Found by the 2026-08-19 merged-PR audit (guard-gap in code merged via #928). Latent — no app path can reach it today (verified 2026-08-20): both dash-wallet swap routes (Maya classic and the SwapKit backend) build fixed-amount, change-leaving sends and never a drain, and the defect additionally requires MORE than one OP_RETURN in a single drain, which no app path constructs (each swap send carries exactly one memo).
The defect: the key-wallet drain (send-all) builder accepts multiple OP_RETURN data outputs and produces a transaction that violates the standardness nDataOut <= 1 rule — unrelayable, with the wallet's entire balance reserved behind it (a self-inflicted balance strand). Separately, a memo attached to an asset-lock build is silently dropped instead of raising a typed error.
A complete fix exists on branch fix/op-return-drain-guards (former PR #973, closed to keep the open-PR queue focused on migration-critical work; CodeRabbit-approved at close): an nDataOut <= 1 ceiling with a typed error, and a typed error for the asset-lock memo drop. Reopen before any feature that builds memo-carrying drains (e.g. a true MAX-to-swap drain).
Found by the 2026-08-19 merged-PR audit (guard-gap in code merged via #928). Latent — no app path can reach it today (verified 2026-08-20): both dash-wallet swap routes (Maya classic and the SwapKit backend) build fixed-amount, change-leaving sends and never a drain, and the defect additionally requires MORE than one OP_RETURN in a single drain, which no app path constructs (each swap send carries exactly one memo).
The defect: the key-wallet drain (send-all) builder accepts multiple OP_RETURN data outputs and produces a transaction that violates the standardness
nDataOut <= 1rule — unrelayable, with the wallet's entire balance reserved behind it (a self-inflicted balance strand). Separately, a memo attached to an asset-lock build is silently dropped instead of raising a typed error.A complete fix exists on branch
fix/op-return-drain-guards(former PR #973, closed to keep the open-PR queue focused on migration-critical work; CodeRabbit-approved at close): annDataOut <= 1ceiling with a typed error, and a typed error for the asset-lock memo drop. Reopen before any feature that builds memo-carrying drains (e.g. a true MAX-to-swap drain).