CommitWatch RSS
BC
← All projectsBitcoin Core

libsecp256k1

High-assurance secp256k1 elliptic-curve library used throughout the Bitcoin ecosystem.

BitcoinCryptographic librariesNormal
Source repository ↗
Repository coverage

176 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

48security candidates5second-pass queue30AI analyses
50commits · 30 days
69commits · 60 days
94commits · 180 days
176commits · 365 days
Backfill bands
Aug 5 → Feb 682 seen1 candidatesComplete
Feb 6 → Jun 625 seen2 candidatesComplete
Jun 6 → Jul 619 seen1 candidatesComplete
Jul 6 → Aug 548 seen1 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
39Strong · 80–100
76Adequate · 60–79
58Thin · 40–59
3Opaque · 0–39
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Sebastian Falbesoner391512065
Hennadii Stepanov4562064
Tim Ruffing2262055
furszy1342087
josibake944066
Lőrinc1333077
kevkevinpal620064
John Moffett421069
copilot-swe-agent[bot]322074
Jonas Nick710053
merge-script210091
gzJx0DuTRHytnHe7P5RmMbPf3wKy2BztweVGXTf211078
Analysis record

Published AI watches

Last scanned 25 minutes ago

Low 26 AI analysisMessage 83 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

sha256: cross-check caller supplied compression function

This commit strengthens the library's startup self-test for SHA-256 compression functions that users can plug in. It adds a more thorough 'smoke test' that compares the user-supplied function against the built-in one across many message le…

Defensive self-test hardening for pluggable cryptographic primitiveExpanded test coverage for multi-block, unaligned-input, and non-IV state casesStartup-time detection of faulty SHA-256 compression functions
c84ea465by furszy+154−14 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

header: Add note on SHA256 override and aux functions

This commit only adds a documentation note to a public header file. It explains that certain auxiliary functions, when called directly by user code, will not use a user-installed SHA256 override callback because they do not receive a libra…

4147f8bdby Tim Ruffing+9−11 file
No security note in commit
Open full analysis →Source commit ↗
Low 32 AI analysisMessage 50 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

ecdsa/ecdh: Use SHA256 override if known noncefp/hashfp is passed

This small change makes Bitcoin's cryptographic library treat two built-in functions (the default ECDSA nonce generator and the default ECDH hash function) as 'default' choices even when a caller explicitly passes them. The practical effec…

Behavioral alignment of default function pointers with context-aware hash implementationPotential misuse path where explicit default function pointer bypassed context hash functionNo explicit security claim, CVE, or vulnerability description in commit or references
ed091bc4by Tim Ruffing+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 71 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

Remove deprecated `secp256k1_context_no_precomp` pointer

This commit removes an old, renamed pointer called secp256k1_context_no_precomp from the secp256k1 cryptographic library. It had been marked as deprecated for over three years and was only an alias for the newer secp256k1_context_static. T…

Removal of a deprecated public API symbolNo change to cryptographic logic, memory handling, or context semanticsPotential downstream build breakage for consumers still using the deprecated alias
bf435856by Sebastian Falbesoner+1−84 files
No security note in commit
Open full analysis →Source commit ↗
Informational 19 AI analysisMessage 71 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

Remove deprecated `secp256k1_schnorrsig_sign` alias

This commit removes an old, renamed function called secp256k1_schnorrsig_sign from the libsecp256k1 cryptographic library. It had been marked as deprecated for over three years and was simply an alias pointing to the newer secp256k1_schnor…

No security-relevant code change: only a deprecated alias and its test are removedNo memory safety, cryptographic, or input validation changesNo bug fix, vulnerability patch, or incident disclosure present in commit or references
e14756bdby Sebastian Falbesoner+4−194 files
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

recovery: check exhaustive API results

This commit tightens a test suite for the secp256k1 cryptographic library. It adds checks to ensure that recoverable signing and signature conversion succeed before using their outputs. It does not change the library's actual signing or ve…

defensive test-hardening onlyno change to cryptographic implementationno change to signature parsing, verification, or recovery logic
1d3f72d3by Lőrinc+3−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 17 AI analysisMessage 83 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

ellswift: check test operation results

This commit fixes test code for the EllSwift module so that it actually checks whether encoding, decoding, and public-key loading operations succeed before using their outputs. Previously the tests silently ignored failure return values, w…

Missing return-value checks in cryptographic test codePotential silent test failures in EllSwift encode/decode roundtrip testsPotential silent test failures in public-key load operations
564afb0bby Lőrinc+10−102 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 86 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

silentpayments: API docs and internal comment followups

This commit only updates documentation comments and an example error message in the silent payments module. It does not change any executable code, cryptographic calculations, or security behavior. The changes clarify when the output-creat…

0fa38f3dby Sebastian Falbesoner+24−223 files
No security note in commit
Open full analysis →Source commit ↗
Low 37 AI analysisMessage 73 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

nonce: terminate RFC6979 loop at UINT_MAX

This commit fixes an infinite-loop bug in the RFC6979 nonce generation code used for creating cryptographic signatures. If a caller asked for attempt number UINT_MAX (the maximum value of an unsigned integer), the old loop would generate t…

Infinite loop in cryptographic nonce generation when counter is UINT_MAXLoop index wraparound causing non-terminationRFC6979 nonce function behavior mismatch with public API contract
b1bc6f3eby Lőrinc+2−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 50 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

silentpayments: drop "shuffle outputs" recommendation from API docs

This commit only changes documentation comments in a header file. It removes a recommendation that callers shuffle transaction outputs before scanning, and instead clarifies that outputs should be passed in their original transaction order…

cea6d114by Sebastian Falbesoner+2−31 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 78 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

tests: add constant time tests

This commit only adds new test code. It extends the project's constant-time test suite to also exercise the silent payments module, ensuring that secret key material is not accidentally leaked through timing side channels during those oper…

Adds constant-time (side-channel) test coverage for the silent payments moduleUses memory-secret marking macros (SECP256K1_CHECKMEM_UNDEFINE/DEFINE) to detect secret-dependent branchesNo functional or cryptographic code changes
936907b0by josibake+78−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 70 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

silentpayments: receiving

This commit adds new code for receiving BIP352 Silent Payments in the libsecp256k1 cryptography library. It introduces functions that let a wallet scan a Bitcoin transaction to find outputs sent to it and compute the secret tweaks needed t…

New feature code, not a security patchExtensive input validation and NULL checks addedSensitive scalars cleared after use (shared_secret, scan_key_scalar, t_k_scalar)
d72a7432by josibake+632−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 41 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

silentpayments: sending

This commit adds a new feature to the secp256k1 cryptographic library: the sender-side logic for Bitcoin Silent Payments (BIP352). It lets a wallet create special one-time payment addresses for recipients without revealing which recipient …

New feature implementation for BIP352 Silent Payments sender sideExtensive input validation (ARG_CHECK) and test coverage for malformed keys and bad argumentsSensitive intermediate values (shared secrets, scalars) are explicitly cleared
b30ea3ebby josibake+719−14 files
No security note in commit
Open full analysis →Source commit ↗
Low 38 AI analysisMessage 73 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

silentpayments: respect per-group recipients protocol limit (K_max=2323)

This commit fixes the libsecp256k1 Silent Payments implementation so it respects the protocol-defined maximum of 2,323 recipients that share the same scan public key. Previously, the code had a TODO warning about unbounded scanning that co…

Unbounded loop bounded to protocol limit to prevent quadratic scanning costSender-side enforcement prevents creating outputs recipients may not findNew public constant documents protocol limit (BIP-352 K_max=2323)
1c1b2753by Sebastian Falbesoner+85−53 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 68 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

silentpayments: recipient label support

This commit adds new public API functions to the silentpayments module of libsecp256k1 to support recipient-side labels for BIP352 silent payments. It is a feature addition, not a security fix or vulnerability patch. There is no evidence i…

c83b6783by Sebastian Falbesoner+302−13 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 62 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

build: add skeleton for new silentpayments (BIP352) module

This commit is purely a build-system and header-file skeleton for a new Silent Payments (BIP352) module. It adds configuration options, dependency checks, and empty placeholder files, but contains no actual cryptographic code or implementa…

a93e696aby Sebastian Falbesoner+83−08 files
No security note in commit
Open full analysis →Source commit ↗
Informational 16 AI analysisMessage 63 · Adequate
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

include: Remove SECP256K1_GNUC_PREREQ macro

This commit removes an unused internal compiler-version-checking helper macro from the public header file. It is a cleanup change with no security implications. The commit message notes it is technically a breaking change for any external …

dba4d937by copilot-swe-agent[bot]+0−91 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

Use __GNUC__ instead of SECP256K1_GNUC_PREREQ

This commit is a routine cleanup of compiler feature checks in the secp256k1 cryptographic library. It replaces a custom version-check macro with a simpler check for whether the compiler is GCC (or claims to be GCC, like Clang). The change…

09870e9cby copilot-swe-agent[bot]+10−102 files
No security note in commit
Open full analysis →Source commit ↗
Low 36 AI analysisMessage 100 · Strong
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

refactor: introduce `_ecmult_gen_ge` helper (preventing accidental gej leaks)

This is a defensive code cleanup in a Bitcoin cryptography library. It introduces a helper function that wraps a common three-step pattern when multiplying by the generator point, ensuring that temporary sensitive Jacobian coordinate data …

New helper ensures intermediate Jacobian coordinates are always cleared after generator multiplicationCommit message states goal is to prevent accidental gej leaks of secret scalar informationRefactors existing call sites in ECDSA sign, Schnorr sign, pubkey creation, and blinding setup
a3296d5eby Sebastian Falbesoner+14−165 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 55 · Thin
BC Bitcoin Corelibsecp256k1 BitcoinCryptographic libraries

doc: correct API docs for ECDSA signing out-params (s/array/signature object/)

This commit only fixes wording in the API documentation comments. It changes the description of a function output parameter from 'pointer to an array' to 'pointer to a signature object' in two header files. No actual code behavior changed,…

40a0d874by Sebastian Falbesoner+2−22 files
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Security candidaterefactor: Remove trailing whitespaceby Hennadii Stepanov · 13e3bee5 · Feb 2, 2026 · 3 filesMessage 47 · ThinTriage 15Details
Commit message · Hennadii Stepanov

refactor: Remove trailing whitespace

47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
Lower-priorityci: Add weekly scheduleby Hennadii Stepanov · 2ccff6eb · Feb 2, 2026 · 1 fileMessage 40 · ThinTriage 0Details
Commit message · Hennadii Stepanov

ci: Add weekly schedule

40/100 · ThinMessage clarity
✓ Subject identifies a change✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-priorityci: Rotate Docker cache keys every 4 weeksby Hennadii Stepanov · 2f18567d · Feb 2, 2026 · 2 filesMessage 84 · StrongTriage 0Details
Commit message · Hennadii Stepanov

ci: Rotate Docker cache keys every 4 weeks

This forces a periodic clean build to ensure we do not rely on stale
cache layers indefinitely.

84/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Explains rationale or failure mode
Why it was queued
documentation-only discount
Security candidateci, docker: Fix LLVM repository signature failureby Hennadii Stepanov · 0ffb1749 · Feb 1, 2026 · 1 fileMessage 91 · StrongInformational 16Details
Commit message · Hennadii Stepanov

ci, docker: Fix LLVM repository signature failure

The LLVM apt repository uses legacy SHA1 signatures which are now
rejected by the stricter Sequoia PGP policy.

This change extends the 'sha1.second_preimage_resistance' cutoff date to
9999-01-01 in the default Sequoia config. This effectively whitelists
the legacy signature algorithm, preventing "OpenPGP signature
verification failed" errors during `apt-get update`.

See https://github.com/llvm/llvm-project/issues/153385.

91/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarydefensive validation
AI analysis · Informational 16/100

This commit changes a CI Docker build script so that an older SHA-1-based PGP signature from the LLVM apt repository is still accepted. It is a build-infrastructure workaround, not a change to the secp256k1 cryptographic code, and it does not introduce a vulnerability in the library itself.

Lower-priorityrelease process: mention the `[Unreleased]` link clearlyby Jonas Nick · 0267b655 · Jan 30, 2026 · 1 fileMessage 65 · AdequateTriage 0Details
Commit message · Jonas Nick

release process: mention the `[Unreleased]` link clearly

Adding this link was forgotten in the first version of the 0.7.1 release PR but
caught in PR review.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
documentation-only discount
Lower-priorityrelease cleanup: bump version after 0.7.1by Jonas Nick · ae7eb729 · Jan 26, 2026 · 3 filesMessage 45 · ThinTriage 0Details
Commit message · Jonas Nick

release cleanup: bump version after 0.7.1

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityrelease: prepare for 0.7.1by Jonas Nick · 20a209f1 · Jan 26, 2026 · 2 filesMessage 45 · ThinTriage 0Details
Commit message · Jonas Nick

release: prepare for 0.7.1

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-prioritychangelog: update in preparation for the v0.7.1 releaseby Jonas Nick · c4b6a81a · Jan 26, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Jonas Nick

changelog: update in preparation for the v0.7.1 release

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritybench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERSby kevkevinpal · c09215f7 · Jan 23, 2026 · 4 filesMessage 73 · AdequateTriage 0Details
Commit message · kevkevinpal

bench: fail early if user inputs invalid value for SECP256K1_BENCH_ITERS

In this change the get_iters function was updated to print an error
message and then return 0. In the functions that use get_iters they
print the help text and then EXIT_FAILURE

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Lower-prioritytest: show both Autotools and CMake usage for ctime_testsby 8144225309 · 1bc74a22 · Jan 22, 2026 · 1 fileMessage 95 · StrongTriage 0Details
Commit message · 8144225309

test: show both Autotools and CMake usage for ctime_tests

The existing message only shows the libtool command, which is
specific to Autotools builds.

Fixes #1697

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Lower-prioritycmake: Set `LABELS` property for testsby Hennadii Stepanov · 8354618e · Jan 20, 2026 · 2 filesMessage 55 · ThinTriage 0Details
Commit message · Hennadii Stepanov

cmake: Set `LABELS` property for tests

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
documentation-only discount
Lower-prioritycmake: Integrate DiscoverTests and normalize test namesby Hennadii Stepanov · 29f26ec3 · Jan 20, 2026 · 2 filesMessage 83 · StrongTriage 0Details
Commit message · Hennadii Stepanov

cmake: Integrate DiscoverTests and normalize test names

Updates the build system to use the new DiscoverTests module.
This also standardizes test names to use dot-separated parts for
consistency.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
documentation-only discount
Lower-prioritysage: verify Eisenstein integer connection for GLV constantsby Justsomebuddy · 29ac4d84 · Jan 14, 2026 · 1 fileMessage 83 · StrongTriage 0Details
Commit message · Justsomebuddy

sage: verify Eisenstein integer connection for GLV constants

Add assertions to verify that the GLV decomposition constants arise
from the Eisenstein integer factorization of the group order N.

The group order factors as N = pi * conj(pi) in Z[w], where pi = A - B*w
is an Eisenstein prime. The GLV eigenvalue LAMBDA = B/A mod N, which is
the image of w^2 under the isomorphism Z[w]/(pi) -> Z/NZ.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Lower-prioritycmake: Add DiscoverTests moduleby Hennadii Stepanov · f95b263f · Jan 13, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Hennadii Stepanov

cmake: Add DiscoverTests module

Co-authored-by: Daniel Pfeifer <daniel@pfeifer-mail.de>

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Lower-prioritycmake, refactor: Deduplicate test-related codeby Hennadii Stepanov · 4ac65114 · Jan 13, 2026 · 1 fileMessage 70 · AdequateTriage 0Details
Commit message · Hennadii Stepanov

cmake, refactor: Deduplicate test-related code

Co-authored-by: furszy <matiasfurszyfer@protonmail.com>

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
documentation-only discount
Lower-prioritydoc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmultby kevkevinpal · bd5ced1f · Jan 7, 2026 · 1 fileMessage 75 · AdequateTriage 0Details
Commit message · kevkevinpal

doc/bench: added help text for SECP256K1_BENCH_ITERS env var for bench_ecmult

In addition a print message saying some tests were skipped was added

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Lower-priorityecmult: Use size_t for array indices into tablesby Tim Ruffing · bb1d199d · Jan 7, 2026 · 4 filesMessage 45 · ThinTriage 0Details
Commit message · Tim Ruffing

ecmult: Use size_t for array indices into tables

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Lower-priorityecmult: Use size_t for array indices in _odd_multiplies_tableby Tim Ruffing · 47eb7095 · Jan 7, 2026 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · Tim Ruffing

ecmult: Use size_t for array indices in _odd_multiplies_table

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Security candidatedoc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmakeby kevkevinpal · 0406cfc4 · Dec 19, 2025 · 1 fileMessage 50 · ThinTriage 15Details
Commit message · kevkevinpal

doc: include arg -DUSE_EXTERNAL_DEFAULT_CALLBACKS=1 for cmake

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
Lower-prioritytest: split monolithic ellswift test into independent casesby furszy · d822b290 · Dec 15, 2025 · 1 fileMessage 95 · StrongTriage 0Details
Commit message · furszy

test: split monolithic ellswift test into independent cases

No behavior changes.

Refactors the previously monolithic ElligatorSwift test into isolated,
independent test cases. Doing so allows the test suite to execute
these cases in parallel rather than sequentially.

Overall, seen 35-40% tests time reduction locally.

This is quite useful for the Debug build with no optimizations,
which is noticeably slow.

#### Local Debug-build Results (7 jobs):

- master: 138.0 seconds.
- this PR: 89.3 seconds.
(~1.55× speedup, ~35% reduction)

#### Local Release-build Results (7 jobs):

- master: 9.5 seconds.
- this PR: 5.9 seconds.
(~1.61× speedup, ~38% reduction)

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Mentions testing or verification
Security candidateAdd VERIFY_CHECKs that flags are 0 or 1by John Moffett · ae00c552 · Dec 15, 2025 · 11 filesMessage 78 · AdequateLow 36Details
Commit message · John Moffett

Add VERIFY_CHECKs that flags are 0 or 1

Flags for constant-time masking rely
on the values being exactly 0 or 1 rather
than 0 or true. Add VERIFY_CHECKs to enforce
in VERIFY builds as a preventative
measure and add documentation where relevant.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
constant-time or timing behavior
AI analysis · Low 36/100

This commit adds safety checks and documentation to ensure that 'flag' values used in secret-handling code are exactly 0 or 1, not just any 'true' value. These flags control constant-time selection and memory wiping. If a caller passed a different non-zero value, the masking math could behave incorrectly and potentially leak secret information through timing or produce wrong results. The new checks only fire in special VERIFY builds, so they are a defensive hardening measure rather than a fix for an active bug.

Security candidaterefactor: remove ret from secp256k1_ec_pubkey_serializeby kevkevinpal · 3daab83a · Dec 9, 2025 · 1 fileMessage 62 · AdequateTriage 15Details
Commit message · kevkevinpal

refactor: remove ret from secp256k1_ec_pubkey_serialize

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
Lower-prioritytest: Add non-NULL checks for "pointer of array" API functionsby Sebastian Falbesoner · 8bcda186 · Dec 9, 2025 · 2 filesMessage 72 · AdequateTriage 0Details
Commit message · Sebastian Falbesoner

test: Add non-NULL checks for "pointer of array" API functions

72/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Mentions testing or verification! No meaningful explanatory body
Security candidateAdd ARG_CHECKs to ensure "array of pointers" elements are non-NULLby Sebastian Falbesoner · 5a08c1bc · Dec 6, 2025 · 3 filesMessage 62 · AdequateTriage 15Details
Commit message · Sebastian Falbesoner

Add ARG_CHECKs to ensure "array of pointers" elements are non-NULL

62/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Explains rationale or failure mode! No meaningful explanatory body
Why it was queued
cryptography-sensitive path
Lower-prioritydoc/bench: Added cmake build options to bench error messagesby kevkevinpal · 3b5b03f3 · Dec 5, 2025 · 1 fileMessage 50 · ThinTriage 0Details
Commit message · kevkevinpal

doc/bench: Added cmake build options to bench error messages

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body