BC
← All projectsBitcoin Core

Bitcoin Core

The Bitcoin network's reference node and wallet implementation.

BitcoinSupply chainNormal
Repository coverage

3157 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

314security candidates665second-pass queue2999AI analyses
154commits · 30 days
332commits · 60 days
1303commits · 180 days
2860commits · 365 days
Backfill bands
Aug 5 → Feb 61351 seen45 candidatesComplete
Feb 6 → Jun 61033 seen63 candidatesComplete
Jun 6 → Jul 6281 seen11 candidatesComplete
Jul 6 → Aug 5207 seen5 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

71/100 average clarity
1162Strong · 80–100
1206Adequate · 60–79
701Thin · 40–59
88Opaque · 0–39
6security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
merge-script1964487389
Antoine Poinsot22422170
Ava Chow19165185068
MarcoFalke41421408074
fanquake23121228058
Lőrinc18121177081
Hennadii Stepanov22316211064
rkrux57957074
Sjors Provoost89889074
Sebastian Falbesoner33733073
David Gumberg55655072
Pieter Wuille95595066
Analysis record

Published AI watches

Last scanned 16 minutes ago

Informational 19 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35675: mining: add block template manager

This is a large internal code reorganization (refactor) in Bitcoin Core. It creates a new BlockTemplateManager class that takes over block-template creation, block submission, and tip-waiting helpers that were previously spread across seve…

Large refactor touching mining, RPC, interfaces, and test shutdown pathsNew object lifetime dependency: BlockTemplateManager holds references to mempool, chainman, and notifications; explicit reset ordering added in Shutdown/InitAndLoadChainstate/test setupsRemoval of early-init node.mining interface; BlockTemplateManager is now created after chainstate load, with a comment that it must exist before setChainstateLoaded(true) unblocks IPC waiters
5c726f20by Ryan Ofsky+561−44926 files
No security note in commit
Informational 12 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35301: Silent Payments: Implement bip352 (take 2)

This commit adds the first implementation of BIP352 (Silent Payments) to Bitcoin Core. Silent Payments are a new type of privacy-preserving Bitcoin address that lets someone receive payments without publicly revealing a fixed address. The …

New cryptographic feature implementation (BIP352 Silent Payments)Extensive use of secp256k1 silentpayments moduleInput public key extraction from P2PKH, P2WPKH, P2SH-P2WPKH, and P2TR inputs
be5d0b55by Ava Chow+6951−010 files
No security note in commit
Low 45 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35440: wallet: check descriptor cache xpub length before decoding

This update fixes a wallet database loading bug where a damaged or tampered Bitcoin wallet file could cause the program to read past the end of a stored extended public key (xpub). The patch makes the loader check the stored xpub length be…

Out-of-bounds read in wallet descriptor cache deserializationASan container-overflow triggered by malformed on-disk recordMissing length validation between record size prefix and fixed-size decoder
b3f846ecby Ava Chow+225−8511 files
Vendor flagged security relevance
Informational 20 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35813: wallet, rpc: Add listrawtransactions RPC

This commit adds a new wallet RPC called listrawtransactions to Bitcoin Core. It is a feature addition that lets users list every transaction their wallet knows about, including internal transfers and consolidations that the existing listt…

No security-relevant bug fix or vulnerability patch is present in the diff.New RPC exposes additional wallet transaction metadata, but only to callers already authorized for wallet RPCs.Code is a refactor of existing gettransaction logic into shared helpers; no new cryptographic, network, or consensus code.
2b95b45aby Ava Chow+334−276 files
No security note in commit
Moderate 68 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35752: wallet: make encryption state updates atomic

This Bitcoin Core update fixes several wallet bugs where a failed database write could leave a wallet in an inconsistent state. For example, encrypting a wallet or changing its passphrase could appear to succeed in memory while the change …

Atomicity fix for encryption state and descriptor key persistenceFailure to persist master key during encryption previously reported success in memoryPassphrase change could activate new passphrase only in memory
7ee3d622by Ava Chow+379−16418 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#35619: test: ExtendedPrivateKey follow-ups

This commit only changes Bitcoin Core's internal functional test code. It replaces hard-coded test keys and addresses with ones generated from a new test helper class, and unifies how tests tell nodes not to create a default wallet. There …

248ce46fby merge-script+18−244 files
No security note in commit
Informational 15 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36261: test: cover PSBT unknown field merging

This commit only adds a new automated test to Bitcoin Core. It checks that when two partially-signed Bitcoin transactions (PSBTs) are combined, any custom 'unknown' data fields attached to them are preserved correctly. There is no change t…

bbc40edeby merge-script+130−01 file
No security note in commit
Informational 18 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36230: wallet: Improve `HasWalletDescriptor` performance and other canonical descriptor string followups

This is a Bitcoin Core wallet maintenance patch. It speeds up a wallet function that checks whether a descriptor already exists by caching a hash of the descriptor's canonical text, instead of rebuilding that text every time. It also tidie…

No security-relevant signal in commit message or diffChange is described as performance improvement and code cleanupBackwards-compatibility test notes a known miniscript wallet loading incompatibility between v31.0/v31.1 and other versions, but this is a documented compatibility quirk, not a vulnerability
4a583f38by merge-script+97−429 files
No security note in commit
Informational 21 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36297: rpc: Correct invalid OpenRPC defaults

This is a documentation-only fix for Bitcoin Core's machine-readable RPC help data. It changes several default values from literal strings to 'hint' labels (because the real default depends on context) and corrects one boolean default from…

OpenRPC schema/default mismatch correctionRPC help metadata type correction (string 'false' to boolean false)No executable code path changes
5f05d8c5by merge-script+6−63 files
No security note in commit
Informational 20 AI analysisMessage 68 · Adequate
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

rpc: Correct OpenRPC default metadata

This commit fixes documentation metadata for six Bitcoin Core RPC arguments. It changes how default values are described so that automatically generated API docs and schemas are accurate. The actual behavior of the software when running is…

No runtime code changesOnly RPC help/schema metadata modifiedVendor explicitly states runtime behavior is unchanged
b7f740c5by will+6−63 files
No security note in commit
Informational 24 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36286: crypto: Fix MuHash3072 division by itself

This commit fixes a bug in Bitcoin Core's MuHash3072 cryptographic code where dividing a MuHash object by itself (x /= x) produced the wrong mathematical result. The fix is straightforward: the code now saves the divisor's numerator before…

Cryptographic correctness bug in MuHash3072 division operatorSelf-aliasing in operator/= produces incorrect 1/D result instead of empty setNo production code path identified that triggers self-division
d48e76e6by merge-script+11−13 files
No security note in commit
Informational 18 AI analysisMessage 93 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36285: refactor: Use static const over inline const to work around ld64 bug

This is a build-compatibility fix, not a security patch. It changes how some constant data is stored internally so that Apple's macOS linker (ld64) can build Bitcoin Core correctly. The change avoids a linker bug that caused build failures…

No security-relevant code logic changedChange is a linker bug workaround, not a vulnerability fixConstants remain read-only; no new attack surface introduced
ad97933aby merge-script+8−82 files
No security note in commit
Informational 23 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#34861: wallet: Add importdescriptors interface

This commit refactors Bitcoin Core's wallet descriptor import feature so the same logic can be used by both the RPC command and a new GUI-facing interface. It also tightens one input rule: negative timestamps are now rejected, and the mini…

Refactor of security-sensitive wallet import code into shared CWallet pathNew input validation: negative timestamps rejected for importdescriptorsCentralization of descriptor range bound checks in CheckDescriptorRangeBounds
2bbbeaa6by Ava Chow+619−26415 files
No security note in commit
Low 30 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36260: torcontrol: Use reconnect backoff after dropped connections

This change fixes a bug in how Bitcoin Core reconnects to the Tor control port. A previous update accidentally removed the wait time between reconnect attempts when an already-established Tor control connection was dropped. Without the wai…

Uncontrolled retry loop causing resource exhaustion and log floodingLocal-only Tor control port interaction; no remote attacker path by defaultRegression introduced by prior refactor (#34158) and restored here
fb68c270by merge-script+32−332 files
No security note in commit
Informational 18 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36256: guix: Update osslsigncode to 2.14

This change updates the Windows code-signing tool used in Bitcoin Core's reproducible build process. It fixes a build-time failure where signature verification could not complete because a certificate package was missing and the old tool v…

Tooling update in release signing pipelineRestores CA certificate store for signature verificationDisables CRL/CDP network lookups during verification
7dedc454by Hennadii Stepanov+22−22 files
No security note in commit
Informational 19 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#34566: feature: Use different datadirs for different signets

This change lets Bitcoin Core store different custom signet blockchains in separate data folders, using a unique suffix derived from each signet's network identifier. It also adds a friendlier error hint in bitcoin-cli when an RPC authenti…

Data isolation between distinct custom signets reduces risk of cross-network state corruption or accidental mainnet/testnet confusionNo memory-safety, cryptographic, or consensus changes observedNo privilege escalation, remote code execution, or denial-of-service vectors introduced in the diff
d32a515fby merge-script+211−4412 files
No security note in commit
Informational 19 AI analysisMessage 81 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36251: rest: add `generated` and `height` to spenttxouts JSON

This change adds two extra pieces of information—whether a spent output came from a coinbase transaction and the block height at which it was created—to a Bitcoin Core REST API endpoint. It is a feature/parity improvement to make the REST …

dadca55fby merge-script+13−54 files
No security note in commit
Low 33 AI analysisMessage 91 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#34743: p2p: don't disconnect manual peers for block stalling

This change makes Bitcoin Core treat manually-added peers (from -addnode, -connect, or the addnode RPC) more gently during Initial Block Download (IBD). Previously, if such a peer was slow or stalled at sending blocks, the node would disco…

Behavior change in peer disconnection logic during IBDManual peers exempted from block-stalling disconnectionNew per-peer cooldown state m_block_download_paused_until introduced
cff00c54by merge-script+148−168 files
No security note in commit
Informational 20 AI analysisMessage 96 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36186: test: return False for a too-short ECDSA signature

This is a small fix in Bitcoin Core's own test helper code. A helper function used only in tests could crash with an IndexError when given an extremely short fake signature, instead of cleanly returning False. The change moves a length che…

Out-of-order bounds check leading to IndexError in test helperRegression test added for malformed short DER signaturesTest-only code path, no production validation logic changed
76343a09by merge-script+11−21 file
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
BC Bitcoin CoreBitcoin Core BitcoinSupply chain

Merge bitcoin/bitcoin#36083: test: cover getrawtransaction on a stale block via txindex

This commit only adds a new functional test to Bitcoin Core. It checks that the getrawtransaction RPC can retrieve a stale block's coinbase transaction via the optional txindex, and that the response correctly shows the block is no longer …

dd3c62c5by merge-script+41−341 file
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedwallet: make loading the wallet after migrating optionalby Pol Espinasa · 4acd063b · Jun 22, 2026 · 2 filesMessage 73 · AdequateInformational 23Details
Commit message · Pol Espinasa

wallet: make loading the wallet after migrating optional

Loading the wallet after migrating is not a necessary step.
By making it optional pruned nodes can also migrate legacy wallets.
Also remove the migrated wallet from the list of wallets to load on startup.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 23/100

This Bitcoin Core change lets users migrate old-style wallets to the newer descriptor format without automatically loading the migrated wallet afterward. The main goal is to support pruned nodes, which previously could not migrate because loading the wallet required full block history. The patch also removes the old wallet from the startup list when migration is done without loading. There is no obvious security bug here; it is a feature/robustness improvement.

AI review queuedwallet: reserve walletrescan before checking wallet is at the tipby Pol Espinasa · 336f5a73 · Jun 22, 2026 · 1 fileMessage 50 · ThinLow 36Details
Commit message · Pol Espinasa

wallet: reserve walletrescan before checking wallet is at the tip

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 36/100

This small change reorders two operations in the `importdescriptors` wallet command. Previously, the wallet first waited until it was caught up to the latest block, then tried to reserve a rescan. Now it reserves the rescan first, then waits to catch up. The likely goal is to prevent a race where another process starts a rescan in between those two steps, which could cause the import to proceed without the expected rescan or with conflicting rescan state. The practical security impact is limited and situational.

AI review queuedHTTPServer: disconnect clientsby Matthew Zipkin · a69bb9e1 · Jun 22, 2026 · 4 filesMessage 35 · OpaqueLow 43Details
Commit message · Matthew Zipkin

HTTPServer: disconnect clients

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
parser or protocol pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Low 43/100

This commit finishes the Bitcoin Core HTTP server's ability to actually close client connections. Before, several error paths had 'TODO: disconnect' comments, meaning misbehaving or finished clients could stay connected longer than intended. The change adds flags and a periodic cleanup routine so the server drops clients after errors, oversized requests, malformed requests, EOF, non-keep-alive responses, and during shutdown. It is best read as a robustness/cleanup improvement rather than a single critical vulnerability fix, though leaving connections hanging can waste resources and, in some designs, be abused.

AI review queuedhttp: Introduce HTTPRemoteClient classby Matthew Zipkin · 4ef4ebdc · Jun 22, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Matthew Zipkin

http: Introduce HTTPRemoteClient class

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds a new C++ class definition to a header file. It does not change any existing behavior, fix a bug, or alter how the program handles data. There is nothing here that would allow an attacker to exploit the software.

AI review queuedhttp: Implement HTTPResponse classby Matthew Zipkin · ad50aa4a · Jun 22, 2026 · 4 filesMessage 66 · AdequateInformational 15Details
Commit message · Matthew Zipkin

http: Implement HTTPResponse class

HTTP Response message:
https://datatracker.ietf.org/doc/html/rfc1945#section-6

Status line (first line of response):
https://datatracker.ietf.org/doc/html/rfc1945#section-6.1

Status code definitions:
https://datatracker.ietf.org/doc/html/rfc1945#section-9

66/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
parser or protocol pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds a new helper class for formatting HTTP response headers in Bitcoin Core's internal web server. It does not change any existing behavior or fix any known problem; it is purely new infrastructure code with accompanying tests.

AI review queuedrpc: add placeholder annotation for deprecated paramsby will · f5116c58 · Jun 20, 2026 · 4 filesMessage 30 · OpaqueInformational 15Details
Commit message · will

rpc: add placeholder annotation for deprecated params

30/100 · OpaqueMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body! Contains work-in-progress language
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a documentation-only metadata change. It adds a new 'placeholder' flag to the internal description of several old, ignored RPC parameters so the help system can label them as kept only for backward compatibility. No code behavior changes, no bug fixes, and no security issue is present.

AI review queuedrpc: expose RPC metadata for introspectionby will · 26c221a9 · Jun 20, 2026 · 3 filesMessage 45 · ThinInformational 19Details
Commit message · will

rpc: expose RPC metadata for introspection

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit adds small plumbing so that Bitcoin Core's RPC command metadata (descriptions, argument details, result formats) can be inspected by other code. It does not change any user-facing RPC behavior by itself; it merely exposes internal data structures that were already present. There is no obvious security bug in the diff.

AI review queuedmining: add reason and debug output to submitSolutionby w0xlt · cbaa1696 · Jun 16, 2026 · 5 filesMessage 73 · AdequateLow 32Details
Commit message · w0xlt

mining: add reason and debug output to submitSolution

Add reason and debug output parameters to submitSolution, matching
submitBlock. This relays the specific failure reason (e.g.
"bad-version(...)", "bad-witness-nonce-size", "duplicate") to callers
instead of just a bool.

Use a new capnp ordinal for the updated method and keep the old @7 method
as a deprecated entry point returning an explicit error, so old clients do
not decode corrupt result fields and are directed to update.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Low 32/100

This commit changes the internal mining interface so that when a miner submits a solved block through the IPC interface, the caller now receives a specific rejection reason (like 'bad-version', 'duplicate', or 'inconclusive') instead of just a true/false answer. It also keeps the old interface method as a deprecated stub that throws an explicit error telling old clients to update, preventing them from misinterpreting new return values. This is a defensive compatibility and observability improvement, not a fix for an active exploit.

AI review queuedrpc: extend TxDoc() for getblock verbosity 2/3by Renato Britto · 372ac283 · Jun 13, 2026 · 3 filesMessage 68 · AdequateInformational 15Details
Commit message · Renato Britto

rpc: extend TxDoc() for getblock verbosity 2/3

Add fee, hex, fee_doc, prevout_doc, and vin_item_doc
options to TxDocOptions, and use them to describe
getblock verbosity=2/3 with structured metadata instead
of inline ELISION-based reuse.

Add GetBlockFields() to share the block-level result layout
across verbosity levels.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a code cleanup in Bitcoin Core's RPC help documentation. It restructures how the help text for the getblock command is generated, replacing duplicated inline descriptions with shared helper functions. It does not change what data the software returns, how it processes network data, or any security-sensitive logic.

AI review queuedrpc: extract ListSinceBlockTxFields() helperby Renato Britto · 8a615a88 · Jun 13, 2026 · 2 filesMessage 58 · ThinInformational 15Details
Commit message · Renato Britto

rpc: extract ListSinceBlockTxFields() helper

Extract the inline listsinceblock transaction field list into a reusable
helper. The removed entry replaces its Type::ELISION placeholder with an empty
string elision.

ToSections() render an empty std::string elision as "...", and suppress
the array continuation marker when the last inner element renders as a
std::string elision.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a code cleanup that extracts a repeated list of RPC help text fields into a reusable helper function. It only affects how the documentation/help output for the listsinceblock command is generated, not how transactions or wallet data are processed. There is no security issue visible in the change.

AI review queuedrpc: expand getaddressinfo embedded with explicit fieldsby Renato Britto · 88e2a6ae · Jun 13, 2026 · 1 fileMessage 73 · AdequateInformational 18Details
Commit message · Renato Britto

rpc: expand getaddressinfo embedded with explicit fields

Replace the ELISION entry inside getaddressinfo's embedded object
with explicit fields using ElideGroup().

Factor the embedded field list into a helper so the nested layout
can be reused without duplicating the full structure inline.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a documentation-only change for the Bitcoin Core wallet's 'getaddressinfo' RPC command. It replaces a vague placeholder in the help text with a detailed, explicit list of fields that can appear inside the 'embedded' object. No wallet logic, validation rules, or network behavior is changed.

AI review queuedrpc: extend TxDoc() for getrawtransaction verbosity 2by Renato Britto · 0380a1c4 · Jun 13, 2026 · 4 filesMessage 73 · AdequateInformational 18Details
Commit message · Renato Britto

rpc: extend TxDoc() for getrawtransaction verbosity 2

Add prevout, elision_mode, and vin_inner_elision options
to TxDocOptions, and use them to describe getrawtransaction verbosity=2
with structured metadata instead of raw ELISION entries. Extract
verbosity=1 block fields into a local verbosity_1_block variable so
verbosity=2 can reuse them via ElideGroup.

When vin_inner_elision is set, vin fields are elided while keeping
prevout visible. With elision_mode == ElisionMode::Silent, every other
top level field is hidden, so the only rendered output comes from the
vin not elided.

Loosen elision_has_description() to accept any group with at least one
field that is not SKIP.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a code cleanup for Bitcoin Core's RPC help documentation. It restructures how the help text for getrawtransaction verbosity=2 is generated, making it more consistent with other RPC documentation. It does not change how transactions are fetched, validated, or returned at runtime. There is no indication this fixes a security bug.

AI review queuedmv btcsignals.h to src/utilby MarcoFalke · fa45783d · Jun 11, 2026 · 10 filesMessage 45 · ThinInformational 15Details
Commit message · MarcoFalke

mv btcsignals.h to src/util

This is a low-level utility header

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit simply moves a header file called btcsignals.h from the top-level src/ directory into src/util/ and updates all the source files that include it. The code inside the file is unchanged. It is a routine code reorganization with no security relevance.

AI review queuedrefactor: Make scoped_connection ctor explicitby MarcoFalke · fa4903db · Jun 11, 2026 · 2 filesMessage 88 · StrongInformational 15Details
Commit message · MarcoFalke

refactor: Make scoped_connection ctor explicit

This ensures that all constructions of scoped connections are explict,
making the intent explicit and review easier. This also follows the
default recommendation from
https://isocpp.github.io/CppCoreGuidelines/CppCoreGuidelines#c46-by-default-declare-single-argument-constructors-explicit

88/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a minor code cleanup change that makes a single-argument constructor require explicit syntax. It does not fix a security bug or change runtime behavior; it only prevents accidental automatic type conversions during compilation.

AI review queuedtest: Check btcsignals determinism in thread_safety test caseby MarcoFalke · fa1bc1fe · Jun 11, 2026 · 1 fileMessage 95 · StrongInformational 12Details
Commit message · MarcoFalke

test: Check btcsignals determinism in thread_safety test case

The test only checked that the single atomic value is greater than 3000.
However, by splitting the atomic into two, one can do one exact check,
and also increase the lower bound on the inexact check.

Also, test disconnect races for every second step, instead of only once
at the end (likely when only one thread is running anyway).

Both changes make the test stricter and may catch non-determinism issues
that are not detected by sanitizers alone.

The test added in this commit should also pass when applied on top of
commit 63c68e2a3f98d2466a7e766d861ba3a94e92cd20, which is still using
the boost implementation.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validationsigning or wallet pathsecond-pass: near security thresholdsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This is a test-only change for Bitcoin Core. It makes an existing unit test stricter by checking that one part of a multi-threaded signal callback counter is deterministic, and by testing connection/disconnection races more frequently. It does not change any production code, runtime behavior, or network protocol.

AI review queuedrefactor: Properly return from ThreadSafeQuestion signalby MarcoFalke · fa86e5db · Jun 11, 2026 · 3 filesMessage 95 · StrongModerate 51Details
Commit message · MarcoFalke

refactor: Properly return from ThreadSafeQuestion signal

Previously, the signal was using btcsignals::optional_last_value<bool>.
However, this only worked by accident:

The return value was influenced by the order in which the connections
were done. The noui callbacks would always overwrite the return value
with false. This makes the code overall brittle, and confusing.

For example, the following patch that changes the order of connections
would break the only and single place where the return value actually
matters:

```diff
diff --git a/src/qt/bitcoin.cpp b/src/qt/bitcoin.cpp
index 0b89c605b9..976549470e 100644
--- a/src/qt/bitcoin.cpp
+++ b/src/qt/bitcoin.cpp
@@ -488,3 +488,2 @@ int GuiMain(int argc, char* argv[])
btcsignals::scoped_connection handler_message_box = ::uiInterface.ThreadSafeMessageBox_connect(noui_ThreadSafeMessageBox);
- btcsignals::scoped_connection handler_question = ::uiInterface.ThreadSafeQuestion_connect(noui_ThreadSafeQuestion);
btcsignals::scoped_connection handler_init_message = ::uiInterface.InitMessage_connect(noui_InitMessage);
@@ -663,2 +662,3 @@ int GuiMain(int argc, char* argv[])
app.createWindow(networkStyle.data());
+ btcsignals::scoped_connection handler_question = ::uiInterface.ThreadSafeQuestion_connect(noui_ThreadSafeQuestion);
// Perform base initialization before spinning up initialization/shutdown thread
```

This can be tested by applying the patch and then calling:

(May have to be started twice to trigger the question)

```
bitcoin-qt -regtest -datadir=/tmp -mocktime=123456789
```

Before the changes in this commit (on current master), pressing `OK`
would not have any effect and would abort the program.

After the changes in this commit, pressing `OK` will correctly trigger a
-reindex and leave the program running.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Moderate 51/100

This commit fixes a brittle signal-handling bug in Bitcoin Core's user-interface code. Previously, when the program asked the user a yes/no question (for example, whether to rebuild the database), the answer could be ignored depending on the order in which internal callbacks were connected. The commit changes the signal system so that a 'yes' answer from any relevant handler is respected, rather than being overwritten by a later handler. The commit message explicitly notes that, before the fix, clicking 'OK' could abort the program instead of performing the requested recovery.

AI review queuedrefactor: Mark btcsignals operator [[nodiscard]]by MarcoFalke · faad9d64 · Jun 11, 2026 · 1 fileMessage 80 · StrongInformational 15Details
Commit message · MarcoFalke

refactor: Mark btcsignals operator [[nodiscard]]

This is only relevant in case the result_type is not void, in which case
the caller should either use the return value or mark it unused.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a minor code-quality change that tells the compiler to warn when a developer ignores the return value of a specific function call. It does not change how the program behaves, fix a bug, or close a security hole. It is a routine refactoring to help catch future programming mistakes during compilation.

AI review queueddoc: add taproot descriptor to getdescriptors exampleby woltx · bd5a32f7 · Jun 11, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · woltx

doc: add taproot descriptor to getdescriptors example

Wallets import descriptors for all supported address types in a
BIP44/49/84/86 compatible manner, so show the BIP86 tr() descriptor in
the example response as well.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathdocumentation-only discountsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates a documentation example in external-signer.md to include a Taproot (BIP86 tr()) descriptor alongside existing address-type examples. It is a documentation-only change with no code modifications, no functional changes, and no security implications.

AI review queueddoc: clarify which commands receive --chain, --fingerprint and --stdinby woltx · 7131c829 · Jun 11, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · woltx

doc: clarify which commands receive --chain, --fingerprint and --stdin

Bitcoin Core passes --chain and --fingerprint to every signer command
except enumerate, so mark them "(required except for enumerate)" and
name the current commands only as examples. Keep --stdin documented as
required for all commands so the interface stays flexible, noting that
Bitcoin Core currently only uses it for signtx.

Add the missing flags to the getdescriptors and displayaddress usage
examples and the corresponding doxygen comments, matching the order and
form of the actual invocations, add testnet4 to the chain name lists,
and drop the getaddressinfo implementation detail from the
walletdisplayaddress description.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates documentation and code comments for Bitcoin Core's external signer interface. It clarifies which command-line flags are passed to which signer commands and fixes usage examples to match the actual implementation. No code behavior changes, no security bug fix, and no vulnerability is present.

AI review queueddoc, rpc: document enumerate model field and fingerprint deduplicationby woltx · fab92257 · Jun 11, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · woltx

doc, rpc: document enumerate model field and fingerprint deduplication

The external signer "enumerate" response uses the optional "model"
field, not "name". Document that Bitcoin Core maps it to the "name"
field of the enumeratesigners RPC result, and that signers with
duplicate master key fingerprints are skipped.

Also document that wallet operations require exactly one connected
signer.

Co-authored-by: optout <13562139+optout21@users.noreply.github.com>
Co-authored-by: naiyoma <lankas.aurelia@gmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates documentation and RPC help text. It explains how Bitcoin Core talks to external hardware wallets: the signer's 'model' field becomes the 'name' shown to users, duplicate fingerprints are skipped, and wallet operations require exactly one connected signer. No code behavior changed, so there is no security issue here.

AI review queuedtest: add abortscan unit testby Pol Espinasa · 2818a171 · Jun 11, 2026 · 1 fileMessage 82 · StrongInformational 15Details
Commit message · Pol Espinasa

test: add abortscan unit test

Co-authored-by: w0xlt <woltx@protonmail.com>

82/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a new unit test to Bitcoin Core's wallet test suite. It verifies that the wallet's rescan-abort mechanism behaves correctly in two scenarios: an abort requested before any rescan starts should not accidentally cancel a later scan, and an abort requested after a reservation but before the scan begins should cancel the scan. There is no change to production code, no bug fix, and no security-relevant behavior introduced.

AI review queuedwallet: move fAbortRescan reset into WalletRescanReserver reserve()by Pol Espinasa · bc30e951 · Jun 11, 2026 · 2 filesMessage 73 · AdequateLow 33Details
Commit message · Pol Espinasa

wallet: move fAbortRescan reset into WalletRescanReserver reserve()

Reserving the wallet rescan is the first thing done when starting a rescan.
As part of the reservation, clear any leftover state from previous
rescans (reset fAbortRescan). This prevents a race condition
where an abort request arrives before the rescan loop starts; without
this reset, the abort could be ignored and the rescan would proceed.

Co-authored-by: w0xlt <woltx@protonmail.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Low 33/100

This Bitcoin Core wallet patch fixes a small but real timing bug: if a user clicked 'abort rescan' at exactly the wrong moment, the abort signal could be ignored and the rescan would keep running. The fix moves the 'clear any old abort signal' step to the moment the rescan reservation is taken, so a fresh abort request is always honored. It is a reliability/usability bug, not a theft-of-funds vulnerability.

AI review queuedbtcsignals: delete broken scoped_connection move assignmentby Thomas · b83a999b · Jun 11, 2026 · 1 fileMessage 73 · AdequateLow 33Details
Commit message · Thomas

btcsignals: delete broken scoped_connection move assignment

The defaulted move assignment overwrites m_conn without disconnecting
it first, so the previous callback stays registered with the signal and
keeps firing, violating the RAII contract:

btcsignals::scoped_connection sc0 = sig.connect(IncrementCallback);
btcsignals::scoped_connection sc1 = sig.connect(SquareCallback);
sc0 = std::move(sc1);
val = 3; sig(val); // both callbacks fire: 16 instead of 9

Move assignment is unused in the codebase, so delete it rather than
fixing it. It can be implemented properly if a use case arises.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 33/100

This commit removes a broken move-assignment operator from a small helper class that manages automatic disconnection of signal callbacks. The broken operator could leave an old callback registered after a move, causing unexpected behavior. The commit states the operator is unused in the codebase, so it is deleted rather than fixed. There is no direct evidence this bug was exploitable for security harm.

AI review queuedtest: add coverage for importdescriptors when manually interrupting a wallet rescanby Pol Espinasa · ed11dd6a · Jun 10, 2026 · 1 fileMessage 87 · StrongInformational 15Details
Commit message · Pol Espinasa

test: add coverage for importdescriptors when manually interrupting a wallet rescan

Co-authored-by: w0xlt <woltx@protonmail.com>

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit adds a new automated test to Bitcoin Core. The test checks what happens when a user cancels a wallet rescan while importing descriptors. It does not change any production wallet code; it only adds test coverage. There is no security vulnerability here.

AI review queuedtest: add coverage for importdescriptors errors when using assumeutxoby Pol Espinasa · d90d7f0a · Jun 10, 2026 · 1 fileMessage 87 · StrongInformational 15Details
Commit message · Pol Espinasa

test: add coverage for importdescriptors errors when using assumeutxo

Co-authored-by: w0xlt <woltx@protonmail.com>

87/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only adds a new test case to Bitcoin Core's test suite. It checks that the wallet's importdescriptors RPC returns a specific error message when used during an in-progress assumeutxo background sync. There is no change to production code, no bug fix, and no security vulnerability being introduced or patched.