refactor(abstract-utxo): delete fetchInputs and remove redundant fee guard

modules/abstract-utxo/src/transaction/fixedScript/verifyTransaction.ts

@@ -5,11 +5,9 @@ import { BitGoBase, TxIntentMismatchError, IBaseCoin } from '@bitgo/sdk-core';
 import { hasPsbtMagic } from '@bitgo/wasm-utxo';
 
 import { AbstractUtxoCoin, VerifyTransactionOptions } from '../../abstractUtxoCoin';
-import { Output, ParsedTransaction } from '../types';
-import { toTNumber } from '../../tnumber';
+import { ParsedTransaction } from '../types';
 import { stringToBufferTryFormats } from '../decode';
 import { verifyCustomChangeKeySignatures, verifyKeySignature, verifyUserPublicKeyAsync } from '../../verifyKey';
-import { getPsbtTxInputs, getTxInputs } from '../fetchInputs';
 
 const debug = buildDebug('bitgo:abstract-utxo:verifyTransaction');
 
@@ -201,29 +199,9 @@ export async function verifyTransaction<TNumber extends bigint | number>(
     }
   }
 
-  const allOutputs = parsedTransaction.outputs;
   if (!txPrebuild.txHex) {
     throw new Error(`txPrebuild.txHex not set`);
   }
-  const inputs = isPsbt
-    ? getPsbtTxInputs(txPrebuild.txHex, coin.name).map((v) => ({
-        ...v,
-        value: toTNumber(v.value, coin.amountType),
-      }))
-    : await getTxInputs({ txPrebuild, bitgo, coin, disableNetworking, reqId });
-  // coins (doge) that can exceed number limits (and thus will use bigint) will have the `valueString` field
-  const inputAmount = inputs.reduce(
-    (sum: bigint, i) => sum + BigInt(coin.amountType === 'bigint' ? i.valueString : i.value),
-    BigInt(0)
-  );
-  const outputAmount = allOutputs.reduce((sum: bigint, o: Output) => sum + BigInt(o.amount), BigInt(0));
-  const fee = inputAmount - outputAmount;
-
-  if (fee < 0) {
-    throw new Error(
-      `attempting to spend ${outputAmount} satoshis, which exceeds the input amount (${inputAmount} satoshis) by ${-fee}`
-    );
-  }
 
   return true;
 }

modules/abstract-utxo/src/transaction/index.ts

@@ -3,7 +3,6 @@ export * from './recipient';
 export { explainTx } from './explainTransaction';
 export { parseTransaction } from './parseTransaction';
 export { verifyTransaction } from './verifyTransaction';
-export * from './fetchInputs';
 export * as bip322 from './bip322';
 export { decodePsbt } from './decode';
 export * from './fixedScript';

modules/abstract-utxo/test/unit/transaction/fixedScript/explainPsbt.ts

@@ -94,6 +94,33 @@ function describeTransactionWith(acidTest: testutil.AcidTest) {
 
 describe('explainPsbt(Wasm)', function () {
   testutil.AcidTest.suite().forEach((test) => describeTransactionWith(test));
+
+  it('explainPsbtWasmBigInt throws when total output value exceeds total input value', function () {
+    const network = utxolib.networks.bitcoin;
+    const rootWalletKeys = testutil.getDefaultWalletKeys();
+    // Valid PSBT: one p2wsh input (5000 sat), one internal p2wsh output (3000 sat), fee = 2000
+    const psbt = testutil.constructPsbt(
+      [{ scriptType: 'p2wsh', value: 5000n }],
+      [{ scriptType: 'p2wsh', value: 3000n, isInternalAddress: true }],
+      network,
+      rootWalletKeys,
+      'unsigned'
+    );
+    // Tamper: reduce the witnessUtxo.value so that inputs (1000) < outputs (3000).
+    // Direct mutation avoids bip174's "duplicate data" guard on updateInput.
+    psbt.data.inputs[0].witnessUtxo!.value = 1000n;
+
+    const wasmPsbt = fixedScriptWallet.BitGoPsbt.fromBytes(psbt.toBuffer(), 'bitcoin');
+    const walletXpubs = fixedScriptWallet.RootWalletKeys.from(rootWalletKeys);
+
+    assert.throws(
+      () =>
+        explainPsbtWasmBigInt(wasmPsbt, walletXpubs, {
+          replayProtection: { publicKeys: [] },
+        }),
+      /Fee calculation error: outputs exceed inputs/
+    );
+  });
 });
 
 describe('aggregateTransactionExplanations', function () {