CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
26341Commits captured
21957AI analyses
47High-risk findings · 30d
Active security advisories
Critical

Electrum 4.8.3: malicious-server RBF theft in the wild

Electrum confirms malicious servers are exploiting a transaction-replacement attack in the wild. A server can suppress a user's newly broadcast transaction, substitute an invalid conflicting transaction paying a lookalike attacker address, and cause Electrum to display it. If the user manually fee-bumps that transaction, the wallet can sign the attacker's replacement. Electrum reports two victims and one confirmed loss of funds.

Affected: Electrum versions before 4.8.3 when connected to an untrusted or malicious Electrum server. Users who connect only to a server they trust, such as their own server, are not affected according to the vendor.

Action: Upgrade to Electrum 4.8.3 immediately, download only from electrum.org, and verify the release signatures. Until upgraded, do not fee-bump an unexpected or substituted transaction and verify every output address and amount before signing any transaction.

Read source ↗
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21957 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 73 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

display "generating transaction" as a full-modal overlay (#3740)

This commit changes the user interface so that a 'Generating transaction...' loading spinner appears as a full-screen overlay while a transaction is being created. It does not change how transactions are built, signed, or broadcast, and it…

f75a175bby malik1004x+78−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1489 from cypherstack/fix/qr-camera-frame-scaling

This commit fixes the desktop QR code scanner so it can read codes from high-resolution Windows webcams without freezing. It also stops the Windows camera plugin from secretly saving a snapshot to your Pictures folder every time it scans. …

Windows QR scanning no longer writes a JPEG to the user's Pictures folder on every scan (privacy leak removed)Camera preview frames are now captured in memory and scaled before QR decodingAdded blank/repeated-frame detection to detect stalled camera previews
cc99e01bby sneurlax+1020−1048 files
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qml: avoid potential Ok signal by tapping while dialog is closing,

This commit fixes a bug in Electrum's mobile-style QML password dialog. If a user tapped the OK/confirm button while the dialog was already closing, the app could emit an extra 'password entered' signal. That extra signal triggered a crash…

Crash in authentication-related code path (AuthMixin)Duplicate signal emission during UI state transitionUser-interaction race condition (tap while dialog closing)
00f981edby Sander van Grieken+8−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36706: policy: remove unused GetVirtualTransactionInputSize

This commit removes an unused helper function called GetVirtualTransactionInputSize and updates the few remaining callers to use an equivalent calculation directly. It is a routine code cleanup with no security relevance.

ed3d34baby merge-script+1−144 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36494: wallet: reject unknown options in sendall

This change fixes a bug in Bitcoin Core's `sendall` wallet command where misspelled or unknown options in the options object were silently ignored. For example, typing `input` instead of `inputs` would spend all coins instead of only the c…

Silent ignore of misspelled options can lead to unintended full-wallet sweep (`input` vs `inputs`)Silent ignore of misspelled `add_to_wallet` or `psbt` can cause unwanted transaction broadcastFix aligns `sendall` with existing strict option validation in `send`, `fundrawtransaction`, `walletcreatefundedpsbt`, and `bumpfee`
f3cd4e4bby merge-script+37−13 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 73 · Adequate
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

Merge pull request #1491 from cypherstack/fix/desktop-address-book-chooser

This commit fixes a desktop bug where the address-book chooser was empty unless the user first opened the Address Book page. The fix moves the logic that builds the "My Stack" self-contact into a shared service method and calls it from the…

Adds concurrency control (mutex) around contact update to prevent race conditions/overwriteAdds defensive error handling so address generation failures don't crash contact creationPrevents Spark wallets from exposing a transparent fallback address when Spark address generation fails
41e8fab9by Julian+299−1154 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35728: rpc: Properly throw on internal I/O errors in GetTransaction

This Bitcoin Core update fixes a bug where several RPC commands and one REST endpoint would incorrectly tell users a confirmed transaction was missing, when in fact the software had hit a disk-read or index corruption problem. After the pa…

Incorrect error handling conflated I/O/index corruption with absent transactionConfirmed transactions could be reported as missing, misleading wallets and downstream systemsPSBT processing could silently continue without required previous transaction data
fb19fed3by Ryan Ofsky+169−447 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

stop labelling a heavily reused address from freezing the ui, and commit receive tab labels on enter so the whole label propagates

This commit fixes two user-interface bugs in the Sparrow bitcoin wallet. First, it prevents the app from freezing when a user labels an address that has been reused for many transactions. Second, it makes the Receive tab commit the whole l…

Performance fix: batched label updates reduce algorithmic complexity for reused addressesUI consistency fix: Receive tab now commits full label on Enter/focus loss instead of relying on bidirectional bindingNo input validation, cryptography, or privilege changes observed
9ab8e0bbby Craig Raw+220−6914 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36344: wallet: reject duplicate inputs in sendall

This patch fixes a bug in Bitcoin Core's `sendall` wallet RPC command. Previously, if a user accidentally listed the same coin (UTXO) twice in the `inputs` option, the command would create an invalid transaction that counted the coin's val…

Input validation bypass leading to creation of an invalid transactionWallet balance accounting temporarily corrupted (negative nonmempool balance)Denial-of-service-like user impact: funds appear missing until transaction is abandoned
67d9d7feby merge-script+27−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

follow up to address context menu change

This commit only removes code comments and switches a fully-qualified class name to a regular import. There is no change to program logic, user-facing behavior, or security controls. It is a minor cleanup follow-up to an earlier change.

ac1ea56cby Craig Raw+2−93 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

avoid creating a node entry for every utxo table address cell update

This commit is a performance and resource-usage improvement, not a security fix. It changes the way a Bitcoin wallet's user interface builds right-click context menus for address cells in the UTXO table. Previously, every time an address c…

Performance/resource-usage optimization onlyNo change to authentication, authorization, cryptography, or network codeNo input validation or parsing changes
f9bf2c43by Jan Dvořák+34−153 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →