Elements

Consensus node software underlying Liquid and other Elements-based Bitcoin sidechains.

BitcoinBitcoin sidechainsCryptographic librariesNode implementationsActive incident

Repository coverage

116 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

34security candidates25second-pass queue59AI analyses

36commits · 30 days

47commits · 60 days

85commits · 180 days

115commits · 365 days

Backfill bands

Sep 7 → Mar 1129 seen5 candidatesComplete

Mar 11 → Jul 938 seen7 candidatesComplete

Jul 9 → Aug 82 seen0 candidatesComplete

Aug 8 → Sep 738 seen13 candidatesComplete

Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

62/100 average clarity

26Strong · 80–100

32Adequate · 60–79

48Thin · 40–59

10Opaque · 0–39

Read the scoring rubric →

Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.

Byron Hambly462227371

Tom Trevethan37414152

merge-script944191

Ruslan Kasheparov827042

Pablo Greco814045

ivanlele111058

Abdullah1738200057

nazarevsky101035

Pieter Wuille100091

Hennadii Stepanov100045

Russell O'Connor101068

fanquake100080

Analysis record

Published AI watches

Last scanned 21 minutes ago

Moderate 64 AI analysisMessage 91 · Strong

3 days, 7 hours ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Merge ElementsProject/elements#1604: [master] sigcache: harden range proof cache keys and add -norangeproofcache option

Cache key collision resistance hardened by length-prefixing all fieldsSurjection-proof cache key now includes vTags, fixing a missing-input vulnerabilityNew runtime option to disable range-proof cache without recompilation

301acc64by merge-script+270−335 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Informational 18 AI analysisMessage 73 · Adequate

1 week, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

init: add -norangeproofcache startup option to disable range proof cache

No security-relevant signal in commit message or diffNew debug/test startup option onlyNo validation logic change; only cache lookup/store paths are bypassed

53167b1fby Byron Hambly+13−52 files

No security note in commit

Open full analysis →Source commit ↗

Moderate 68 AI analysisMessage 83 · Strong

1 week, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

sigcache: harden proof cache keys with length-prefixed hashing

Cache-key collision in proof verification cache could allow bypass of cryptographic verificationRaw concatenation of variable-length fields in cache-key constructionMissing input (vTags) in surjection-proof cache key

b0a27528by Byron Hambly+92−282 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Moderate 59 AI analysisMessage 100 · Strong

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Merge ElementsProject/elements#1593: Fix RPC return errors for psbt and invalid rangeproofs

assert-to-error conversion in rangeproof generationPSBT explicit output data now required before signing blinded outputspeg-in witness stack length and deserialization hardening

4ddaefc8by merge-script+221−4515 files

No security note in commit

Open full analysis →Source commit ↗

High 72 AI analysisMessage 91 · Strong

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Merge ElementsProject/elements#1592: blind/blindpsbt fixes

Replacement of assertion failures with recoverable error returns in attacker-influenced PSET blinding pathsOut-of-bounds read prevention by requiring 33-byte Pedersen commitments before passing buffers to libsecp256k1Range-proof equality verification now checks both min and max bounds, closing a proof-forgery window

31e8f27fby merge-script+86−189 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Informational 15 AI analysisMessage 96 · Strong

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Merge ElementsProject/elements#1576: Fix intermittent failure in feature_pegin_subsidy.py

This commit only updates test scripts to fix flaky automated tests. It changes how test code calculates expected pegin subsidy values and how test nodes bind to network ports when using Bitcoin Core as a parent chain. No production node co…

No changes to production source codeChanges limited to test/functional/ Python test scriptsTest assertion hardening: dynamic subsidy computation instead of hardcoded constants

bad8ca42by merge-script+154−382 files

No security note in commit

Open full analysis →Source commit ↗

Moderate 60 AI analysisMessage 50 · Thin

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

PartiallySignedTransaction::SetupFromTx indexes vtxinwit checked

Out-of-bounds array access fixed in PSBT peg-in setupMissing length validation added for pegin witness stack elementsException handling added around deserialization of pegin witness components

ffd91c05by Tom Trevethan+57−332 files

No security note in commit

Open full analysis →Source commit ↗

High 72 AI analysisMessage 50 · Thin

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Return error for psbt if explicit amounts/assets deleted

Missing input validation on attacker-controlled PSBT dataBlinding proof verification relied on explicit fields that could be omitted by a counterpartyAssertions replaced with safe error returns for off-host data

3a8dec12by Tom Trevethan+18−73 files

No security note in commit

Open full analysis →Source commit ↗

Moderate 60 AI analysisMessage 45 · Thin

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Return error for invalid rangproof amounts

Removal of assert() on cryptographic operation result in transaction blinding codeConversion of abort-on-failure into error-return for rangeproof generation failuresNew explicit validation rejecting zero-amount spendable outputs in PSBT blinding

4e5ca94fby Tom Trevethan+99−54 files

No security note in commit

Open full analysis →Source commit ↗

High 74 AI analysisMessage 73 · Adequate

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: return error instead of asserting on surjection proof failure

assert-to-error conversiondenial-of-service vector from untrusted PSET inputsurjection proof failure on attacker-chosen tags/generators

b0aba619by Byron Hambly+9−21 file

Vendor flagged security relevance

Open full analysis →Source commit ↗

Moderate 62 AI analysisMessage 73 · Adequate

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: refuse to blind a PSET output with no amount

Undefined behavior from dereferencing a disengaged std::optionalMissing input validation on optional PSET fieldPotential denial-of-service/crash via crafted PSET

066ecf6eby Byron Hambly+8−01 file

Vendor flagged security relevance

Open full analysis →Source commit ↗

Moderate 63 AI analysisMessage 73 · Adequate

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

headerssync: retain Elements identity and proof fields

Header integrity loss in sync path: reconstructed header hash would not match received headerLoss of proof and signblock witness data needed for signed/dynafed validationPotential denial-of-service via sync failure or validation rejection of otherwise valid headers

fef1a30bby Byron Hambly+26−32 files

No security note in commit

Open full analysis →Source commit ↗

High 74 AI analysisMessage 85 · Strong

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: require both range bounds to match claim in VerifyBlindValueProof

Understated output values in PSET blind value proofsIncomplete range-proof bound verificationConfidential transaction amount mismatch risk

34be37f3by Byron Hambly+5−11 file

Vendor flagged security relevance

Open full analysis →Source commit ↗

Low 48 AI analysisMessage 73 · Adequate

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

validation: always validate and retain dynafed header block_height

Header hash mismatch between accepted and reconstructed dynafed headers when legacy option disabledMissing height validation for dynafed headers when -con_blockheightinheader option is offPotential for accepting dynafed headers with incorrect block_height

c7ec63c5by Byron Hambly+12−32 files

No security note in commit

Open full analysis →Source commit ↗

Moderate 62 AI analysisMessage 73 · Adequate

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: reject off-curve blinding pubkey before ECDH

Off-curve / invalid elliptic-curve public key reaches ECDHAssertion abort (DoS / process termination) via crafted inputMissing input validation in PSBT blinding path compared to non-PSBT path

f634a3a4by Byron Hambly+7−01 file

Vendor flagged security relevance

Open full analysis →Source commit ↗

Moderate 60 AI analysisMessage 78 · Adequate

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

dynafed: require at least four-fifths approval for parameter transition

Consensus threshold under-approximation due to integer floor divisionPotential for dynafed parameter transition with less than intended 80% block approvalOverflow-safe ceiling formula used as remediation

bdedb12eby Byron Hambly+5−21 file

Vendor flagged security relevance

Open full analysis →Source commit ↗

Moderate 62 AI analysisMessage 73 · Adequate

2 weeks, 4 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: require genuine commitments in VerifyBlindValueProof

Out-of-bounds read in cryptographic proof verificationInsufficient input validation before passing buffer to libsecp256k1Confidential value/asset commitment type confusion

6f1a5131by Byron Hambly+5−11 file

Vendor flagged security relevance

Open full analysis →Source commit ↗

Informational 12 AI analysisMessage 95 · Strong

3 weeks, 3 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

test: assert wallet default commits rangeproofs post-dynafed

This commit only adds a new test to the project's test suite. It checks that the wallet's default signing behavior correctly includes (or excludes) a special 'rangeproof' flag depending on whether a network upgrade called 'dynafed' is acti…

Adds functional test coverage for SIGHASH_RANGEPROOF default behaviorVerifies pre-dynafed wallet default does not set SIGHASH_RANGEPROOF bitNo modification to signing, consensus, or mempool code

a1aacfaaby Byron Hambly+45−01 file

No security note in commit

Open full analysis →Source commit ↗

Moderate 64 AI analysisMessage 73 · Adequate

3 weeks, 3 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

wallet: default to rangeproof-committing sighash when dynafed active

This commit changes the Elements wallet so that, when a newer consensus feature called 'DynaFed' is active, any transaction the wallet signs without an explicit signature mode will automatically include the transaction's confidential outpu…

Fixes a known malleability vector: pre-Taproot rangeproof/witness malleabilityChanges wallet default sighash only when dynafed is activeDoes not override explicit user sighash choices

ce342f58by Byron Hambly+12−33 files

Vendor flagged security relevance

Open full analysis →Source commit ↗

Low 33 AI analysisMessage 73 · Adequate

3 weeks, 3 days ago

EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

rpc: default raw signing to rangeproof-committing sighash when dynafed active

This commit changes how the Elements blockchain software creates and checks digital signatures for raw transactions. Once a network upgrade called 'dynafed' is active, the software now defaults to a signature type that also commits to conf…

New consensus-relevant sighash default gated by dynafed activationVerification flag added to accept previously rejected signature typeRaw transaction signing behavior change for RPC callers

f5e2b1f5by Byron Hambly+27−84 files

No security note in commit

Open full analysis →Source commit ↗

Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidateMerge ElementsProject/elements#1604: [master] sigcache: harden range proof cache keys and add -norangeproofcache optionby merge-script · 301acc64 · Sep 16, 2026 · 5 filesMessage 91 · StrongModerate 64Details

Commit message · merge-script

Merge ElementsProject/elements#1604: [master] sigcache: harden range proof cache keys and add -norangeproofcache option

53167b1f452f9cdf96b1ec4af7fed613ba772c95 init: add -norangeproofcache startup option to disable range proof cache (Byron Hambly)
5e5f8e613329a493d062f6cb0c74235d8ddc6114 sigcache: add proof cache key collision-resistance tests (Byron Hambly)
b0a275281ee5bfd789b832027fe6d5532273eb74 sigcache: harden proof cache keys with length-prefixed hashing (Byron Hambly)

Pull request description:

target is **master** branch, cherry-picked commits from #1600

Switch the range-proof and surjection-proof cache hashers from raw
CSHA256 concatenation to CHashWriter . This length-prefixes
every field, so distinct argument tuples with byte-identical raw
concatenations no longer collide to the same cache key.

Both caches retain per-process salted midstates with distinct domain
separators ('r' / 's').

Also adds a -norangeproofcache startup option to
disable the range proof cache without recompiling.

ACKs for top commit:
tomt1664:
ACK 53167b1f452f9cdf96b1ec4af7fed613ba772c95 tested locally

Tree-SHA512: 35412700e9773437b67b5ef350e752201856afab5e04e850ee6f9abe2aa4dc5127f5e9c13278c66236193f3279f34ec437f603ade6ba63e8149abd6f364c0246

91/100 · StrongMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference

Why it was queued

defensive validationconsensus or confidential-proof validationmerge-commit duplicate discount

AI analysis · Moderate 64/100

This commit fixes a cache-key collision bug in Elements' range-proof and surjection-proof validation caches. Previously, the cache key was built by simply concatenating raw bytes, so two different sets of inputs could accidentally produce the same key. If that happened, a node might skip verification and accept a proof it had never actually checked. The patch switches to length-prefixed hashing so distinct inputs always get distinct keys, adds the missing vTags data to the surjection-proof key, and adds a startup option to disable the range-proof cache. It also adds unit tests to prevent regressions.

Security candidateinit: add -norangeproofcache startup option to disable range proof cacheby Byron Hambly · 53167b1f · Sep 8, 2026 · 2 filesMessage 73 · AdequateInformational 18Details

Commit message · Byron Hambly

init: add -norangeproofcache startup option to disable range proof cache

Add -norangeproofcache startup option. InitRangeproofCache()
early-returns (allocating nothing) when the flag is set. VerifyRangeProof
reads the flag on each call and bypasses both the Get and Set paths,
so cache behaviour is fully skipped without restarting.

(cherry picked from commit 19d704279b3197af16ac52d910a915225505fe61)

73/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

Why it was queued

consensus or confidential-proof validation

AI analysis · Informational 18/100

This commit adds a new command-line option `-norangeproofcache` that lets node operators turn off an internal performance cache used when validating confidential transaction range proofs. It is a debug/test option, not a security fix. There is no evidence in the commit or supplied references that this change addresses a vulnerability or that disabling the cache is security-relevant.

Lower-prioritysigcache: add proof cache key collision-resistance testsby Byron Hambly · 5e5f8e61 · Sep 8, 2026 · 2 filesMessage 83 · StrongTriage 0Details

Commit message · Byron Hambly

sigcache: add proof cache key collision-resistance tests

Test the field-boundary, script-sensitivity, domain-separation,
determinism, and vTags-sensitivity properties of the range-proof and
surjection-proof cache entry computation.

(cherry picked from commit 1513d63d17bbbb2373640ead8ac0215c749281db)

83/100 · StrongMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification

Security candidatesigcache: harden proof cache keys with length-prefixed hashingby Byron Hambly · b0a27528 · Sep 8, 2026 · 2 filesMessage 83 · StrongModerate 68Details

Commit message · Byron Hambly

sigcache: harden proof cache keys with length-prefixed hashing

Switch range-proof and surjection-proof cache hashers from raw CSHA256
concatenation to CHashWriter (SER_GETHASH). This serializes each field
with a length prefix, so distinct argument tuples with byte-identical
raw concatenations no longer collide to the same cache key.

A cache entry is a positive verification result; a collision would let
an attacker bypass verification. The fix affects two caches:

- ComputeEntryRangeProof: proof, commitment, asset_commitment, scriptPubKey
- ComputeEntrySurjectionProof: add vTags to key (was missing entirely)

Both caches retain the per-process 64-byte salted midstate
(nonce || PADDING_RANGE_PROOF / PADDING_SURJECTION_PROOF) for domain
separation between the two proof types.

Expose thin test-only hooks (TestComputeEntryRangeProof /
TestComputeEntrySurjectionProof) so unit tests can reach the
anonymous-namespace cache internals.

(cherry picked from commit 94000967f6dc05b1afd435e79b1bbc597e29f816)

83/100 · StrongMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification

Why it was queued

explicit security languagedefensive validationconsensus or confidential-proof validation

AI analysis · Moderate 68/100

This commit fixes a cache-key collision bug in Elements' proof verification caches. Previously, the cache key for range proofs and surjection proofs was built by simply concatenating raw bytes, so two different sets of inputs could accidentally produce the same key. Because a cache hit means 'this proof was already verified, skip checking it again,' an attacker who could trigger such a collision could potentially make the node accept an invalid proof. The fix switches to length-prefixed serialization so distinct inputs can no longer collide, and also adds a missing input (vTags) to the surjection-proof cache key. The commit message explicitly calls this a hardening fix against verification bypass.

Lower-priorityMerge ElementsProject/elements#1597: build: fix depends Qt download linkby merge-script · c7e856fa · Sep 4, 2026 · 2 filesMessage 81 · StrongTriage 0Details

Commit message · merge-script

Merge ElementsProject/elements#1597: build: fix depends Qt download link

7fd790144126ea89463934039641182f8abc4deb build: fix depends Qt download link (fanquake)

Pull request description:

Cherry-pick of https://github.com/bitcoin/bitcoin/pull/33563

ACKs for top commit:
delta1:
ACK 7fd790144126ea89463934039641182f8abc4deb

Tree-SHA512: 1d08bfa78564bcffc03e7b9f41a97b0907507a8b0e96ff593e1b47ec3bd7a9fc714789578673bf72a7056943357413eae30a93a457ec8be310b7cee1c219d97b

81/100 · StrongMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference

Why it was queued

merge-commit duplicate discount

Security candidateMerge ElementsProject/elements#1593: Fix RPC return errors for psbt and invalid rangeproofsby merge-script · 4ddaefc8 · Sep 1, 2026 · 15 filesMessage 100 · StrongModerate 59Details

Commit message · merge-script

Merge ElementsProject/elements#1593: Fix RPC return errors for psbt and invalid rangeproofs

a9db3b1c1fce0288f47dac21915f9fceaaeb231a Add startup warning for signed-blocks parent chain (Tom Trevethan)
246c5ab63adb7c3a3f672992109e227ab668d096 Add virtual desctructor to CChainParams (Tom Trevethan)
779e71f545d82d706bd5bec083261dfa03c582ce PAK enforcement on confidential nAsset (Tom Trevethan)
ffd91c0512eddcb58b74489b3c07939470f3e79e PartiallySignedTransaction::SetupFromTx indexes vtxinwit checked (Tom Trevethan)
84a05e35aa94bf86b80b9e27ba4e25809068d666 check pubkey validity in tweakfedpegscript to prevent assert failure (Tom Trevethan)
3a8dec1258eceac38e110c20fd7b5d7a04d4c536 Return error for psbt if explicit amounts/assets deleted (Tom Trevethan)
4e5ca94f6b6ce0eecb7dc1fa65780d9a724f67bb Return error for invalid rangproof amounts (Tom Trevethan)

Pull request description:

Fixes for a number of issues with RPC errors for invalid PSBTs and amounts/rangeproofs.

ACKs for top commit:
delta1:
ACK a9db3b1c1fce0288f47dac21915f9fceaaeb231a; tested locally

Tree-SHA512: bf35348a5fad30e0f1f2b3caa2ec35ec521b583155e97f3a5f2504a3d70b41677f215fc01b28ccd30706ff5a7d021afb74c110a2c8f270942f5cba344544a55d

100/100 · StrongMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference

Why it was queued

signing boundaryconsensus or confidential-proof validationsigning or wallet pathmerge-commit duplicate discount

AI analysis · Moderate 59/100

This update fixes several ways that malformed transaction data could crash Elements nodes or trick wallet users into signing bad transactions. The main changes turn internal 'assert' crashes into proper error returns when creating confidential range proofs, add checks for missing or tampered PSBT output data, reject peg-in witness data that is the wrong size or badly encoded, enforce that peg-out outputs must not hide their asset type, and prevent a bad federation script from causing an assertion failure. One change also adds a startup warning about a known limitation with signed-blocks parent chains.

Security candidateMerge ElementsProject/elements#1592: blind/blindpsbt fixesby merge-script · 31e8f27f · Sep 1, 2026 · 9 filesMessage 91 · StrongHigh 72Details

Commit message · merge-script

Merge ElementsProject/elements#1592: blind/blindpsbt fixes

c26d719c29a40da280a825b25657e9c3d8bc7d99 fix: range proof cache bind to asset and scriptpubkey (Byron Hambly)
b0aba619b6ff2846617b285274a954e0404137f5 blindpsbt: return error instead of asserting on surjection proof failure (Byron Hambly)
f634a3a4635550b881d3db3376c42d614ea1d9b4 blindpsbt: reject off-curve blinding pubkey before ECDH (Byron Hambly)
066ecf6eb3bc54e6135d79864b969ac6ad84795e blindpsbt: refuse to blind a PSET output with no amount (Byron Hambly)
fef1a30b62374d06e29bc8617dcf415c37993ffa headerssync: retain Elements identity and proof fields (Byron Hambly)
bdedb12ee3996adab4959b63b51ccbe9575284bf dynafed: require at least four-fifths approval for parameter transition (Byron Hambly)
c7ec63c58312c4581c763f02f4aa31ef608e12a8 validation: always validate and retain dynafed header block_height (Byron Hambly)
34be37f34d25fde692d6c5559ee0ca13b1c48654 blindpsbt: require both range bounds to match claim in VerifyBlindValueProof (Byron Hambly)
6f1a51310b85e8072e7ffe0983b515a86f397411 blindpsbt: require genuine commitments in VerifyBlindValueProof (Byron Hambly)
a7a88214f740a23b49aec0a7b1125e03ac9227a4 blind: reject empty surjection-target set in SurjectOutput (Byron Hambly)

Pull request description:

Fixes a number of small issues picked up during LLM scans

ACKs for top commit:
tomt1664:
ACK c26d719c29a40da280a825b25657e9c3d8bc7d99 tested locally.

Tree-SHA512: f38aa278a313124665e3f135b210f09604277d7edfb6236bd74607fe9eaed13c2ce7eb606a63403accabe4b821ce80b230648870b06436529e7289eed2ea7ecc

91/100 · StrongMessage clarity

Why it was queued

signing boundarydefensive validationconsensus or confidential-proof validationsigning or wallet pathmerge-commit duplicate discount

AI analysis · High 72/100

This merge commit fixes several security and robustness bugs in Elements' confidential-transaction blinding code and in its dynamic-federated (dynafed) header handling. The most user-visible issues are in 'blindpsbt': malformed PSET inputs could previously crash the node (assertion failures), read memory out of bounds, or trick a verifier into accepting a wrong amount. Other changes stop a zero-input transaction from crashing during surjection-proof creation, make the range-proof cache depend on more data so it cannot return a wrong 'already verified' answer, and ensure dynafed block headers always carry and validate their height even when a legacy option is off. The pull request says the issues were 'picked up during LLM scans' and does not claim any are already exploited in the wild.

Security candidateMerge ElementsProject/elements#1576: Fix intermittent failure in feature_pegin_subsidy.pyby merge-script · bad8ca42 · Sep 1, 2026 · 2 filesMessage 96 · StrongInformational 15Details

Commit message · merge-script

Merge ElementsProject/elements#1576: Fix intermittent failure in feature_pegin_subsidy.py

45fd28fca72b19fcc2db9d5fa013aee16febf75b test: fix fedpeg test to work with bitcoind parent (Byron Hambly)
22bb277474e10d02a2a30ad0d02ab03f59762b23 test: fix pegin subsidy test to work with bitcoind parent (Byron Hambly)
c6692e16c724ce3854b9c34fb49c86e7a7d44ab5 Fix intermittent failure in feature_pegin_subsidy.py (Tom Trevethan)

Pull request description:

feature_pegin_subsidy.py has several assertions comparing the burn subsidy against hardcoded constants assumed fixed-length witness (t * 72 bytes per signature), but the actual subsidy is computed by the node from the parent-chain deposit transaction's real fee and vsize. DER-signature lengths on the parent-chain transaction vary by a byte or two causing a rare intermittent failure.

Replaced hardcoded subsidy values with a Python function that replicates `CheckPeginSubsidyAndMinimum`'s computation.

ACKs for top commit:
delta1:
ACK 45fd28fca72b19fcc2db9d5fa013aee16febf75b; tested locally

Tree-SHA512: 2d193f8617aa0812f3fa2fce18369e893658d2d81c0bf6063de3b4543b211ac17f9e518ac4598cd39cac8cda0423da52a23ea3dd64705116d0f8966e6368b3d5

96/100 · StrongMessage clarity

Why it was queued

signing boundarymerge-commit duplicate discount

AI analysis · Informational 15/100

Lower-priorityMerge ElementsProject/elements#1590: Fix interface_zmq.py functional testsby merge-script · 18c25e6b · Sep 1, 2026 · 2 filesMessage 91 · StrongTriage 0Details

Commit message · merge-script

Merge ElementsProject/elements#1590: Fix interface_zmq.py functional tests

665d873883192dacd67118580ad39c1c2a463c68 broaden the CMake guard for simplicity to also match Clang on any platform (Tom Trevethan)

Pull request description:

For the test-each-commit CI job:

Broaden the CMake guard from if(APPLE) to also match Clang on any platform, e.g. if(CMAKE_C_COMPILER_ID MATCHES "Clang") (this covers both Clang and AppleClang) for the elementssimplicity compilation.

Fix is_valid() in test framework for elements amounts, enabling interface_zmq.py to pass.

ACKs for top commit:
delta1:
ACK 665d873883192dacd67118580ad39c1c2a463c68; tested locally

Tree-SHA512: f255eb6ed5b19076793309fbdb54682871f16d2b127abc0c8d21855d7d2347582b246ac57e48997194d06dc9a8c98f6fb95c8d26a325cf6f61dbcb4750153596

91/100 · StrongMessage clarity

Why it was queued

merge-commit duplicate discount

Lower-priorityAdd startup warning for signed-blocks parent chainby Tom Trevethan · a9db3b1c · Sep 1, 2026 · 1 fileMessage 50 · ThinTriage 0Details

Commit message · Tom Trevethan

Add startup warning for signed-blocks parent chain

50/100 · ThinMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

Lower-priorityAdd virtual desctructor to CChainParamsby Tom Trevethan · 246c5ab6 · Sep 1, 2026 · 1 fileMessage 45 · ThinTriage 0Details

Commit message · Tom Trevethan

Add virtual desctructor to CChainParams

45/100 · ThinMessage clarity

✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

Lower-priorityPAK enforcement on confidential nAssetby Tom Trevethan · 779e71f5 · Sep 1, 2026 · 3 filesMessage 45 · ThinTriage 0Details

Commit message · Tom Trevethan

PAK enforcement on confidential nAsset

45/100 · ThinMessage clarity

✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

AI review queuedPartiallySignedTransaction::SetupFromTx indexes vtxinwit checkedby Tom Trevethan · ffd91c05 · Sep 1, 2026 · 2 filesMessage 50 · ThinModerate 60Details

Commit message · Tom Trevethan

PartiallySignedTransaction::SetupFromTx indexes vtxinwit checked

50/100 · ThinMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

Why it was queued

signing or wallet pathsecond-pass: security-sensitive path

AI analysis · Moderate 60/100

This commit hardens how Elements handles 'peg-in' transactions—transfers of assets from a parent blockchain into a sidechain. It adds size checks for witness data fields and wraps decoding in error handling so malformed inputs are rejected cleanly. It also fixes a place where the code could read past the end of an array when setting up a Partially Signed Transaction (PSBT). The changes are defensive: they prevent crashes or undefined behavior from bad transaction data, but they do not by themselves create new asset theft or remote-code-execution paths.

Lower-prioritycheck pubkey validity in tweakfedpegscript to prevent assert failureby Tom Trevethan · 84a05e35 · Sep 1, 2026 · 1 fileMessage 62 · AdequateTriage 0Details

Commit message · Tom Trevethan

check pubkey validity in tweakfedpegscript to prevent assert failure

62/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Explains rationale or failure mode! No meaningful explanatory body

Security candidateReturn error for psbt if explicit amounts/assets deletedby Tom Trevethan · 3a8dec12 · Sep 1, 2026 · 3 filesMessage 50 · ThinHigh 72Details

Commit message · Tom Trevethan

Return error for psbt if explicit amounts/assets deleted

50/100 · ThinMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

Why it was queued

signing boundarysigning or wallet path

AI analysis · High 72/100

This commit fixes a security bug in how the Elements wallet signs partially-signed Bitcoin transactions (PSBTs) for confidential (blinded) payments. Previously, a malicious counterparty could remove the plain-text amount and asset fields from a transaction output before asking the wallet to sign. The wallet would then unblind the output and blindly trust whatever hidden value the counterparty had committed to, potentially allowing the wallet to sign away funds without knowing the real amount or asset type. The patch now refuses to sign if those explicit fields are missing, and replaces internal 'this can never happen' crash assertions with proper error returns, because the transaction data comes from outside the wallet.

AI review queuedReturn error for invalid rangproof amountsby Tom Trevethan · 4e5ca94f · Sep 1, 2026 · 4 filesMessage 45 · ThinModerate 60Details

Commit message · Tom Trevethan

Return error for invalid rangproof amounts

45/100 · ThinMessage clarity

✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body

Why it was queued

signing or wallet pathsecond-pass: security-sensitive path

AI analysis · Moderate 60/100

This commit fixes a crash bug in the Elements blockchain wallet software. When creating a confidential (blinded) transaction, the code could hit an internal 'assert' and abort the program if it tried to generate a rangeproof for a zero-amount output sent to a normal spendable address. The patch turns those hard crashes into ordinary error returns, and adds an explicit early check that rejects zero-value spendable outputs before blinding. It also adds tests proving the boundary between valid and invalid cases. The change is defensive and improves robustness, but it is a partial patch: it does not add the same explicit zero-amount guard to the older BlindTransaction path, only to the newer PSBT blinding path.

Security candidateblindpsbt: return error instead of asserting on surjection proof failureby Byron Hambly · b0aba619 · Sep 1, 2026 · 1 fileMessage 73 · AdequateHigh 74Details

Commit message · Byron Hambly

blindpsbt: return error instead of asserting on surjection proof failure

CreateAssetSurjectionProof asserted on secp256k1_surjectionproof_generate
and _verify failure. A crafted PSET can supply unrelated tags/generators
with no known discrete-log relationship, causing generation to fail and the
assert to abort the process. Make these recoverable errors by returning
false.

73/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

Why it was queued

signing boundaryconsensus or confidential-proof validationsigning or wallet path

AI analysis · High 74/100

This commit fixes a denial-of-service bug in Elements' confidential asset handling. Previously, a malformed transaction file (PSET) could trigger a hard program crash (assert/abort) by feeding in mismatched cryptographic tags. The patch turns that crash into a normal, recoverable error so the process stays alive and simply rejects the bad input.

Security candidatevalidation: always validate and retain dynafed header block_heightby Byron Hambly · c7ec63c5 · Sep 1, 2026 · 2 filesMessage 73 · AdequateLow 48Details

Commit message · Byron Hambly

validation: always validate and retain dynafed header block_height

A dynafed header always serializes block_height as part of its identity
(CBlockHeader::Serialize/GetHash), independent of the legacy
-con_blockheightinheader option. Previously the height was only validated
in ContextualCheckBlockHeader and only reconstructed in
CBlockIndex/CDiskBlockIndex::GetBlockHeader when that option was on, so a
dynafed header with a mismatched height could be accepted, and a header
rebuilt from an accepted index no longer matched the accepted header's hash
when the option was off.

Validate and reconstruct block_height for all dynafed headers regardless of
the option. Non-dynafed headers keep the legacy option behaviour. This does
not change any consensus rule: the height was already part of every dynafed
header's hash.

73/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

Why it was queued

defensive validationconsensus or confidential-proof validation

AI analysis · Low 48/100

This patch fixes a bug in the Elements blockchain where dynamic-federation (dynafed) block headers could contain an incorrect block height and still be accepted, and where stored header records could be rebuilt with a different hash than the original accepted header. The fix ensures dynafed headers always validate and preserve their block height, even when an older compatibility option is turned off. It is a consistency and integrity fix rather than a change to consensus rules.

Security candidateblindpsbt: require genuine commitments in VerifyBlindValueProofby Byron Hambly · 6f1a5131 · Sep 1, 2026 · 1 fileMessage 73 · AdequateModerate 62Details

Commit message · Byron Hambly

blindpsbt: require genuine commitments in VerifyBlindValueProof

An explicit 9-byte value (or a null field) passed the IsNull() check and
its buffer was then parsed as a 33-byte Pedersen commitment, reading past
the end. Require IsCommitment() on both the value and asset fields so the
parser's length precondition holds and the out-of-bounds read is avoided.

73/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

Why it was queued

signing boundarysigning or wallet path

AI analysis · Moderate 62/100

This commit fixes a bug in the way confidential transaction value proofs are validated. Previously, the code accepted an explicit 9-byte value or an empty field where a 33-byte cryptographic commitment was expected. It then passed that shorter buffer to a library that always reads 33 bytes, causing it to read past the end of the data. The fix now requires both the value and asset fields to be genuine 33-byte commitments before handing them to the parser, preventing an out-of-bounds read.

Lower-priorityblind: reject empty surjection-target set in SurjectOutputby Byron Hambly · a7a88214 · Sep 1, 2026 · 1 fileMessage 73 · AdequateTriage 0Details

Commit message · Byron Hambly

blind: reject empty surjection-target set in SurjectOutput

The raw-blind RPC path can reach SurjectOutput with an empty
surjection_targets vector (a zero-input tx with multiple blindable
outputs), which indexed element [0] of the empty vector and passed it to
secp256k1_surjectionproof_initialize, triggering undefined behaviour.
Reject empty target sets up front, matching the existing over-limit guard.

73/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

Security candidatedynafed: require at least four-fifths approval for parameter transitionby Byron Hambly · bdedb12e · Sep 1, 2026 · 1 fileMessage 78 · AdequateModerate 60Details

Commit message · Byron Hambly

dynafed: require at least four-fifths approval for parameter transition

NextBlockIsParameterTransition computed the approval threshold as
(epoch_length*4)/5, which floor-divides. For epoch lengths not divisible by
5 this is below the intended at-least-four-fifths rule, so a transition
could pass with fewer than 80% of the epoch's blocks voting for it.

Use the overflow-safe ceiling N - N/5 (== ceil(N*4/5)). This is a no-op for
epoch lengths divisible by 5 (the only currently deployed case) and only
corrects the under-approximation for non-divisible epoch lengths.

78/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly

Why it was queued

memory safety

AI analysis · Moderate 60/100

This commit fixes a voting threshold bug in Elements' dynamic federation (dynafed) feature. The code was supposed to require at least 80% (four-fifths) of recent blocks to approve a change to federation parameters, but due to integer division rounding down, it could approve changes with slightly less than 80% support when the voting epoch length was not evenly divisible by 5. The fix changes the math so the threshold is always rounded up to the next whole number, ensuring the true 80% requirement is met. Currently deployed systems use epoch lengths divisible by 5, so this is a no-op for them, but it corrects the behavior for other configurations.

Security candidateblindpsbt: refuse to blind a PSET output with no amountby Byron Hambly · 066ecf6e · Sep 1, 2026 · 1 fileMessage 73 · AdequateModerate 62Details

Commit message · Byron Hambly

blindpsbt: refuse to blind a PSET output with no amount

BlindPSBT dereferenced output.amount without a nullopt check. A crafted v0
PSET output (m_blinder_index set, amount absent) reached the blinding loop
and dereferenced a disengaged std::optional, which is undefined behaviour.
Refuse such outputs with BlindingStatus::INVALID_BLINDER.

73/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

Why it was queued

signing boundarysigning or wallet path

AI analysis · Moderate 62/100

This commit fixes a crash/undefined-behavior bug in the Elements wallet's confidential-transaction blinding code. When processing a specially crafted Partially Signed Elements Transaction (PSET), the software would blindly use an output amount that might not exist, which can crash the program or cause unpredictable behavior. The fix now checks whether the amount is present and refuses to blind the output if it is missing.

Security candidateheaderssync: retain Elements identity and proof fieldsby Byron Hambly · fef1a30b · Sep 1, 2026 · 2 filesMessage 73 · AdequateModerate 63Details

Commit message · Byron Hambly

headerssync: retain Elements identity and proof fields

CompressedHeader kept only the Bitcoin PoW fields and GetFullHeader()
reconstructed only those. In the low-work headers presync/redownload path
Elements headers were therefore rebuilt without block_height, proof,
dynafed params, or the signblock witness, so the reconstructed header's hash
no longer matched what was received and the fields signed/dynafed validation
needs were dropped.

Retain block_height, proof, m_dynafed_params, and m_signblock_witness in
CompressedHeader and reconstruct them in GetFullHeader(). This enlarges the
per-header redownload buffer footprint (previously assumed to be 48 bytes);
the comment and static_assert are updated accordingly. No consensus rule
changes: the reconstructed header now matches the header that was received.

73/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

Why it was queued

consensus or confidential-proof validation

AI analysis · Moderate 63/100

This commit fixes a bug in how Elements nodes temporarily store block headers during initial sync. The node was stripping out Elements-specific fields (block height, proof, dynamic federation parameters, and signblock witness) when compressing headers for memory efficiency. When it later rebuilt the full header, those fields were missing, so the rebuilt header's hash no longer matched the original header that was received. This could cause sync failures or validation problems for Elements nodes, but it does not change any consensus rules.

Security candidateblindpsbt: reject off-curve blinding pubkey before ECDHby Byron Hambly · f634a3a4 · Sep 1, 2026 · 1 fileMessage 73 · AdequateModerate 62Details

Commit message · Byron Hambly

blindpsbt: reject off-curve blinding pubkey before ECDH

BlindPSBT passed the blinding pubkey straight to CKey::ECDH, whose only
validation is an assert on the peer key, so a crafted off-curve pubkey
(reaching IsBlinded() but failing IsFullyValid()) aborted the process.
Mirror the non-PSET path and return BlindingStatus::INVALID_BLINDER when the
pubkey is not fully valid.

73/100 · AdequateMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context

Why it was queued

signing boundarysigning or wallet path

AI analysis · Moderate 62/100

This commit fixes a crash bug in Elements' confidential-transaction blinding code for PSBTs (Partially Signed Bitcoin Transactions). A malformed, attacker-chosen 'blinding public key' that is not actually a valid point on the cryptographic curve could slip through earlier checks and reach a low-level ECDH key-exchange routine. That routine only had an internal assertion for validation, so the invalid key would trigger an assertion failure and abort the running process. The fix adds an explicit validity check and returns a controlled error instead of crashing.

Security candidateblindpsbt: require both range bounds to match claim in VerifyBlindValueProofby Byron Hambly · 34be37f3 · Sep 1, 2026 · 1 fileMessage 85 · StrongHigh 74Details

Commit message · Byron Hambly

blindpsbt: require both range bounds to match claim in VerifyBlindValueProof

A range-membership proof whose lower bound equalled the displayed PSET
amount was accepted even when the committed value was larger, because only
min_value was compared. Require both verified bounds to equal the claimed
amount so a proof can no longer understate an output's value.

85/100 · StrongMessage clarity

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode

Why it was queued

signing boundarysigning or wallet path

AI analysis · High 74/100

This commit fixes a bug in how Elements verifies confidential transaction value proofs. Previously, the software only checked the lower bound of a mathematical range proof against the amount shown in a transaction. That meant a proof could truthfully prove the hidden amount was at least the displayed value, while the actual hidden amount was larger. This could let someone understate the value of an output in a partially-signed transaction (PSET). The fix now requires both the lower and upper bounds to equal the claimed amount, turning the range proof into a proper equality proof.