CommitWatch RSS
EP
← All projectsElements Project

Core Lightning

Modular C implementation of the Lightning Network protocol and node stack.

BitcoinLightning NetworkNormal
Source repository ↗
Repository coverage

1854 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

158security candidates263second-pass queue573AI analyses
144commits · 30 days
226commits · 60 days
804commits · 180 days
1850commits · 365 days
Backfill bands
Aug 5 → Feb 61049 seen37 candidatesComplete
Feb 6 → Jun 6579 seen10 candidatesComplete
Jun 6 → Jul 678 seen1 candidatesComplete
Jul 6 → Aug 5147 seen16 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
431Strong · 80–100
1163Adequate · 60–79
231Thin · 40–59
29Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
dovgopoly1502164
Rusty Russell95873247072
Sangbida Chaudhuri1473171066
Dusty Daemon771314066
ShahanaFarooqui931032063
daywalker9089537062
Níckolas Goline40516076
Lagrang376428069
Christian Decker3647072
Vincenzo Palazzo834080
Chandra Pratap56250082
ekzyis222063
Analysis record

Published AI watches

Last scanned 56 minutes ago

Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "doc: require Homebrew GNU make and gpatch on macOS"

This commit is a simple documentation revert. It undoes a previous change that told macOS users to install GNU make and GNU patch from Homebrew and to put those tools first in their command path. The reverted instructions now omit gpatch a…

0cfa949fby Sangbida Chaudhuri+4−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 75 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Revert "tests: drop obsolete x-prefix in compacter-slow.sh"

This commit re-adds an old-style 'x' prefix to a string comparison in a test helper script. It is a test-only change with no effect on the actual Core Lightning node software, user funds, network behavior, or security. The change simply re…

116fd7cdby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

doc: require Homebrew GNU make and gpatch on macOS

This commit only updates macOS installation instructions in the documentation. It tells macOS users to install newer GNU versions of 'make' and 'patch' from Homebrew because Apple's built-in tools are too old for building and running sourc…

d3ff1474by Sangbida Chaudhuri+8−41 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 83 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

tests: drop obsolete x-prefix in compacter-slow.sh

This commit is a trivial shell script cleanup. It removes an old-fashioned 'x' prefix from a string comparison in a test helper script so that a newer version of the Shellcheck linter stops warning about it. The change does not alter progr…

474c272aby Sangbida Chaudhuri+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist amount+currency parsing into common code.

This commit moves existing code that parses payment amounts (Bitcoin millisatoshis, 'any' amount, or fiat currency amounts) from one plugin file into a shared library so it can be reused by a future feature. It is a code refactoring with n…

Refactoring of amount-parsing code into a shared helperAddition of explicit u64 overflow guards (mul_overflows_u64, add_overflows_u64) in the new common codeNo change to wire protocol or RPC interface semantics
e0f86c17by Rusty Russell+112−723 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: internal cleanups since all non-command JSON IDs are strings.

This is a routine internal cleanup commit in Core Lightning. It removes an unused helper function and simplifies how JSON-RPC request IDs are stored and formatted, since the project now always uses string IDs for non-command JSON traffic. …

No security-relevant keywords in commit title or messageNo CVE, advisory, or bug reference presentChanges are refactor/cleanup in nature
a70ae963by Rusty Russell+25−378 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

common: hoist hash_str helper into its own header.

This commit is a routine code cleanup: it moves a small string-hashing helper function into a shared header file so it can be reused without being copied and pasted. There is no change to behavior, no bug fix, and no security relevance.

581bbb1fby Rusty Russell+16−176 files
No security note in commit
Open full analysis →Source commit ↗
Informational 23 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade: we need to remove "impressions" from askrene datastore when downgrading to v26.06.

This is a database downgrade helper fix, not a live network vulnerability. Core Lightning's downgrade tool previously failed to strip out new 'channel impression' records when rolling a database back to version v26.06. The patch teaches th…

Database downgrade path could leave incompatible records in older schemaOffline tool only; no remote or on-chain triggerFix prevents potential node startup failure after version rollback
4d926285by Rusty Russell+43−111 file
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

downgrade tool: fix invalid memory bug

This commit fixes a typo in a database downgrade helper tool. The bug caused the tool to pass a negative number (turned into a huge positive size) when copying data, which led to an out-of-memory (OOM) error. The fix swaps two variable nam…

Integer underflow / negative-to-size_t wrap leading to excessive allocationOut-of-memory crash in maintenance toolMemory corruption potential if allocation somehow succeeded
42995326by Lagrang3+8−81 file
No security note in commit
Open full analysis →Source commit ↗
Informational 24 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: actually tell askrene when a payment succeeded.

This commit fixes a bookkeeping bug in Core Lightning's xpay plugin. Previously, when a payment succeeded, xpay did not tell the askrene routing-helper that the route worked. As a result, askrene kept stale or overly pessimistic ideas abou…

Missing success feedback to routing layer can degrade payment reliabilityStale negative impressions may bias future path selection toward worse or failing routesNo direct funds-loss primitive is introduced or fixed
a66fabd4by Rusty Russell+40−02 files
No security note in commit
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 58 · Thin
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: correctly order constraints.

This commit fixes a bug in Core Lightning's routing helper (askrene) where two kinds of channel information—hard limits called 'constraints' and usage estimates called 'impressions'—were being applied in the wrong order. Because impression…

Routing decision bug caused by incorrect ordering of time-relative channel statePotential payment failure or acceptance of an over-capacity routeRegression test added demonstrating incorrect route acceptance before fix
4b6fe4a1by Rusty Russell+211−1182 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 68 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

askrene: don't leak channel intel entries

This commit fixes a memory leak in the askrene plugin of Core Lightning. When individual channel intelligence entries were deleted, the code removed the entry from its array but forgot to free two internal pointers (impression and constrai…

Memory leak in plugin data structure cleanupMissing deallocation of nested pointers before array removalFix located in routing/intelligence plugin (askrene)
8891f414by Lagrang3+5−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

xpay: tests should expect the new error messages

This commit only updates test files so that automated checks expect slightly different error wording from the xpay payment command. It does not change any production code, so it cannot introduce a security vulnerability or fix one on its o…

0b67601fby Lagrang3+24−32 files
No security note in commit
Open full analysis →Source commit ↗
Low 43 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit invoices to 10 minutes for recurring offers in other currencies.

This change tightens the lifetime of recurring invoices priced in foreign currencies (like USD) to 10 minutes by default, and refreshes them with current exchange rates when they expire. Previously, such invoices could remain valid for the…

Fixes stale exchange-rate exposure for currency-denominated recurring invoicesAdds configurable expiry cap for recurring currency invoicesDistinguishes user-cancellation (0s expiry) from natural expiry to avoid misleading errors
446312cfby Rusty Russell+134−148 files
No security note in commit
Open full analysis →Source commit ↗
Low 45 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

offers: limit expiry to offer limit, or 10 minutes with currency conversion.

This commit tightens the expiration time on invoices created from BOLT12 offers. Previously, all such invoices defaulted to a 2-hour payment window. Now, if the offer has an absolute expiry, the invoice expires when the offer expires; and …

BOLT12 invoice expiry now bounded by offer absolute expiryCurrency-converted invoices use short expiry to limit exchange-rate exposureNew regression test added for expiry behavior
a6cf4915by Rusty Russell+55−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 29 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: don't bother with checking recurrence timing.

This commit removes local timing checks in Core Lightning's fetchinvoice plugin for recurring payments. Instead of the plugin refusing too-early or too-late invoice requests, it now lets the remote node decide and report back. The change i…

Removal of local input-validation checks for recurring invoice requestsReliance on remote-party enforcement for recurrence period limits and pay windowsTest expectations changed from local rejection to remote failure messages
3e49d908by Rusty Russell+2−682 files
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

lightningd: don't do previous invoice checking in createinvoicerequest.

This commit removes a local sanity check in Core Lightning's experimental 'createinvoicerequest' command. Previously, when creating a recurring invoice request, the code looked up past payments by label to verify the previous recurrence wa…

Removal of local payment-state validation for recurring invoice requestsParameter rename from recurrence_label to label in internal RPC callsTest expectations changed from local 'previous invoice has not been paid' errors to remote failure messages
4348d8acby Rusty Russell+5−1224 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 65 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

fetchinvoice: handle weird labels in recurrence_label parameter.

This commit fixes how the fetchinvoice plugin handles user-supplied labels that contain special characters such as backslashes, quotes, tabs, and newlines. Previously these labels were passed as raw strings, which could cause JSON encoding…

JSON injection / improper escaping of user-controlled input passed between RPC componentsPotential mismatch between label parsing and label serialization leading to functional failures or unexpected behaviorFix is narrowly scoped to a single plugin and parameter
d7f87f2dby Rusty Russell+37−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

Add unit tests for str_to_u64

This commit only adds a new automated test file that checks how a helper function (str_to_u64) converts text strings to unsigned 64-bit integers. It does not change any production code, so it cannot by itself introduce a security vulnerabi…

dddb455dby Lagrang3+203−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

pytest: add tests for what we want askrene to do.

This commit only adds a new pytest test file. It does not change any production code. The test describes desired future behavior for the askrene routing module's error messages when a payment source or destination lacks enough channel capa…

518620aeby Rusty Russell+67−01 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritypytest: test for currencyrate median code when values are cached.by Rusty Russell · 17824fab · Mar 23, 2026 · 1 fileMessage 75 · AdequateTriage 0Details
Commit message · Rusty Russell

pytest: test for currencyrate median code when values are cached.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Lower-prioritydoc: add missing schema for currencyconvert API.by Rusty Russell · 42b33e3a · Mar 23, 2026 · 4 filesMessage 60 · AdequateTriage 0Details
Commit message · Rusty Russell

doc: add missing schema for currencyconvert API.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritylightningd: add generic scriptpubkey watches.by Rusty Russell · f266d174 · Mar 22, 2026 · 5 filesMessage 68 · AdequateTriage 0Details
Commit message · Rusty Russell

lightningd: add generic scriptpubkey watches.

The wallet has "our_addresses" which contains our own addresses; this
adds a more generic callback mechanism which can be used for funding
txs and splices.

This will map better onto bwatch, which won't have ability to watch by
txid.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritylightningd: use scriptpubkey and blockdepth watches instead of tx watches for dual funding.by Rusty Russell · 53d0de44 · Mar 22, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

lightningd: use scriptpubkey and blockdepth watches instead of tx watches for dual funding.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritylightningd: support watch-for-blockdepth primitive.by Rusty Russell · 70ad8de0 · Mar 22, 2026 · 4 filesMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

lightningd: support watch-for-blockdepth primitive.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritylightningd: bail out on splice if scid doesn't fit.by Rusty Russell · 46505f92 · Mar 22, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

lightningd: bail out on splice if scid doesn't fit.

If it fails, we cannot proceed with the channel.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritylightningd: use scriptpubkey watch and block depth watch for splicing.by Rusty Russell · c4beb2a7 · Mar 22, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

lightningd: use scriptpubkey watch and block depth watch for splicing.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritylightningd: use htable lock/unlock to ensure we don't add to htables while iterating.by Rusty Russell · 8429bc73 · Mar 22, 2026 · 4 filesMessage 85 · StrongTriage 0Details
Commit message · Rusty Russell

lightningd: use htable lock/unlock to ensure we don't add to htables while iterating.

Not all of them, but I've done the ones which weren't obvious.

Also, there's never a problem deleting during iteration, so remove places which
tried to "handle" that problem.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Security candidatechaintopology: don't use txfilter, rely on wallet_extract_owned_outputs.by Rusty Russell · 5cdb7bde · Mar 22, 2026 · 1 fileMessage 73 · AdequateInformational 24Details
Commit message · Rusty Russell

chaintopology: don't use txfilter, rely on wallet_extract_owned_outputs.

txfilter.c keeps a hash with interface:
* INSERT: txfilter_add_scriptpubkey &txfilter_add_derkey
* SEARCH: txfilter_match & txfilter_scriptpubkey_matches. It simply returns true/false.

wallet.c keeps an our_addresses hash:
* INSERT: on-demand when asked based on max keyidx (plus gap)
* SEARCH: wallet_can_spend (and thus its caller wallet_extract_owned_outputs).

Here are the places which populate the txfilter:

lightningd/channel.c:
- When we generate our own address final address
=> this is already covered when we call wallet_get_newindex() to get the final_key_idx
lightningd/lightningd.c:
- init_txfilter initializes all the prior addresses
=> wallet_can_spend populates this on first call.
wallet/reservation.c:
- finish_psbt and json_addpsbtoutput for change output
=> this is already covered when get call wallet_get_newindex() in the same funciton.
wallet/wallet.c:
- got_utxo for unconfirmed outputs
=> This is called when we have already determined we can spend the output (wallet_extract_owned_outputs), or on the fixup migration where the addresses are populated from a keyindex we've already created.
wallet/walletrpc.c:
- newaddr_inner
=> Already covered by wallet_get_newindex()

The result: we can just rely on the wallet to find our addresses, and
we don't need the txfilter at all. Just make chaintopology ask the
wallet directly.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Informational 24/100

This commit removes an old shortcut (a Bloom-like 'txfilter') that Core Lightning used to guess whether a new Bitcoin block contained transactions relevant to the wallet. Instead, it now asks the wallet directly to identify which transaction outputs belong to the node. The change is a code simplification and likely a defensive fix: the old filter could in theory miss transactions or produce false positives, while the wallet lookup is authoritative. There is no direct evidence in the commit that this was exploited or that it caused a concrete loss of funds, but it touches the code that decides whether the node notices its own on-chain payments.

Lower-prioritylightningd: change watch_scriptpubkey and watch_blockdepth not to insert exact duplicates.by Rusty Russell · ad315e1f · Mar 22, 2026 · 2 filesMessage 83 · StrongTriage 0Details
Commit message · Rusty Russell

lightningd: change watch_scriptpubkey and watch_blockdepth not to insert exact duplicates.

This double-watching is in fact invoked for splicing (on restart, see
tests/test_splicing.py::test_commit_crash_splice) and the "not
creating duplicates" API mirrors the future bwatch API which is persistent.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-prioritytx: make bitcoin_tx_output_get_amount_sat() return amount_sat.by Rusty Russell · a46c2502 · Mar 22, 2026 · 4 filesMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

tx: make bitcoin_tx_output_get_amount_sat() return amount_sat.

We return this when we can: it's just a u64.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Security candidatebitcoin: hoist script_with_len out of wallet/ into here.by Rusty Russell · 8f8cab0e · Mar 22, 2026 · 56 filesMessage 95 · StrongInformational 15Details
Commit message · Rusty Russell

bitcoin: hoist script_with_len out of wallet/ into here.

Vital for hashing. But adding script_with_len_hash here breaks
fuzzing build, so that requires a little modification.

I also noticed that `#include <common/randbytes.h>` is redundant in
all the common/ unit tests, so removed it.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencecryptography-sensitive pathsigning or wallet pathparser or protocol path
AI analysis · Informational 15/100

This commit is a routine code cleanup: it moves a small helper structure and its hash/equality functions from the wallet module to the more general Bitcoin module so other code can reuse them. It also updates many test files to provide a stub for a hash-seed function and removes an unused header include. There is no security fix or vulnerability here.

Lower-prioritylightningd: make dualopend's opening_depth_cb use depthcb_update_scid.by Rusty Russell · 43967a82 · Mar 22, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

lightningd: make dualopend's opening_depth_cb use depthcb_update_scid.

It doesn't need to reinvent the wheel.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
AI review queuedlightningd: explicitly unwatch funding scriptpubkey when channel finally closed.by Rusty Russell · 95f1a4c0 · Mar 22, 2026 · 5 filesMessage 73 · AdequateInformational 17Details
Commit message · Rusty Russell

lightningd: explicitly unwatch funding scriptpubkey when channel finally closed.

This is unnecessary now, since we have a destructor, but it'll be important when
we move watching out to `bwatch`.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This change adds an explicit cleanup step that tells the node to stop monitoring the funding transaction once a channel is finally closed. The commit message says this is not strictly needed today because an existing destructor already handles it, but it will matter in a future refactor. There is no direct evidence this fixes an exploitable security bug.

AI review queuedcommon: make encode_scriptpubkey_to_addr take explicit len.by Rusty Russell · 3b0def41 · Mar 22, 2026 · 8 filesMessage 73 · AdequateInformational 18Details
Commit message · Rusty Russell

common: make encode_scriptpubkey_to_addr take explicit len.

Don't assume it's a tal array: this is useful for dealing with
wally_tx internals.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This change refactors a helper function that turns Bitcoin scriptPubKeys into human-readable addresses. Previously the function measured the length itself using a memory-tracking helper (tal_bytelen). Now callers pass the length explicitly. This is mostly a code-cleanup to support data that isn't tracked by that helper, such as internal libwally transaction buffers. There is no direct security bug being fixed, but the old pattern could theoretically lead to incorrect length handling if a non-tal buffer were passed in future code.

AI review queuedlightningd: remove redundant `txid` arg in depthcb_update_scid.by Rusty Russell · ff46af09 · Mar 22, 2026 · 5 filesMessage 65 · AdequateInformational 15Details
Commit message · Rusty Russell

lightningd: remove redundant `txid` arg in depthcb_update_scid.

It's outpoint->txid in all cases.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a small internal cleanup: a function that updates a channel's short identifier was being passed both a transaction ID and a funding outpoint, but the transaction ID is always already part of the outpoint. The change removes the redundant argument and uses the outpoint's own transaction ID instead. There is no security-relevant change.

AI review queuedlightningd: make caller to deptch_update_scid fetch the location in the blockby Rusty Russell · 88b394d2 · Mar 22, 2026 · 5 filesMessage 85 · StrongInformational 12Details
Commit message · Rusty Russell

lightningd: make caller to deptch_update_scid fetch the location in the block

We'll actually have it directly when we use outpoint watches from
chaintopology, so we will be able to avoid the lookup.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This is a small internal code cleanup in Core Lightning. A function that builds a channel identifier (short_channel_id) used to look up a transaction's block position itself; now its callers look up that position and pass it in. The commit message frames this as preparation for a future change, not as a security fix. There is no indication of a vulnerability being patched.

AI review queuedlightningd: save short_channel_id in inflight struct as soon as it gets mined.by Rusty Russell · 669e1024 · Mar 22, 2026 · 6 filesMessage 73 · AdequateInformational 18Details
Commit message · Rusty Russell

lightningd: save short_channel_id in inflight struct as soon as it gets mined.

This also removed the last call to wallet_transaction_locate, so remove that too.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This is a small internal cleanup change in Core Lightning. It stores a channel identifier (short_channel_id) in memory as soon as a splicing transaction is mined, instead of looking it up from the database every time it is needed. It also removes an unused database helper function. There is no obvious security vulnerability here; it is primarily a code-quality and efficiency improvement.

AI review queuedlightningd: make wallet_extract_owned_outputs return bool, optionally output numbers.by Rusty Russell · 60eef930 · Mar 22, 2026 · 8 filesMessage 65 · AdequateInformational 12Details
Commit message · Rusty Russell

lightningd: make wallet_extract_owned_outputs return bool, optionally output numbers.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This is a small internal code cleanup in Core Lightning. A wallet helper function that scans transactions for outputs belonging to the node is changed from returning a count of found outputs to returning a simple yes/no answer, with an optional list of output numbers. Callers are updated to use the new yes/no style. Nothing in the commit message or diff suggests a security bug is being fixed.

AI review queuedwallet: remove txfilter.by Rusty Russell · fa35af24 · Mar 22, 2026 · 13 filesMessage 51 · ThinInformational 12Details
Commit message · Rusty Russell

wallet: remove txfilter.

chaintopology was the only user, so we don't need the txfilter at all.
Remove it.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit removes an unused internal transaction filter called txfilter. The code that added wallet addresses and public keys to this filter is deleted because nothing was actually using the filter anymore. There is no indication in the commit that this fixes a security bug; it appears to be ordinary code cleanup.

AI review queuedlightningd: use a blockdepth callback instead of a watch_txid.by Rusty Russell · d63b1e3b · Mar 22, 2026 · 7 filesMessage 73 · AdequateInformational 23Details
Commit message · Rusty Russell

lightningd: use a blockdepth callback instead of a watch_txid.

This is more explicit, and will work far better with an external watcher.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 23/100

This commit refactors how Core Lightning tracks the confirmation depth of a channel's funding transaction. Instead of watching a specific transaction ID, it now watches the block height at which the funding transaction was found. The change is described by the author as making the code more explicit and better suited to external blockchain watchers. There is no direct evidence in the commit that this fixes a security vulnerability, but it does touch reorganization handling and could affect how the node reacts when a funding transaction is removed from the blockchain.

AI review queuedlightningd: use scriptpubkey, not watch_txid for initial spotting of the funding tx.by Rusty Russell · 2432cae0 · Mar 22, 2026 · 3 filesMessage 73 · AdequateInformational 24Details
Commit message · Rusty Russell

lightningd: use scriptpubkey, not watch_txid for initial spotting of the funding tx.

funding_depth_cb handled three cases, implicitly:

1. First time we see the funding tx.
2. When we see the funding tx block reorged out.
3. When we see the tx depth increase.

This replaces first one with a scriptpubkey watch. The other two stay
using the watch_txid for now.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 24/100

This change alters how Core Lightning first detects a channel's funding transaction on the Bitcoin blockchain. Previously it looked for an exact transaction ID; now it watches for any transaction that pays to the channel's expected 2-of-2 multisig script. The commit message frames this as a refactor of the three existing cases handled by the funding-depth callback, not as a security fix. There is no direct evidence in the diff of a vulnerability being patched, but the change could reduce sensitivity to transaction malleability or to cases where the funding transaction ID is not yet known.

Lower-prioritylightningd: fix type of splice_depth_cb, remove never-working splice_inflight_txwatch.by Rusty Russell · defb198a · Mar 22, 2026 · 1 fileMessage 73 · AdequateTriage 0Details
Commit message · Rusty Russell

lightningd: fix type of splice_depth_cb, remove never-working splice_inflight_txwatch.

We use typesafe callbacks: void * arguments are strongly eschewed.
Indeed, when we fix this one, we find it's getting called wrong in
splice_inflight_txwatch.

Since we handed the wrong arg to splice_inflight_txwatch (channel
instead of inflight), it never worked. Indeed, we always get:

Splice inflight event but not in AWAITING_SPLICE, ending watch of txid f6f0cb65584389caf7722b06d9ffe98aea3ad8fd04d74b2b11e2e227cf28cffe

So remove it. The watch will delete itself (as above), or be freed with the inflight.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritylightningd: use scriptpubkey watches not txid watches for inflights on closing.by Rusty Russell · 205941f4 · Mar 22, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

lightningd: use scriptpubkey watches not txid watches for inflights on closing.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Lower-prioritylightningd: use inflight->locked_scid instead of db lookup when splice locked.by Rusty Russell · 3cb658a9 · Mar 22, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Rusty Russell

lightningd: use inflight->locked_scid instead of db lookup when splice locked.

This means splitting up the deptch_update_scid() a little.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body