[bisq-network/bisq] Fix taker use all BSQ for fee payment (#4354)

[sqrrm]

Fixes https://github.com/bisq-network/security/issues/4

Issue: if a taker used exactly all BSQ from the BSQ inputs to pay the
trading fee, there was no BSQ change in the takeOfferFeeTx. It was
assumed that the second output was the reservedForTrade output, but in
the case of missing BSQ change it was the first output.

Fix: added a check to make sure the value of the inputs to the deposit
tx match the expected inputAmount.

Added a check that if there is no BSQ outputs in the bsqTradingFeeTx a
change output is added of value 1 satoshi more than the BSQ input value.
This ensures that the second output is always the reservedForTrade
output. It also ensures that the BSQ is burnt, even in the very unlikely
case that the amount of BSQ burnt is larger than the reservedForTrade
amount.



You can view, comment on, or merge this pull request online at:

  https://github.com/bisq-network/bisq/pull/4354

-- Commit Summary --

  * Fix taker use all BSQ for fee payment

-- File Changes --

    M core/src/main/java/bisq/core/btc/wallet/BsqWalletService.java (1)
    M core/src/main/java/bisq/core/btc/wallet/TradeWalletService.java (25)
    M core/src/main/java/bisq/core/trade/protocol/tasks/buyer_as_taker/BuyerAsTakerCreatesDepositTxInputs.java (9)

-- Patch Links --

https://github.com/bisq-network/bisq/pull/4354.patch
https://github.com/bisq-network/bisq/pull/4354.diff

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/bisq-network/bisq/pull/4354
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.bisq.network/pipermail/bisq-github/attachments/20200706/a2d1b73a/attachment.html>