We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.
AI analysis is published as generated. Community notes appear after human validation.
This commit is described as a routine CI (continuous integration) update with only one line changed in a release-related file. No code changes affecting wallet security, cryptography, or user funds are visible, and no security relevance is…
39cfff13by soralit+1−11 fileThis commit is a straightforward internal code refactor for Ledger hardware wallet support. It changes the data structure returned when signing a Bitcoin transaction from a simple tuple of raw bytes to a more descriptive object that can ca…
e86440aeby Sjors Provoost+73−274 filesThis commit updates the Ledger hardware wallet driver in HWI so it can correctly store Taproot script-path signatures in a PSBT, not just key-path signatures. Previously, the code had a placeholder that always treated any Taproot signature…
fc206450by Sjors Provoost+5−31 fileThis commit fixes a class of low-level memory-safety bugs where Rust code was given buffers containing uninitialized bytes. Rust's rules require every byte of a slice to be initialized, even if the function will overwrite them. Passing uni…
511018eaby benma's agent+52−2713 filesThis commit fixes a critical random-number bug in COLDCARD hardware wallets. The device was accidentally using a weak, software-based fallback random generator instead of its secure hardware one when creating Bitcoin seed phrases. Because …
ca724637by Peter D. Gray+60−711 filesThis commit is a routine internal refactoring in the rust-bitcoin SHA-256 hashing code. It exposes the SHA-256 initial value (IV) as a public constant and renames an internal helper function so it can start from any midstate rather than al…
dc21841bby Andrew Poelstra+39−143 filesThis commit adds new helper methods to the SHA-256 'Midstate' type in the rust-bitcoin hashes library. These helpers let callers compute SHA-256 intermediate states inside 'const' contexts (compile-time constants). It is a routine feature …
7d8f06d2by Andrew Poelstra+80−72 filesThis commit adds a new public-key compression function to a cryptographic library and updates the existing decompression function so both can accept already-compressed or already-uncompressed keys as input. It also adds tests and language …
03351cc9by Jon Griffiths+92−1610 filesThis commit tightens signature validation in a cryptographic library. It now rejects malformed DER-encoded signatures that are longer than allowed, or where one of the signature numbers (R or S) is zero. Previously, the underlying secp256k…
e7894ee6by Jon Griffiths+6−11 fileThis commit fixes a bug in the Lightning Dev Kit where, after a disconnection, a node could fail to retransmit a 'splice_locked' message to a peer that was still waiting for transaction signatures. Without this retransmission, the two peer…
5434015bby Wilmer Paulino+266−12 filesThis is a cosmetic user-interface change for the Trezor hardware wallet. It adds a trailing colon to labels shown when a user is reviewing Ethereum EIP-7702 authorization or revoke actions. There is no security impact: no code logic, crypt…
243a9d21by Roman Zeyde+218−2003 filesThis commit fixes a bug in Electrum's support for Trezor hardware wallets. After a Trezor session times out or is closed, Electrum now forgets the old session ID. Previously it kept the stale session ID, so the next attempt to sign a trans…
071b1e24by f321x+8−51 fileA quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.