platform-wallet: unconfirmed spend reservations from unauthenticated mempool transactions never expire

[lklimek]

Summary

An unconfirmed (mempool) transaction that spends a wallet outpoint reserves that outpoint indefinitely. The reservation survives restart, and a rescan does not clear it. Only a conflicting InstantSend-locked or confirmed spend releases it.

Why this matters

dash-spv forwards peer mempool transactions to the wallet. The wallet recognises a spend by matching tracked outpoints and does not verify the spending signature. A connected peer can therefore relay an unsigned or never-mineable transaction that references a victim UTXO, and the UTXO becomes unspendable in that wallet:

• In-process, this predates fix(platform-wallet)!: restore Core spending state and repair persisted accounting #5150.
• Since fix(platform-wallet)!: restore Core spending state and repair persisted accounting #5150, the SQLite persister stores such records and replays them on every load. fix(platform-wallet)!: replay recorded transaction history on load for every persister #5220 does the same for every persister. Restart and ordinary rescan therefore no longer recover the coin.

Regression evidence: should_not_release_inputs_reserved_by_unconfirmed_spend passes with an empty scriptSig.

Expected

Legitimate pending sends keep their reservation until they confirm, are replaced, or expire. Unauthenticated peer observations cannot lock funds permanently. The fix must clear both the persisted reservation and the in-memory one, and must never release confirmed or InstantSend-locked spends.

Possible directions

• Provenance: distinguish locally authored sends from peer observations when persisting.
• Expiry: drop unconfirmed spend reservations that are not locally authored after a bound (time or block count), including on load.
• Revalidation: verify input scripts before a peer mempool transaction may reserve an outpoint.

References

• TODO(expire-unconfirmed-spend-reservations): rs-platform-wallet-storage/src/sqlite/rehydrate.rs, moved in fix(platform-wallet)!: replay recorded transaction history on load for every persister #5220 to rs-platform-wallet/src/manager/history_replay.rs.
• Review threads on fix(platform-wallet)!: restore Core spending state and repair persisted accounting #5150 (SEC findings; the owner deferred them).

🤖 Generated with Claude Code