CommitWatch RSS
BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Source repository ↗
Repository coverage

2876 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

252security candidates603second-pass queue225AI analyses
210commits · 30 days
492commits · 60 days
1521commits · 180 days
2876commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
915Strong · 80–100
1187Adequate · 60–79
686Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Antoine Poinsot2244170
Ava Chow1564948064
MarcoFalke4062113074
Lőrinc1772121081
fanquake2271916057
Hennadii Stepanov2081413063
rkrux5798074
Sjors Provoost8988074
Sebastian Falbesoner3376073
David Gumberg5565072
Pieter Wuille9555066
Hodlinator6654076
Analysis record

Published AI watches

Last scanned 55 minutes ago

Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Make all `const static` class members `constexpr`

This commit is a code cleanup that changes many internal class constants from 'static const' to 'static constexpr'. In modern C++, constexpr constants are automatically inlined and avoid certain linker errors when used in specific ways. Th…

05c35c40by rustaceanrob+38−4024 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

scripted-diff: Use long form of shell options in Guix scripts

This commit is a purely cosmetic change in Bitcoin Core's Guix build scripts. It replaces the short shell command 'set -e' with its long-form equivalent 'set -o errexit'. Both forms do exactly the same thing: they make the script exit imme…

2cb3bfa8by Hennadii Stepanov+6−66 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

guix: Add copyright headers to Guix scripts

This commit only adds or updates copyright and license header comments at the top of several helper scripts used for Bitcoin Core's Guix build process. It does not change any executable code, logic, or behavior. There is no security risk.

711eb10fby Hennadii Stepanov+20−27 files
No security note in commit
Open full analysis →Source commit ↗
Low 28 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Squashed 'src/secp256k1/' changes from bd0287d650..d2d04864ef

This commit updates the secp256k1 cryptographic library inside Bitcoin Core to a newer version. The main change is adding support for a new optional feature called 'Silent Payments' (BIP352), which is a privacy-enhancing way to receive Bit…

New cryptographic module added (Silent Payments / BIP352)Field-element equality check magnitude bound corrected from 31 to 30X-only public key even-Y invariant enforced in extrakeys module
a33f2405by fanquake+13939−13434 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

scripted-diff: Use C.UTF-8 locale in Guix scripts

This commit is a routine cleanup that changes the locale setting in Bitcoin Core's Guix build scripts from the old ASCII-only 'C' locale to the modern 'C.UTF-8' locale. It is not a security fix and does not change any behavior that could b…

8916f796by Hennadii Stepanov+15−1515 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

p2p: Assume v2transport for addresses from seeds

This change makes Bitcoin Core assume that hard-coded and DNS seed nodes support the newer BIP324 encrypted transport (v2) when first connecting. If the guess is wrong, the software falls back to the older v1 protocol automatically. It is …

Adds NODE_P2P_V2 to assumed service flags for seed-derived addressesFallback to v1 transport exists if the v2 assumption is wrongNo input validation, memory safety, or cryptographic changes
cf0f2aeaby Martin Zumsande+10−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: simplify adding SipHash-1-3-UJ

This is a code cleanup (refactor) that moves the internal SipHash mixing steps into shared helper methods. It does not change how Bitcoin hashes data, how many rounds are run, or any user-visible behavior. There is no security bug being fi…

25bfca06by Lőrinc+74−1222 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

crypto: add generic SipHash-1-3-UJ

This commit adds a new, weaker variant of the SipHash algorithm inside Bitcoin Core's cryptography module. It is explicitly designed for low-security uses such as internal hash tables, not for protecting funds or network messages. The code…

New weaker cryptographic primitive added (SipHash-1-3 vs. standard SipHash-2-4)Explicit unpadded input design removes length-commitment paddingJumbo 256-bit blocks increase attacker control within a single round
c2d7931bby Pieter Wuille+103−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

bench: add fixed-width SipHash benchmarks

This commit only adds new performance benchmark tests for a hash function called SipHash. It does not change any production code that handles Bitcoin transactions, networking, or wallet data. There is no security issue here.

7ff55cc6by Lőrinc+49−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

crypto: add fixed-width SipHash-1-3-UJ

This commit adds two new shortcut methods for computing a specific SipHash variant on fixed-size inputs. It is a pure performance/ergonomics addition: the new methods copy the hasher's internal state before operating, so they do not alter …

a0ccd4adby Pieter Wuille+21−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add shared SipHash vectors

This commit only adds new test data and test code for the SipHash hashing function used in Bitcoin Core. It does not change any production code that handles transactions, networking, or wallets. The goal is to make sure the existing SipHas…

af50ba85by Lőrinc+797−237 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: compat, ensure downgrade preserves tx witness variants

This commit adds a new regression test to Bitcoin Core. It checks that when a wallet created on a newer version is loaded on an older version and then brought back to the newer version, the wallet still remembers alternative 'witness varia…

99bdcb06by furszy+74−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

fuzz: clang-format LIMITED_WHILE

This commit is purely a code-style cleanup. It adds a space between the macro name LIMITED_WHILE and its opening parenthesis across many fuzz test files, plus a few tiny formatting fixes like removing a redundant semicolon and fixing inden…

fab8eeedby MarcoFalke+91−14265 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 63 AI analysisMessage 90 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

net_processing: add a global delay queue for sending txs

This commit adds a global rate limiter to how many transaction announcements (INV messages) a Bitcoin node sends out. Before, each peer had its own queue, so a node could receive one transaction and announce it to over 100 peers, acting li…

Global rate limiting replaces per-peer queues to prevent transaction-announcement amplificationDual token buckets bound both INV count and relay bandwidthCommit message explicitly describes the change as limiting transaction-spam amplification and excessive memory/CPU usage
df31ee57by Anthony Towns+176−252 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 45 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

chainparams: delete my DNS seed

A Bitcoin Core developer removed their own DNS seed (seed.bitcoin.sipa.be, run by Pieter Wuille) from the list of hardcoded network seeds that help new Bitcoin nodes find peers when they first start up. This is a routine operational/mainte…

Removal of a trusted bootstrap DNS seed from default chain parametersReduction in peer-discovery redundancy for new mainnet nodesNo vulnerability patch, cryptographic fix, or memory-safety change present
d9080639by Pieter Wuille+1−32 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: Redeclare variable as signed in `util_tests`

This is a minor fix to a unit test file. A test variable was being assigned a negative value in an unsigned container, which caused a silent underflow and made the test assertion technically incorrect. The patch changes the test to check t…

cd2a4bc5by rustaceanrob+1−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

test: add regression test for in-memory SQLiteDatabase reopen

This commit only adds a new automated test. It checks that Bitcoin Core's in-memory SQLite wallet database correctly refuses to reopen after being closed, because reopening would silently create a fresh empty database and discard any previ…

Regression test for data-loss prevention behavior in wallet database layerIn-memory SQLite database reopen could silently discard wallet dataOpen() now throws std::runtime_error instead of returning a fresh connection
777d23f2by Pablo Martin+9−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

refactor: Use u64 over size_t for all cache sizes to fix a 32-bit overflow

This commit fixes a bug in Bitcoin Core that only affects 32-bit computers. When the program calculated how much database cache to allocate, it multiplied a large default cache value by 10. On 32-bit systems that multiplication overflowed,…

Integer overflow in cache-size calculation on 32-bit systemsUnsigned multiplication overflow explicitly mentioned in commit message with runtime sanitizer outputType promotion from size_t to uint64_t to prevent platform-dependent width issues
fabafd91by MarcoFalke+37−285 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 85 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

wallet: Use Descriptor::CanSelfExpand() in CanGetAddresses()

This is a small Bitcoin Core wallet change that lets the wallet generate addresses from certain descriptors even when it does not have private keys and has already used up its pre-derived address range. It only affects descriptors that can…

Changes address-derivation gating logic in wallet codeExpands conditions under which addresses can be produced without private keysNo explicit security framing, CVE, or advisory language in commit
1e996640by Ava Chow+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 58 · Thin
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

descriptor: Add CanSelfExpand()

This commit adds a new helper method called CanSelfExpand() to Bitcoin Core's descriptor system. It lets the code ask whether a wallet descriptor can produce its Bitcoin address(es) on its own, without needing a saved cache or private keys…

New API surface added to descriptor subsystem (CanSelfExpand)No change to existing expansion, signing, or key-derivation logicNo bounds, memory, or cryptographic operations modified
d2ee9227by Ava Chow+57−184 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidaterefactor: use SignOptions for MutableTransactionSignatureCreatorby Sjors Provoost · eab72d14 · Apr 28, 2026 · 11 filesMessage 62 · AdequateInformational 15Details
Commit message · Sjors Provoost

refactor: use SignOptions for MutableTransactionSignatureCreator

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit is a straightforward code cleanup: it replaces a raw integer parameter representing the signature hash type with a small structured options object called SignOptions. All call sites are updated to pass the same value inside the new structure. There is no change to what the program actually does, no bug fix, and no security-relevant behavior change.

Security candidatefuzz: mine blocks and send headers for them in cmpctblock harnessby Eugene Siegel · 3c58efe2 · Apr 27, 2026 · 3 filesMessage 95 · StrongInformational 15Details
Commit message · Eugene Siegel

fuzz: mine blocks and send headers for them in cmpctblock harness

The blocks may include mempool and non-mempool transactions. If the
block index was added to, reset the rng, mempool, and chainman. Also
move FinalizeHeader from p2p_headers_presync.cpp to util.h so that
the mining function can use it to create valid headers.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
entropy or randomnessfuzzing or regression evidence
AI analysis · Informational 15/100

This commit only changes Bitcoin Core's internal fuzz testing code. It expands a fuzz harness so that the test can mine fake blocks and send headers for them, improving test coverage for compact block processing. There is no change to production network code, wallets, consensus rules, or RPC interfaces, so it does not introduce a security vulnerability in the software users run.

Security candidatefuzz: create and send transactions in cmpctblock harnessby Eugene Siegel · 65162243 · Apr 27, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Eugene Siegel

fuzz: create and send transactions in cmpctblock harness

If the mempool is modified at all (determined by a change in the sequence
counter), reset the rng, mempool, and the chainman for the next iteration.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
entropy or randomnessfuzzing or regression evidence
AI analysis · Informational 15/100

This commit only changes a fuzz test file (src/test/fuzz/cmpctblock.cpp). It makes the compact-block fuzzing harness create and send fake transactions during testing, and resets internal test state if the mempool changes. There is no change to production Bitcoin Core code, network rules, or wallet behavior. It does not fix or introduce a real security vulnerability.

Security candidateFix startup failure with RLIM_INFINITY fd limitsby Sjors Provoost · 4afbabdc · Apr 23, 2026 · 4 filesMessage 78 · AdequateLow 29Details
Commit message · Sjors Provoost

Fix startup failure with RLIM_INFINITY fd limits

When setting the fd limit to unlimited, the node fails to start:

ulimit -n unlimited
build/bin/bitcoind
Error: Not enough file descriptors available. -1 available, 160 required.

This was caused by RaiseFileDescriptorLimit() casting limitFD.rlim_cur
to int, which for RLIM_INFINITY overflows to -1. Fix it by returning
std::numeric_limits<int>::max() instead.

This commit also adds a functional test, which is skipped on environments
with a hard limit below infinity.

Co-authored-by: Luke Dashjr <luke-jr+git@utopios.org>
Co-authored-by: winterrdog

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
memory safety
AI analysis · Low 29/100

This commit fixes a bug where Bitcoin Core would refuse to start if the user's system was configured to allow an unlimited number of open files ('ulimit -n unlimited'). The program incorrectly treated 'unlimited' as -1 available file descriptors, then reported 'Not enough file descriptors available' and exited. The fix makes the program recognize 'unlimited' as the maximum integer value instead, so startup succeeds. This is a reliability/availability fix, not a security vulnerability that an attacker can exploit.

Security candidaterefactor: use _MiB consistently for Mebibyte conversionsby Lőrinc · af0ee28e · Apr 20, 2026 · 36 filesMessage 100 · StrongInformational 20Details
Commit message · Lőrinc

refactor: use _MiB consistently for Mebibyte conversions

Replace hard-coded MiB byte conversions (e.g. `1024*1024`, `1<<20`, `1048576`) with the existing `_MiB` literal to improve readability and avoid repeating constants.
In the few spots where arithmetic involves signed values, the result is identical to the previous code assuming those quantities never turn negative.

Also switch to brace init on every declaration assigned from `_MiB`/`_GiB` literals so a future oversized value (e.g. `unsigned int x{4096_MiB}`) becomes a compile error through the C++11 narrowing check instead of silently truncating.

Extend unit tests to cover the 32-bit `size_t` overflow boundary and to assert equivalence for integer and floating-point conversions.

Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>
Co-authored-by: w0xlt <94266259+w0xlt@users.noreply.github.com>

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
memory safetyseed or entropy path
AI analysis · Informational 20/100

This is a code cleanup change that replaces scattered hard-coded byte counts like 1024*1024 with a single named helper, _MiB, and adds unit tests for it. It does not change any user-visible behavior or fix a known security bug. The main safety benefit is making future accidental mistakes (for example, writing the wrong number of zeros) less likely and turning some oversized-value mistakes into compile-time errors.

Security candidateutil: add _GiB for Gibibyte conversionsby Lőrinc · b3edd30a · Apr 20, 2026 · 6 filesMessage 83 · StrongInformational 15Details
Commit message · Lőrinc

util: add _GiB for Gibibyte conversions

Introduce `operator""_GiB`, sharing the overflow-checked conversion logic with the existing `operator""_MiB`.

Use `1_GiB` in a few existing places where it is a drop-in replacement (e.g. `1024_MiB`, `1<<30`) and extend unit tests to cover boundary behavior.

83/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
memory safety
AI analysis · Informational 15/100

This commit adds a new code helper for writing byte sizes in gigabytes (GiB) and replaces a few existing hard-coded numbers with the new helper. It is a code cleanup and readability change with no security-relevant behavior change.

Security candidatenet: cleanup SOCKS5 auth loggingby takeshikurosawaa · b2debc92 · Apr 19, 2026 · 1 fileMessage 73 · AdequateLow 49Details
Commit message · takeshikurosawaa

net: cleanup SOCKS5 auth logging

Do not log SOCKS5 auth credentials.

Keep the log entry for the auth path, but omit the
username and password.

No behavior change intended.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
credential or privilege state
AI analysis · Low 49/100

This commit removes a debug log line that printed SOCKS5 proxy usernames and passwords in plain text. The change prevents sensitive credentials from being written to log files, which could otherwise expose them to anyone with access to those logs. It is a straightforward cleanup with clear security benefit, though it only affects debug-level logging.

Security candidatetor: torcontrol disconnect on too many lines to avoid OOMby David Gumberg · 9fe5896a · Apr 17, 2026 · 2 filesMessage 98 · StrongModerate 62Details
Commit message · David Gumberg

tor: torcontrol disconnect on too many lines to avoid OOM

This commit ensures the `TorControlConnection::m_message` buffer doesn't
grow unbounded and exhaust memory, by limiting the number of lines
handled by `TorControlConnection::ProcessBuffer()` to `MAX_LINE_COUNT =
1000`. Now the most memory that can be occupied by `m_message` is on the
order of `MAX_LINE_LENGTH * MAX_LINE_COUNT= 100MB`

Although this is not compliant with the tor control protocol in general,
where commands like `GETINFO ns/all` will likely return thousands of
lines, it is more than sufficient for handling the replies from the
commands that are used by a node:

`AUTHENTICATE`: 1 line:
The server responds with 250 OK on success or 515 Bad
authentication if the authentication cookie is incorrect. Tor closes
the connection on an authentication failure.

https://spec.torproject.org/control-spec/commands.html#authenticate

`GETINFO net/listener/socks`: 2 lines
A quoted, space-separated list of the locations where Tor is
listening...

https://spec.torproject.org/control-spec/commands.html#getinfo

`AUTHCHALLENGE SAFECOOKIE`: 1 line
If the server accepts the command, the server reply format is:

```
"250 AUTHCHALLENGE" SP "SERVERHASH=" ServerHash SP "SERVERNONCE="
ServerNonce CRLF
```

https://spec.torproject.org/control-spec/commands.html#authenticate

`PROTOCOLINFO`: 4-5 lines

The server reply format is:

```
250-PROTOCOLINFO" SP PIVERSION CRLF \*InfoLine "250 OK" CRLF
InfoLine = AuthLine / VersionLine / OtherLine
```

(https://spec.torproject.org/control-spec/commands.html#protocolinfo)

`ADD_ONION`: 2-3 lines for Bitcoin Core's tor control client.

The server reply format is:

```
"250-ServiceID=" ServiceID CRLF
["250-PrivateKey=" KeyType ":" KeyBlob CRLF]
*("250-ClientAuth=" ClientName ":" ClientBlob CRLF)
"250 OK" CRLF
```

...

The server response will only include a private key if the server
was requested to generate a new keypair

...

If client authorization is enabled using the “BasicAuth” flag (which
is v2 only), the service will not be accessible to clients without
valid authorization data (configured with the “HidServAuth” option).
The list of authorized clients is specified with one or more
“ClientAuth” parameters. If “ClientBlob” is not specified for a
client, a new credential will be randomly generated and returned."

https://spec.torproject.org/control-spec/commands.html#add_onion

We don't set the `BasicAuth` flag, so the response will not include any
`ClientAuthLines`.

98/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
secret or key materialaccess controlcredential or privilege state
AI analysis · Moderate 62/100

This change fixes a memory safety issue in Bitcoin Core's connection to the Tor control port. A malicious or misbehaving Tor control server could send an endless stream of reply lines, causing Bitcoin Core to keep allocating memory until the system ran out. The patch caps the number of lines accepted in a single reply at 1,000, after which the connection is closed. The commit message explicitly says this is to avoid out-of-memory (OOM) exhaustion.

Security candidatewallet, bdbro: Enforce overflow data lengthsby Ava Chow · dc3a2b9c · Apr 16, 2026 · 1 fileMessage 73 · AdequateModerate 60Details
Commit message · Ava Chow

wallet, bdbro: Enforce overflow data lengths

The total length of the data in an overflow record is being given to us.
We should validate that the length is reasonable (fits in the total size
of the file), and to stop reading additional data if the amount of data
read exceeds the stated legnth. This prevents infinite looping behavior.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
memory safetydefensive validationsigning or wallet path
AI analysis · Moderate 60/100

This patch fixes a bug in Bitcoin Core's wallet migration code that reads old Berkeley DB wallet files. A malformed wallet file could claim an overflow data record was extremely long, causing the software to loop through pages forever. The fix checks that the claimed length fits within the actual file size and stops reading if the collected data exceeds that claimed length. This prevents a denial-of-service via infinite loop when opening a crafted wallet file.

Security candidateSquashed 'src/secp256k1/' changes from 57315a6985..7262adb4b4by fanquake · dfd54c95 · Apr 9, 2026 · 41 filesMessage 96 · StrongLow 34Details
Commit message · fanquake

Squashed 'src/secp256k1/' changes from 57315a6985..7262adb4b4

7262adb4b4 Merge bitcoin-core/secp256k1#1841: gha: Bump deprecated GHA workflow dependencies
c5cd9d6d9a gha: Bump deprecated GHA workflow dependencies
95b702de34 Merge bitcoin-core/secp256k1#1839: ecdsa: VERIFY_CHECK result of _fe_set_b32_limit
634215f3fc Merge bitcoin-core/secp256k1#1837: tests: Fix function pointer initialization C89 error in ellswift tests
43fca0ff55 ecdsa: VERIFY_CHECK result of _fe_set_b32_limit
b84635ed3b tests: Fix C89 function pointer initialization in ellswift tests
ffc25a2731 Merge bitcoin-core/secp256k1#1834: ecmult: Document and test ng=NULL in ecmult
3a403639dc eckey: Call ecmult with NULL instead of zero scalar
7e68c0c88b ecmult: Document and test ng=NULL in ecmult
1aafe15139 Merge bitcoin-core/secp256k1#1777: Make SHA256 compression runtime pluggable
b9cb1cbfd7 Merge bitcoin-core/secp256k1#1824: util: introduce and use `ARRAY_SIZE` macro
4d92a083bc sha256: speed up writes using multi-block compression
0753f8b909 Add API to override SHA256 compression at runtime
fdb6a91a5e Introduce hash context to support pluggable SHA256 compression
c0a2aba088 Merge bitcoin-core/secp256k1#1811: bench: Update help functions in bench and bench_internal
10f546a2c0 Merge bitcoin-core/secp256k1#1832: testrand: Remove testrand_finish
8d0eda07e9 testrand: Remove testrand_finish
95e6815843 Merge bitcoin-core/secp256k1#1825: hash: remove redundant `secp256k1_sha256_initialize` in tagged hash midstate functions
f48b1bfa5d hash: add midstate initializer and use it for tagged hashes
3019186a6d Merge bitcoin-core/secp256k1#1829: ci: Fix leftover use of old ECMULTGENPRECISION
79e9f25237 ci: Fix leftover use of old ECMULTGENPRECISION
dfe042feb2 Merge bitcoin-core/secp256k1#1828: Revert "ci, docker: Fix LLVM repository signature failure"
76e92cfeea Revert "ci, docker: Fix LLVM repository signature failure"
ac561601b8 Merge bitcoin-core/secp256k1#1760: cmake: Add dynamic test discovery to improve parallelism
c7a7f732bd Merge bitcoin-core/secp256k1#1821: ellswift: fix overflow flag handling in secp256k1_ellswift_xdh
921b9711ea util: introduce and use `ARRAY_SIZE` macro
b99a94c382 Add tests for bad scalar inputs in ellswift XDH
307b49f1b9 ellswift: fix overflow flag handling in secp256k1_ellswift_xdh
322d0a4358 Merge bitcoin-core/secp256k1#1823: ci: Load Docker image by ID from builder step
ed02466d3f ci: Load Docker image by ID from builder step
c49c9be504 bench: Update help functions in bench and bench_internal
1d146ac3ed Merge bitcoin-core/secp256k1#1819: tests: Improve secp256k1_scalar_check_overflow tests (Issue #1812)
f47bbc07f0 test: add unit tests for secp256k1_scalar_check_overflow
d071aa56d5 Merge bitcoin-core/secp256k1#1815: refactor: remove unnecessary `malloc` result casts
99ab4a105e Merge bitcoin-core/secp256k1#1817: ci: Disable Docker build summary generation
c5da3bde9c Merge bitcoin-core/secp256k1#1818: ci: Enforce base-10 evaluation
97de5120cf Merge bitcoin-core/secp256k1#1804: test: show both CMake and Autotools usage for ctime_tests
4fb7ccf5d4 ci: Enforce base-10 evaluation
3ae72e7867 ci: Disable Docker build summary generation
97b3c47849 refactor: remove unnecessary `malloc` result casts
1bc74a22f8 test: show both Autotools and CMake usage for ctime_tests
8354618e02 cmake: Set `LABELS` property for tests
29f26ec3cf cmake: Integrate DiscoverTests and normalize test names
f95b263f23 cmake: Add DiscoverTests module
4ac651144b cmake, refactor: Deduplicate test-related code

git-subtree-dir: src/secp256k1
git-subtree-split: 7262adb4b40074201fb30847035a82b8d742f350

96/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarymemory safetycryptography-sensitive path
AI analysis · Low 34/100

This is a routine subtree update that pulls in many upstream libsecp256k1 changes. The most notable user-visible change is a new API that lets callers replace the internal SHA256 compression function with a custom one (for example, a hardware-accelerated version). The update also fixes a small bug in the EllSwift ECDH helper where an all-zero secret key was not always rejected, and it adds several code-quality and test improvements. There is no evidence in the commit message or diff of an undisclosed security vulnerability being patched.

Security candidaterefactor: normalize CCoinsView whitespace and signaturesby Lőrinc · a9f92e34 · Apr 8, 2026 · 4 filesMessage 77 · AdequateInformational 15Details
Commit message · Lőrinc

refactor: normalize CCoinsView whitespace and signatures

Let's get these out of the way to simplify riskier followup commits

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit is purely a code cleanup: it changes spacing and formatting in C++ function signatures (for example, moving the ampersand in `COutPoint &outpoint` to `COutPoint& outpoint` and adjusting line breaks). No program behavior is changed, and there is no security risk.

Security candidatetest: Add SRD success testsby Murch · fe9f53bf · Apr 7, 2026 · 1 fileMessage 90 · StrongInformational 15Details
Commit message · Murch

test: Add SRD success tests

Previously, SRD had only failure and edge-case coverage, so we add a few
simple coin selection targets that should quickly succeed, including one
that will create a minimal change output.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit only adds new test cases for an existing coin-selection algorithm called SRD (Single Random Draw). It does not change any production wallet code, network rules, or consensus behavior. The change is purely in the test suite and verifies that SRD succeeds for simple, realistic selection targets. There is no security issue here.

Security candidatescripted-diff: replace remaining Python test equality assertsby Lőrinc · 3fd68a95 · Apr 7, 2026 · 37 filesMessage 83 · StrongInformational 15Details
Commit message · Lőrinc

scripted-diff: replace remaining Python test equality asserts

Some Python functional tests still use plain `assert x == y`.
The earlier commits convert the ambiguous assert patterns by hand, so this commit can rewrite the remaining safe cases mechanically.
The verify script excludes `wallet_bumpfee.py`, `test_framework/netutil.py`, and `test_framework/authproxy.py`, which still contain assert forms that the plain line-based substitution would misidentify.

-BEGIN VERIFY SCRIPT-
perl -pi -e 's/^(\s*)assert (.+?) == ([^,#]+?)$/\1assert_equal(\2, \3)/' $(git ls-files -- 'test/functional' \
':(exclude)test/functional/wallet_bumpfee.py' ':(exclude)test/functional/test_framework/netutil.py' ':(exclude)test/functional/test_framework/authproxy.py')
-END VERIFY SCRIPT-

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a bulk cleanup of Bitcoin Core's Python functional tests. It mechanically replaces plain `assert x == y` statements with a project-specific `assert_equal(x, y)` helper. The change only affects test code, not the Bitcoin node software that users run, so it cannot directly impact live Bitcoin operations, wallets, or consensus. It improves the quality of test failure messages but introduces no security vulnerability and fixes no exploitable bug.

Security candidatetest: add missing `assert_equal` importsby Lőrinc · 301b1d7b · Apr 7, 2026 · 10 filesMessage 90 · StrongInformational 15Details
Commit message · Lőrinc

test: add missing `assert_equal` imports

The later scripted diff only rewrites call sites.
Add `assert_equal` imports in the remaining files that still need them so the mechanical replacement can apply cleanly.

90/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit only adds missing Python imports for a helper function named assert_equal in test files. It does not change how Bitcoin Core runs, validates transactions, or handles user funds. It is a routine test-code cleanup with no security relevance.

Security candidatetest: convert truthy asserts in `wallet_miniscript` and `rpc_psbt`by Lőrinc · 06a4176c · Apr 7, 2026 · 2 filesMessage 95 · StrongInformational 15Details
Commit message · Lőrinc

test: convert truthy asserts in `wallet_miniscript` and `rpc_psbt`

Replace the last remaining truthy asserts (and a remaining `is False`) in `wallet_miniscript.py` and `rpc_psbt.py` with `assert_equal`.

Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit only changes test code. It replaces loose truthiness checks (like `assert x` or `assert not x`) with stricter equality checks (`assert_equal(x, True/False)`) in two Python test files. It does not change any production Bitcoin Core code, so it cannot directly affect live wallets, nodes, or transactions.

Security candidatetest: convert simple equality asserts in excluded filesby Lőrinc · d9a3cf20 · Apr 7, 2026 · 2 filesMessage 100 · StrongInformational 15Details
Commit message · Lőrinc

test: convert simple equality asserts in excluded files

A few files still need to stay out of the later scripted diff because they contain more complicated assert shapes.
Convert the straightforward equality checks in those files by hand first.
Use a local import in `authproxy.py` so the change does not create an import cycle.

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing or wallet pathauthentication path
AI analysis · Informational 15/100

This commit only changes test code. It replaces plain Python assert statements with a custom assert_equal helper in two test files. There is no change to Bitcoin Core's production code, network behavior, wallet logic, or consensus rules, so it has no security impact on users.

Security candidaterpc: fix initialization-order-fiasco by lazy-init of decodepsbt_inputsby Eugene Siegel · d517fa0a · Apr 3, 2026 · 2 filesMessage 73 · AdequateLow 25Details
Commit message · Eugene Siegel

rpc: fix initialization-order-fiasco by lazy-init of decodepsbt_inputs

Prior to this commit, decodepsbt_inputs would call TxDoc during initialization
which lives in another TLU. TxDoc relies on CURRENCY_UNIT to be initialized when
it may not have been (note this is different from the TLU containing
decodepsbt_inputs which also has a CURRENCY_UNIT). Fix this by lazy initializing
decodepsbt_inputs.

Prevent the issue from occurring in the future by also doing the same for
decodepsbt_outputs and getblock_vin.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 25/100

This commit fixes a subtle startup bug in Bitcoin Core's RPC help system. Some help text for commands like 'decodepsbt' and 'getblock' was being built before all global constants were ready, which could cause crashes or garbled output when the program starts. The fix delays building that help text until it is actually needed. It is a reliability fix, not a remote attack vector.

Security candidatecrypto: disable ASan instrumentation of SSE4 SHA256 for GCCby deadmanoz · fedeff7f · Apr 1, 2026 · 1 fileMessage 83 · StrongInformational 18Details
Commit message · deadmanoz

crypto: disable ASan instrumentation of SSE4 SHA256 for GCC

The existing Clang-only no_sanitize("address") guard is extended to
also cover GCC. When GCC compiles this file with -fsanitize=address
in debug builds, the instrumented inline assembly causes a SEGV during
SHA256AutoDetect()'s self-test on CPUs that use the SSE4 code path
(i.e. those without SHA-NI support), regardless of optimization level.

The original Clang code placed the attribute between the function
declarator and the opening brace. GCC's Attribute Syntax
documentation notes that this position in a function definition
"may, in future, be permitted," so it is not currently supported.
The attribute is moved to the start of the function definition,
which is valid form for both GCC and Clang.

The preprocessor guards are restructured so each compiler branch is
explicit: __clang__ with __has_feature, and __GNUC__ with
__SANITIZE_ADDRESS__.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validationcryptography-sensitive path
AI analysis · Informational 18/100

This is a build-compatibility fix, not a security vulnerability in normal Bitcoin operation. It stops a specific compiler sanitizer (GCC's AddressSanitizer, used only in debug/test builds) from crashing when running SHA-256 self-tests on older CPUs that lack SHA-NI hardware support. The change does not affect production releases or how Bitcoin validates transactions.

Security candidatecli: Clearer error messages on authentication failureby Hodlinator · 20a94c15 · Mar 31, 2026 · 5 filesMessage 70 · AdequateInformational 18Details
Commit message · Hodlinator

cli: Clearer error messages on authentication failure

Co-authored-by: MarcoFalke <*~=`'#}+{/-|&$^_@721217.xyz>

70/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Names security-relevant behavior explicitly
Why it was queued
access control
AI analysis · Informational 18/100

This commit only changes the wording of error messages shown when bitcoin-cli fails to log in to the RPC server. It does not fix or introduce any security vulnerability; it is a user-experience improvement that tells users more precisely why authentication failed (missing cookie file, cookie disabled, bad cookie contents, or wrong password).

Security candidateci, iwyu: Fix warnings in `src/util` and treat them as errorsby Hennadii Stepanov · 8b49e2dd · Mar 30, 2026 · 42 filesMessage 50 · ThinInformational 15Details
Commit message · Hennadii Stepanov

ci, iwyu: Fix warnings in `src/util` and treat them as errors

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathsigning or wallet path
AI analysis · Informational 15/100

This commit is a routine code-quality cleanup. It adjusts which C++ header files are included in various source files under src/util and turns on a stricter automated check (IWYU) in the project's continuous integration. There is no functional change to Bitcoin Core's behavior, no bug fix, and no security-relevant change.

Security candidatefuzz: Use CAmount for storing best_wasteby Ava Chow · 890a09b1 · Mar 28, 2026 · 1 fileMessage 75 · AdequateInformational 17Details
Commit message · Ava Chow

fuzz: Use CAmount for storing best_waste

Waste is a CAmount, which is an int64_t. This will overflow an int, so
`best_waste` should also be a `CAmount`.

75/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
memory safetyfuzzing or regression evidencesigning or wallet path
AI analysis · Informational 17/100

This is a one-line fix in a fuzz test (automated randomized test) for Bitcoin Core's coin selection logic. It changes a variable that tracks the 'best waste' amount from a 32-bit signed integer to a 64-bit signed integer type, matching the actual CAmount type. The change prevents a possible integer overflow inside the fuzz test itself, not in the production wallet code that handles real Bitcoin transactions. It does not appear to be a security vulnerability in live Bitcoin Core software.

Security candidateSquashed 'src/ipc/libmultiprocess/' changes from 1868a84451f..70f632bda8fby Ryan Ofsky · 2478a15e · Mar 27, 2026 · 28 filesMessage 91 · StrongModerate 59Details
Commit message · Ryan Ofsky

Squashed 'src/ipc/libmultiprocess/' changes from 1868a84451f..70f632bda8f

70f632bda8f Merge bitcoin-core/libmultiprocess#265: ci: set LC_ALL in shell scripts
8e8e564259a Merge bitcoin-core/libmultiprocess#249: fixes for race conditions on disconnects
05d34cc2ec3 ci: set LC_ALL in shell scripts
e606fd84a8c Merge bitcoin-core/libmultiprocess#264: ci: reduce nproc multipliers
ff0eed1bf18 refactor: Use loop variable in type-context.h
ff1d8ba172a refactor: Move type-context.h getParams() call closer to use
1dbc59a4aa3 race fix: m_on_cancel called after request finishes
1643d05ba07 test: m_on_cancel called after request finishes
f5509a31fcc race fix: getParams() called after request cancel
4a60c39f24a test: getParams() called after request cancel
f11ec29ed20 race fix: worker thread destroyed before it is initialized
a1d643348f4 test: worker thread destroyed before it is initialized
336023382c4 ci: reduce nproc multipliers
b090beb9651 Merge bitcoin-core/libmultiprocess#256: ci: cache gnu32 nix store
be8622816da ci: cache gnu32 nix store
975270b619c Merge bitcoin-core/libmultiprocess#263: ci: bump timeout factor to 40
09f10e5a598 ci: bump timeout factor to 40
db8f76ad290 Merge bitcoin-core/libmultiprocess#253: ci: run some Bitcoin Core CI jobs
55a9b557b19 ci: set Bitcoin Core CI test repetition
fb0fc84d556 ci: add TSan job with instrumented libc++
0f29c38725b ci: add Bitcoin Core IPC tests (ASan + macOS)
3f64320315d Merge bitcoin-core/libmultiprocess#262: ci: enable clang-tidy in macOS job, use nullptr
cd9f8bdc9f0 Merge bitcoin-core/libmultiprocess#258: log: add socket connected info message and demote destroy logs to debug
b5d6258a42f Merge bitcoin-core/libmultiprocess#255: fix: use unsigned char cast and sizeof in LogEscape escape sequence
d94688e2c32 Merge bitcoin-core/libmultiprocess#251: Improved CustomBuildField for std::optional in IPC/libmultiprocess
a9499fad755 mp: use nullptr with pthread_threadid_np
f499e37850f ci: enable clang-tidy in macOS job
98f1352159d log: add socket connected info message and demote destroy logs to debug
554a481ea73 fix: use unsigned char cast and sizeof in LogEscape escape sequence
1977b9f3f65 Use std::forward in CustomBuildField for std::optional to allow move semantics, resolves FIXME
22bec918c97 Merge bitcoin-core/libmultiprocess#247: type-map: Work around LLVM 22 "out of bounds index" error
8a5e3ae6ed2 Merge bitcoin-core/libmultiprocess#242: proxy-types: add CustomHasField hook to map Cap'n Proto values to null C++ values
e8d35246918 Merge bitcoin-core/libmultiprocess#246: doc: Bump version 8 > 9
97d877053b6 proxy-types: add CustomHasField hook for nullable decode paths
8c2f10252c9 refactor: add missing includes to mp/type-data.h
b1638aceb40 doc: Bump version 8 > 9
f61af487217 type-map: Work around LLVM 22 "out of bounds index" error

git-subtree-dir: src/ipc/libmultiprocess
git-subtree-split: 70f632bda8f80449b6240f98da768206a535a04e

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
memory safety
AI analysis · Moderate 59/100

This commit updates the libmultiprocess library inside Bitcoin Core. The most important changes are fixes for three race-condition bugs that could crash or destabilize the inter-process communication (IPC) layer when a connection is disconnected while worker threads are starting, running, or finishing. The commit also adds a new way to represent null data values in IPC messages, improves build/CI scripts, and bumps the library version. The race fixes are defensive hardening rather than obviously exploitable vulnerabilities, but they remove real crash paths that could be triggered by an attacker able to disconnect an IPC session at the right moment.

Security candidaterpc, refactor: gettxoutsetinfo race condition fix follow-upsby rkrux · 3e5dc610 · Mar 24, 2026 · 2 filesMessage 78 · AdequateInformational 11Details
Commit message · rkrux

rpc, refactor: gettxoutsetinfo race condition fix follow-ups

This patch addresses my own review comments from the review of PR 34451.
If these are found helpful, it makes sense to do them now after the previous
PR was merged and backported.

Pasting the comments below that also explains the changes:

- Move the pindex declaration below now that it is not used earlier.
- stats was being generated partially in both these ComputeUTXOStats functions,
which reads oddly to me. Now that the pcursor is also moved and passed to this
function, which reads oddly as well, I believe we can refactor this function
to completely build the stats inside this function. A side benefit is that by
removing the stats and pcursor arguments, the function signature becomes quite
similar to its namesake, which in turn becomes a straightforward wrapper of
this function.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 11/100

This is a small internal cleanup change for a Bitcoin Core function that calculates statistics about the unspent coin set (used by the gettxoutsetinfo RPC). It moves where a variable is declared and refactors how the statistics object is built so the code is easier to read. There is no direct security fix in this commit itself; it is described as a follow-up to a prior pull request that addressed a race condition.

Security candidateMerge bitcoin-core/gui#815: Bugfix on TransactionsView - Disable if privacy mode is set during wallet selectionby Hennadii Stepanov · 999c4248 · Mar 22, 2026 · 2919 filesMessage 91 · StrongLow 25Details
Commit message · Hennadii Stepanov

Merge bitcoin-core/gui#815: Bugfix on TransactionsView - Disable if privacy mode is set during wallet selection

0dc337f73d013e342b880746292f1c3247b287cf gui: Fix TransactionsView on setCurrentWallet (pablomartin4btc)

Pull request description:

<details>
<summary>Currenlty on <code>master</code>, when the "mask values" checkbox is ticked if the user selects a different wallet, the history action is enable and if the user clicks on it can see all the transactions in the transaction view.</summary>

![Peek 2024-04-09 17-37](https://github.com/bitcoin-core/gui/assets/110166421/d8e2fdd1-aaa6-4506-acde-51fa45a74910)

</details>
<details>
<summary>This PR fixes it.</summary>

![Peek 2024-04-09 17-45](https://github.com/bitcoin-core/gui/assets/110166421/78c30dc5-42a6-4829-981d-6b9aaa03f014)

</details>

Note for maintainers: this needs to be backported to 25.x and 26.x.

ACKs for top commit:
hebasto:
ACK 0dc337f73d013e342b880746292f1c3247b287cf, tested on Fedora 43.

Tree-SHA512: 54581546917f87b4c1db0ff1eaa1962ee6eb078285dbb205b4c8d027c3e350f3dc46409b376948c10e668f9487b7a5a70bab0dff5faf510deab1a54452f7f0e5

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol pathmerge-commit duplicate discount
AI analysis · Low 25/100

This commit fixes a small user-interface bug in Bitcoin Core's Qt wallet GUI. When the user turns on 'privacy mode' (the 'mask values' checkbox that hides balances), then switches to a different wallet, the 'History' button was incorrectly staying enabled. Clicking it would reveal the transaction list for the newly selected wallet, defeating the intended privacy setting. The fix makes the transaction view stay disabled when privacy mode is active during a wallet switch. It is a local, UI-only information-disclosure issue that requires the attacker to already have access to the unlocked GUI and the ability to switch wallets.

Security candidatewallet: feebumper, fix crash when combined bump fee is unavailableby furszy · 6072a2a6 · Mar 19, 2026 · 1 fileMessage 73 · AdequateLow 45Details
Commit message · furszy

wallet: feebumper, fix crash when combined bump fee is unavailable

When a large cluster of unconfirmed transactions exceeds the limit,
calculateCombinedBumpFee() returns std::nullopt.

Previously, we continued executing and the optional value was
accessed unconditionally, leading to a std::bad_optional_access
exception.

Fix this by returning early when the returned bumped fee is null.

Note:
This is a crash for the GUI, and an uncaught exception for the RPC
bumpfee and psbtbumpfee.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Low 45/100

This commit fixes a bug in Bitcoin Core's transaction fee-bumping feature. When a user tried to increase the fee on a transaction that was tied to a very large cluster of unconfirmed transactions, the software could not calculate the required fee and returned an empty value. The old code then tried to use that empty value anyway, causing the program to crash (in the GUI) or throw an unhandled exception (in command-line tools). The fix simply checks for the empty value and returns a proper error message instead of crashing.