CommitWatch RSS
S
← Developer activityStrong match

SomberNight

Public commit activity attributed with strong match confidence. This page describes observable work, not personal trustworthiness.

351 commits2 monitored projects26 candidates0 high-risk analyses
Project constellation

Where the commits appear

Amber nodes are monitored by CommitWatch. Gray nodes are sampled from authenticated GitHub public commit search and may not represent complete contribution history.

Monitored External sample
Projects connected to SomberNightA visual map of monitored and externally discovered repositories.Sdeveloper350Electrum1Bitcoin Core
Monitored evidence

CommitWatch projects

ElectrumElectrum350 commits25 candidates0 high riskBitcoin CoreBitcoin Core1 commits1 candidates0 high risk
External discovery

Other public projects

No external sample loaded yet.

A verified GitHub handle is needed before external discovery.
Analyzed activity

Recent published watches

Message quality and risk characterize commits, never the person.

Informational 19 AI analysisMessage 96 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

wallet: sign_message: strip whitespaces in GUIs, do not strip in CLI

This commit tidies up how Electrum handles extra spaces around Bitcoin addresses, messages, and signatures when signing or verifying messages. Previously, different parts of the program (desktop GUI, mobile-style GUI, command line) behaved…

Behavior normalization across GUI and CLI interfacesNo cryptographic primitive changedNo privilege boundary crossed
4c3064f5by SomberNight+27−185 files
No security note in commit
Open full analysis →Source commit ↗
Low 42 AI analysisMessage 85 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

wallet.check_sighash: don't assume tx.add_info_from_wallet alrdy ran

This commit fixes a defensive check in the Electrum Bitcoin wallet. Before signing a transaction, Electrum checks whether the transaction uses unusual 'sighash' flags that could allow someone else to move coins unexpectedly. The bug was th…

Sighash sanity check could be bypassed for beyond-gap-limit wallet inputsFix adds defensive deep-copy and wallet-info population inside check_sighashRegression test demonstrates dangerous sighash is now caught even with gap_limit=2
b57327fbby SomberNight+48−02 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 55 AI analysisMessage 68 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

lnpeer: on_ping: drain out-socket buffer

This change fixes a potential denial-of-service weakness in Electrum's Lightning network peer handling. Previously, when Electrum replied to a peer's 'ping' message, it would add the reply to the outgoing socket buffer without waiting to c…

memory exhaustion / DoS mitigationunbounded outbound buffer growth preventedbackpressure added to peer ping/pong handling
9b206576by SomberNight+6−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 93 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

verifier.py: fix CVE-2012-2459: reject left-sibling duplicates

This commit fixes a known Bitcoin weakness (CVE-2012-2459) in Electrum's light-client verification. Because Bitcoin's Merkle tree duplicates the last hash when a level has an odd number of items, an attacker can craft a block proof that ma…

Fixes CVE-2012-2459 (Merkle tree duplicate-node weakness)Adds explicit LeftSiblingDuplicate exceptionStrengthens SPV Merkle proof verification
3d390742by SomberNight+106−262 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 65 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

daemon: set restrictive permission on RPC-server unix domain socket

Electrum's background daemon runs a local control server using a Unix domain socket. Previously, that socket file was created with permissions 0775, meaning any user in the same group could connect to it and potentially control the wallet.…

permission tightening on local RPC socketacknowledged race condition between socket creation and chmodlocal privilege boundary issue (group-writable socket)
9d204abfby SomberNight+8−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 78 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

in GUI mode, only start a limited minimal RPC server

This commit reduces the attack surface of Electrum's built-in remote-control server when running in normal GUI mode. Previously, the RPC server exposed many wallet-related commands; now, in GUI mode on mainnet, it only exposes two safe com…

Reduction of RPC attack surface in GUI modeUnencrypted localhost RPC with config-stored passwordWindows localhost TCP exposure of RPC server
d951a3d2by SomberNight+22−102 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 86 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

daemon: forbid "setconfig" command to change rpcserver settings in-flight

This commit fixes a security issue in Electrum's background daemon (the program that stays running to serve wallet requests). Previously, a user could run a command that would instantly strip the RPC password from a running daemon, leaving…

Authentication bypass via empty RPC passwordIn-flight weakening of daemon security settingsInconsistent security state across daemon restart
0dcef978by SomberNight+16−72 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

locale: don't translate string "Electrum", "BIP39"

This commit removes translation markers from two proper names ('Electrum' and 'BIP39') in a wallet setup wizard dropdown. It is a localization/UI consistency fix with no security relevance.

cf259909by SomberNight+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

locale: don't translate URL, like wtf

This commit removes translation markup from a hardcoded web link in Electrum's 'About' screen. The developer's message warns that translation functions can be risky because malicious or compromised translators could alter URLs or inject ha…

Removal of translation wrapper from rich-text URLDeveloper note explicitly flags _()/qsTr() as potential attack vectorsRichText + external URL opening in QML component
61a6ab1dby SomberNight+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

CI: changed API key for crowdin translations, update notes

This commit is a routine CI maintenance change. The developer rotated a Crowdin translation API key to a new dedicated bot account with fewer permissions and added a comment explaining it. No code behavior changed, and nothing in the commi…

cd802c6eby SomberNight+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 78 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: rpc: manpage: fix example missing `fee_rate` argument

This commit fixes a typo in the documentation example for the `send` RPC command. The example was missing a placeholder for the `fee_rate` argument, which caused the example command to be interpreted incorrectly and produce an error if cop…

Documentation-only correctionNo executable code changedNo RPC behavior or validation logic modified
50cf6838by SomberNight+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

transaction: tx_from_any: rm all whitespaces from str, none from bytes

This commit fixes a bug in how Electrum reads transaction files. Previously, the program would strip whitespace from both text and raw binary transaction data. For binary data, this is dangerous because a byte that looks like a space or ne…

Data integrity / malleability: stripping bytes from binary transaction inputs could silently alter a valid PSBT or raw txInput validation: clearer separation of text vs binary handlingRegression tests added/updated to enforce the new behavior
37db6ea7by SomberNight+46−323 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EL ElectrumElectrum BitcoinSoftware wallets

transaction: psbt.from_raw_psbt: clarify hex input must be str

This is a tiny code cleanup in Electrum's transaction handling. The change removes a check that accepted bytes for a hex-encoded PSBT, because Python's bytes.fromhex() only accepts strings anyway. The commit message explicitly says there i…

9af0195fby SomberNight+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 81 · Strong
EL ElectrumElectrum BitcoinSoftware wallets

qt confirm_tx_dialog: fix wallet.get_candidates_for_batching

This commit fixes a bug in Electrum's transaction batching feature. Previously, when suggesting which existing transactions could be combined (batched) with a new payment, the code ignored the wallet's available unspent coins. This made th…

Functional bug in transaction batching candidate selectionPotential for unexpected transaction construction or fee/change behavior due to missing UTXO contextNo explicit security claim, exploit primitive, or vulnerability disclosure present in commit
d01e6b81by SomberNight+19−33 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 50 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

contrib: shell scripts: add quotes around more variables

This commit adds missing quotation marks around variables in a collection of build and release shell scripts. In shell scripting, unquoted variables can split or be interpreted unexpectedly if paths contain spaces or special characters. Th…

shell variable quoting hardeningbuild/release script hardeningdefensive patch against word-splitting and glob expansion
4a0a3bb3by SomberNight+27−2711 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
EL ElectrumElectrum BitcoinSoftware wallets

tests: wizard: use real bip39 seeds

This commit only updates test data in Electrum's test suite. It replaces fake/placeholder BIP39 seed phrases with the well-known standard test seed 'abandon abandon ... about' and updates the corresponding expected public keys and Bitcoin …

f025a753by SomberNight+17−121 file
No security note in commit
Open full analysis →Source commit ↗
Wrong identity?Names can collide and public author strings can be misleading.Contact commitwatch@karma-x.io →