Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit adds the first implementation of BIP352 (Silent Payments) to Bitcoin Core. Silent Payments are a new type of privacy-preserving Bitcoin address that lets someone receive payments without publicly revealing a fixed address. The …
New cryptographic feature implementation (BIP352 Silent Payments)Extensive use of secp256k1 silentpayments moduleInput public key extraction from P2PKH, P2WPKH, P2SH-P2WPKH, and P2TR inputs
This update fixes a wallet database loading bug where a damaged or tampered Bitcoin wallet file could cause the program to read past the end of a stored extended public key (xpub). The patch makes the loader check the stored xpub length be…
Out-of-bounds read in wallet descriptor cache deserializationASan container-overflow triggered by malformed on-disk recordMissing length validation between record size prefix and fixed-size decoder
This commit adds a new wallet RPC called listrawtransactions to Bitcoin Core. It is a feature addition that lets users list every transaction their wallet knows about, including internal transfers and consolidations that the existing listt…
No security-relevant bug fix or vulnerability patch is present in the diff.New RPC exposes additional wallet transaction metadata, but only to callers already authorized for wallet RPCs.Code is a refactor of existing gettransaction logic into shared helpers; no new cryptographic, network, or consensus code.
This Bitcoin Core update fixes several wallet bugs where a failed database write could leave a wallet in an inconsistent state. For example, encrypting a wallet or changing its passphrase could appear to succeed in memory while the change …
Atomicity fix for encryption state and descriptor key persistenceFailure to persist master key during encryption previously reported success in memoryPassphrase change could activate new passphrase only in memory
This commit only changes Bitcoin Core's internal functional test code. It replaces hard-coded test keys and addresses with ones generated from a new test helper class, and unifies how tests tell nodes not to create a default wallet. There …
This commit only adds a new automated test to Bitcoin Core. It checks that when two partially-signed Bitcoin transactions (PSBTs) are combined, any custom 'unknown' data fields attached to them are preserved correctly. There is no change t…
This is a Bitcoin Core wallet maintenance patch. It speeds up a wallet function that checks whether a descriptor already exists by caching a hash of the descriptor's canonical text, instead of rebuilding that text every time. It also tidie…
No security-relevant signal in commit message or diffChange is described as performance improvement and code cleanupBackwards-compatibility test notes a known miniscript wallet loading incompatibility between v31.0/v31.1 and other versions, but this is a documented compatibility quirk, not a vulnerability
This is a documentation-only fix for Bitcoin Core's machine-readable RPC help data. It changes several default values from literal strings to 'hint' labels (because the real default depends on context) and corrects one boolean default from…
OpenRPC schema/default mismatch correctionRPC help metadata type correction (string 'false' to boolean false)No executable code path changes
This commit fixes documentation metadata for six Bitcoin Core RPC arguments. It changes how default values are described so that automatically generated API docs and schemas are accurate. The actual behavior of the software when running is…
No runtime code changesOnly RPC help/schema metadata modifiedVendor explicitly states runtime behavior is unchanged
This commit fixes a bug in Bitcoin Core's MuHash3072 cryptographic code where dividing a MuHash object by itself (x /= x) produced the wrong mathematical result. The fix is straightforward: the code now saves the divisor's numerator before…
Cryptographic correctness bug in MuHash3072 division operatorSelf-aliasing in operator/= produces incorrect 1/D result instead of empty setNo production code path identified that triggers self-division
This is a build-compatibility fix, not a security patch. It changes how some constant data is stored internally so that Apple's macOS linker (ld64) can build Bitcoin Core correctly. The change avoids a linker bug that caused build failures…
No security-relevant code logic changedChange is a linker bug workaround, not a vulnerability fixConstants remain read-only; no new attack surface introduced
This commit refactors Bitcoin Core's wallet descriptor import feature so the same logic can be used by both the RPC command and a new GUI-facing interface. It also tightens one input rule: negative timestamps are now rejected, and the mini…
Refactor of security-sensitive wallet import code into shared CWallet pathNew input validation: negative timestamps rejected for importdescriptorsCentralization of descriptor range bound checks in CheckDescriptorRangeBounds
This change fixes a bug in how Bitcoin Core reconnects to the Tor control port. A previous update accidentally removed the wait time between reconnect attempts when an already-established Tor control connection was dropped. Without the wai…
Uncontrolled retry loop causing resource exhaustion and log floodingLocal-only Tor control port interaction; no remote attacker path by defaultRegression introduced by prior refactor (#34158) and restored here
This change updates the Windows code-signing tool used in Bitcoin Core's reproducible build process. It fixes a build-time failure where signature verification could not complete because a certificate package was missing and the old tool v…
Tooling update in release signing pipelineRestores CA certificate store for signature verificationDisables CRL/CDP network lookups during verification
This change lets Bitcoin Core store different custom signet blockchains in separate data folders, using a unique suffix derived from each signet's network identifier. It also adds a friendlier error hint in bitcoin-cli when an RPC authenti…
Data isolation between distinct custom signets reduces risk of cross-network state corruption or accidental mainnet/testnet confusionNo memory-safety, cryptographic, or consensus changes observedNo privilege escalation, remote code execution, or denial-of-service vectors introduced in the diff
This change adds two extra pieces of information—whether a spent output came from a coinbase transaction and the block height at which it was created—to a Bitcoin Core REST API endpoint. It is a feature/parity improvement to make the REST …
This change makes Bitcoin Core treat manually-added peers (from -addnode, -connect, or the addnode RPC) more gently during Initial Block Download (IBD). Previously, if such a peer was slow or stalled at sending blocks, the node would disco…
Behavior change in peer disconnection logic during IBDManual peers exempted from block-stalling disconnectionNew per-peer cooldown state m_block_download_paused_until introduced
This is a small fix in Bitcoin Core's own test helper code. A helper function used only in tests could crash with an IndexError when given an extremely short fake signature, instead of cleanly returning False. The change moves a length che…
Out-of-order bounds check leading to IndexError in test helperRegression test added for malformed short DER signaturesTest-only code path, no production validation logic changed
This commit only adds a new functional test to Bitcoin Core. It checks that the getrawtransaction RPC can retrieve a stale block's coinbase transaction via the optional txindex, and that the response correctly shows the block is no longer …
This commit only adds a new automated test to Bitcoin Core. It does not change any production wallet, mempool, or node code. The test verifies that when a user tries to bump the fee of a transaction whose unconfirmed inputs depend on too m…
Adds regression test for previously fixed crash path (bad optional_access in CheckFeeRate)No production code changes; no new attack surface introducedTest exercises DoS-limit error handling in fee bumping
**Problem:** `getprioritisedtransactions` lets node operators inspect fee adjustments. While building the response, the RPC checks each transaction ID against all previous IDs, even though duplicates are impossible. The same unnecessary search appears in a few other RPC responses built directly from `std::map` or `std::set` keys.
**Fix:** Each changed response key comes from a `std::map` or `std::set`, where keys are unique, so insertion can skip the linear `findKey()` call.
**Reproducer:** On a RPi 4, the test below took almost a minute before the fix and about half that time after. The other changed map and set loops perform the same per-key search, so their response construction has the same quadratic-to-linear scaling as the number of entries grows.
<details> <summary>Reproducer commands</summary>
```patch diff --git a/test/functional/mining_prioritisetransaction.py b/test/functional/mining_prioritisetransaction.py --- a/test/functional/mining_prioritisetransaction.py +++ b/test/functional/mining_prioritisetransaction.py @@ -11,6 +11,7 @@ from test_framework.blocktools import NORMAL_GBT_REQUEST_PARAMS from test_framework.messages import ( COIN, MAX_BLOCK_WEIGHT, + ser_uint256, ) from test_framework.test_framework import BitcoinTestFramework from test_framework.util import ( @@ -215,4 +216,10 @@ class PrioritiseTransactionTest(BitcoinTestFramework): assert_raises_rpc_error(-1, "getprioritisedtransactions", self.nodes[0].getprioritisedtransactions, True)
+ self.log.info("Test getprioritisedtransactions order") + txids = [ser_uint256(i).hex() for i in range(20_000, 0, -1)] + self.nodes[0].batch([self.nodes[0].prioritisetransaction.get_request(txid, 0, 1) for txid in txids]) + assert_equal(list(self.nodes[0].getprioritisedtransactions()), txids[::-1]) + self.clear_prioritisation(self.nodes[0]) + # Test `prioritisetransaction` invalid `txid` ``` </details>
ACKs for top commit: sedited: ACK 74ddf1c0a0ef8447686f59044b2fc2ee8d78c0e4 hodlinator: re-ACK 74ddf1c0a0ef8447686f59044b2fc2ee8d78c0e4
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 20/100
This change is a performance improvement, not a security fix. It replaces a slow method for building JSON responses in several Bitcoin RPC commands with a faster one. The old method could waste CPU time when returning very large responses because it unnecessarily checked for duplicate keys in containers that cannot have duplicates. The new method skips that check, making large responses faster to generate. There is no indication this change fixes a vulnerability or can be directly exploited.
AI review queuedMerge bitcoin/bitcoin#36130: test: add tests in transaction_tests.cpp covering live mutantsby merge-script · 0f206eed · Sep 5, 2026 · 1 fileMessage 91 · StrongInformational 15Details
Commit message · merge-script
Merge bitcoin/bitcoin#36130: test: add tests in transaction_tests.cpp covering live mutants
5ce3a0b4aab5ad9ec710e803f88d79139b3b3c44 test: cover legacy sigops count CHECKMULTISIG inaccurately (ViniciusCestarii) a5fc82e2b1403b7bf0f1ad494a62ccff793f99d0 test: cover enforce BIP68 to tx versions higher than 2 (ViniciusCestarii) bba1d4150ee8d4d4b4df2b91166dff564a756c09 test: cover IsFinalTx requires every input to be SEQUENCE_FINAL (ViniciusCestarii)
Pull request description:
Kills some live mutants on tx_verify.cpp that affect consensus found with https://github.com/ViniciusCestarii/mutant-harness. They are:
<details> <summary>tx_verify.cpp (killed by 5c35785d6ddda80d5147616342e42d759490e6b9): <code>IsFinalTx</code>: sequence loop returns on the first input instead of requiring all of them</summary>
```diff diff --git a/src/consensus/tx_verify.cpp b/src/consensus/tx_verify.cpp index e580a9d..46009a6 100644 --- a/src/consensus/tx_verify.cpp +++ b/src/consensus/tx_verify.cpp @@ -35,11 +35,7 @@ bool IsFinalTx(const CTransaction &tx, int nBlockHeight, int64_t nBlockTime) // also check that the spending input's nSequence != SEQUENCE_FINAL, // ensuring that an unsatisfied nLockTime value will actually cause // IsFinalTx() to return false here: - for (const auto& txin : tx.vin) { - if (!(txin.nSequence == CTxIn::SEQUENCE_FINAL)) - return false; - } - return true; + return std::ranges::any_of(tx.vin, [](const CTxIn& txin) { return txin.nSequence == CTxIn::SEQUENCE_FINAL; }); }
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit only adds new test cases to Bitcoin Core. It does not change any production consensus, validation, or networking code. The tests are designed to detect accidental future code changes (called 'mutants') that could break consensus rules around transaction finality, relative locktimes, and legacy signature operation counting. Because no real bug is being fixed and no live vulnerability is present, this is a defensive hardening change with no direct security impact on its own.
Merge bitcoin/bitcoin#36118: test: tolerate race condition in interface_http.py
a51df9b0ecf6ecab1a9eb7728a0b475be6eec3fd test: tolerate race condition in interface_http.py (Matthew Zipkin)
Pull request description:
Fixes #35632 by allowing both outcomes of a race condition. The server behavior is unchanged: in response to a malformed request we send an error code and disconnect. The issue is that sometimes on Windows the RST is caught by the platform and the receive buffer is discarded before the Python client can process it with recv().
We can also be much more polite to misbehaving clients by implementing a lingering close using SO_LINGER as suggested in #35780 but that will require more review.
The exact error in #35632 is hard to produce reliably but there are a few close options for reviewers. I tested this on windows native building with MSVC. In both of these cases the patch from this PR caught the error and passed the test.
**RemoteDisconnected: Remote end closed connection without response**
// We failed to read a complete request from the buffer - WriteNoStoreErrorReply(*client->m_req, HTTP_BAD_REQUEST); + // WriteNoStoreErrorReply(*client->m_req, HTTP_BAD_REQUEST); client->m_disconnect = true; return nullptr; } ```
**ConnectionResetError: [WinError 10054] An existing connection was forcibly closed by the remote host**
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit only changes a test script. It makes the test accept either receiving an HTTP error response or the connection being abruptly closed, because on Windows the Python test client sometimes sees the socket close before it can read the server's error reply. The actual Bitcoin Core server behavior is not changed.
Merge bitcoin/bitcoin#36148: test: Avoid unsafe memory race in index_reorg_crash shutdown
fab80e82c1087126477e07eda5f6e3a1f25ceb99 test: Avoid unsafe memory race in baseindex_no_commit_ahead_of_flush (MarcoFalke) fa0f14ef5e76424ed7770936f7d053f27336a601 test: Avoid unsafe memory race in index_reorg_crash shutdown (MarcoFalke) faf9c8e8a12cff5ef4f277d8c3f1035776e57c14 test: Clarify index.GetSummary().synced state in index_reorg_crash (MarcoFalke)
Pull request description:
Currently, the `index_reorg_crash` test may rarely crash due to UB in sanitizers like TSan or ASan. This is perfectly fine, because it is just a rare test-only issue.
However, fix it nonetheless by adding a missing drain of the unused in-flight events. Also, add a small check about the synced state while touching this test.
ACKs for top commit: arejula27: ACK fab80e82c1 furszy: ACK fab80e82c1087126477e07eda5f6e3a1f25ceb99
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This is a fix for a flaky test in Bitcoin Core, not a fix for the Bitcoin network or wallet software itself. The test sometimes crashed under memory-safety checkers because it shut down an index while background validation events were still in flight. The patch drains those pending events before shutdown, similar to what the real shutdown code does. It does not affect live node behavior or user funds.
**Problem:** On non-Windows builds, operators can configure `-walletnotify` to run a command for wallet transactions, with `%w` replaced by the shell-escaped wallet name. An authenticated RPC caller allowed to create wallets can supply a name containing `$'`, request an address, and send a transaction to it. While replacing `%w`, `ReplaceAll()` passes the escaped wallet name to `std::regex_replace()` as replacement text. There, `$'` copies the command suffix into the escaped name, breaking its quote accounting and allowing shell metacharacters in the wallet name to alter the command. `runCommand()` passes the result to `system()`, so a suitable command template could execute additional shell commands as the node process account. It is not reachable over P2P or by an unauthenticated network peer. #25803 introduced this behavior in v24 when it replaced Boost's literal substitution with `std::regex_replace()`.
**Fix:** Restore the literal, non-recursive contract `ReplaceAll()` had before #25803, matching every current caller's literal search and replacement text, while the wallet notification test covers a wallet name containing `$'`.
**Related:** #35833 restricts control characters in new wallet names, while this change fixes replacement metacharacters in `ReplaceAll()`.
This was found and disclosed responsibly by the Red Team 🟥.
ACKs for top commit: maflcko: re-ACK db39de5601094dc3f0b15ce4759e1b88025403c2 💈 jeanpablojp: re-ACK db39de5601094dc3f0b15ce4759e1b88025403c2 stickies-v: re-ACK db39de5601094dc3f0b15ce4759e1b88025403c2
This commit fixes a shell command injection bug in Bitcoin Core's wallet notification feature. If a node operator had turned on -walletnotify on Linux or macOS, an attacker who could create wallets via RPC could craft a wallet name containing special characters. Due to a quirk in the previous string-replacement code, those characters could break out of the shell-escaped name and run extra commands as the Bitcoin node user. The fix replaces the regex-based string replacer with a simple literal one, and adds a test proving the attack no longer works.
AI review queuedMerge bitcoin/bitcoin#35868: rpc, wallet: fix invalid JSON in HelpExampleRpc curl examplesby merge-script · ca7162cd · Aug 29, 2026 · 9 filesMessage 100 · StrongInformational 21Details
Several `HelpExampleRpc` call sites reused CLI-style argument strings verbatim instead of valid JSON — missing commas, bare unquoted words, or single backslashes that are not valid JSON escapes. As a result the documented `curl` command for 14 RPCs (`getblockfrompeer`, `addnode`, `addconnection`, `sendmsgtopeer`, `restorewallet`, `getmempoolcluster`, `importmempool`, `getindexinfo`, `listlabels`, `unloadwallet`, `createwalletdescriptor`, `addhdkey`, `loadwallet`, `listunspent`) fails to parse as JSON if copy-pasted as-is. Also fixes a stray trailing quote in the `restorewallet` named-argument examples.
This was previously raised in #31275, which sipa confirmed at runtime by adding a `UniValue::read` check, but that PR was closed unmerged. Since then two more examples broke the same way (`getmempoolcluster`, `addhdkey`), which is why this adds a permanent regression check to `rpc_help.py::dump_help()` instead of just fixing the current list.
Fixes #35864.
ACKs for top commit: maflcko: review ACK 21d4e0ba759bb1024c5cc14c76b4f2963f252007 🚝 sedited: ACK 21d4e0ba759bb1024c5cc14c76b4f2963f252007
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 21/100
This commit fixes broken copy-paste examples in Bitcoin Core's command-line help text. The examples showed curl commands with JSON payloads that were not valid JSON, so users who copied them directly would get a JSON parse error. It is a documentation and developer-experience bug, not a security vulnerability, and it does not affect live code handling real transactions or network traffic.
AI review queuedMerge bitcoin/bitcoin#36107: iwyu: Fix warnings in `src/init` and treat them as errorsby Hennadii Stepanov · 05e49b34 · Aug 28, 2026 · 10 filesMessage 81 · StrongInformational 15Details
Commit message · Hennadii Stepanov
Merge bitcoin/bitcoin#36107: iwyu: Fix warnings in `src/init` and treat them as errors
1ad86412783225776c53fb702982f5882f99fcca iwyu: Fix warnings in `src/init` and treat them as errors (Hennadii Stepanov)
Pull request description:
This PR continues the ongoing effort to enforce IWYU warnings.
See [Developer Notes](https://github.com/bitcoin/bitcoin/blob/master/doc/developer-notes.md#using-iwyu).
ACKs for top commit: maflcko: lgtm ACK 1ad86412783225776c53fb702982f5882f99fcca
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine code-quality cleanup. It adjusts which C++ header files are included in several source files under src/init and tells the project's automated 'Include What You Use' (IWYU) checker to treat any remaining warnings in those files as errors. There is no change to how Bitcoin Core behaves, processes data, or handles the network, so it has no security impact on users.
AI review queuedMerge bitcoin/bitcoin#35900: iwyu: Fix warnings in `src/interfaces` and treat them as errorsby merge-script · 204256c7 · Aug 27, 2026 · 7 filesMessage 81 · StrongInformational 15Details
Commit message · merge-script
Merge bitcoin/bitcoin#35900: iwyu: Fix warnings in `src/interfaces` and treat them as errors
b3ff9c4d683fdcd0530b7c76c408b4a6e9e0830e iwyu: Fix warnings in `src/interfaces` and treat them as errors (Hennadii Stepanov) d564b0255f7ec984b1c788910a113a2533dd4d6a iwyu: Add temporary mapping to work around upstream bug (Hennadii Stepanov)
Pull request description:
This PR continues the ongoing effort to enforce IWYU warnings.
See [Developer Notes](https://github.com/bitcoin/bitcoin/blob/master/doc/developer-notes.md#using-iwyu).
ACKs for top commit: maflcko: review ACK b3ff9c4d683fdcd0530b7c76c408b4a6e9e0830e 🖋
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This is a routine code cleanup pull request. It adjusts which C++ header files are included in several source files and turns on a stricter automated check for the 'interfaces' directory. There is no change to program logic, no bug fix, and no security-relevant behavior.
AI review queuedMerge bitcoin/bitcoin#36032: rpc: avoid quadratic output lookupsby Ava Chow · 03117519 · Aug 25, 2026 · 1 fileMessage 91 · StrongModerate 59Details
**Problem:** Transaction-creation RPCs currently take quadratic time to parse outputs. An authenticated RPC client can therefore tie up a worker with a large request. `sendmany` also holds the wallet lock while parsing, delaying other operations on the same wallet.
**Fix:** Parse transaction outputs in linear time by reading corresponding keys and values by index instead of looking up each value by key.
**Reproducer:** Run `time build/bin/test_bitcoin --run_test=rpc_tests/parse_outputs` before and after the fix: <details> <summary>parse_outputs test in `rpc_tests.cpp`</summary>
```cpp BOOST_AUTO_TEST_CASE(parse_outputs) { constexpr size_t OUTPUT_COUNT{10'000}; UniValue outputs{UniValue::VOBJ}; for (size_t i{0}; i < OUTPUT_COUNT; ++i) { auto destination{EncodeDestination(WitnessV0ScriptHash{CScript{} << i})}; outputs.pushKVEnd(destination, ValueFromAmount(i + 1)); }
const auto parsed_outputs{ParseOutputs(outputs)}; BOOST_REQUIRE_EQUAL(parsed_outputs.size(), OUTPUT_COUNT); for (size_t i{OUTPUT_COUNT}; i > 0; --i) { std::pair expected{CTxDestination{WitnessV0ScriptHash{CScript{} << (i - 1)}}, static_cast<CAmount>(i)}; BOOST_CHECK(parsed_outputs[i - 1] == expected); } } ``` </details> E.g. on my M4 Max with `debug` build:
```python Before ████████████████████ 1.80 s After █████▒░░░░░░░░░░░░░░ 0.50 s -72% ``` Related to #35889
ACKs for top commit: achow101: ACK 747cff842481153357199bf9a81b5a4d82ea91fb jonatack: ACK 747cff842481153357199bf9a81b5a4d82ea91fb jeanpablojp: tACK 747cff842481153357199bf9a81b5a4d82ea91fb hodlinator: ACK 747cff842481153357199bf9a81b5a4d82ea91fb
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Moderate 59/100
This change fixes a performance bug in Bitcoin Core's RPC (remote procedure call) handling where creating a transaction with many outputs could take much longer than necessary. An authenticated RPC user could send a specially crafted request with thousands of outputs and temporarily slow down or stall a server worker. The fix makes the output parsing run in linear time instead of quadratic time, and removes a wallet-lock delay in the `sendmany` RPC. It is a denial-of-service improvement rather than a code-execution or theft bug.
AI review queuedMerge bitcoin/bitcoin#34993: wallet: `NotifyCanGetAddressesChanged` when advancing `next_index`by Ava Chow · 4375d74d · Aug 24, 2026 · 4 filesMessage 91 · StrongLow 26Details
Commit message · Ava Chow
Merge bitcoin/bitcoin#34993: wallet: `NotifyCanGetAddressesChanged` when advancing `next_index`
e2ab8ae55142370f31d8606531a065e098be6c77 wallet: spkm: Only notify CanGetAddressesChanged on change (David Gumberg) 0892f16f911d0e2ac7ebf40946b74c2cef485e2c refactor: moveonly: Pair CanGetAddressesChanged notifications with desc range. (David Gumberg) e6adae3db242a2146504bc72cf18ae58bb73401e wallet: `NotifyCanGetAddressesChanged` when advancing `next_index` (David Gumberg)
Pull request description:
Even though `TopUp()` notifies, advancing `next_index` after can deplete available addresses, so make sure to notify any time it's changed.
This would manifest as users seeing a clickable `Receive` button in the GUI when in fact no address can be generated in some edge cases, e.g. when a user has a watch only wallet with a hardened derivation path and runs out of keys.
This feels like it's begging for:
1) a refactor to make it impossible to modify `next_index` or `range_end` without firing `CanGetAddressesChanged` 2) a test
I banged my head against the keyboard for a bit but I couldn't get either of these to fall out, I also tried massaging a few clankers into doing it but I couldn't get any results that seemed reasonable to me, still seems like a worthwhile fix so opening PR anyway.
I also included a moveonly commit to pair code that can change the result of `CanGetAddresses()` with the notification firing
ACKs for top commit: achow101: ACK e2ab8ae55142370f31d8606531a065e098be6c77 polespinasa: ACK e2ab8ae55142370f31d8606531a065e098be6c77 furszy: utACK e2ab8ae55142370f31d8606531a065e098be6c77
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validationsigning or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Low 26/100
This Bitcoin Core change fixes a wallet notification bug. In the GUI, the 'Receive' button could stay clickable even when the wallet had actually run out of addresses it could generate. The patch makes sure the wallet emits a 'CanGetAddressesChanged' signal whenever the next available address index advances, so the UI can disable the Receive button at the right time. It is a correctness/UI fix, not a remote code execution or theft vulnerability.
AI review queuedMerge bitcoin/bitcoin#36059: test: make index crash test check saved stateby merge-script · 07ca9ba9 · Aug 24, 2026 · 1 fileMessage 91 · StrongInformational 13Details
Commit message · merge-script
Merge bitcoin/bitcoin#36059: test: make index crash test check saved state
7ea36e985a900b2291ce549e468f6baab5324dc6 test: preserve index crash test state (Lőrinc) 5aa15df60c49aacd3b3dafe13a4ceded9cec07cc test: expose missing index crash checkpoint (Lőrinc)
Pull request description:
**Problem:** #35847 moved the unclean-shutdown test into the shared base index tests, but it checked only that each index could reopen and start background sync. Both checks also pass when the index reopens at height 0, so they do not verify that a height-100 checkpoint was saved before the simulated crash and reloaded afterward.
**Fix:** The first commit records the existing false positive by asserting that each index reopens at height 0 before background sync. The second commit establishes a durable checkpoint at height 100, drains its setup notification, and changes the same assertion to the pre-crash height.
ACKs for top commit: jeanpablojp: tACK 7ea36e985a900b2291ce549e468f6baab5324dc6 mzumsande: ACK 7ea36e985a900b2291ce549e468f6baab5324dc6
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This is a test-only change for Bitcoin Core. It strengthens an existing automated test that simulates a crash to make sure that, after a restart, an index resumes from the correct block height rather than silently starting over from block 0. No production code was changed, and there is no fix for a live security vulnerability in this commit.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a code cleanup in Bitcoin Core's test and utility code. It removes an old, deprecated shortcut function called SetMockTime that accepted a plain integer, and updates the few remaining callers to use a modern, type-safe time API. There is no security vulnerability here; it is purely a refactoring change to make the codebase easier to maintain.
util: refactor: Remove deprecated SetMockTime(i64) alias
The deprecated test-only alias is only used in three places and required in none.
So remove it.
75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This is a small internal cleanup change in Bitcoin Core. It removes an old, redundant shortcut function called SetMockTime that accepted a plain integer, and updates the few remaining callers to use the newer version that takes a typed chrono duration. There is no security fix here; it is purely a code simplification and modernization.
AI review queuedMerge bitcoin/bitcoin#35884: util: set os-level thread names on Windowsby merge-script · f5e91c6f · Aug 21, 2026 · 1 fileMessage 91 · StrongInformational 15Details
Commit message · merge-script
Merge bitcoin/bitcoin#35884: util: set os-level thread names on Windows
dd669f40b98bb864bb9713673f0c38d946040591 util: set os-level thread names on Windows (ViniciusCestarii)
Pull request description:
Update SetThreadName to set os-level thread names on Windows too.
This is useful for debugging-ergonomics on Windows. Threads currently show up unnamed in debuggers, crash dumps on Windows and mismatch what's documented under https://github.com/bitcoin/bitcoin/blob/master/doc/developer-notes.md#threads.
Tested with the mingw cross build running on Windows 11, print from WinDbg:
ACKs for top commit: l0rinc: code review ACK dd669f40b98bb864bb9713673f0c38d946040591 hebasto: ACK dd669f40b98bb864bb9713673f0c38d946040591, tested Guix-built `bitcoind.exe` on Windows 11 Pro using WinDbg: winterrdog: utACK dd669f40b98bb864bb9713673f0c38d946040591
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This change lets Bitcoin Core give meaningful names to its internal threads when running on Windows, so they appear labeled in debuggers and crash dumps. It is purely a debugging convenience improvement and does not change how the software behaves or process any attacker-controlled data.
AI review queuedMerge bitcoin/bitcoin#36018: test: [refactor] Properly use BOOST_CHECK_EXCEPTIONby merge-script · 08dfaa04 · Aug 20, 2026 · 9 filesMessage 100 · StrongInformational 15Details
Commit message · merge-script
Merge bitcoin/bitcoin#36018: test: [refactor] Properly use BOOST_CHECK_EXCEPTION
fa0fe212f52ad261bfc59683dd8309a7a0cf3a51 test: [refactor] Properly use BOOST_CHECK_EXCEPTION (MarcoFalke)
Pull request description:
The exception checking in unit tests is partly verbose, fragile, inconsistent and thus confusing.
Fix all those issues by using `BOOST_CHECK_EXCEPTION` consistently:
* The test code is less bloated and follows a standard pattern; Extra state and dead code like `exceptionThrown = false;` or `BOOST_CHECK(0)` can be removed. * The checks are more strict, because they use `HasReason{...}` or a similar predicate.
ACKs for top commit: l0rinc: ACK fa0fe212f52ad261bfc59683dd8309a7a0cf3a51 janb84: ACK fa0fe212f52ad261bfc59683dd8309a7a0cf3a51 jonatack: Light ACK fa0fe212f52ad261bfc59683dd8309a7a0cf3a51
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a pure test-code cleanup. It replaces hand-written try/catch blocks in Bitcoin Core's unit tests with a standard Boost testing macro, BOOST_CHECK_EXCEPTION. No production code is changed, and the behavior being tested is unchanged. There is no security fix or vulnerability here.
AI review queuedMerge bitcoin/bitcoin#35968: test: sync funding block before isolating nodesby merge-script · 4d86d9cc · Aug 19, 2026 · 1 fileMessage 100 · StrongInformational 15Details
Commit message · merge-script
Merge bitcoin/bitcoin#35968: test: sync funding block before isolating nodes
8454fb2bd74cd0e43b447dd8f49d388b8a25d2d7 test: sync funding block before isolating nodes (shaurya2k06)
Pull request description:
Fixes #35967
test_alternate_witness_tx mines the taproot funding output on node0 with sync_fun=self.no_op and immediately disconnects. node1 later includes the script-path spend via generateblock. If the funding block has not reached node1, that call fails with bad-txns-inputs-missingorspent.
Drop the no_op so generate() uses the default sync_all before the partition. Later generate* calls keep no_op because the nodes are then disconnected.
Seen twice this week in hebasto bitcoin-core-nightly NetBSD jobs: https://github.com/hebasto/bitcoin-core-nightly/actions/runs/31350308484/job/93339698854 https://github.com/hebasto/bitcoin-core-nightly/actions/runs/31765546925/job/94660585799
The modified test is test/functional/wallet_listtransactions.py. I ran it locally three times with build/test/functional/wallet_listtransactions.py.
ACKs for top commit: achow101: ACK 8454fb2bd74cd0e43b447dd8f49d388b8a25d2d7 furszy: utACK 8454fb2bd74cd0e43b447dd8f49d388b8a25d2d7
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This is a one-line fix inside a Bitcoin Core automated test. The test was occasionally failing because it mined a block on one node and immediately disconnected the nodes before that block had time to reach the others. The fix simply lets the test framework synchronize the newly mined block across nodes before disconnecting them. It does not change any production wallet, consensus, or networking code, so it has no direct security impact on real users.
AI review queuedMerge bitcoin/bitcoin#32162: depends: Switch from multilib to platform-specific toolchainsby merge-script · fe5e2a63 · Aug 19, 2026 · 5 filesMessage 81 · StrongInformational 19Details
Commit message · merge-script
Merge bitcoin/bitcoin#32162: depends: Switch from multilib to platform-specific toolchains
de9b436ba36576903744feb17e4fae7b1842c75b depends: Switch from multilib to platform-specific toolchains (Hennadii Stepanov)
Pull request description:
Using the multilib GCC toolchain, as currently documented in [`depends/README.md`](https://github.com/bitcoin/bitcoin/blob/4c1906a500cacab385b09e780b54271b0addaf4b/depends/README.md), has several issues, such as:
1. The [`g++-multilib`](https://packages.ubuntu.com/noble/g++-multilib) package conflicts with platform-specific cross-compiler packages. This means it is not possible to cross compile for `i686` and other platforms using the same set of installed packages.
2. The [`g++-multilib`](https://packages.ubuntu.com/noble/g++-multilib) package is not available for `arm64`: ```sh $ sudo apt install g++-multilib Reading package lists... Done Building dependency tree... Done Reading state information... Done E: Unable to locate package g++-multilib ```
3. Managing the multilib GCC toolchain requires additional code in both depends and Guix scripts.
This PR addresses all the issues mentioned above by switching from multilib to platform-specific toolchains.
Also see https://github.com/bitcoin/bitcoin/pull/22456.
---
Here are examples of building for different scenarions:
- Linux, `x86_64` or `arm64`, building with depends natively: ```sh $ gmake -C depends -j $(nproc) $ cmake -B build --toolchain depends/$(./depends/config.sub $(./depends/config.guess))/toolchain.cmake $ cmake --build build -j $(nproc) ```
This commit changes Bitcoin Core's build system to stop using a single 'multilib' compiler package and instead use separate, platform-specific compiler packages for each target CPU. It is a build tooling and documentation change, not a fix for a security vulnerability in the software users run.
AI review queuedtest: [refactor] Properly use BOOST_CHECK_EXCEPTIONby MarcoFalke · fa0fe212 · Aug 19, 2026 · 9 filesMessage 72 · AdequateInformational 15Details
Commit message · MarcoFalke
test: [refactor] Properly use BOOST_CHECK_EXCEPTION
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a pure test-code cleanup. It replaces hand-written try/catch blocks in Bitcoin Core's unit tests with the standard BOOST_CHECK_EXCEPTION and BOOST_CHECK_NO_THROW macros. No production code is changed, so it cannot affect live node behavior, wallets, or network security.
AI review queuedMerge bitcoin/bitcoin#36008: wallet: WalletBatch->WriteVersion respect argumentby Ava Chow · 59224b66 · Aug 18, 2026 · 1 fileMessage 91 · StrongInformational 18Details
> Previously would use global `CLIENT_VERSION` no matter what, but this is one sense a refactor since all of the places where WriteVersion is called currently call it with `CLIENT_VERSION` anyways. The `client_version` argument is kept since future test code may want to write other versions.
> Addresses a review comment from [#32636](https://github.com/bitcoin/bitcoin/pull/32636#discussion_r2356299627):
This was originally pointed out in https://github.com/bitcoin/bitcoin/pull/32636#discussion_r2356299627, and the followup (#34490) was never merged. However I think it's confusing to have functions that take arguments but ignore them (and it's dead code), so I've cherry-picked the fix up from #34490.
ACKs for top commit: achow101: ACK ec5d19665b8935eabac36df4ec1ba2e19ee05c25 pablomartin4btc: ACK ec5d19665b8935eabac36df4ec1ba2e19ee05c25 w0xlt: ACK ec5d19665b8935eabac36df4ec1ba2e19ee05c25
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 18/100
This is a small code cleanup in Bitcoin Core's wallet database code. A function called WriteVersion was supposed to save a version number passed to it, but it was ignoring that input and always saving the current client version instead. The fix makes it actually use the passed-in value. All existing callers were already passing the current client version, so this does not change behavior today. It is described by the author as a refactor to remove confusing dead code and to allow future tests to write older versions safely.
AI review queuedMerge bitcoin/bitcoin#35946: rpc: Improve some type specs for openrpcby merge-script · a23df4bf · Aug 18, 2026 · 2 filesMessage 91 · StrongInformational 18Details
Commit message · merge-script
Merge bitcoin/bitcoin#35946: rpc: Improve some type specs for openrpc
e07d826e0ebd9507793fe033236e5f0f12ba5732 rpc: Fix type in ApplyTypeStrOverride (Shuvam Pandey) c94074fa1b1396e310ab94955f5d04c9bda61b64 rpc: Surface OBJ_USER_KEYS description for openrpc (sedited) c020c21d543a14268b98995d1a9d1878f3d95ec2 rpc: Handle skip type args for openrpc (sedited)
Pull request description:
This was initially motivated by testing the dump of the schema against open-rpc-generator, which crashed with:
``` open-rpc-generator generate -t client -l rust -n bitcoin_client -d ./openrpc.gen.json -o ./generated There was error at generator runtime: TypeError: Cannot convert undefined or null to object ```
The changes here fix this crash (albeit perfectly valid existing schema), but I think creating a more complete output is helpful on its own. The openrpc schema dumps can eventually be re-used for the rpc docs and to track rpc interface changes more accurately. Adding the CreateTxDoc outputs section seems useful for that.
Also includes a type tightening from number to integer in `ApplyTypeStrOverride` to reflect the actual behaviour in the rpc calls, where only integers are accepted.
ACKs for top commit: achow101: ACK e07d826e0ebd9507793fe033236e5f0f12ba5732 willcl-ark: ACK e07d826e0ebd9507793fe033236e5f0f12ba5732
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
This commit improves the automatically generated JSON schema that describes Bitcoin Core's RPC (remote procedure call) interface. It fixes a crash in a third-party OpenRPC code generator by producing more complete type descriptions, and tightens one type label from 'number' to 'integer' to match what the RPC actually accepts. There is no runtime code change that processes user transactions, blocks, or network data, so it does not introduce or fix a security vulnerability in the Bitcoin node itself.
AI review queuedMerge bitcoin/bitcoin#35955: wallet: remove orphaned GetAffectedKeys and LegacyScriptPubKeyMan declarationsby merge-script · 20ad7c9e · Aug 18, 2026 · 7 filesMessage 91 · StrongInformational 15Details
Commit message · merge-script
Merge bitcoin/bitcoin#35955: wallet: remove orphaned GetAffectedKeys and LegacyScriptPubKeyMan declarations
Follow-up to #28710, which removed `GetAffectedKeys()` and `LegacyScriptPubKeyMan` but left their declarations behind.
Remove both orphaned declarations, rename `SetupLegacyScriptPubKeyMan()` to `SetupLegacyDataSPKM()`, and update related comments and logging to reflect the minimal `LegacyDataSPKM` retained for legacy wallet loading and migration.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathmerge-commit duplicate discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a routine code cleanup. It removes leftover declarations of functions and classes that no longer exist, renames one internal wallet setup function, and updates comments and log messages to use the current class name. There is no change to how the software behaves or to any security-sensitive logic.
AI review queuedReplace CTransaction::operator== with Equals that has optionsby Ava Chow · b973a355 · Aug 13, 2026 · 8 filesMessage 81 · StrongInformational 17Details
Commit message · Ava Chow
Replace CTransaction::operator== with Equals that has options
CTransaction::operator== is only used in a few places. In a few instances of checking transaction equality, we want to control which fields are actually being compared, so use a custom Equals() function which takes a EqualsOptions struct to control the checks.
As suggested in https://github.com/bitcoin/bitcoin/pull/32723#issuecomment-3028112892
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100
This commit is a code cleanup: it replaces a simple transaction equality operator with a more flexible Equals() function that lets callers choose whether to compare signature and witness data. The change does not fix a known bug or vulnerability on its own. It is a refactor that makes future code easier to write correctly, especially in the wallet where transactions need to be compared ignoring signatures.
AI review queuedtest: Bumping a transaction prevents bumping malleationsby Ava Chow · 2c6047df · Aug 13, 2026 · 1 fileMessage 72 · AdequateInformational 15Details
Commit message · Ava Chow
test: Bumping a transaction prevents bumping malleations
72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit only adds and updates a test file. It does not change any production wallet code. The new test checks that when a user has both an original transaction and a malleated version of it in their wallet, bumping the fee on one of them correctly prevents the other from also being bumped. This is a regression test for existing behavior, not a security fix.
AI review queuedtest: Test rbf metadata sync of malleated txby Ava Chow · a44f9ad3 · Aug 13, 2026 · 1 fileMessage 67 · AdequateInformational 12Details
Commit message · Ava Chow
test: Test rbf metadata sync of malleated tx
67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100
This commit only adds a new automated test to Bitcoin Core. It checks that when a user creates a replace-by-fee (RBF) transaction and someone later alters (malleates) that transaction, the wallet still correctly preserves the user's original comment and the ID of the transaction it replaced. There is no change to production wallet code here, only a regression test.
AI review queuedwallet: Clarify IsEquivalentTo is actually checking malleationby Ava Chow · 34533d5d · Aug 13, 2026 · 3 filesMessage 73 · AdequateInformational 15Details
Commit message · Ava Chow
wallet: Clarify IsEquivalentTo is actually checking malleation
IsEquivalentTo is used to determine whether another CWalletTx is actually a malleation of the current tx. Rename to clarify this.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100
This commit is a simple rename and documentation update. A wallet function called IsEquivalentTo is renamed to IsMalleation, and its comment is expanded to explain exactly what it checks. No behavior changes, no bug fixes, and no security implications are present in the diff.
