CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24896Commits captured
21204AI analyses
57High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21204 analyses
Highest risk·RSS
Informational 21 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

qt: fix onchain invoice dialog exc for script outputs

This commit fixes a simple user-interface crash in Electrum's desktop (Qt) wallet. When a user double-clicked a saved invoice that pays to a raw Bitcoin script (rather than a normal address), the invoice details dialog threw an error and f…

UI crash / unhandled exceptionNoneType string concatenation errorDefensive null-safe display helper
539ab9e9by f321x+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

refresh a node when its script hash status returns to an earlier value, retiring the mitigation for electrs < 0.9.0

This commit changes how Sparrow Wallet tracks Electrum server notifications about Bitcoin address activity. Previously, the app remembered every status value it had ever seen for each address and ignored repeats of any earlier value. Now i…

State desynchronization between wallet client and Electrum serverRetired historical-status whitelist could cause stale transaction data to persistMempool eviction/replacement or reorg could return scripthash status to earlier value
70e56a5bby Craig Raw+125−213 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 38 · Opaque
LD LedgerLedger Bitcoin app BitcoinHardware wallets

Version bump to v2.5.1

This commit is a routine version bump from 2.5.0 to 2.5.1 for the Ledger Bitcoin app. It only updates the changelog and Makefile version number. No code changes are present in the diff, and no security fixes or vulnerabilities are describe…

e7618c98by Ilya Artemov+5−42 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 57 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35445: wallet, descriptor: Revert `StringType::COMPAT` for Miniscript expressions and drop the concept of a Descriptor ID that can be validated

This Bitcoin Core update fixes a wallet bug where certain newer-style descriptors (called Miniscript) could not be loaded after being created in older versions. The root cause was an internal ID that was computed differently for Miniscript…

Fixes wallet load failure (DBErrors::CORRUPT) for Miniscript descriptors created in prior versionsRemoves validation of stored descriptor ID against recomputed hashSwitches descriptor equality checks from hash comparison to canonical string comparison
fb26bc9cby merge-script+293−19518 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 55 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

do not offer copy and qr export actions for an extended private key pasted into the keystore xpub field

This commit fixes a UI behavior in Sparrow Wallet where a user could accidentally paste a secret extended private key (xprv) into the public-key-only 'xpub' field of a watch-only wallet. Previously, the app treated it as valid, offered cop…

Private key material accepted in public-key field before fixCopy and QR export actions exposed for private key materialValidation now rejects extended private keys in watch-only xpub field
34f27fd8by Craig Raw+6−31 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 56 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

require the policy line and check the declared cosigner count when importing coldcard format multisig wallets

This commit tightens how Sparrow Wallet imports multisig wallet files from Coldcard. Previously, if the file omitted the 'Policy' line or listed fewer cosigner keys than the policy required, Sparrow would silently assume a default 2-of-2 s…

Input validation added to wallet import parserPreviously silent default fallback for missing policy removedMismatch between declared cosigner count and supplied keys now rejected
5aa262eeby Craig Raw+53−44 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 72 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

fix: switch "seed" to "recovery phrase" in more places and handle edgecases for seed verification reminders

This commit is mostly a user-interface wording change: it replaces the word 'seed' with 'recovery phrase' across many languages and fixes a few related navigation and reminder-handling edge cases. The code changes do not introduce obvious …

MobX reaction disposers added to prevent listener leaks (minor cleanup, not a vulnerability fix)Seed backup reminder flag now reverts in memory if save() fails (defensive consistency)Bitcoin seed flow now clears the route stack instead of pushing a new route (prevents accidental back-navigation to seed screen)
6bb52fd7by Blazebrain+448−44539 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 50 · Thin
SW Stack WalletStack Wallet MoneroPrivacy protocolsSoftware wallets

flutter 3.47 and dart 3.13 minimum and associated changes

This commit updates the Stack Wallet app to require newer Flutter and Dart versions. Most changes are routine housekeeping: reformatting code, removing the 'final' keyword from function parameters to match new language rules, updating iOS/…

Dependency version bump: flutter_libsparkmobile 0.1.0 -> 0.2.0 (git ref fe505c29f5dbb5dd94fb986e509506be9e2f37e7)Platform minimum version raised: macOS 10.15 -> 12.0, Flutter 3.44.9 -> 3.47.2, Dart 3.12 -> 3.13New non-null assertions added in wallet gap scanning (bitcoin_frost_wallet.dart, electrumx_interface.dart)
2dc2473bby Julian+261−12720 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 58 · Thin
BT btcsuitebtcd BitcoinNode implementations

Merge pull request #2601 from vbrekher/fix/psbt-multi-a-finalizer

This change fixes how btcd finalizes a specific type of Bitcoin Taproot smart contract called multi_a. Previously, the finalizer simply stacked signatures in the order they appeared in the PSBT file. For multi_a contracts, signatures must …

Incorrect witness ordering for multi_a tapscripts could produce invalid Bitcoin transactionsNew parser enforces standard multi_a template and rejects unsupported CHECKSIGADD constructionsDuplicate and non-matching signatures now return ErrInvalidPsbtFormat
ca0bb02cby Olaoluwa Osuntokun+366−93 files
No security note in commit
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 62 · Adequate
CW Cake WalletCake Wallet / Monero.com MoneroPrivacy protocolsSoftware wallets

refactor: improve locale handling fixing issues with yoruba, hausa and guarani languages

This commit fixes app crashes and broken number formatting that could happen when the wallet was set to certain less-common languages such as Yoruba, Hausa, or Guarani. It makes the app fall back to English formatting when the device's loc…

Locale fallback prevents unhandled NumberFormat exceptionsSaved language code is now validated against the supported list before restorationNo cryptographic, authentication, or authorization changes observed
7e0f0fc3by Blazebrain+68−449 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 95 · Strong
BT btcsuitebtcd BitcoinNode implementations

psbt: test multi_a excess signature handling

This commit only adds a new unit test for the PSBT finalizer. It checks that when a Bitcoin Taproot multi-signature (multi_a) input has more valid signatures than required, the finalizer picks exactly the required number and leaves the ext…

26ee1cc8by Olaoluwa Osuntokun+33−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 95 · Strong
BT btcsuitebtcd BitcoinNode implementations

psbt: test multi_a signature input ordering

This commit only adds a new test case to the project's test suite. It does not change any production code. The test verifies that a PSBT (Partially Signed Bitcoin Transaction) finalizer correctly orders signatures for a specific type of Ta…

Regression test for Taproot multi_a signature orderingNo production code changesDefensive guard against incorrect finalizer implementations
709069b9by Olaoluwa Osuntokun+36−131 file
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →