CommitWatch RSS
BC
← All projectsBitcoin Core

libsecp256k1

High-assurance secp256k1 elliptic-curve library used throughout the Bitcoin ecosystem.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

176 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

48security candidates5second-pass queue14AI analyses
50commits · 30 days
69commits · 60 days
94commits · 180 days
176commits · 365 days
Backfill bands
Aug 5 → Feb 682 seen1 candidatesComplete
Feb 6 → Jun 625 seen2 candidatesComplete
Jun 6 → Jul 619 seen1 candidatesComplete
Jul 6 → Aug 548 seen1 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
39Strong · 80–100
76Adequate · 60–79
58Thin · 40–59
3Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Sebastian Falbesoner39155065
Hennadii Stepanov4561064
Tim Ruffing2260055
furszy1341087
josibake942066
Lőrinc1332077
kevkevinpal620064
John Moffett421069
copilot-swe-agent[bot]320074
Jonas Nick710053
merge-script210091
gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf211078
Analysis record

Published AI watches

Last scanned 48 minutes ago

Informational 17 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

recovery: check exhaustive API results

This commit tightens a test suite for the secp256k1 cryptographic library. It adds checks to ensure that recoverable signing and signature conversion succeed before using their outputs. It does not change the library's actual signing or ve…

defensive test-hardening onlyno change to cryptographic implementationno change to signature parsing, verification, or recovery logic
1d3f72d3by Lőrinc+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 83 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

ellswift: check test operation results

This commit fixes test code for the EllSwift module so that it actually checks whether encoding, decoding, and public-key loading operations succeed before using their outputs. Previously the tests silently ignored failure return values, w…

Missing return-value checks in cryptographic test codePotential silent test failures in EllSwift encode/decode roundtrip testsPotential silent test failures in public-key load operations
564afb0bby Lőrinc+10−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

tests: add constant time tests

This commit only adds new test code. It extends the project's constant-time test suite to also exercise the silent payments module, ensuring that secret key material is not accidentally leaked through timing side channels during those oper…

Adds constant-time (side-channel) test coverage for the silent payments moduleUses memory-secret marking macros (SECP256K1_CHECKMEM_UNDEFINE/DEFINE) to detect secret-dependent branchesNo functional or cryptographic code changes
936907b0by josibake+78−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 41 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

silentpayments: sending

This commit adds a new feature to the secp256k1 cryptographic library: the sender-side logic for Bitcoin Silent Payments (BIP352). It lets a wallet create special one-time payment addresses for recipients without revealing which recipient …

New feature implementation for BIP352 Silent Payments sender sideExtensive input validation (ARG_CHECK) and test coverage for malformed keys and bad argumentsSensitive intermediate values (shared secrets, scalars) are explicitly cleared
b30ea3ebby josibake+719−14 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 100 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks)

This is a defensive code cleanup in a Bitcoin cryptography library. It introduces a helper function that wraps a common three-step pattern when multiplying by the generator point, ensuring that temporary sensitive Jacobian coordinate data …

New helper ensures intermediate Jacobian coordinates are always cleared after generator multiplicationCommit message states goal is to prevent accidental gej leaks of secret scalar informationRefactors existing call sites in ECDSA sign, Schnorr sign, pubkey creation, and blinding setup
a3296d5eby Sebastian Falbesoner+14−165 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

doc: correct API docs for ECDSA signing out-params (s/array/signature object/)

This commit only fixes wording in the API documentation comments. It changes the description of a function output parameter from 'pointer to an array' to 'pointer to a signature object' in two header files. No actual code behavior changed,…

40a0d874by Sebastian Falbesoner+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 73 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

musig: always clear out secret key in `secp256k1_musig_nonce_gen_counter`

This is a small defensive cleanup in Bitcoin Core's libsecp256k1 MuSig code. The function that generates a cryptographic nonce could, in rare error cases, leave a temporary copy of the user's secret key in memory instead of wiping it. The …

secret-key material left uncleared on an error pathuse of explicit memory clearing (`secp256k1_memclear_explicit`) added to failure pathMuSig nonce generation function
8479eafaby Sebastian Falbesoner+2−41 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 76 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

util: introduce and use `ARRAY_SIZE` macro

This commit is a simple code cleanup: it introduces a standard ARRAY_SIZE macro and replaces repeated manual array-size calculations with that macro. It does not change any behavior, fix any bug, or alter any security-sensitive logic. Ther…

921b9711by Sebastian Falbesoner+42−388 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 100 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

ellswift: fix overflow flag handling in secp256k1_ellswift_xdh

This commit fixes a bug in the ElligatorSwift-based ECDH key exchange function. The function was supposed to reject secret keys that are invalid (zero or greater than or equal to the curve order), but due to a one-character bug it only che…

Cryptographic secret-key validation bypassSilent modular reduction instead of rejection for out-of-range secretsInconsistency with documented/referenced ECDH overflow handling
307b49f1by gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 72 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

test: add unit tests for secp256k1_scalar_check_overflow

This commit only adds new unit tests for an existing internal function that checks whether a number has overflowed the secp256k1 group order. It does not change any production code, cryptographic logic, or behavior that could affect users.…

f47bbc07by Rohit Yadav+50−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 100 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

refactor: remove unnecessary `malloc` result casts

This commit is a straightforward code cleanup: it removes unnecessary type casts in front of memory allocation calls like malloc. In modern C, casting the result of malloc is not needed and is generally discouraged. The change does not alt…

97b3c478by Sebastian Falbesoner+17−173 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 91 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

ci, docker: Fix LLVM repository signature failure

This commit changes a CI Docker build script so that an older SHA-1-based PGP signature from the LLVM apt repository is still accepted. It is a build-infrastructure workaround, not a change to the secp256k1 cryptographic code, and it does …

Configuration relaxation of PGP signature policy in CI environmentUse of SHA-1 signature algorithm whitelisted by date extensionBuild-infrastructure-only change with no effect on shipped library
0ffb1749by Hennadii Stepanov+3−01 file
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

Add VERIFY_CHECKs that flags are 0 or 1

This commit adds safety checks and documentation to ensure that 'flag' values used in secret-handling code are exactly 0 or 1, not just any 'true' value. These flags control constant-time selection and memory wiping. If a caller passed a d…

constant-time masking invariant enforcementVERIFY_CHECK hardening for secret-dependent flag valuesdocumentation update clarifying 0/1 flag contract
ae00c552by John Moffett+30−811 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 95 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

test: introduce (mini) unit test framework

This commit is a pure test-infrastructure change. It introduces a small internal unit-test framework for the secp256k1 cryptographic library, replacing a long hand-written main() function with a registry of test cases and adding optional p…

48789dafby furszy+674−1436 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritySECURITY.md: remove Jonas Nick from trusted keysby Jonas Nick · 21645c03 · Jun 29, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · Jonas Nick

SECURITY.md: remove Jonas Nick from trusted keys

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityscalar: correct `_scalar_get_bits_{limb32,var}` input condition docsby Sebastian Falbesoner · 6a599a44 · Jun 26, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Sebastian Falbesoner

scalar: correct `_scalar_get_bits_{limb32,var}` input condition docs

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityfield: correct fe_equal's b magnitude boundby Lőrinc · 994b3501 · Jun 25, 2026 · 3 filesMessage 83 · StrongTriage 0Details
Commit message · Lőrinc

field: correct fe_equal's b magnitude bound

`secp256k1_fe_equal` negates `a` before adding `b`.
That gives the temporary value magnitude 2, and the following field addition requires the input magnitudes to sum to at most 32.
So the largest `b` magnitude the implementation can accept is 30, not 31.

Lower the documented and checked bound for `b` to 30.
Adjust the focused test to use random field elements with randomized magnitudes within the accepted `a <= 1` and `b <= 30` bounds.

Co-authored-by: Sebastian Falbesoner <sebastian.falbesoner@gmail.com>
Co-authored-by: Tim Ruffing <me@real-or-random.org>

83/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Lower-prioritytests: Fix GCC 17 snapshot warningby Tim Ruffing · 9d75769d · Jun 25, 2026 · 1 fileMessage 78 · AdequateTriage 0Details
Commit message · Tim Ruffing

tests: Fix GCC 17 snapshot warning

Passing a non-malloc pointer to free() would be UB. In this case, the
free() line is never actually reached (and GCC 17 fails to prove this)
in a correct implementation of secp256k1_scratch_space_destroy(), but
the test shouldn't rely on the correctness of the tested function.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-priorityci: add 'brew trust' invocation to macOS CIby fanquake · 66260b78 · Jun 25, 2026 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · fanquake

ci: add 'brew trust' invocation to macOS CI

Should fix issues like:

> Error: Refusing to load formula louisbrunner/valgrind/valgrind from untrusted tap louisbrunner/valgrind.
> Run `brew trust --formula louisbrunner/valgrind/valgrind` or `brew trust louisbrunner/valgrind` to trust it.
> Error: Process completed with exit code 1.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
Security candidateinclude: Remove SECP256K1_GNUC_PREREQ macroby copilot-swe-agent[bot] · dba4d937 · Jun 17, 2026 · 1 fileMessage 63 · AdequateTriage 15Details
Commit message · copilot-swe-agent[bot]

include: Remove SECP256K1_GNUC_PREREQ macro

The macro is no longer used anywhere in the codebase. This is
technically a breaking change, but it's not expected any user code
actually uses this macro.

Co-authored-by: Tim Ruffing <me@real-or-random.org>

63/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
cryptography-sensitive path
Security candidateUse __GNUC__ instead of SECP256K1_GNUC_PREREQby copilot-swe-agent[bot] · 09870e9c · Jun 17, 2026 · 2 filesMessage 85 · StrongTriage 15Details
Commit message · copilot-swe-agent[bot]

Use __GNUC__ instead of SECP256K1_GNUC_PREREQ

Replace all SECP256K1_GNUC_PREREQ version checks with plain
defined(__GNUC__) checks, since the macro was only used for ancient GCC
versions that are no longer worth supporting individually. Moreover, the
macro was misleading because Clang claims to be GCC 4.2 by default.

All GCC versions that we reasonably support have the features previously
gated behind these checks (__inline__, __builtin_expect, __restrict__,
__warn_unused_result__, __nonnull__, and the __builtin_ctz* family).

Co-authored-by: Tim Ruffing <me@real-or-random.org>

85/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Names security-relevant behavior explicitly
Why it was queued
cryptography-sensitive path
Lower-priorityhash: Include secp256k1.h directlyby copilot-swe-agent[bot] · ae075d7c · Jun 17, 2026 · 2 filesMessage 73 · AdequateTriage 0Details
Commit message · copilot-swe-agent[bot]

hash: Include secp256k1.h directly

Move the #include "../include/secp256k1.h" from src/util.h to
src/hash.h, which is the file that actually depends on the
secp256k1_sha256_compression_function type defined there.

Co-authored-by: Tim Ruffing <me@real-or-random.org>

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Lower-priorityfield: force-inline 5x52 mul and sqrby Lőrinc · 71fcd841 · Jun 15, 2026 · 4 filesMessage 78 · AdequateTriage 8Details
Commit message · Lőrinc

field: force-inline 5x52 mul and sqr

The 5x52 field multiplication and squaring routines are hot in group arithmetic and scalar multiplication.

Use the new `SECP256K1_FORCE_INLINE` for the thin wrappers and `int128` inner helpers so compilers can schedule the 64x64->128 arithmetic without a call boundary.

Across the measured GCC and MSVC Release builds, this improves ECDSA verification by 0.6% to 9.1%, ECDH by 0.7% to 9.3%, and Schnorr verification by 0.6% to 9.6%.

The direct field benchmarks generally show the intended effect on field squaring and multiplication, while Clang results are mostly flat and less consistently positive.

This is a code-size tradeoff: the tested static library builds grew by about 4.6% to 4.7%, and the tested Windows Release DLL grew by 14.1%.

Co-authored-by: Sebastian Falbesoner <sebastian.falbesoner@gmail.com>
Co-authored-by: Hennadii Stepanov <32963518+hebasto@users.noreply.github.com>
Co-authored-by: Tim Ruffing <crypto@timruffing.de>

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validation
Lower-prioritytest: enable -Wunused-function in test suite (Fix #1831)by kallal79 · a77dacad · Jun 12, 2026 · 4 filesMessage 80 · StrongTriage 0Details
Commit message · kallal79

test: enable -Wunused-function in test suite (Fix #1831)

80/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
Lower-prioritytest: add unit test for `_ecmult_gen_ge`by Sebastian Falbesoner · 2ee79e77 · Jun 11, 2026 · 1 fileMessage 67 · AdequateTriage 0Details
Commit message · Sebastian Falbesoner

test: add unit test for `_ecmult_gen_ge`

67/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritytest: musig: fix dead "aggnonce encodes two points at infinity" checkby Sebastian Falbesoner · d7125e51 · Jun 9, 2026 · 1 fileMessage 72 · AdequateTriage 0Details
Commit message · Sebastian Falbesoner

test: musig: fix dead "aggnonce encodes two points at infinity" check

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Lower-prioritycmake: Fix shared library versioning on OpenBSDby Hennadii Stepanov · 1eab7572 · Jun 9, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Hennadii Stepanov

cmake: Fix shared library versioning on OpenBSD

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritycmake: Fix shared library versioning on NetBSDby Hennadii Stepanov · a401c514 · Jun 9, 2026 · 1 fileMessage 45 · ThinTriage 0Details
Commit message · Hennadii Stepanov

cmake: Fix shared library versioning on NetBSD

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritycmake, refactor: Improve documenting in `SetLibtoolAbiVersion` moduleby Hennadii Stepanov · 8a0f4002 · Jun 9, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Hennadii Stepanov

cmake, refactor: Improve documenting in `SetLibtoolAbiVersion` module

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritycmake, refactor: Introduce `SetLibtoolAbiVersion` moduleby Hennadii Stepanov · acf2084a · Jun 9, 2026 · 2 filesMessage 50 · ThinTriage 0Details
Commit message · Hennadii Stepanov

cmake, refactor: Introduce `SetLibtoolAbiVersion` module

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritytest: refactor: simplify tests by using `_ecmult_gen_ge` helperby Sebastian Falbesoner · ca68daf8 · Jun 8, 2026 · 2 filesMessage 100 · StrongTriage 0Details
Commit message · Sebastian Falbesoner

test: refactor: simplify tests by using `_ecmult_gen_ge` helper

If the generator point multiplication result in Jacobian coordinates is
immediately converted to affine coordinates after and is not needed for
anything else, we can deduplicate by using the helper introduced in #1861.

Note that in a very strict sense this is not a refactor, as the Jacobian
object is now cleared out which was not done on master, but for the logic
in the tests this shouldn't matter at all.

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Lower-priorityrefactor: rename `_ecmult_gen` -> `_ecmult_gen_gej` for consistencyby Sebastian Falbesoner · 9e017e50 · Jun 7, 2026 · 6 filesMessage 85 · StrongTriage 0Details
Commit message · Sebastian Falbesoner

refactor: rename `_ecmult_gen` -> `_ecmult_gen_gej` for consistency

Now that we have a function `_ecmult_gen_ge`, it makes sense to rename
the existing function `_ecmult_gen` to `_ecmult_gen_gej` for
consistency, to signal that the result is a Jacobian group element.

This diff was created by applying
```
$ sed -i s/secp256k1_ecmult_gen\(/secp256k1_ecmult_gen_gej\(/g $(git ls-files)
```

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Security candidaterefactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks)by Sebastian Falbesoner · a3296d5e · Jun 7, 2026 · 5 filesMessage 100 · StrongLow 36Details
Commit message · Sebastian Falbesoner

refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks)

Scalar multiplication with the generator point frequently involves a
conversion to affine coordinates and clearing out the temporary Jacobian
group element object after to avoid leaking secret key material, i.e.
executing the following three steps:
- secp256k1_ecmult_gen(ctx, &rj, ...)
- secp256k1_ge_set_gej(&r, &rj)
- secp256k1_gej_clear(&rj)

This commit introduces a corresponding helper to deduplicate code
and mitigate the risk that last step is forgotten (which can easily
happen and is not detected by tests).

The idea came up during a conversation with furszy, see
https://github.com/bitcoin-core/secp256k1/pull/1765#issuecomment-4482838033

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
secret or key materialcryptography-sensitive path
AI analysis · Low 36/100

This is a defensive code cleanup in a Bitcoin cryptography library. It introduces a helper function that wraps a common three-step pattern when multiplying by the generator point, ensuring that temporary sensitive Jacobian coordinate data is always wiped from memory. The change reduces the chance that a future developer forgets to clear that temporary data, which could theoretically leak tiny fragments of secret key information through memory side channels. It does not fix a known active bug or reported vulnerability.

Lower-prioritybench: add internal benchmark for `secp256k1_fe_normalize_var`by Sebastian Falbesoner · 240578ee · Jun 4, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Sebastian Falbesoner

bench: add internal benchmark for `secp256k1_fe_normalize_var`

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityAdd exhaustive test for ECDH moduleby Sebastian Falbesoner · 5698e66c · Jun 2, 2026 · 3 filesMessage 55 · ThinTriage 0Details
Commit message · Sebastian Falbesoner

Add exhaustive test for ECDH module

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI review queuedtests: compare full MuSig aggregate nonceby w0xlt · af1fdd12 · May 12, 2026 · 1 fileMessage 55 · ThinTriage 0Details
Commit message · w0xlt

tests: compare full MuSig aggregate nonce

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
Security candidatedoc: correct API docs for ECDSA signing out-params (s/array/signature object/)by Sebastian Falbesoner · 40a0d874 · Apr 29, 2026 · 2 filesMessage 55 · ThinInformational 15Details
Commit message · Sebastian Falbesoner

doc: correct API docs for ECDSA signing out-params (s/array/signature object/)

55/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Names security-relevant behavior explicitly! No meaningful explanatory body
Why it was queued
signing boundarycryptography-sensitive path
AI analysis · Informational 15/100

This commit only fixes wording in the API documentation comments. It changes the description of a function output parameter from 'pointer to an array' to 'pointer to a signature object' in two header files. No actual code behavior changed, so there is no security impact.

Security candidatemusig: always clear out secret key in `secp256k1_musig_nonce_gen_counter`by Sebastian Falbesoner · 8479eafa · Apr 28, 2026 · 1 fileMessage 73 · AdequateLow 34Details
Commit message · Sebastian Falbesoner

musig: always clear out secret key in `secp256k1_musig_nonce_gen_counter`

Even though `secp256k1_musig_nonce_gen_internal` can currently only fail
if the API is misused (invalid `keypair` or `keyagg_cache` parameters),
clear out the buffer holding secret key data as well in this case to
follow best practices.

The issue was found and reported by l0rinc using GPT 5.5 (Thanks!).

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
secret or key material
AI analysis · Low 34/100

This is a small defensive cleanup in Bitcoin Core's libsecp256k1 MuSig code. The function that generates a cryptographic nonce could, in rare error cases, leave a temporary copy of the user's secret key in memory instead of wiping it. The patch makes sure the secret key buffer is always cleared, even when the internal function fails. The actual failure path can only be reached if the API is misused (bad keypair or cache), so this is best-practice hardening rather than an active exploit.

Lower-priorityci: Bump GCC snapshot major version to 17by Hennadii Stepanov · 3cca6451 · Apr 27, 2026 · 1 fileMessage 80 · StrongTriage 0Details
Commit message · Hennadii Stepanov

ci: Bump GCC snapshot major version to 17

See https://gcc.gnu.org/pipermail/gcc/2026-April/248048.html.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference