EP
← All projectsElements Project

Elements

Consensus node software underlying Liquid and other Elements-based Bitcoin sidechains.

BitcoinBitcoin sidechainsCryptographic librariesNode implementationsActive incident
Repository coverage

116 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

34security candidates25second-pass queue59AI analyses
36commits · 30 days
47commits · 60 days
85commits · 180 days
115commits · 365 days
Backfill bands
Sep 7 → Mar 1129 seen5 candidatesComplete
Mar 11 → Jul 938 seen7 candidatesComplete
Jul 9 → Aug 82 seen0 candidatesComplete
Aug 8 → Sep 738 seen13 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

62/100 average clarity
26Strong · 80–100
32Adequate · 60–79
48Thin · 40–59
10Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Byron Hambly462227371
Tom Trevethan37414152
merge-script944191
Ruslan Kasheparov827042
Pablo Greco814045
ivanlele111058
Abdullah1738200057
nazarevsky101035
Pieter Wuille100091
Hennadii Stepanov100045
Russell O'Connor101068
fanquake100080
Analysis record

Published AI watches

Last scanned 40 minutes ago

Moderate 64 AI analysisMessage 91 · Strong
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Merge ElementsProject/elements#1604: [master] sigcache: harden range proof cache keys and add -norangeproofcache option

This commit fixes a cache-key collision bug in Elements' range-proof and surjection-proof validation caches. Previously, the cache key was built by simply concatenating raw bytes, so two different sets of inputs could accidentally produce …

Cache key collision resistance hardened by length-prefixing all fieldsSurjection-proof cache key now includes vTags, fixing a missing-input vulnerabilityNew runtime option to disable range-proof cache without recompilation
301acc64by merge-script+270−335 files
Vendor flagged security relevance
Informational 18 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

init: add -norangeproofcache startup option to disable range proof cache

This commit adds a new command-line option `-norangeproofcache` that lets node operators turn off an internal performance cache used when validating confidential transaction range proofs. It is a debug/test option, not a security fix. Ther…

No security-relevant signal in commit message or diffNew debug/test startup option onlyNo validation logic change; only cache lookup/store paths are bypassed
53167b1fby Byron Hambly+13−52 files
No security note in commit
Moderate 68 AI analysisMessage 83 · Strong
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

sigcache: harden proof cache keys with length-prefixed hashing

This commit fixes a cache-key collision bug in Elements' proof verification caches. Previously, the cache key for range proofs and surjection proofs was built by simply concatenating raw bytes, so two different sets of inputs could acciden…

Cache-key collision in proof verification cache could allow bypass of cryptographic verificationRaw concatenation of variable-length fields in cache-key constructionMissing input (vTags) in surjection-proof cache key
b0a27528by Byron Hambly+92−282 files
Vendor flagged security relevance
Moderate 59 AI analysisMessage 100 · Strong
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Merge ElementsProject/elements#1593: Fix RPC return errors for psbt and invalid rangeproofs

This update fixes several ways that malformed transaction data could crash Elements nodes or trick wallet users into signing bad transactions. The main changes turn internal 'assert' crashes into proper error returns when creating confiden…

assert-to-error conversion in rangeproof generationPSBT explicit output data now required before signing blinded outputspeg-in witness stack length and deserialization hardening
4ddaefc8by merge-script+221−4515 files
No security note in commit
High 72 AI analysisMessage 91 · Strong
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Merge ElementsProject/elements#1592: blind/blindpsbt fixes

This merge commit fixes several security and robustness bugs in Elements' confidential-transaction blinding code and in its dynamic-federated (dynafed) header handling. The most user-visible issues are in 'blindpsbt': malformed PSET inputs…

Replacement of assertion failures with recoverable error returns in attacker-influenced PSET blinding pathsOut-of-bounds read prevention by requiring 33-byte Pedersen commitments before passing buffers to libsecp256k1Range-proof equality verification now checks both min and max bounds, closing a proof-forgery window
31e8f27fby merge-script+86−189 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 96 · Strong
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Merge ElementsProject/elements#1576: Fix intermittent failure in feature_pegin_subsidy.py

This commit only updates test scripts to fix flaky automated tests. It changes how test code calculates expected pegin subsidy values and how test nodes bind to network ports when using Bitcoin Core as a parent chain. No production node co…

No changes to production source codeChanges limited to test/functional/ Python test scriptsTest assertion hardening: dynamic subsidy computation instead of hardcoded constants
bad8ca42by merge-script+154−382 files
No security note in commit
Moderate 60 AI analysisMessage 50 · Thin
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

PartiallySignedTransaction::SetupFromTx indexes vtxinwit checked

This commit hardens how Elements handles 'peg-in' transactions—transfers of assets from a parent blockchain into a sidechain. It adds size checks for witness data fields and wraps decoding in error handling so malformed inputs are rejected…

Out-of-bounds array access fixed in PSBT peg-in setupMissing length validation added for pegin witness stack elementsException handling added around deserialization of pegin witness components
ffd91c05by Tom Trevethan+57−332 files
No security note in commit
High 72 AI analysisMessage 50 · Thin
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Return error for psbt if explicit amounts/assets deleted

This commit fixes a security bug in how the Elements wallet signs partially-signed Bitcoin transactions (PSBTs) for confidential (blinded) payments. Previously, a malicious counterparty could remove the plain-text amount and asset fields f…

Missing input validation on attacker-controlled PSBT dataBlinding proof verification relied on explicit fields that could be omitted by a counterpartyAssertions replaced with safe error returns for off-host data
3a8dec12by Tom Trevethan+18−73 files
No security note in commit
Moderate 60 AI analysisMessage 45 · Thin
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

Return error for invalid rangproof amounts

This commit fixes a crash bug in the Elements blockchain wallet software. When creating a confidential (blinded) transaction, the code could hit an internal 'assert' and abort the program if it tried to generate a rangeproof for a zero-amo…

Removal of assert() on cryptographic operation result in transaction blinding codeConversion of abort-on-failure into error-return for rangeproof generation failuresNew explicit validation rejecting zero-amount spendable outputs in PSBT blinding
4e5ca94fby Tom Trevethan+99−54 files
No security note in commit
High 74 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: return error instead of asserting on surjection proof failure

This commit fixes a denial-of-service bug in Elements' confidential asset handling. Previously, a malformed transaction file (PSET) could trigger a hard program crash (assert/abort) by feeding in mismatched cryptographic tags. The patch tu…

assert-to-error conversiondenial-of-service vector from untrusted PSET inputsurjection proof failure on attacker-chosen tags/generators
b0aba619by Byron Hambly+9−21 file
Vendor flagged security relevance
Moderate 62 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: refuse to blind a PSET output with no amount

This commit fixes a crash/undefined-behavior bug in the Elements wallet's confidential-transaction blinding code. When processing a specially crafted Partially Signed Elements Transaction (PSET), the software would blindly use an output am…

Undefined behavior from dereferencing a disengaged std::optionalMissing input validation on optional PSET fieldPotential denial-of-service/crash via crafted PSET
066ecf6eby Byron Hambly+8−01 file
Vendor flagged security relevance
Moderate 63 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

headerssync: retain Elements identity and proof fields

This commit fixes a bug in how Elements nodes temporarily store block headers during initial sync. The node was stripping out Elements-specific fields (block height, proof, dynamic federation parameters, and signblock witness) when compres…

Header integrity loss in sync path: reconstructed header hash would not match received headerLoss of proof and signblock witness data needed for signed/dynafed validationPotential denial-of-service via sync failure or validation rejection of otherwise valid headers
fef1a30bby Byron Hambly+26−32 files
No security note in commit
High 74 AI analysisMessage 85 · Strong
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: require both range bounds to match claim in VerifyBlindValueProof

This commit fixes a bug in how Elements verifies confidential transaction value proofs. Previously, the software only checked the lower bound of a mathematical range proof against the amount shown in a transaction. That meant a proof could…

Understated output values in PSET blind value proofsIncomplete range-proof bound verificationConfidential transaction amount mismatch risk
34be37f3by Byron Hambly+5−11 file
Vendor flagged security relevance
Low 48 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

validation: always validate and retain dynafed header block_height

This patch fixes a bug in the Elements blockchain where dynamic-federation (dynafed) block headers could contain an incorrect block height and still be accepted, and where stored header records could be rebuilt with a different hash than t…

Header hash mismatch between accepted and reconstructed dynafed headers when legacy option disabledMissing height validation for dynafed headers when -con_blockheightinheader option is offPotential for accepting dynafed headers with incorrect block_height
c7ec63c5by Byron Hambly+12−32 files
No security note in commit
Moderate 62 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: reject off-curve blinding pubkey before ECDH

This commit fixes a crash bug in Elements' confidential-transaction blinding code for PSBTs (Partially Signed Bitcoin Transactions). A malformed, attacker-chosen 'blinding public key' that is not actually a valid point on the cryptographic…

Off-curve / invalid elliptic-curve public key reaches ECDHAssertion abort (DoS / process termination) via crafted inputMissing input validation in PSBT blinding path compared to non-PSBT path
f634a3a4by Byron Hambly+7−01 file
Vendor flagged security relevance
Moderate 60 AI analysisMessage 78 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

dynafed: require at least four-fifths approval for parameter transition

This commit fixes a voting threshold bug in Elements' dynamic federation (dynafed) feature. The code was supposed to require at least 80% (four-fifths) of recent blocks to approve a change to federation parameters, but due to integer divis…

Consensus threshold under-approximation due to integer floor divisionPotential for dynafed parameter transition with less than intended 80% block approvalOverflow-safe ceiling formula used as remediation
bdedb12eby Byron Hambly+5−21 file
Vendor flagged security relevance
Moderate 62 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

blindpsbt: require genuine commitments in VerifyBlindValueProof

This commit fixes a bug in the way confidential transaction value proofs are validated. Previously, the code accepted an explicit 9-byte value or an empty field where a 33-byte cryptographic commitment was expected. It then passed that sho…

Out-of-bounds read in cryptographic proof verificationInsufficient input validation before passing buffer to libsecp256k1Confidential value/asset commitment type confusion
6f1a5131by Byron Hambly+5−11 file
Vendor flagged security relevance
Informational 12 AI analysisMessage 95 · Strong
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

test: assert wallet default commits rangeproofs post-dynafed

This commit only adds a new test to the project's test suite. It checks that the wallet's default signing behavior correctly includes (or excludes) a special 'rangeproof' flag depending on whether a network upgrade called 'dynafed' is acti…

Adds functional test coverage for SIGHASH_RANGEPROOF default behaviorVerifies pre-dynafed wallet default does not set SIGHASH_RANGEPROOF bitNo modification to signing, consensus, or mempool code
a1aacfaaby Byron Hambly+45−01 file
No security note in commit
Moderate 64 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

wallet: default to rangeproof-committing sighash when dynafed active

This commit changes the Elements wallet so that, when a newer consensus feature called 'DynaFed' is active, any transaction the wallet signs without an explicit signature mode will automatically include the transaction's confidential outpu…

Fixes a known malleability vector: pre-Taproot rangeproof/witness malleabilityChanges wallet default sighash only when dynafed is activeDoes not override explicit user sighash choices
ce342f58by Byron Hambly+12−33 files
Vendor flagged security relevance
Low 33 AI analysisMessage 73 · Adequate
EP Elements ProjectElements BitcoinBitcoin sidechainsCryptographic librariesNode implementations

rpc: default raw signing to rangeproof-committing sighash when dynafed active

This commit changes how the Elements blockchain software creates and checks digital signatures for raw transactions. Once a network upgrade called 'dynafed' is active, the software now defaults to a signature type that also commits to conf…

New consensus-relevant sighash default gated by dynafed activationVerification flag added to accept previously rejected signature typeRaw transaction signing behavior change for RPC callers
f5e2b1f5by Byron Hambly+27−84 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidaterpc: fix fields describtion in man in 'decodepsbt'by Ruslan Kasheparov · 91ae0e92 · Jun 24, 2026 · 1 fileMessage 50 · ThinInformational 19Details
Commit message · Ruslan Kasheparov

rpc: fix fields describtion in man in 'decodepsbt'

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 19/100

This commit corrects the help text for the decodepsbt RPC command. It changes the documented return type from an array of input indexes to a simple true/false flag, matching what the code actually returns. There is no code behavior change and no security impact.

Security candidateUpdate src/secp256k1 to latest BlockstreamResearch/secp256k1-zkp masterby Tom Trevethan · 60fba755 · Jun 17, 2026 · 159 filesMessage 50 · ThinLow 44Details
Commit message · Tom Trevethan

Update src/secp256k1 to latest BlockstreamResearch/secp256k1-zkp master

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
AI analysis · Low 44/100

This commit updates the embedded secp256k1-zkp cryptographic library inside the Elements project to the latest master from BlockstreamResearch. It is a large, routine dependency refresh touching build scripts, CI configuration, and many source files. The commit itself does not describe any specific security bug fix, and the visible changes are mostly build/CI modernization plus upstream synchronization. Because it is a wholesale submodule-style update, it could silently include upstream security fixes, but the provided diff does not identify any particular vulnerability or CVE.

Security candidateset Wno-error for simplicity keep warning but dont error on itby Tom Trevethan · 13398037 · Jun 17, 2026 · 33 filesMessage 91 · StrongLow 25Details
Commit message · Tom Trevethan

set Wno-error for simplicity keep warning but dont error on it

fuzz test fixes

set -DPRODUCTION for simplicity in fuzz tests

set UNDEBUG for simplicity in fuzz tests

update wallet fuzz tests

update test script

fix msvc conversion issues

more msvc vector conversion fixes and substitution of boost libs

fix more hexstr calls

fix hexstr calls in init.cpp

default CMAKE_GENERATOR to Unix Makefiles

more span fixes

specify build bin directory

fix executable locations

fix fuzz tests for c11 and functional test fixes

fix fuzz test executable path

specify legacy wallet for elements functional tests

remove assertion for static initialization order issue

use elements fuzz corpus

print debug log on failure

use heap for blind and asset_blind

test: avoid disk space warning for non-regtest

feature_config_args.py incorrectly assumed that its testnet4 node
would not log a disk space warning.

0683b8ebf33386d5c05140df89df10b1853d7c7e increased m_assumed_blockchain_size
on testnet4 from 1 to 11 GiB which triggers this bug on more
systems, e.g. a RAM disk.

Prevent the warning by setting -prune for these nodes.

Fix the same issue in feature_signet.py

Github-Pull: #32057
Rebased-From: 20fe41e9e83d510fd467f5a999d55a614b16ef89

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
fuzzing or regression evidenceseed or entropy pathsigning or wallet path
AI analysis · Low 25/100

This commit is a large maintenance patch for the Elements blockchain project. It mainly fixes build and test problems introduced by a recent upstream Bitcoin merge: compiler warnings became errors, fuzz tests used the wrong transaction format, Windows/MSVC builds failed, and some functional tests assumed too much disk space. The only directly user-visible runtime change is replacing a risky fixed-size on-stack array in transaction blinding code with a heap-allocated vector, which removes a potential stack-overflow/crash path when handling very large transactions. Most other changes are build-system, CI, or test-only adjustments.

Security candidateMerge 8cb6ab0b97 into merged_master (Bitcoin PR bitcoin/bitcoin#32025)by ivanlele · c1820ce4 · Apr 16, 2026 · 3195 filesMessage 58 · ThinInformational 15Details
Commit message · ivanlele

Merge 8cb6ab0b97 into merged_master (Bitcoin PR bitcoin/bitcoin#32025)

58/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Why it was queued
cryptography-sensitive pathseed or entropy pathsigning or wallet pathboot or update pathauthentication pathparser or protocol pathmerge-commit duplicate discount
AI analysis · Informational 15/100

This commit is a massive merge of upstream Bitcoin Core changes into the Elements repository. It adds or replaces thousands of files covering the build system, CI configuration, documentation, tests, and source code. There is no specific security fix or vulnerability patch visible in the supplied materials; it appears to be a routine upstream synchronization.

Security candidateDecomposePeginWitness: fix deserialization flags for MerkleBlock proofby Byron Hambly · f3b63f4b · Jan 15, 2026 · 1 fileMessage 95 · StrongLow 27Details
Commit message · Byron Hambly

DecomposePeginWitness: fix deserialization flags for MerkleBlock proof

In CreatePeginWitnessInner, the MerkleBlock is always serialized without
witness: PROTOCOL_VERSION | SERIALIZE_TRANSACTION_NO_WITNESS

In DecomposePeginWitness before this change, the MerkleBlock was
deserialized with witness: PROTOCOL_VERSION

This was only noticed as an issue in the pegin subsidy implementation,
in a failure in the feature_dynafed functional test. In the
test_transition_mempool_eject test case, the Merkle block proof is coming
from the same chain where we are creating a pegin.

See the comment: "hack: since we're not validating peg-ins in parent chain,
just make both the funding and claim tx on same chain (printing money)"

I haven't investigated enough to explain why this causes a
deserialization failure in this specific case, but presumably this change
is correct since we're always serializing without witness. Before this
DecomposePeginWitness was only used in src/psbt.cpp

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing boundary
AI analysis · Low 27/100

This commit fixes a mismatch in how a Merkle block proof is unpacked inside a 'pegin' (a transaction that moves coins from a parent blockchain into this Elements sidechain). The proof was being read as if it might contain witness data, but it is always written without witness data. This mismatch could cause the proof to fail to decode in some situations, which could break peg-in validation or processing.

Security candidateSquashed 'src/simplicity/' changes from 6d503ea4f8..49b96499a6by Byron Hambly · 87c0b44f · Jan 12, 2026 · 121 filesMessage 83 · StrongInformational 22Details
Commit message · Byron Hambly

Squashed 'src/simplicity/' changes from 6d503ea4f8..49b96499a6

49b96499a6 Replace Bitcoin Relative Timelock Jets
89ddb43eed Mark depricated parts of the TxEnv as obsolete
ff5d6fe4f7 Deprecate Broken Jets
ae008201ac Test Bitcoin jet deserialization
e81b68f197 Add GenPrimitive --bitcoin option
7887d16f24 Bitcoin specific fee jets
68603073b3 Bitcoin specific environment
ae3287e60f Refactor Makefile
99e3804e2d C: replace string initializations with arrays
c3dd9331cd Allow building on non-intel systems

git-subtree-dir: src/simplicity
git-subtree-split: 49b96499a6bb93b31d2f712fc1d4524f341ae640

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
cryptography-sensitive pathparser or protocol path
AI analysis · Informational 22/100

This is a large subtree update that imports a newer version of the Simplicity library into the Elements project. The visible changes add Bitcoin-specific jets (pre-built functions), transaction environment handling, and build files. There is no direct evidence in the commit message or diff that this fixes a known security vulnerability; it reads as a feature and maintenance update. However, any change to cryptographic/transaction code deserves careful review because bugs here could affect how transaction scripts are validated.

Security candidatedocs: add simplicity code update instructionsby Byron Hambly · 73d1e521 · Jan 12, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Byron Hambly

docs: add simplicity code update instructions

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
boot or update pathdocumentation-only discount
AI analysis · Informational 15/100

This commit only adds a new documentation file explaining how developers can update the Simplicity C code subtree in the Elements repository. It contains no code changes, no configuration changes, and no executable logic. There is no security-relevant change to the software itself.

Security candidateci(windows): pin jom to 1.1.2by Byron Hambly · 656ad6d1 · Jan 9, 2026 · 1 fileMessage 57 · ThinInformational 15Details
Commit message · Byron Hambly

ci(windows): pin jom to 1.1.2

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
access control
AI analysis · Informational 15/100

This commit changes a single line in the project's Windows CI configuration. It pins the version of 'jom'—a build tool used during automated Windows builds—to a specific release (1.1.2) instead of always downloading the latest version. There is no direct evidence in the commit or supplied references that this fixes a security vulnerability. It appears to be a build reliability or reproducibility change.

Security candidateAdd GPG key for release signingby Pablo Greco · 4465853a · Nov 10, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Pablo Greco

Add GPG key for release signing

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 15/100

This commit simply adds a new GPG public key file used to verify official release signatures. It is a routine trust/key-management addition with no code changes and no direct security vulnerability.