, and if it does, it's taking a risk that ends up on its users too.

[atookz]

Bottom line is:
Unconfirmed transactions are not trusted.
Unconfirmed transactions when you use a SPV client are even less trusted.

Aside, I think you and @nullius are both sort of right. A light client should not end up checking everything a full node checks, but if there is something cheap that a light client can check (such as signatures on its own inputs), why not? From the advisory you linked, it sounds like this is what 4.8.3 does now, but I haven’t read the code, so take it with a pinch of salt.

In either case, the moral of the story for the general public is not to blindly trust an unconfirmed tx, especially before bumping its fee. Check with a block explorer if you do not see the txid in your wallet’s list, look it up in a block explorer first. If the block explorer doesn’t find your tx at all, that’s suspicious. If the transaction conflicts with another one, treat it as a new transaction and carefully read the outputs before you sign. If you can afford it, running your own server helps as well.

Oh, and the txid changes after a bump. If an exchange requests it, provide them with the new txid.

[MusaMohamed]

My advice is do not go directly to goggle play store to actually download or update your electrum app or any other wallet

It's very risky to do so.

Becareful they are lots of fake electrum apps out there

It's true for Electrum wallet application, other wallet applications, and exchange applications too.

rather the best option is to go directly to the main website; https://electrum.org/#download to download the application which gives you the ability to verify even the signatures there.

[Guide] How to Safely Download and Verify Electrum.
[Guide] The paranoid user's security guide for using Electrum safely.

[Zaguru12]

One thing nobody mentioned yet, from the side of the service that receives the coins.

When you bump the fee with RBF, the txid changes and the old one will never confirm. So if you sent to an exchange or a merchant and support asks for your txid, take it from your wallet history or a block explorer after the bump, not the one you copied before. Otherwise they look up a tx that has been replaced, and it looks like your coins disappeared.

Nobody mentioned it here because the OP actually understands that many members here understand what an RBF or any bump fee option means. The RBF itself means Replace-By-Fee and that tells everything. In the past when the nodes haven’t implemented the full RBF, both transactions do exist with the one which doesn’t get confirmed invalidate and it is mostly the first transaction because nodes give priority to transaction fees.

As for the TXID to give out after RBF, yes you should give out the new TXID after the RBF is done, but even if you give someone the earlier TXID and they decides to check it up on explorer, the explorers will still tell you that the transaction has been replaced and will even direct you to the new transaction. So even the old TXID isn’t actually wrong.

The difference with the vulnerability that OP brought is that the old TXID doe’s not exist because it was never broadcasted by the node and even if you check it up on any explorer it doesn’t finds any transaction with that ID

[Hamza2424]

Yep, thanks for sharing, bro. You explained it in the easiest way, and now everyone understands the applications of this vulnerability for attackers and how they can use it to scam us. We should never sign any transaction without reading the details, even if the wallet is Sparrow or any wallet other than Electrum.

We should make it our habit, especially if we have funds in our wallets. We can lose them as well, which is why we have to check everything first and revoke old connections so we don't sign and confirm something outdated that was shown to us when we opened the wallet while making a transaction.

I am not talking only about Electrum but also Web3 wallets like MetaMask, etc. Our signature is our authorization, and we should value it as much as we value our seed phrases.

[BlackHatCoiner]

I'll never understand why Electrum and other major wallets never bought into the concept of compact block filters that protect user's privacy by connecting directly to the Bitcoin network and download blocks. It's 2026, and people are still connecting their wallets to an SPV server, who can scan and group all their addresses.

Anyone who thinks these servers are run voluntarily by "community members" are living in 2012. This is 2026, and chain analysis has significantly developed since.

This is it, just my two thoughts on Electrum and why you should think twice before using it.

[Chibit01]

So you can see the importance of that good habit. It can effectively prevent this attack from affecting those who have this habit and double check everything.

This reminds me of this thread Electrum Bug or a common mistake from my end ?? The top of the thread conducted a transaction due to delay, later decided to increase the fee and in the process of doing that, the destination address changed to one of his unused addresses without his consent, which caused him to panic. If the address was originally changed to that of an attacker, that could have been the end.

It costs extremely nothing to double check, if not triple, before confirming that idea that once a transaction is confirmed it can't be reversed alone should make everyone to be extremely careful.

[pooya87]

I'll never understand why Electrum and other major wallets never bought into the concept of compact block filters that protect user's privacy by connecting directly to the Bitcoin network and download blocks. It's 2026, and people are still connecting their wallets to an SPV server, who can scan and group all their addresses.

Anyone who thinks these servers are run voluntarily by "community members" are living in 2012. This is 2026, and chain analysis has significantly developed since.

This is it, just my two thoughts on Electrum and why you should think twice before using it.

Different methods all come with their own set of pros and cons, even if they sound better on paper. For example BIP-157/158 (compact block filters) also has its own issues. In this approach, the client will have to produce filters for a very large number of blocks (5.2 million blocks for testnet3), download and process the node's responds for a new wallet and also it has to download full blocks whenever it finds a match to process that block locally. With the false positives that need to exist for privacy reasons, the bandwidth consumption and processing power consumed grows.

It's worth mentioning that it improves privacy it doesn't guarantee it. There are still shortcomings in that approach as well.

[Outhue]

Thank you for this information. Immediately I finished reading this post, I dashed for my electrum update via Google Play and did the needful. For sometime now I have been noticing some funny observations whenever I want to do transaction via the electrum app but I could detect what exactly was wrong. I checked for update and nothing there to update but I am happy I found this post and immediately I finished reading, I updated my app. This post finally cleared my doubt that something was wrong with the old version of the electrum app and now I know exactly where and what the problem is all about.

My advice is do not go directly to goggle play store to actually download or update your electrum app or any other wallet rather the best option is to go directly to the main website; https://electrum.org/#download to download the application which gives you the ability to verify even the signatures there. Becareful they are lots of fake electrum apps out there

What was the funny observations you found out earlier.

No one should be doing this in 2026, let Electrum official website direct you to the right Electrum wallet on Playstore, what if there is a fake or replicate Electrum wallet on playstore already? I was a victim of fake crypto wallet in 2020 or so, it cost me thousands of dollars, I went into Playstore and use their search engine to find a crypto wallet and it was fake with positive reviews, it was since that time that I stopped trusting reviews online and also stop using Playstore to find apps direct, it's not safe.