I like the idea 👍

Maybe we can preserve the exception-like output though? Smth like

diff --git a/src/util.h b/src/util.h
index eb436f7f3..98c924328 100644
--- a/src/util.h
+++ b/src/util.h
@@ -101,7 +101,9 @@ std::string SafeStringFormat(const std::string& fmt, const Args&... args)
     try {
         return tinyformat::format(fmt, args...);
     } catch (std::runtime_error& e) {
-        return tinyformat::format("****TINYFORMAT ERROR**** - err=%s, fmt=%s", e.what(), fmt);
+        std::string message = tinyformat::format("\n****TINYFORMAT ERROR****\n    err=\"%s\"\n    fmt=\"%s\"\n", e.what(), fmt);
+        fprintf(stderr, "%s", message.c_str());
+        return message;
     }
 }
 

Also, there is another way to crash things while formatting - strprintf ;) Fixing this would require injecting SafeStringFormat (logic) into tinyformat.h (which is the way Bitcoin Core did this, see // Added for Bitcoin Core at the eof) OR moving #define strprintf out of tinyformat.h into util.h (#define strprintf SafeStringFormat) and swapping all #include "tinyformat.h" with #include "util.h" (which makes things a bit cleaner but can cause conflicts on future backports).

Applied the suggested changes to the PR. In regard to strprintf: I considered doing the same for it as well in the beginning, but then decided to not do it. The reason is that LogPrintf is solely used for debugging and has no influence on anything else (unless it crashes :D), while strprintf might actually cause real bugs. Remember when we used strprintf to sign messages? That one was an example where this logic could have caused serious issues if someone would have forgotten a parameter to strprintf. Better to crash in these cases.