AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Moderate 59 Bitcoin

wallettool: do not use fs::remove_all in createfromdump cleanup

Public commit record

What the developer wrote

Authored by Ava Chow

50/100 · Thin
wallettool: do not use fs::remove_all in createfromdump cleanup
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
The short version

What changed, and why it matters

This patch fixes a cleanup routine in Bitcoin Core's wallet tool. Previously, when creating a wallet from a dump file failed, the tool used a broad 'delete everything in this directory' command. The change makes it delete only the specific files that belong to the wallet it just created, reducing the risk of accidentally wiping unrelated files or directories.

Recommended action

Treat as a security-hardening fix and include in release notes. Users running prior versions should avoid passing untrusted or empty wallet names to bitcoin-wallet createfromdump, and should back up any data in the wallets directory before using the tool.

Security signals we found

01

Potential path-deletion vulnerability: fs::remove_all on a user-influenced path could remove more than intended

02

Switch from recursive directory removal to targeted file removal

03

New regression test for empty wallet name case

04

Command-line wallet tool surface (bitcoin-wallet createfromdump)

Risk score

Why this scored 59/100

Our methodology →
Potential impact 18/30
Exploitability 12/25
Stealth signal 8/15
Affected reach 10/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.