CommitWatch RSS
Continuous public-repository analysis

Open source.
Not open secrets.

We watch what security-critical projects change—then translate the code into clear, independent intelligence anyone can understand.

Explore the watch feed ↓See how scoring works →
34Projects watched
24903Commits captured
21206AI analyses
53High-risk findings · 30d
Active security advisories
Critical

Core Lightning v26.06.9: urgent loss-of-funds security update

Core Lightning says v26.06.9 fixes a newly reported vulnerability that can lead to loss of funds. The release also contains security fixes in channel reestablishment, splicing, HTLC shutdown handling, onion and on-chain handling, gossip range queries, runes, configuration, and several remote-crash and hardening fixes.

Affected: Every Core Lightning node running v26.06.8 or earlier is affected, according to the vendor. Technical tests for the security fixes are temporarily withheld to slow exploit development while operators upgrade.

Action: Upgrade to Core Lightning v26.06.9 immediately. Download the release from https://github.com/ElementsProject/lightning/releases/tag/v26.06.9, verify the appropriate signed SHA256 manifest and checksums for your architecture, install it, restart lightningd, and confirm the running version.

Read source ↗
Critical

Liquid Network: ~4,000 BTC withdrawn in critical peg incident

Liquid confirms that purported white-hat actors withdrew roughly 4,000 BTC (about $320 million) from its federation wallet through the SideSwap PAK. Liquid says the PAK and other federation keys were not compromised. The actors have not yet returned the funds. Independent public analysis points to a newly introduced range-proof cache-key flaw, but Liquid has not yet published its root-cause report.

Affected: The L-BTC peg and Liquid federation reserves are affected. Bridge nodes are disabled, the sidechain is paused, and exchanges have suspended L-BTC deposits and withdrawals. Liquid says other issued assets, including USDT, DePix, and RWAs, are unaffected; Bitcoin's base layer is not affected.

Action: Do not initiate Liquid peg-ins, peg-outs, swaps, or L-BTC exchange deposits or withdrawals while the network is paused. Follow official Liquid and Blockstream updates, and treat L-BTC peg exposure as impaired until reserves are restored and a verified fix and incident report are published.

Read source ↗
Critical

BTCPay Server: actively exploited LND credential theft

BTCPay confirms that an unauthenticated remote attacker could obtain LND .macaroon credentials, take control of affected LND nodes, and move funds. The vendor reports confirmed exploitation and stolen funds.

Affected: BTCPay Server versions before 2.4.2, including 2.4.2 release candidates, when used with LND. BTCPay says other Lightning implementations are not exposed to this specific credential risk.

Action: Update to BTCPay Server 2.4.2 and LND 0.21.1 immediately, review node activity, and rotate credentials. If you cannot update now, take the affected server offline.

Read source ↗
The watch feed

Changes worth understanding

AI analysis is published as generated. Community notes appear after human validation.

21206 analyses
Highest risk·RSS
Informational 15 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

test(clear_signing): add test fixture for external threshold message

This commit only adds a new test case for the Trezor Ethereum clear-signing feature. It records an expected transaction signature and screen snapshots for an Aave 'repayWithPermit' operation. The actual human-readable definition file neede…

3c4fdb49by PrisionMike+48−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(clear_signing): add threshold message support

This commit adds a small feature to Trezor's Ethereum 'clear signing' code that lets a data format specify a custom message to show when a token amount exceeds a configured threshold. Previously the device always displayed the word 'unlimi…

UI display string now configurable via external ERC-7730 metadataNo sanitization of threshold_message is shown in the diffDefault fallback to existing translated string preserves prior behavior
b73d87efby PrisionMike+15−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36176: wallet: avoid a crash when creating a wallet with -nosettings

This commit fixes a crash in Bitcoin Core's graphical wallet (Bitcoin-Qt) when creating a wallet while the user has disabled dynamic settings with -nosettings. Previously, the program would terminate with an uncaught exception because it t…

Denial of service via local configuration: -nosettings triggers uncaught exception in GUIUncaught std::logic_error leading to application terminationRPC state inconsistency: error returned after wallet state mutation
013b0b2dby Ava Chow+34−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

chore(clear_signing): add threshold message support

This commit adds a new optional text field called 'threshold_message' to the data structure used for Ethereum clear-signing. It only updates protocol definitions and generated code in Python, Rust, and the core firmware. There is no change…

bc90e0d8by PrisionMike+73−124 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 72 · Adequate
TZ TrezorTrezor firmware BitcoinHardware wallets

feat(ui): assert property list is never empty.

This commit adds a runtime check (assert) that ensures a UI function for confirming on-screen properties is never called with an empty list. It also changes the expected input type from a generic iterable to a sequence and converts a coupl…

Defensive assertion added to UI confirmation pathType narrowed from Iterable to Sequence to support emptiness check and repeated iterationCaller sites converted from generator/tuple to list to satisfy Sequence contract
fc09afceby PrisionMike+17−96 files
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36113: psbt: fix rendering for invalid long sighash type field

This change fixes a display bug in Bitcoin Core's PSBT decoder. When a PSBT contains an invalid 32-bit sighash type value, the old code silently truncated it to one byte and then showed a friendly name for that truncated value, which could…

Informational UI/rendering bug in RPC outputPotential user confusion from incorrect sighash type labelNo consensus, network, or wallet enforcement change
2ed4be47by Ava Chow+18−44 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 50 · Thin
BB BitBoxBitBox02 firmware BitcoinHardware wallets

Merge remote-tracking branch 'agent/benma-agent/validate-py-antiklepto-signatures'

This commit adds extra safety checks in the BitBox02 Python library for ECDSA signatures used in Bitcoin and Ethereum signing. It now validates that signatures have the correct length, use valid numbers, and use the safer low-S form. It al…

Defensive validation added for ECDSA signature format and low-S encodingRecovery ID range validation added for recoverable signaturesAnti-Klepto verification now rejects malformed/malleable signatures before nonce verification
0d1a7997by Marko Bencun+152−65 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 25 AI analysisMessage 95 · Strong
TZ TrezorTrezor firmware BitcoinHardware wallets

fix(core/xtask): pad a combined image's erased regions as erased

This commit fixes a build-time tooling bug in Trezor's firmware build helper. When creating a combined firmware image, the tool was filling unused gaps between sections with 0x00 bytes. One specific gap (the UCB region) is erased by the bo…

Boot chain behavior mismatch between host-generated image and device-erased flashFactory verification failure due to byte-level image divergence after first bootHost-side build tooling correction with no firmware/bootloader runtime change
7d423838by tychovrahe+84−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

crypto: reformat with new rustfmt

This commit is purely a code formatting change. It uses a newer version of rustfmt to re-wrap long match-arm expressions onto multiple lines in a single file. No logic, behavior, or security properties of the code were changed.

d69e1768by satsfy (Renato Britto)+6−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 60 · Adequate
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

hashes: mark deprecation on cpufeatures macro

This commit is a routine code cleanup. It changes the compiler warning suppression attribute from `#[allow(deprecated_in_future)]` to `#[allow(deprecated)]` because the upstream `cpufeatures` crate now triggers a current `deprecated` warni…

2f03a216by satsfy (Renato Britto)+5−61 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
RB Rust Bitcoinrust-bitcoin BitcoinCryptographic libraries

p2p: remove else block, return early on conn err

This is a minor code cleanup in an example program. It changes how a failed network connection is handled so the program exits early with an error message instead of silently doing nothing. There is no security issue here.

b4bec571by satsfy (Renato Britto)+26−271 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
XMR Monero ProjectMonero Cryptographic librariesMoneroNode implementationsPrivacy protocols

crypto: init p3 double scalarmult result when both scalars are zero

This commit fixes a bug in Monero's cryptographic code where a specific function could return an uninitialized result when both input numbers (scalars) are zero. The fix explicitly sets the result to the point-at-infinity (the elliptic-cur…

Uninitialized/undefined output in elliptic-curve scalar multiplication routineFix explicitly initializes result to identity point before computationAdded regression test for zero-scalar edge case
1c8f96a9by Thomas+20−02 files
No security note in commit
Open full analysis →Source commit ↗
01
Why commit watching?

Security should leave a paper trail.

A quiet fix may be responsible caution—or it may leave users unaware that their assets were ever at risk. CommitWatch preserves the evidence, adds context, and tracks whether vendors disclose, acknowledge, and learn.

Why we built this →