From 6435e06408dc441bc3516508c2ba9f2f1fdd2193 Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Wed, 24 Jun 2026 14:21:37 +0200
Subject: [PATCH 1/2] validation: check subsidy asset and amount are explicit

---
 src/validation.cpp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/validation.cpp b/src/validation.cpp
index 86de340c14..9412753f14 100644
--- a/src/validation.cpp
+++ b/src/validation.cpp
@@ -673,7 +673,7 @@ class MemPoolAccept
             // calculate the burned subsidy value from the tx
             CAmount subsidy = 0;
             for (const CTxOut& txout : tx.vout) {
-                if (txout.scriptPubKey.IsUnspendable() && txout.nAsset.GetAsset() == Params().GetConsensus().pegged_asset && !txout.IsFee()) {
+                if (txout.scriptPubKey.IsUnspendable() && !txout.IsFee() && txout.nAsset.IsExplicit() && txout.nValue.IsExplicit() && txout.nAsset.GetAsset() == Params().GetConsensus().pegged_asset) {
                     subsidy += txout.nValue.GetAmount();
                 }
             }

From fe648bc6f51ec142ca91d1cff69e4b9c007803ad Mon Sep 17 00:00:00 2001
From: Byron Hambly <bhambly@blockstream.com>
Date: Wed, 24 Jun 2026 14:22:57 +0200
Subject: [PATCH 2/2] fix: minor fixes

---
 src/block_proof.cpp         | 2 --
 src/pegins.cpp              | 2 +-
 src/wallet/rpc/elements.cpp | 3 +++
 3 files changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/block_proof.cpp b/src/block_proof.cpp
index 272d9c0569..0ef130b517 100644
--- a/src/block_proof.cpp
+++ b/src/block_proof.cpp
@@ -26,10 +26,8 @@ static bool CheckProofGeneric(const CBlockHeader& block, const uint32_t max_bloc
 
     // Check signature limits for blocks
     if (scriptSig.size() > max_block_signature_size) {
-        assert(!is_dyna);
         return false;
     } else if (witness.GetSerializedSize() > max_block_signature_size) {
-        assert(is_dyna);
         return false;
     }
 
diff --git a/src/pegins.cpp b/src/pegins.cpp
index 8e44936398..3871e52637 100644
--- a/src/pegins.cpp
+++ b/src/pegins.cpp
@@ -552,7 +552,7 @@ bool DecomposePeginWitness(const CScriptWitness& witness, CAmount& value, CAsset
 {
     const auto& stack = witness.stack;
 
-    if (stack.size() < 5) return false;
+    if (stack.size() != 6) return false;
 
     CDataStream stream(stack[0], SER_NETWORK, PROTOCOL_VERSION);
     stream >> value;
diff --git a/src/wallet/rpc/elements.cpp b/src/wallet/rpc/elements.cpp
index 0f0f0c7cdd..28393cf4d1 100644
--- a/src/wallet/rpc/elements.cpp
+++ b/src/wallet/rpc/elements.cpp
@@ -1376,6 +1376,9 @@ RPCHelpMan blindrawtransaction()
         // Vacuous, just return the transaction
         return EncodeHexTx(CTransaction(tx));
     } else if (n_blinded_ins > 0 && num_pubkeys == 0) {
+        if (tx.vout.empty()) {
+            throw JSONRPCError(RPC_INVALID_PARAMETER, "Unable to blind transaction: transaction has no outputs to balance blinded inputs against.");
+        }
         // Blinded inputs need to balanced with something to be valid, make a dummy.
         CTxOut newTxOut(tx.vout.back().nAsset.GetAsset(), 0, CScript() << OP_RETURN);
         tx.vout.push_back(newTxOut);