CommitWatch RSS
BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Source repository ↗
Repository coverage

2876 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

252security candidates603second-pass queue225AI analyses
210commits · 30 days
492commits · 60 days
1521commits · 180 days
2876commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
915Strong · 80–100
1187Adequate · 60–79
686Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot2244170
Ava Chow1564948064
MarcoFalke4062113074
Lőrinc1772121081
fanquake2271916057
Hennadii Stepanov2081413063
rkrux5798074
Sjors Provoost8988074
Sebastian Falbesoner3376073
David Gumberg5565072
Pieter Wuille9555066
Hodlinator6654076
Analysis record

Published AI watches

Last scanned 53 minutes ago

Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Make all `const static` class members `constexpr`

This commit is a code cleanup that changes many internal class constants from 'static const' to 'static constexpr'. In modern C++, constexpr constants are automatically inlined and avoid certain linker errors when used in specific ways. Th…

05c35c40by rustaceanrob+38−4024 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

scripted-diff: Use long form of shell options in Guix scripts

This commit is a purely cosmetic change in Bitcoin Core's Guix build scripts. It replaces the short shell command 'set -e' with its long-form equivalent 'set -o errexit'. Both forms do exactly the same thing: they make the script exit imme…

2cb3bfa8by Hennadii Stepanov+6−66 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: Add copyright headers to Guix scripts

This commit only adds or updates copyright and license header comments at the top of several helper scripts used for Bitcoin Core's Guix build process. It does not change any executable code, logic, or behavior. There is no security risk.

711eb10fby Hennadii Stepanov+20−27 files
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Squashed 'src/secp256k1/' changes from bd0287d650..d2d04864ef

This commit updates the secp256k1 cryptographic library inside Bitcoin Core to a newer version. The main change is adding support for a new optional feature called 'Silent Payments' (BIP352), which is a privacy-enhancing way to receive Bit…

New cryptographic module added (Silent Payments / BIP352)Field-element equality check magnitude bound corrected from 31 to 30X-only public key even-Y invariant enforced in extrakeys module
a33f2405by fanquake+13939−13434 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

scripted-diff: Use C.UTF-8 locale in Guix scripts

This commit is a routine cleanup that changes the locale setting in Bitcoin Core's Guix build scripts from the old ASCII-only 'C' locale to the modern 'C.UTF-8' locale. It is not a security fix and does not change any behavior that could b…

8916f796by Hennadii Stepanov+15−1515 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

p2p: Assume v2transport for addresses from seeds

This change makes Bitcoin Core assume that hard-coded and DNS seed nodes support the newer BIP324 encrypted transport (v2) when first connecting. If the guess is wrong, the software falls back to the older v1 protocol automatically. It is …

Adds NODE_P2P_V2 to assumed service flags for seed-derived addressesFallback to v1 transport exists if the v2 assumption is wrongNo input validation, memory safety, or cryptographic changes
cf0f2aeaby Martin Zumsande+10−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: simplify adding SipHash-1-3-UJ

This is a code cleanup (refactor) that moves the internal SipHash mixing steps into shared helper methods. It does not change how Bitcoin hashes data, how many rounds are run, or any user-visible behavior. There is no security bug being fi…

25bfca06by Lőrinc+74−1222 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

crypto: add generic SipHash-1-3-UJ

This commit adds a new, weaker variant of the SipHash algorithm inside Bitcoin Core's cryptography module. It is explicitly designed for low-security uses such as internal hash tables, not for protecting funds or network messages. The code…

New weaker cryptographic primitive added (SipHash-1-3 vs. standard SipHash-2-4)Explicit unpadded input design removes length-commitment paddingJumbo 256-bit blocks increase attacker control within a single round
c2d7931bby Pieter Wuille+103−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

bench: add fixed-width SipHash benchmarks

This commit only adds new performance benchmark tests for a hash function called SipHash. It does not change any production code that handles Bitcoin transactions, networking, or wallet data. There is no security issue here.

7ff55cc6by Lőrinc+49−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

crypto: add fixed-width SipHash-1-3-UJ

This commit adds two new shortcut methods for computing a specific SipHash variant on fixed-size inputs. It is a pure performance/ergonomics addition: the new methods copy the hasher's internal state before operating, so they do not alter …

a0ccd4adby Pieter Wuille+21−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add shared SipHash vectors

This commit only adds new test data and test code for the SipHash hashing function used in Bitcoin Core. It does not change any production code that handles transactions, networking, or wallets. The goal is to make sure the existing SipHas…

af50ba85by Lőrinc+797−237 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: compat, ensure downgrade preserves tx witness variants

This commit adds a new regression test to Bitcoin Core. It checks that when a wallet created on a newer version is loaded on an older version and then brought back to the newer version, the wallet still remembers alternative 'witness varia…

99bdcb06by furszy+74−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: clang-format LIMITED_WHILE

This commit is purely a code-style cleanup. It adds a space between the macro name LIMITED_WHILE and its opening parenthesis across many fuzz test files, plus a few tiny formatting fixes like removing a redundant semicolon and fixing inden…

fab8eeedby MarcoFalke+91−14265 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net_processing: add a global delay queue for sending txs

This commit adds a global rate limiter to how many transaction announcements (INV messages) a Bitcoin node sends out. Before, each peer had its own queue, so a node could receive one transaction and announce it to over 100 peers, acting li…

Global rate limiting replaces per-peer queues to prevent transaction-announcement amplificationDual token buckets bound both INV count and relay bandwidthCommit message explicitly describes the change as limiting transaction-spam amplification and excessive memory/CPU usage
df31ee57by Anthony Towns+176−252 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

chainparams: delete my DNS seed

A Bitcoin Core developer removed their own DNS seed (seed.bitcoin.sipa.be, run by Pieter Wuille) from the list of hardcoded network seeds that help new Bitcoin nodes find peers when they first start up. This is a routine operational/mainte…

Removal of a trusted bootstrap DNS seed from default chain parametersReduction in peer-discovery redundancy for new mainnet nodesNo vulnerability patch, cryptographic fix, or memory-safety change present
d9080639by Pieter Wuille+1−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Redeclare variable as signed in `util_tests`

This is a minor fix to a unit test file. A test variable was being assigned a negative value in an unsigned container, which caused a silent underflow and made the test assertion technically incorrect. The patch changes the test to check t…

cd2a4bc5by rustaceanrob+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add regression test for in-memory SQLiteDatabase reopen

This commit only adds a new automated test. It checks that Bitcoin Core's in-memory SQLite wallet database correctly refuses to reopen after being closed, because reopening would silently create a fresh empty database and discard any previ…

Regression test for data-loss prevention behavior in wallet database layerIn-memory SQLite database reopen could silently discard wallet dataOpen() now throws std::runtime_error instead of returning a fresh connection
777d23f2by Pablo Martin+9−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use u64 over size_t for all cache sizes to fix a 32-bit overflow

This commit fixes a bug in Bitcoin Core that only affects 32-bit computers. When the program calculated how much database cache to allocate, it multiplied a large default cache value by 10. On 32-bit systems that multiplication overflowed,…

Integer overflow in cache-size calculation on 32-bit systemsUnsigned multiplication overflow explicitly mentioned in commit message with runtime sanitizer outputType promotion from size_t to uint64_t to prevent platform-dependent width issues
fabafd91by MarcoFalke+37−285 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Use Descriptor::CanSelfExpand() in CanGetAddresses()

This is a small Bitcoin Core wallet change that lets the wallet generate addresses from certain descriptors even when it does not have private keys and has already used up its pre-derived address range. It only affects descriptors that can…

Changes address-derivation gating logic in wallet codeExpands conditions under which addresses can be produced without private keysNo explicit security framing, CVE, or advisory language in commit
1e996640by Ava Chow+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 58 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

descriptor: Add CanSelfExpand()

This commit adds a new helper method called CanSelfExpand() to Bitcoin Core's descriptor system. It lets the code ask whether a wallet descriptor can produce its Bitcoin address(es) on its own, without needing a saved cache or private keys…

New API surface added to descriptor subsystem (CanSelfExpand)No change to existing expansion, signing, or key-derivation logicNo bounds, memory, or cryptographic operations modified
d2ee9227by Ava Chow+57−184 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateSquashed 'src/secp256k1/' changes from 57315a6985..7262adb4b4by fanquake · dfd54c95 · Apr 9, 2026 · 41 filesMessage 96 · StrongLow 34Details
Commit message · fanquake

Squashed 'src/secp256k1/' changes from 57315a6985..7262adb4b4

7262adb4b4 Merge bitcoin-core/secp256k1#1841: gha: Bump deprecated GHA workflow dependencies
c5cd9d6d9a gha: Bump deprecated GHA workflow dependencies
95b702de34 Merge bitcoin-core/secp256k1#1839: ecdsa: VERIFY_CHECK result of _fe_set_b32_limit
634215f3fc Merge bitcoin-core/secp256k1#1837: tests: Fix function pointer initialization C89 error in ellswift tests
43fca0ff55 ecdsa: VERIFY_CHECK result of _fe_set_b32_limit
b84635ed3b tests: Fix C89 function pointer initialization in ellswift tests
ffc25a2731 Merge bitcoin-core/secp256k1#1834: ecmult: Document and test ng=NULL in ecmult
3a403639dc eckey: Call ecmult with NULL instead of zero scalar
7e68c0c88b ecmult: Document and test ng=NULL in ecmult
1aafe15139 Merge bitcoin-core/secp256k1#1777: Make SHA256 compression runtime pluggable
b9cb1cbfd7 Merge bitcoin-core/secp256k1#1824: util: introduce and use `ARRAY_SIZE` macro
4d92a083bc sha256: speed up writes using multi-block compression
0753f8b909 Add API to override SHA256 compression at runtime
fdb6a91a5e Introduce hash context to support pluggable SHA256 compression
c0a2aba088 Merge bitcoin-core/secp256k1#1811: bench: Update help functions in bench and bench_internal
10f546a2c0 Merge bitcoin-core/secp256k1#1832: testrand: Remove testrand_finish
8d0eda07e9 testrand: Remove testrand_finish
95e6815843 Merge bitcoin-core/secp256k1#1825: hash: remove redundant `secp256k1_sha256_initialize` in tagged hash midstate functions
f48b1bfa5d hash: add midstate initializer and use it for tagged hashes
3019186a6d Merge bitcoin-core/secp256k1#1829: ci: Fix leftover use of old ECMULTGENPRECISION
79e9f25237 ci: Fix leftover use of old ECMULTGENPRECISION
dfe042feb2 Merge bitcoin-core/secp256k1#1828: Revert "ci, docker: Fix LLVM repository signature failure"
76e92cfeea Revert "ci, docker: Fix LLVM repository signature failure"
ac561601b8 Merge bitcoin-core/secp256k1#1760: cmake: Add dynamic test discovery to improve parallelism
c7a7f732bd Merge bitcoin-core/secp256k1#1821: ellswift: fix overflow flag handling in secp256k1_ellswift_xdh
921b9711ea util: introduce and use `ARRAY_SIZE` macro
b99a94c382 Add tests for bad scalar inputs in ellswift XDH
307b49f1b9 ellswift: fix overflow flag handling in secp256k1_ellswift_xdh
322d0a4358 Merge bitcoin-core/secp256k1#1823: ci: Load Docker image by ID from builder step
ed02466d3f ci: Load Docker image by ID from builder step
c49c9be504 bench: Update help functions in bench and bench_internal
1d146ac3ed Merge bitcoin-core/secp256k1#1819: tests: Improve secp256k1_scalar_check_overflow tests (Issue #1812)
f47bbc07f0 test: add unit tests for secp256k1_scalar_check_overflow
d071aa56d5 Merge bitcoin-core/secp256k1#1815: refactor: remove unnecessary `malloc` result casts
99ab4a105e Merge bitcoin-core/secp256k1#1817: ci: Disable Docker build summary generation
c5da3bde9c Merge bitcoin-core/secp256k1#1818: ci: Enforce base-10 evaluation
97de5120cf Merge bitcoin-core/secp256k1#1804: test: show both CMake and Autotools usage for ctime_tests
4fb7ccf5d4 ci: Enforce base-10 evaluation
3ae72e7867 ci: Disable Docker build summary generation
97b3c47849 refactor: remove unnecessary `malloc` result casts
1bc74a22f8 test: show both Autotools and CMake usage for ctime_tests
8354618e02 cmake: Set `LABELS` property for tests
29f26ec3cf cmake: Integrate DiscoverTests and normalize test names
f95b263f23 cmake: Add DiscoverTests module
4ac651144b cmake, refactor: Deduplicate test-related code

git-subtree-dir: src/secp256k1
git-subtree-split: 7262adb4b40074201fb30847035a82b8d742f350

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarymemory safetycryptography-sensitive path
AI analysis · Low 34/100

This is a routine subtree update that pulls in many upstream libsecp256k1 changes. The most notable user-visible change is a new API that lets callers replace the internal SHA256 compression function with a custom one (for example, a hardware-accelerated version). The update also fixes a small bug in the EllSwift ECDH helper where an all-zero secret key was not always rejected, and it adds several code-quality and test improvements. There is no evidence in the commit message or diff of an undisclosed security vulnerability being patched.

Security candidaterefactor: normalize CCoinsView whitespace and signaturesby Lőrinc · a9f92e34 · Apr 8, 2026 · 4 filesMessage 77 · AdequateInformational 15Details
Commit message · Lőrinc

refactor: normalize CCoinsView whitespace and signatures

Let's get these out of the way to simplify riskier followup commits

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit is purely a code cleanup: it changes spacing and formatting in C++ function signatures (for example, moving the ampersand in `COutPoint &outpoint` to `COutPoint& outpoint` and adjusting line breaks). No program behavior is changed, and there is no security risk.

Security candidatetest: Add SRD success testsby Murch · fe9f53bf · Apr 7, 2026 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · Murch

test: Add SRD success tests

Previously, SRD had only failure and edge-case coverage, so we add a few
simple coin selection targets that should quickly succeed, including one
that will create a minimal change output.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit only adds new test cases for an existing coin-selection algorithm called SRD (Single Random Draw). It does not change any production wallet code, network rules, or consensus behavior. The change is purely in the test suite and verifies that SRD succeeds for simple, realistic selection targets. There is no security issue here.

Security candidatescripted-diff: replace remaining Python test equality assertsby Lőrinc · 3fd68a95 · Apr 7, 2026 · 37 filesMessage 83 · StrongInformational 15Details
Commit message · Lőrinc

scripted-diff: replace remaining Python test equality asserts

Some Python functional tests still use plain `assert x == y`.
The earlier commits convert the ambiguous assert patterns by hand, so this commit can rewrite the remaining safe cases mechanically.
The verify script excludes `wallet_bumpfee.py`, `test_framework/netutil.py`, and `test_framework/authproxy.py`, which still contain assert forms that the plain line-based substitution would misidentify.

-BEGIN VERIFY SCRIPT-
perl -pi -e 's/^(\s*)assert (.+?) == ([^,#]+?)$/\1assert_equal(\2, \3)/' $(git ls-files -- 'test/functional' \
':(exclude)test/functional/wallet_bumpfee.py' ':(exclude)test/functional/test_framework/netutil.py' ':(exclude)test/functional/test_framework/authproxy.py')
-END VERIFY SCRIPT-

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a bulk cleanup of Bitcoin Core's Python functional tests. It mechanically replaces plain `assert x == y` statements with a project-specific `assert_equal(x, y)` helper. The change only affects test code, not the Bitcoin node software that users run, so it cannot directly impact live Bitcoin operations, wallets, or consensus. It improves the quality of test failure messages but introduces no security vulnerability and fixes no exploitable bug.

Security candidatetest: add missing `assert_equal` importsby Lőrinc · 301b1d7b · Apr 7, 2026 · 10 filesMessage 90 · StrongInformational 15Details
Commit message · Lőrinc

test: add missing `assert_equal` imports

The later scripted diff only rewrites call sites.
Add `assert_equal` imports in the remaining files that still need them so the mechanical replacement can apply cleanly.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit only adds missing Python imports for a helper function named assert_equal in test files. It does not change how Bitcoin Core runs, validates transactions, or handles user funds. It is a routine test-code cleanup with no security relevance.

Security candidatetest: convert truthy asserts in `wallet_miniscript` and `rpc_psbt`by Lőrinc · 06a4176c · Apr 7, 2026 · 2 filesMessage 95 · StrongInformational 15Details
Commit message · Lőrinc

test: convert truthy asserts in `wallet_miniscript` and `rpc_psbt`

Replace the last remaining truthy asserts (and a remaining `is False`) in `wallet_miniscript.py` and `rpc_psbt.py` with `assert_equal`.

Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit only changes test code. It replaces loose truthiness checks (like `assert x` or `assert not x`) with stricter equality checks (`assert_equal(x, True/False)`) in two Python test files. It does not change any production Bitcoin Core code, so it cannot directly affect live wallets, nodes, or transactions.

Security candidatetest: convert simple equality asserts in excluded filesby Lőrinc · d9a3cf20 · Apr 7, 2026 · 2 filesMessage 100 · StrongInformational 15Details
Commit message · Lőrinc

test: convert simple equality asserts in excluded files

A few files still need to stay out of the later scripted diff because they contain more complicated assert shapes.
Convert the straightforward equality checks in those files by hand first.
Use a local import in `authproxy.py` so the change does not create an import cycle.

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing or wallet pathauthentication path
AI analysis · Informational 15/100

This commit only changes test code. It replaces plain Python assert statements with a custom assert_equal helper in two test files. There is no change to Bitcoin Core's production code, network behavior, wallet logic, or consensus rules, so it has no security impact on users.

Security candidaterpc: fix initialization-order-fiasco by lazy-init of decodepsbt_inputsby Eugene Siegel · d517fa0a · Apr 3, 2026 · 2 filesMessage 73 · AdequateLow 25Details
Commit message · Eugene Siegel

rpc: fix initialization-order-fiasco by lazy-init of decodepsbt_inputs

Prior to this commit, decodepsbt_inputs would call TxDoc during initialization
which lives in another TLU. TxDoc relies on CURRENCY_UNIT to be initialized when
it may not have been (note this is different from the TLU containing
decodepsbt_inputs which also has a CURRENCY_UNIT). Fix this by lazy initializing
decodepsbt_inputs.

Prevent the issue from occurring in the future by also doing the same for
decodepsbt_outputs and getblock_vin.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 25/100

This commit fixes a subtle startup bug in Bitcoin Core's RPC help system. Some help text for commands like 'decodepsbt' and 'getblock' was being built before all global constants were ready, which could cause crashes or garbled output when the program starts. The fix delays building that help text until it is actually needed. It is a reliability fix, not a remote attack vector.

Security candidatecrypto: disable ASan instrumentation of SSE4 SHA256 for GCCby deadmanoz · fedeff7f · Apr 1, 2026 · 1 fileMessage 83 · StrongInformational 18Details
Commit message · deadmanoz

crypto: disable ASan instrumentation of SSE4 SHA256 for GCC

The existing Clang-only no_sanitize("address") guard is extended to
also cover GCC. When GCC compiles this file with -fsanitize=address
in debug builds, the instrumented inline assembly causes a SEGV during
SHA256AutoDetect()'s self-test on CPUs that use the SSE4 code path
(i.e. those without SHA-NI support), regardless of optimization level.

The original Clang code placed the attribute between the function
declarator and the opening brace. GCC's Attribute Syntax
documentation notes that this position in a function definition
"may, in future, be permitted," so it is not currently supported.
The attribute is moved to the start of the function definition,
which is valid form for both GCC and Clang.

The preprocessor guards are restructured so each compiler branch is
explicit: __clang__ with __has_feature, and __GNUC__ with
__SANITIZE_ADDRESS__.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validationcryptography-sensitive path
AI analysis · Informational 18/100

This is a build-compatibility fix, not a security vulnerability in normal Bitcoin operation. It stops a specific compiler sanitizer (GCC's AddressSanitizer, used only in debug/test builds) from crashing when running SHA-256 self-tests on older CPUs that lack SHA-NI hardware support. The change does not affect production releases or how Bitcoin validates transactions.

Security candidatecli: Clearer error messages on authentication failureby Hodlinator · 20a94c15 · Mar 31, 2026 · 5 filesMessage 70 · AdequateInformational 18Details
Commit message · Hodlinator

cli: Clearer error messages on authentication failure

Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>

70/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Names security-relevant behavior explicitly
Why it was queued
access control
AI analysis · Informational 18/100

This commit only changes the wording of error messages shown when bitcoin-cli fails to log in to the RPC server. It does not fix or introduce any security vulnerability; it is a user-experience improvement that tells users more precisely why authentication failed (missing cookie file, cookie disabled, bad cookie contents, or wrong password).

Security candidateci, iwyu: Fix warnings in `src/util` and treat them as errorsby Hennadii Stepanov · 8b49e2dd · Mar 30, 2026 · 42 filesMessage 50 · ThinInformational 15Details
Commit message · Hennadii Stepanov

ci, iwyu: Fix warnings in `src/util` and treat them as errors

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a routine code-quality cleanup. It adjusts which C++ header files are included in various source files under src/util and turns on a stricter automated check (IWYU) in the project's continuous integration. There is no functional change to Bitcoin Core's behavior, no bug fix, and no security-relevant change.

Security candidatefuzz: Use CAmount for storing best_wasteby Ava Chow · 890a09b1 · Mar 28, 2026 · 1 fileMessage 75 · AdequateInformational 17Details
Commit message · Ava Chow

fuzz: Use CAmount for storing best_waste

Waste is a CAmount, which is an int64_t. This will overflow an int, so
`best_waste` should also be a `CAmount`.

75/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
memory safetyfuzzing or regression evidencesigning or wallet path
AI analysis · Informational 17/100

This is a one-line fix in a fuzz test (automated randomized test) for Bitcoin Core's coin selection logic. It changes a variable that tracks the 'best waste' amount from a 32-bit signed integer to a 64-bit signed integer type, matching the actual CAmount type. The change prevents a possible integer overflow inside the fuzz test itself, not in the production wallet code that handles real Bitcoin transactions. It does not appear to be a security vulnerability in live Bitcoin Core software.

Security candidateSquashed 'src/ipc/libmultiprocess/' changes from 1868a84451f..70f632bda8fby Ryan Ofsky · 2478a15e · Mar 27, 2026 · 28 filesMessage 91 · StrongModerate 59Details
Commit message · Ryan Ofsky

Squashed 'src/ipc/libmultiprocess/' changes from 1868a84451f..70f632bda8f

70f632bda8f Merge bitcoin-core/libmultiprocess#265: ci: set LC_ALL in shell scripts
8e8e564259a Merge bitcoin-core/libmultiprocess#249: fixes for race conditions on disconnects
05d34cc2ec3 ci: set LC_ALL in shell scripts
e606fd84a8c Merge bitcoin-core/libmultiprocess#264: ci: reduce nproc multipliers
ff0eed1bf18 refactor: Use loop variable in type-context.h
ff1d8ba172a refactor: Move type-context.h getParams() call closer to use
1dbc59a4aa3 race fix: m_on_cancel called after request finishes
1643d05ba07 test: m_on_cancel called after request finishes
f5509a31fcc race fix: getParams() called after request cancel
4a60c39f24a test: getParams() called after request cancel
f11ec29ed20 race fix: worker thread destroyed before it is initialized
a1d643348f4 test: worker thread destroyed before it is initialized
336023382c4 ci: reduce nproc multipliers
b090beb9651 Merge bitcoin-core/libmultiprocess#256: ci: cache gnu32 nix store
be8622816da ci: cache gnu32 nix store
975270b619c Merge bitcoin-core/libmultiprocess#263: ci: bump timeout factor to 40
09f10e5a598 ci: bump timeout factor to 40
db8f76ad290 Merge bitcoin-core/libmultiprocess#253: ci: run some Bitcoin Core CI jobs
55a9b557b19 ci: set Bitcoin Core CI test repetition
fb0fc84d556 ci: add TSan job with instrumented libc++
0f29c38725b ci: add Bitcoin Core IPC tests (ASan + macOS)
3f64320315d Merge bitcoin-core/libmultiprocess#262: ci: enable clang-tidy in macOS job, use nullptr
cd9f8bdc9f0 Merge bitcoin-core/libmultiprocess#258: log: add socket connected info message and demote destroy logs to debug
b5d6258a42f Merge bitcoin-core/libmultiprocess#255: fix: use unsigned char cast and sizeof in LogEscape escape sequence
d94688e2c32 Merge bitcoin-core/libmultiprocess#251: Improved CustomBuildField for std::optional in IPC/libmultiprocess
a9499fad755 mp: use nullptr with pthread_threadid_np
f499e37850f ci: enable clang-tidy in macOS job
98f1352159d log: add socket connected info message and demote destroy logs to debug
554a481ea73 fix: use unsigned char cast and sizeof in LogEscape escape sequence
1977b9f3f65 Use std::forward in CustomBuildField for std::optional to allow move semantics, resolves FIXME
22bec918c97 Merge bitcoin-core/libmultiprocess#247: type-map: Work around LLVM 22 "out of bounds index" error
8a5e3ae6ed2 Merge bitcoin-core/libmultiprocess#242: proxy-types: add CustomHasField hook to map Cap'n Proto values to null C++ values
e8d35246918 Merge bitcoin-core/libmultiprocess#246: doc: Bump version 8 > 9
97d877053b6 proxy-types: add CustomHasField hook for nullable decode paths
8c2f10252c9 refactor: add missing includes to mp/type-data.h
b1638aceb40 doc: Bump version 8 > 9
f61af487217 type-map: Work around LLVM 22 "out of bounds index" error

git-subtree-dir: src/ipc/libmultiprocess
git-subtree-split: 70f632bda8f80449b6240f98da768206a535a04e

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
memory safety
AI analysis · Moderate 59/100

This commit updates the libmultiprocess library inside Bitcoin Core. The most important changes are fixes for three race-condition bugs that could crash or destabilize the inter-process communication (IPC) layer when a connection is disconnected while worker threads are starting, running, or finishing. The commit also adds a new way to represent null data values in IPC messages, improves build/CI scripts, and bumps the library version. The race fixes are defensive hardening rather than obviously exploitable vulnerabilities, but they remove real crash paths that could be triggered by an attacker able to disconnect an IPC session at the right moment.

Security candidaterpc, refactor: gettxoutsetinfo race condition fix follow-upsby rkrux · 3e5dc610 · Mar 24, 2026 · 2 filesMessage 78 · AdequateInformational 11Details
Commit message · rkrux

rpc, refactor: gettxoutsetinfo race condition fix follow-ups

This patch addresses my own review comments from the review of PR 34451.
If these are found helpful, it makes sense to do them now after the previous
PR was merged and backported.

Pasting the comments below that also explains the changes:

- Move the pindex declaration below now that it is not used earlier.
- stats was being generated partially in both these ComputeUTXOStats functions,
which reads oddly to me. Now that the pcursor is also moved and passed to this
function, which reads oddly as well, I believe we can refactor this function
to completely build the stats inside this function. A side benefit is that by
removing the stats and pcursor arguments, the function signature becomes quite
similar to its namesake, which in turn becomes a straightforward wrapper of
this function.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 11/100

This is a small internal cleanup change for a Bitcoin Core function that calculates statistics about the unspent coin set (used by the gettxoutsetinfo RPC). It moves where a variable is declared and refactors how the statistics object is built so the code is easier to read. There is no direct security fix in this commit itself; it is described as a follow-up to a prior pull request that addressed a race condition.

Security candidateMerge bitcoin-core/gui#815: Bugfix on TransactionsView - Disable if privacy mode is set during wallet selectionby Hennadii Stepanov · 999c4248 · Mar 22, 2026 · 2919 filesMessage 91 · StrongLow 25Details
Commit message · Hennadii Stepanov

Merge bitcoin-core/gui#815: Bugfix on TransactionsView - Disable if privacy mode is set during wallet selection

0dc337f73d013e342b880746292f1c3247b287cf gui: Fix TransactionsView on setCurrentWallet (pablomartin4btc)

Pull request description:

<details>
<summary>Currenlty on <code>master</code>, when the "mask values" checkbox is ticked if the user selects a different wallet, the history action is enable and if the user clicks on it can see all the transactions in the transaction view.</summary>

![Peek 2024-04-09 17-37](https://github.com/bitcoin-core/gui/assets/110166421/d8e2fdd1-aaa6-4506-acde-51fa45a74910)

</details>
<details>
<summary>This PR fixes it.</summary>

![Peek 2024-04-09 17-45](https://github.com/bitcoin-core/gui/assets/110166421/78c30dc5-42a6-4829-981d-6b9aaa03f014)

</details>

Note for maintainers: this needs to be backported to 25.x and 26.x.

ACKs for top commit:
hebasto:
ACK 0dc337f73d013e342b880746292f1c3247b287cf, tested on Fedora 43.

Tree-SHA512: 54581546917f87b4c1db0ff1eaa1962ee6eb078285dbb205b4c8d027c3e350f3dc46409b376948c10e668f9487b7a5a70bab0dff5faf510deab1a54452f7f0e5

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol pathmerge-commit duplicate discount
AI analysis · Low 25/100

This commit fixes a small user-interface bug in Bitcoin Core's Qt wallet GUI. When the user turns on 'privacy mode' (the 'mask values' checkbox that hides balances), then switches to a different wallet, the 'History' button was incorrectly staying enabled. Clicking it would reveal the transaction list for the newly selected wallet, defeating the intended privacy setting. The fix makes the transaction view stay disabled when privacy mode is active during a wallet switch. It is a local, UI-only information-disclosure issue that requires the attacker to already have access to the unlocked GUI and the ability to switch wallets.

Security candidatewallet: feebumper, fix crash when combined bump fee is unavailableby furszy · 6072a2a6 · Mar 19, 2026 · 1 fileMessage 73 · AdequateLow 45Details
Commit message · furszy

wallet: feebumper, fix crash when combined bump fee is unavailable

When a large cluster of unconfirmed transactions exceeds the limit,
calculateCombinedBumpFee() returns std::nullopt.

Previously, we continued executing and the optional value was
accessed unconditionally, leading to a std::bad_optional_access
exception.

Fix this by returning early when the returned bumped fee is null.

Note:
This is a crash for the GUI, and an uncaught exception for the RPC
bumpfee and psbtbumpfee.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 45/100

This commit fixes a bug in Bitcoin Core's transaction fee-bumping feature. When a user tried to increase the fee on a transaction that was tied to a very large cluster of unconfirmed transactions, the software could not calculate the required fee and returned an empty value. The old code then tried to use that empty value anyway, causing the program to crash (in the GUI) or throw an unhandled exception (in command-line tools). The fix simply checks for the empty value and returns a proper error message instead of crashing.

Security candidateguix: switch to upstream python-oscrypto packageby fanquake · 2276426b · Mar 17, 2026 · 2 filesMessage 45 · ThinInformational 17Details
Commit message · fanquake

guix: switch to upstream python-oscrypto package

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Informational 17/100

This commit changes how Bitcoin Core's Guix build system obtains a Python cryptography helper library called oscrypto. Previously, Bitcoin Core maintained its own custom package definition and a patch that forced oscrypto to use a specific OpenSSL library path. Now it uses the standard upstream package from the Guix distribution. This is primarily a build-maintenance simplification. It is not a direct fix for a known vulnerability, but it removes a local patch and custom package, which could slightly change what code is compiled into release builds.

Security candidaterpc: Run type check on decodepsbt resultby MarcoFalke · fadf901f · Mar 16, 2026 · 5 filesMessage 80 · StrongInformational 19Details
Commit message · MarcoFalke

rpc: Run type check on decodepsbt result

For RPCResults, the type may be ELISION, which is confusing and brittle:

* The elision should only affect the help output, not the type.
* The type should be the real type, so that type checks can be run on
it.

Fix this issue by introducing a new print_elision option and using it
in decodepsbt.

This change will ensure that RPCResult::MatchesType is properly run.
Also, this clarifies the RPC output minimally:

```diff
--- a/decodepsbt
+++ b/decodepsbt
@@ -35,7 +35,7 @@ Result:
"inputs" : [ (json array)
{ (json object)
"non_witness_utxo" : { (json object, optional) Decoded network transaction for non-witness UTXOs
- ...
+ ... The layout is the same as the output of decoderawtransaction.
},
"witness_utxo" : { (json object, optional) Transaction output for witness UTXOs
"amount" : n, (numeric) The value in BTC
```

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 19/100

This is a code-quality fix for Bitcoin Core's RPC help output. It changes how the documentation generator marks parts of the response as '...' (elided) so that the internal type checker can still verify the real data types. It does not change how transactions are decoded or how the network behaves, and it is not a security patch in the usual sense. The only user-visible change is a slightly clearer help message for the decodepsbt command.

Security candidatetest: Move event loop creation to network threadby MarcoFalke · fa050da9 · Mar 13, 2026 · 2 filesMessage 98 · StrongInformational 17Details
Commit message · MarcoFalke

test: Move event loop creation to network thread

This should fix https://github.com/bitcoin/bitcoin/issues/34367

I am not familiar with Windows sockets thread-safety, but creating the
event loop on the main thread, and running it in the network thread
could lead to a fast abort in Python on Windows (without any stderr):

```
77/276 - wallet_txn_clone.py failed, Duration: 1 s

stdout:
2025-12-10T08:04:27.500134Z TestFramework (INFO): PRNG seed is: 4018092284830106117

stderr:

Combine the logs and print the last 99999999 lines ...
============
Combined log for D:\a\_temp/test_runner_₿_🏃_20251210_075632/wallet_txn_clone_196:
============
test 2025-12-10T08:04:27.500134Z TestFramework (INFO): PRNG seed is: 4018092284830106117
test 2025-12-10T08:04:27.500433Z TestFramework (DEBUG): Setting up network thread
```

Also, I couldn't find any docs that require the loop must be created on
the thread that runs them:

* https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.new_event_loop
* https://docs.python.org/3/library/asyncio-eventloop.html#asyncio.loop.run_forever

However, the patch seems trivial to review, harmless, and easy to
revert, so it may be a good try to fix the intermittent Windows Python
crash.

98/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
entropy or randomness
AI analysis · Informational 17/100

This is a small test-only change in Bitcoin Core's Python testing framework. It moves where an internal networking event loop is created so it is created on the same thread that later runs it, rather than on the main test thread. The goal is to stop an intermittent crash/abort that happens on Windows when running functional tests. It does not change the Bitcoin node itself, consensus rules, wallet handling, or network protocol, and there is no indication it fixes a security vulnerability.

Security candidateci: check macos bundle structure and codesigningby fanquake · d03e3be2 · Mar 11, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · fanquake

ci: check macos bundle structure and codesigning

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit adds a new automated CI (Continuous Integration) test step for macOS releases. After building the macOS app bundle, the script now unzips the produced file and runs Apple's `codesign --verify` to confirm the application is properly code-signed. It does not change any wallet, networking, or consensus code, and it does not fix a security bug in the software itself. It is purely a build/verification improvement.

Security candidatecrypto: Use `secure_allocator` for `AES256CBC*::iv`by David Gumberg · af0da2fc · Mar 11, 2026 · 2 filesMessage 50 · ThinLow 43Details
Commit message · David Gumberg

crypto: Use `secure_allocator` for `AES256CBC*::iv`

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Low 43/100

This change makes the encryption initialization vector (IV) used by Bitcoin Core's AES-256-CBC routines live in locked, non-swappable memory and be securely erased when no longer needed. Previously the IV was a normal stack-like array, which could potentially be swapped to disk or remain in memory after use. The IV is not a secret key, but it is cryptographic material that should be handled carefully. The patch is a hardening improvement rather than a fix for a known active attack.

Security candidatecrypto: Use `secure_allocator` for `AES256_ctx`by David Gumberg · d53852be · Mar 11, 2026 · 2 filesMessage 45 · ThinLow 43Details
Commit message · David Gumberg

crypto: Use `secure_allocator` for `AES256_ctx`

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Low 43/100

This change makes Bitcoin Core store sensitive AES encryption/decryption context data in locked, non-swappable memory instead of ordinary memory. The goal is to reduce the chance that encryption keys or key-derived data leak into swap files or core dumps. It is a defensive hardening patch, not a fix for an actively exploitable bug.

Security candidateBugfix: GUI/Intro: Handle errors from SelectParams the same as if during InitConfigby Luke Dashjr · 55d37546 · Mar 6, 2026 · 2653 filesMessage 65 · AdequateInformational 17Details
Commit message · Luke Dashjr

Bugfix: GUI/Intro: Handle errors from SelectParams the same as if during InitConfig

Without this, invalid vbparams just silently exit with no message

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 17/100

This commit is a small bug fix in the Bitcoin Core graphical wallet (bitcoin-qt). When a user starts the GUI with an invalid custom network parameter (the -vbparams option), the program used to quit without showing any error message. The fix makes the GUI display the same helpful error message that the command-line daemon already shows, so users know what went wrong.

Security candidatefuzz: set whitelist permissions on connman targetby Bruno Garcia · 32debfa1 · Mar 5, 2026 · 1 fileMessage 55 · ThinInformational 15Details
Commit message · Bruno Garcia

fuzz: set whitelist permissions on connman target

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidencecredential or privilege state
AI analysis · Informational 15/100

This commit adds fuzz-testing coverage for whitelist permission settings inside a test harness. It does not change production network code, user-facing behavior, or fix a live vulnerability. It is a test-quality improvement that helps automated fuzzers explore more code paths in CConnman initialization.

Security candidatefuzz: make sure PSBT serialization roundtripsby Antoine Poinsot · d76ec4de · Mar 4, 2026 · 1 fileMessage 70 · AdequateLow 29Details
Commit message · Antoine Poinsot

fuzz: make sure PSBT serialization roundtrips

This will prevent us from creating a serialization we do not accept
going forward.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing boundaryfuzzing or regression evidencesigning or wallet path
AI analysis · Low 29/100

This commit adds a new fuzz test to Bitcoin Core that checks whether PSBT (Partially Signed Bitcoin Transaction) data can be serialized and then deserialized back to the exact same bytes. It is a defensive test meant to catch future bugs where the software might write a PSBT format it cannot later read. The commit itself does not fix any active vulnerability; it adds a regression test.