CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24903Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 97 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

build(core): fix NFC feature propagation at emulator

This is a build-system-only change that moves where the NFC feature flag is defined so the emulator compiles correctly. It does not change any runtime behavior, user-facing functionality, or security logic.

1be155c0by Roman Zeyde+3−43 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 50 · Thin
SW SparrowSparrow Wallet BitcoinHardware integrationSoftware wallets

clear a replacement transaction when a utxo it spends is frozen rather than silently removing the input

This change fixes a bug in Sparrow Wallet where freezing a coin (UTXO) that was being used in a replacement transaction could silently remove the input and accidentally break the transaction's privacy-related outputs. Now, if removing the …

Behavioral fix preventing silent mutation of in-flight replacement transactionsDefensive copying of mutable UTXO collections to avoid side effectsGuard condition tied to isSafeToAddInputsOrOutputs for replacement transactions
b7902f54by Craig Raw+17−61 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 69 AI analysisMessage 58 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

Merge pull request #10929 from spesmilo/fix_trampoline_forwarding

This commit fixes how Electrum handles Lightning trampoline forwarding and zero-conf channels. Previously, a forwarding node could be tricked into forwarding a partial/incomplete payment set, or could open risky zero-conf channels while al…

Fixes incomplete HTLC-set handling that could allow premature trampoline forwardingPrevents forwarding wallets from accepting zeroconf/JIT channels, reducing theft riskTightens zeroconf feature signaling to avoid advertising support to untrusted peers
5f5439a4by ThomasV+98−464 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
KS KeystoneKeystone 3 firmware BitcoinHardware wallets

pin to new release config (#2285)

This commit only updates a Git submodule pointer (keystone3-firmware-release) from one commit hash to another. There is no code change visible in the diff, no description of what the new release config contains, and no security-related inf…

bc01c889by Aaron Chen+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36168: PSBT: Make input/output `Merge()` methods return void

This commit is a straightforward code cleanup in Bitcoin Core's Partially Signed Bitcoin Transaction (PSBT) handling. It changes two internal methods from returning true (always, with no way to fail) to returning nothing at all, and remove…

33a363eaby merge-script+6−142 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 28 · Opaque
EL ElectrumElectrum BitcoinSoftware wallets

minor fix (f321x)

This is a one-line bug fix in Electrum's Lightning Network payment handling. The code was comparing a whole status object to a resolution value, which would always be false. The fix compares just the resolution status correctly. This likel…

Lightning Network payment failure path logic errorIncorrect comparison between object and enum valueChange affects error code returned to remote peer for failed HTLCs
fac84c34by ThomasV+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 57 · Thin
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(core): fix a small comment typo

This commit fixes a grammar typo in two code comments/docstrings, changing 'Receive a BLE events' to 'Receive a BLE event'. It does not change any executable code, behavior, or security properties.

578e011bby Roman Zeyde+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(trezorlib): improve terse headertool output (secmon)

This commit only changes how a command-line tool prints information about secure-monitor firmware headers. In non-verbose mode it now shows the device model and version instead of dumping every header field. There is no change to security …

8a4e0dfbby cepetr+17−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 45 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

crypto: reduce crypto.h header weight

This is a large code cleanup commit that reorganizes Monero's cryptographic headers to reduce how much code gets pulled in when including crypto.h. It removes a custom 'POD_CLASS' macro in favor of plain C++ structs, moves some hash-relate…

Touches cryptographic primitives (hash functions, ring signatures, ChaCha key derivation, secret-key handling)Removes inline definitions of hash wrappers, converting them to out-of-line functions in new hash.cppChanges how scrubbed/mlocked array types are spelled (scrubbed_arr alias removed)
c7a2d4f6by jeffro256+313−22437 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

test(clear_signing): native currency address in token formatter

This commit only adds a new test case for the Trezor hardware wallet's Ethereum transaction-signing feature. It records a sample Aave 'withdraw ETH' transaction and its expected on-screen snapshots across many languages. There is no change…

c20785e7by PrisionMike+49−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): support native currency address in token formatter

This commit adds support for passing a 'native currency address' into an Ethereum token amount formatter used for Trezor's clear-signing feature. It is a small feature addition with no obvious security bug. There is no evidence in the comm…

No security-relevant keywords in commit title or messageNo changelog entry providedNo input validation changes observed
f855babbby PrisionMike+4−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(clear_signing): support native currency addresses

This commit adds a new optional data field called native_currency_address to the message format used for Trezor's Ethereum clear-signing feature. It only changes protocol definitions and generated serialization code across Python, Rust, an…

Adds a new repeated bytes field to an existing protobuf message used in Ethereum transaction display metadataNo bounds checks or validation logic are visible in the diff because no consumer code is includedGenerated protobuf code handles the field with standard repeated-bytes serialization
eec97d43by PrisionMike+37−124 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →