CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24872Commits captured
21194AI analyses
60High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21194 analyses
Highest risk·RSS
Low 37 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

omit a paynym contact whose payment code does not parse rather than keeping it with a null code or failing the whole paynym response

This commit fixes a bug in Sparrow Wallet's PayNym (BIP47 reusable payment code) contact handling. Previously, if a single contact in your PayNym following/followers list had a malformed payment code, the app either kept a broken contact w…

Null payment code previously stored in contact objectPotential NullPointerException or downstream dereference of null PaymentCode in contact lists/searchWhole PayNym response could fail on one malformed contact
94ebb849by Craig Raw+43−114 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

skip the exchange currencies request in offline mode in the desktop and terminal general settings

This change stops Sparrow Wallet from trying to fetch live fiat-currency exchange rates when the user has explicitly chosen 'offline mode'. Instead of making a network request that is doomed to fail, it now reuses the currency already save…

Avoids unnecessary network egress in offline modeReduces error/warning noise for expected offline behavior
b91f7993by Craig Raw+15−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 91 · Strong
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

Merge rust-bitcoin/rust-bitcoin#6850: Use stacked attributes for feature conjunctions

This commit is a code-style cleanup with no security impact. It changes how Rust conditional-compilation attributes are written, replacing combined `#[cfg(all(...))]` checks with stacked `#[cfg(...)]` attributes, following the project's ow…

ab7652b3by Andrew Poelstra+14−73 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

chore: lints cleanup and localization

This commit is a routine cleanup: it changes some quote styles in Dart code from single to double quotes, adds a blank line, and updates translated text strings in several language files. There is no security-relevant change.

87f372d6by Blazebrain+16−1512 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 30 · Opaque
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

chore: cleanup

This commit is a routine UI cleanup. It swaps a custom checkbox drawing for a shared checkbox widget, changes two icon colors from light blue to white, and reorders some translated text strings in the Brazilian Portuguese language file. Th…

3b9ed6f4by Blazebrain+8−254 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

skip addresses already given out under a label and widen the gap limit on an explicit advance in the terminal receive dialog

This commit fixes two related Bitcoin wallet behaviors in Sparrow. First, when you ask for a new receive address, the wallet now skips any address that already has a label, because a label means that address was already given to someone. P…

Address reuse prevention: labeled-but-empty addresses are now skipped consistently across desktop and terminal receive flowsGap-limit widening on explicit advance reduces risk of missing funds during wallet recovery/rescanLogic centralized in WalletForm to reduce UI-specific divergence
cae870ceby Craig Raw+85−164 files
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

cap bbqr display and pdf encodings at the 1295 parts the header can number, using larger parts for data that needs more rather than emitting a sequence that cannot be reassembled

This commit fixes a bug in Sparrow Wallet's BBQ QR code format. Previously, if a large transaction or data blob needed more than 1,295 QR-code-sized pieces, the app would generate pieces with impossible sequence numbers that could not be r…

Integer/sequence-number overflow-like limit violation in a data-encoding protocolPotential denial-of-service or data-integrity failure when exporting large transactions via QRRound-trip unit test added to prevent regression
4b5326d8by Craig Raw+27−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

map transaction hex witness segments by the segwit flag and treat an input with no witness as empty, matching the serializer rather than relying on it having filled them in

This commit fixes how Sparrow Wallet's transaction hex viewer highlights the parts of a SegWit Bitcoin transaction. Previously, if a SegWit transaction contained an input with no witness data, the viewer would skip highlighting that input'…

UI display desynchronization between parsed transaction and raw hexIncorrect handling of BIP-141 SegWit witness serializationPotential for user confusion or misreading of transaction bytes
0030aee2by Craig Raw+11−121 file
No security note in commit
Open full analysis →Source commit ↗
High 72 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: refuse channels whose channel_id is already in use

This update fixes a crash bug in Core Lightning. A malicious or careless peer could open a new Lightning channel using the same funding transaction details as an old, forgotten channel. Because the channel ID is derived from those details,…

Remote peer can trigger an assertion abort and persistent crash-on-restart by reusing a funding outpointDenial-of-service via protocol-level channel open, no authentication bypass requiredFix adds explicit duplicate channel_id rejection across all channel-opening paths
7c6926c1by cdecker+60−77 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

hold unit format decimal formatters per thread rather than sharing one instance between the export task and table cells

This change fixes a thread-safety bug in how Bitcoin amounts are formatted for display and export. Previously, the same number-formatting objects were shared between background export tasks and the on-screen transaction table. Because thos…

Thread-safety fix for shared DecimalFormat instancesConcurrent use between background export task and UI table cellsPotential data corruption or incorrect numeric formatting in outputs
e8d82c49by Craig Raw+50−761 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 50 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

pytest: channels reusing a funding outpoint must not crash us

This commit adds a test showing that Core Lightning can crash if a node's database ends up with two channels sharing the same internal channel ID—one already closed and another later closed with the same ID. The test is currently marked as…

Denial-of-service via local database state corruptionDaemon crash on startup after duplicate channel_id enters closed channelsDatabase uniqueness/lookup assumption violation on channel_id
8e94554bby cdecker+44−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

hsmd: don't report forced channel secrets as memleaks

This is a tiny developer-only fix for a memory-leak false alarm. When running tests with a special developer flag that forces fixed channel secrets, those secrets were wrongly reported as leaked memory during test teardown. The patch tells…

Developer-only test option, not reachable in production buildsNo change to secret handling, cryptography, or access controlFixes a false-positive memleak report, not an actual memory leak
2f56c235by cdecker+2−01 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →