fix(key-wallet): stop a never-broadcast transaction from crediting money that does not exist

key-wallet/src/managed_account/managed_account_collection.rs

@@ -3,7 +3,10 @@
 //! This module provides a structure for managing multiple accounts
 //! across different networks in a hierarchical manner.
 
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
+
+use dashcore::blockdata::transaction::OutPoint;
+use dashcore::Transaction;
 
 use crate::account::account_collection::{DashpayAccountKey, PlatformPaymentAccountKey};
 use crate::gap_limit::DIP17_GAP_LIMIT;
@@ -934,6 +937,27 @@ impl ManagedAccountCollection {
         accounts
     }
 
+    /// Union, across every funds-bearing account, of the outpoints among
+    /// `tx`'s inputs that the wallet holds as final UTXOs.
+    ///
+    /// A single account can only answer this for the coins it owns, but
+    /// pooled funding (asset locks draw from BIP44 + BIP32 + the DashPay
+    /// contact-receiving accounts) routinely spreads one transaction's inputs
+    /// across several. The union is what makes the trusted-self-send check in
+    /// [`ManagedCoreFundsAccount::record_transaction`] see the whole wallet.
+    ///
+    /// Must be taken before any account processes `tx` — `update_utxos`
+    /// removes spent parents as it goes.
+    pub(crate) fn final_parents_of(&self, tx: &Transaction) -> BTreeSet<OutPoint> {
+        let mut parents = BTreeSet::new();
+        for account in self.all_accounts() {
+            if let ManagedAccountRef::Funds(funds) = account {
+                funds.collect_final_parents(tx, &mut parents);
+            }
+        }
+        parents
+    }
+
     /// Get all accounts in the collection as mutable
     /// [`ManagedAccountRefMut`] values.
     pub fn all_accounts_mut(&mut self) -> Vec<ManagedAccountRefMut<'_>> {

key-wallet/src/managed_account/managed_account_ref.rs

@@ -23,7 +23,7 @@ use crate::Network;
 use dashcore::blockdata::transaction::OutPoint;
 use dashcore::prelude::CoreBlockHeight;
 use dashcore::{Address, ScriptBuf, Transaction, Txid};
-use std::collections::BTreeMap;
+use std::collections::{BTreeMap, BTreeSet};
 
 /// Immutable reference to a managed core account, either funds-bearing or
 /// keys-only.
@@ -314,25 +314,35 @@ impl<'a> ManagedAccountRefMut<'a> {
             context,
             transaction_type,
             &BTreeMap::new(),
+            &BTreeSet::new(),
         )
     }
 
     /// Record a new transaction, reconciling it against `observed_spent` —
     /// the wallet-level `observed_spent_outpoints` view
     /// (dashpay/rust-dashcore#649); only the funds variant consults it (keys
     /// accounts track no UTXOs/output details).
+    ///
+    /// `external_final_parents` is the wallet-level view of input parents held
+    /// by sibling accounts, used for the trusted-self-send determination.
     pub(crate) fn record_transaction_with_observed_spends(
         &mut self,
         tx: &Transaction,
         account_match: &AccountMatch,
         context: TransactionContext,
         transaction_type: TransactionType,
         observed_spent: &BTreeMap<OutPoint, CoreBlockHeight>,
+        external_final_parents: &BTreeSet<OutPoint>,
     ) -> TransactionRecord {
         match self {
-            ManagedAccountRefMut::Funds(a) => {
-                a.record_transaction(tx, account_match, context, transaction_type, observed_spent)
-            }
+            ManagedAccountRefMut::Funds(a) => a.record_transaction(
+                tx,
+                account_match,
+                context,
+                transaction_type,
+                observed_spent,
+                external_final_parents,
+            ),
             ManagedAccountRefMut::Keys(a) => {
                 a.record_transaction(tx, account_match, context, transaction_type)
             }
@@ -361,24 +371,34 @@ impl<'a> ManagedAccountRefMut<'a> {
             context,
             transaction_type,
             &BTreeMap::new(),
+            &BTreeSet::new(),
         )
     }
 
     /// Re-process an existing transaction, reconciling refreshed UTXO state
     /// against `observed_spent` — the wallet-level `observed_spent_outpoints`
     /// view (dashpay/rust-dashcore#649); only the funds variant consults it.
+    ///
+    /// `external_final_parents` is the wallet-level view of input parents held
+    /// by sibling accounts, used for the trusted-self-send determination.
     pub(crate) fn confirm_transaction_with_observed_spends(
         &mut self,
         tx: &Transaction,
         account_match: &AccountMatch,
         context: TransactionContext,
         transaction_type: TransactionType,
         observed_spent: &BTreeMap<OutPoint, CoreBlockHeight>,
+        external_final_parents: &BTreeSet<OutPoint>,
     ) -> Option<TransactionRecord> {
         match self {
-            ManagedAccountRefMut::Funds(a) => {
-                a.confirm_transaction(tx, account_match, context, transaction_type, observed_spent)
-            }
+            ManagedAccountRefMut::Funds(a) => a.confirm_transaction(
+                tx,
+                account_match,
+                context,
+                transaction_type,
+                observed_spent,
+                external_final_parents,
+            ),
             ManagedAccountRefMut::Keys(a) => {
                 a.confirm_transaction(tx, account_match, context, transaction_type)
             }