CommitWatch RSS
BT
← Watched projectsVendor accountability

btcsuite

Vendor website ↗
Security hygiene0/100 · Insufficient dataPreliminary score
How the vendor scores

Security hygiene breakdown

Disclosure quality 0/100
Researcher acknowledgement 0/100
Security process 0/100
Patch clarity 0/100
Response quality 0/100
Accountability record

Recent watches

Informational 12 AI analysisMessage 86 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcserver: test null getblock verbosity

This commit only adds a new integration test that sends a null value for the optional verbosity parameter of the getblock RPC and checks that the server returns a normal verbose block response. It does not change any production code. The t…

Regression test for a prior RPC server panic (#2600)No production code changes; defensive test coverage only
c130f0bfby Olaoluwa Osuntokun+36−01 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 65 AI analysisMessage 73 · Adequate
BT btcsuitebtcd BitcoinNode implementations

Merge pull request #2600 from allocz/fix_issue_2597

This patch fixes a server crash in btcd's JSON-RPC 'getblock' command. When a caller did not provide an optional 'verbosity' parameter, the code later dereferenced a nil pointer, causing the entire btcd process to panic. The fix supplies a…

nil-pointer dereference panic in RPC handlerdenial-of-service via crafted JSON-RPC requestserver process crash (availability impact)
a3f20384by Olaoluwa Osuntokun+5−11 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 58 · Thin
BT btcsuitebtcd BitcoinNode implementations

Merge pull request #2601 from vbrekher/fix/psbt-multi-a-finalizer

This change fixes how btcd finalizes a specific type of Bitcoin Taproot smart contract called multi_a. Previously, the finalizer simply stacked signatures in the order they appeared in the PSBT file. For multi_a contracts, signatures must …

Incorrect witness ordering for multi_a tapscripts could produce invalid Bitcoin transactionsNew parser enforces standard multi_a template and rejects unsupported CHECKSIGADD constructionsDuplicate and non-matching signatures now return ErrInvalidPsbtFormat
ca0bb02cby Olaoluwa Osuntokun+366−93 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 95 · Strong
BT btcsuitebtcd BitcoinNode implementations

psbt: test multi_a excess signature handling

This commit only adds a new unit test for the PSBT finalizer. It checks that when a Bitcoin Taproot multi-signature (multi_a) input has more valid signatures than required, the finalizer picks exactly the required number and leaves the ext…

26ee1cc8by Olaoluwa Osuntokun+33−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 95 · Strong
BT btcsuitebtcd BitcoinNode implementations

psbt: test multi_a signature input ordering

This commit only adds a new test case to the project's test suite. It does not change any production code. The test verifies that a PSBT (Partially Signed Bitcoin Transaction) finalizer correctly orders signatures for a specific type of Ta…

Regression test for Taproot multi_a signature orderingNo production code changesDefensive guard against incorrect finalizer implementations
709069b9by Olaoluwa Osuntokun+36−131 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 58 · Thin
BT btcsuitebtcd BitcoinNode implementations

Merge pull request #2580 from Roasbeef/version-bump-v0.26.2

This commit only changes the software version number from v0.26.1-beta.rc1 to v0.26.2-beta. It does not modify any security-related code, network behavior, or user-facing functionality. There is no security issue here.

05585e03by Olaoluwa Osuntokun+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BT btcsuitebtcd BitcoinNode implementations

build: bump version to v0.26.2-beta

This commit only changes the software version number from v0.26.1-beta.rc1 to v0.26.2-beta. It does not modify any program logic, network code, or security behavior. There is no security issue here.

d9948c49by Olaoluwa Osuntokun+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 80 · Strong
BT btcsuitebtcd BitcoinNode implementations

build: bump version to v0.26.1-beta.rc1

This commit only changes the reported software version number from v0.26.0-beta to v0.26.1-beta.rc1. It does not alter any program logic, network behavior, or security-sensitive code. There is no security issue here.

3fa0a65cby Olaoluwa Osuntokun+2−21 file
No security note in commit
Open full analysis →Source commit ↗
Informational 18 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

version: preserve semantic version separators

This commit fixes a small bug in how the btcd Bitcoin node software cleans up version strings. Previously, dots in pre-release version labels like 'beta.rc1' were accidentally removed, turning them into 'betarc1'. The change adds dots to t…

No security-relevant signals in commit message or diffChange is a string-normalization correctness fixNo input from untrusted network sources is processed by this code path
65db4939by Olaoluwa Osuntokun+20−12 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 85 · Strong
BT btcsuitebtcd BitcoinNode implementations

build: pin tagged submodules and remove local replacements

This commit is a routine build housekeeping change. It updates two internal Go module dependencies to newly published tagged versions and removes local directory overrides so that everyone builds with the same published code. There is no i…

3d3b5e8aby Olaoluwa Osuntokun+8−82 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 88 · Strong
BT btcsuitebtcd BitcoinNode implementations

build: bump v2transport to v1.1.0

This commit only updates a dependency version number in the project's Go module file. It bumps the v2transport package from version 1.0.1 to 1.1.0 so that downstream projects building btcd as a module can access new handshake admission API…

8d902916by Olaoluwa Osuntokun+1−11 file
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcclient: harden DisableAuth transport tests

This commit only changes tests and clarifies a public comment. It does not alter the actual authentication behavior of the btcd RPC client. The code already only suppresses the internally generated Basic auth header when DisableAuth is tru…

No functional code change; only tests and commentsComment clarification that DisableAuth only suppresses generated Basic auth, not caller-provided Authorization headersTests now cover WebSocket handshake, cookie bypass, and caller-provided headers
52d2fadeby Olaoluwa Osuntokun+186−1272 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

rpcclient: wrap DisableAuth tests to 80 columns

This commit only reformats an existing test file. It wraps long lines to 80 columns, splits nested code into separate variables, and adjusts whitespace. No production code was changed, and no security behavior is altered.

fe84a0e1by Olaoluwa Osuntokun+83−521 file
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 96 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcclient: add tests for DisableAuth header behavior

This commit only adds new unit tests for an existing feature. It does not change any production code, so it cannot introduce a security vulnerability or fix one directly. The tests verify that an existing option called DisableAuth correctl…

9b849c17by Drake Thomsen+109−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 86 · Strong
BT btcsuitebtcd BitcoinNode implementations

rpcclient: make HTTP Basic Auth optional via DisableAuth

This change adds a new optional setting called DisableAuth to the btcd RPC client. When a user turns it on, the client will not send username/password credentials automatically. This is meant to let users connect to external Bitcoin API se…

New opt-in configuration flag that disables authentication headersDefault behavior unchanged; authentication still required unless user explicitly disables itNo validation added to ensure alternative authentication is present when DisableAuth is true
5d22b395by Drake Thomsen+25−131 file
No security note in commit
Open full analysis →Source commit ↗
Informational 14 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

integration: stabilize pre-verack disconnect cycles

This change only modifies an integration test file. It makes a test more reliable by waiting for a version response and retrying connection attempts, rather than changing any production code that handles real Bitcoin peer connections. Ther…

76ba8842by Olaoluwa Osuntokun+58−191 file
No security note in commit
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

server+connmgr: make outbound startup deterministic

This commit fixes a scheduling bug in how a Bitcoin node decides how many automatic outbound peers to connect to at startup. Previously, if a user had configured permanent peers, those permanent peers could grab internal connection IDs bef…

Non-deterministic outbound peer count at startupPermanent peers could consume connection request IDs before automatic counter sampledPotential for fewer automatic outbound peers than configured, reducing network diversity
58ee9ef6by Olaoluwa Osuntokun+157−224 files
No security note in commit
Open full analysis →Source commit ↗
Low 26 AI analysisMessage 68 · Adequate
BT btcsuitebtcd BitcoinNode implementations

config: reject non-positive maxpeers

This commit fixes a configuration bug in btcd, a Bitcoin node implementation. Previously, setting maxpeers=0 caused the node to enter a tight loop: it would repeatedly try to connect to outbound peers and immediately reject them. The chang…

Denial-of-service-like resource exhaustion via tight reconnect loop triggered by a configuration valueInput validation added for a previously unbounded configuration parameterNo memory corruption, authentication bypass, or remote code execution signals present
7e9414faby Olaoluwa Osuntokun+42−23 files
No security note in commit
Open full analysis →Source commit ↗
Informational 12 AI analysisMessage 83 · Strong
BT btcsuitebtcd BitcoinNode implementations

integration: synchronize p2p lifecycle stress batches

This commit changes only test code. It tightens up an integration test that simulates many fake Bitcoin peers connecting and disconnecting from a node, and makes a small cleanup in a unit test for closing network pipes. There is no change …

No production code changedTest-only synchronization improvementsNo authentication, cryptography, consensus, or network handling logic modified
5a2c5063by Olaoluwa Osuntokun+217−202 files
No security note in commit
Open full analysis →Source commit ↗
Low 48 AI analysisMessage 78 · Adequate
BT btcsuitebtcd BitcoinNode implementations

v2transport: restore responder handshake progress

This commit fixes a deadlock risk in btcd's new Bitcoin v2 transport handshake. Previously, the responder waited until it had received the initiator's full 64-byte key before doing any work, which could cause both sides to sit waiting for …

BIP324 handshake deadlock avoidanceCPU admission lease split to prevent resource exhaustion / lock holding across network I/OResponder now sends key material before full initiator key is received
09717871by Olaoluwa Osuntokun+231−862 files
No security note in commit
Open full analysis →Source commit ↗