CommitWatch RSS
MC
← Developer activityStrong match

Matt Corallo

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

19 commits1 monitored projects3 candidates0 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to Matt CoralloA visual map of monitored and externally discovered repositories.MCdeveloper19rust-lightning
Monitored evidence

CommitWatch projects

rust-lightningLightning Dev Kit19 commits3 candidates0 high risk
External discovery

Other public projects

No external sample loaded yet.

A verified GitHub handle is needed before external discovery.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Moderate 69 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Apply the unfunded channel peer limit to all unaccepted channels

This commit fixes a rate-limiting bug in the Lightning Dev Kit (LDK) that let a single peer bypass the cap on how many different peers can have unfunded (not-yet-funded) channels open. Previously, if a peer sent multiple channel requests q…

Denial-of-service resource exhaustion via rapid inbound channel open requestsLogic error in rate-limiting conditionRegression test added for the bypass scenario
56a4ee43by Matt Corallo+87−62 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Expose DNS query failure on invalid proofs or bad BIP 353 records

This commit changes how a Lightning node handles DNS proof responses for human-readable names (like BIP 353 addresses). Previously, if a DNS proof was invalid, expired, or didn't contain a usable Bitcoin offer, the code silently returned n…

Change from silent None to explicit Err failure reporting for invalid/expired DNSSEC proofsPending resolution state is now cleaned up and failed requests are surfaced when all query contexts are exhaustedValid proof with no usable BIP 353 record or BOLT 12 Offer now returns failure instead of hanging
204134c0by Matt Corallo+102−571 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Upload new fuzz corpus entries as a short-lived CI artifact

This commit changes a CI workflow for the rust-lightning project. It stops trying to push new fuzz test inputs directly to a corpus repository from automated test runs, and instead uploads them as a temporary artifact that a separate sched…

b9f55b6cby Matt Corallo+52−451 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ci: don't double-assign reviewers, support manual assignment runs

This is a routine update to the project's automated reviewer-assignment workflow. It prevents the bot from accidentally adding a second random reviewer when one is already assigned, and adds a manual trigger so maintainers can request an a…

24651a1aby Matt Corallo+73−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add workflow to assign a random reviewer on new PRs

This commit adds a harmless automation script that randomly picks a code reviewer when a new pull request is opened. It does not change any payment, cryptography, or network code, and it does not introduce any obvious security flaw.

Uses pull_request_target, but only for API write access and does not check out PR codeNo execution of untrusted code from the pull requestNo changes to cryptographic, networking, or payment-handling logic
311a74cfby Matt Corallo+46−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Pass commit context to codecov explicitly in coverage job

This commit is a routine CI workflow fix. It tells the Codecov coverage tool the correct repository, commit hash, branch, and pull request number because the project's Forgejo-based CI environment isn't on Codecov's auto-detection list. Th…

4f884af2by Matt Corallo+17−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Comment the codecov report link on PRs

This change adds a CI workflow step that automatically posts or updates a link to a code-coverage report on pull requests. It is purely a developer-convenience automation and does not touch any production code, cryptography, networking, or…

51d0a4f8by Matt Corallo+29−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Use preinstalled rustup instead of curling the installer

This commit is a routine cleanup of the project's automated build scripts. It replaces the practice of downloading and running the Rust installer from the internet with using the Rust toolchain manager (rustup) that is already installed on…

c897a448by Matt Corallo+14−145 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Run tor in the background for the tor-connect job

This commit is a routine fix to the project's CI (continuous integration) workflow. It changes how the Tor proxy is started during automated testing so that tests can run on a new runner image that lacks sudo privileges. There is no indica…

7c206895by Matt Corallo+22−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Pin actions/checkout + actions/cache to a full URL and commit hash

This commit hardens the project's automated build and test scripts by replacing loose version tags like 'actions/checkout@v4' with exact commit hashes served from a specific domain. This prevents a compromised or renamed third-party action…

CI/CD supply-chain hardeningAction reference pinning to immutable commit hashUse of explicit action mirror URL
3a56fcc2by Matt Corallo+19−196 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add Forgejo Actions workflows mirroring GitHub CI

This commit adds new Forgejo-based CI/CD workflow files that mirror the project's existing GitHub Actions. It does not change any application code, cryptographic logic, or user-facing behavior. It is purely an infrastructure change to run …

93ac5802by Matt Corallo+640−06 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add an auto-generated unicode character category file

This commit replaces a hand-maintained list of suspicious Unicode characters with an automatically generated list based on official Unicode data. It also starts blocking unassigned Unicode code points. The change is a hardening improvement…

Hardens Unicode sanitization by switching from a static, hand-curated format-character table to an auto-generated table covering all General_Category=Other assigned code pointsAdds blocking of unassigned Unicode code points (Cn) in untrusted-string display outputAdds CI automation to detect stale Unicode tables and file an issue
65e8cc8dby Matt Corallo+1139−345 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 93 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Attempt to unblock blocked monitor updates on startup

This patch fixes a Lightning node startup issue. When a multi-part payment is claimed, the node temporarily blocks certain channel updates until all parts of the payment are safely recorded. Those temporary blockers are intentionally not s…

Fixes a liveness/progress issue in channel monitor update processing after restartBlocked monitor updates could prevent preimage propagation to channel monitorsPotential funds-availability or channel-stall risk if updates remain blocked
b0c312dbby Matt Corallo+20−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Switch to ldk-fuzzing-corpus repo rather than CI cache

This change only moves the project's fuzzing test data from a GitHub Actions cache into a separate public repository. It updates CI scripts to clone that repository, copy files into place, and open pull requests with any newly discovered f…

efa95b49by Matt Corallo+148−302 files
No security note in commit
Open full analysis →Source commit ↗
Informational 20 AI analysisMessage 58 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Rename `BestBlock` to `BlockLocator`

This commit is a straightforward rename of the Rust type `BestBlock` to `BlockLocator` across the rust-lightning codebase. The struct's fields, serialization format, and behavior are unchanged; only identifiers, comments, and documentation…

dcba68d2by Matt Corallo+189−18422 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Include recent blocks in the `synchronize_listeners`-returned cache

This patch fixes a bug in rust-lightning's initial blockchain synchronization where the header cache returned to callers was often nearly empty. The cache is meant to keep recent block headers so the node can handle chain reorganizations a…

Header cache eviction during initial sync could leave node without recent headersMissing recent headers impairs safe reorg handling after startupNew `retain_on_disconnect` flag changes cache eviction semantics during synchronization
74e1da3cby Matt Corallo+40−72 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Replace `Cache::block_disconnected` with `blocks_disconnected`

This commit is a follow-up code cleanup in rust-lightning's block synchronization module. It changes how the code handles blockchain reorganizations (when the chain temporarily forks and then switches to a different branch). Previously, th…

API semantic alignment after prior listener disconnect changeRemoval of per-block disconnect tracking in favor of fork-point notificationNo explicit security bug, CVE, or vulnerability description in commit
8b9ccb64by Matt Corallo+19−262 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Pass a `BestBlock` to `init::synchronize_listeners`

This commit changes how a Bitcoin Lightning node (LDK) recovers after a restart when the blockchain has split/reorganized. Previously, the node only remembered its last known block hash. If that block was no longer available from the block…

Denial-of-service / node bricking: prior behavior could leave a node unable to locate the fork point after a reorg if the synced block source changed or resyncedData structure change: `BestBlock` now stores recent block hashes to aid fork-point resolutionNew fallback resolution path: `find_difference_from_best_block` walks previous block hashes with height hints
2664d599by Matt Corallo+93−334 files
No security note in commit
Open full analysis →Source commit ↗
Low 33 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Send BroadcastChannelAnnouncements via the broadcast queue

This commit fixes an internal consistency bug in LDK (a Lightning Network implementation in Rust). When a new block created a channel announcement while a peer was offline, the announcement was placed in that specific peer's queue. After a…

Fixes assertion failure / potential panic on peer reconnection (denial-of-service vector)Moves broadcast messages from per-peer state to global broadcast queue, reducing stale-state riskChanges behavior of message delivery ordering observable by tests
6da89c22by Matt Corallo+29−283 files
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →