TX Fee can be set to anything by anyone

[iancoleman]

The transaction fee can be set to any value by any person. This may lead to the user sending a small amount of coins and accidentally paying a giant tx fee without ever realising it.

See https://github.com/thedawnrider/malicious-bitcoin-example for an example of how this is done.

Options for resolving this are outlined here
https://bitcointalk.org/index.php?topic=102606.msg1126479#msg1126479

[hllhll]

If this is a trojan horse of some kind, malware, or any kind of malicious EXE, What is the problem for the torjan to replace all the Bitcoin-QT software altogether, maybe even leaking out private keys...

[jonasschnelli]

Should we display the txfee in the transcation-confirm-promt in bitcoin-qt?
Display the txfee only when it's higher than the tx amount?

Protection (some security mechanism) of the config/registry value would make no sense in my eyes.

[laanwj]

Not sure, it would be nice to do so, but I don't think the actual fee is known yet at the time the confirmation dialog is shown (that's also why there is an separate askFee prompt).

[jonasschnelli]

@laanwj could we not just show the "nTransactionFee" from walletmodel in the dialog according to mockups in #1714? Because we also do the exceeds calculations based on nTransactionFee,... so i would say it's also okay to place them there. The real txfee will might be different. Maybe we show " and ~0.0005 BTC to transaction fees"?

[laanwj]

Nah, showing an approximate value could confuse people even more. I'm for either showing nothing or the actual fee that will be paid.

[jonasschnelli]

@laanwj okay,... let me check if i can somehow calculate (use the current txfee calc code) the fee before the confirmation dialogue pops up.

[laanwj]

This is fixed by #2651, closing