OP_RETURN treated as change output

[tsusanka]

Impact: Theft of Funds
Scalability: Remote (Interaction)
Severity: Critical
Fixed in: 1.9.0 + 2.3.0
Reported by: Saleem Rashid
Date reported: 2020-03-02

Details

The confirmation dialog for the OP_RETURN output wasn't displayed in case the address_n field was provided.

Read more

Official blogpost