CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 34 Bitcoin

Fix: Phoenixd incorrectly marks payment as partial (#7325)

BT90e211b0 View source ↗
Public commit record

What the developer wrote

Authored by Nicolas Dorier

70/100 · Adequate
Fix: Phoenixd incorrectly marks payment as partial (#7325)
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
The short version

What changed, and why it matters

This commit updates several software libraries and changes how BTCPay Server reads Bitcoin wallet descriptors (the strings that define which addresses belong to a wallet). The title says it fixes a bug where Phoenixd lightning payments were wrongly marked as partial, but the actual code changes mostly replace an older output-descriptor parser with a simpler one and update documentation examples. The security relevance is unclear from the diff alone: it could be a routine bug fix, or the library updates could include security patches. There is no direct evidence in the commit of an exploit or a disclosed vulnerability.

Recommended action

Treat this as a maintenance/bug-fix commit with possible indirect security implications from dependency updates. Review the changelogs for NBitcoin 10.0.1, NBitcoin.Altcoins 6.0.3, BTCPayServer.Lightning.All 1.6.15, and MailKit 4.16.0 to identify any security fixes. Validate that the simplified descriptor parser still rejects malformed or unsupported descriptors correctly, because the removal of explicit type-specific checks could broaden accepted input. No immediate emergency response is warranted based solely on this diff.

Security signals we found

01

Dependency version bumps in NBitcoin, NBitcoin.Altcoins, BTCPayServer.Lightning.All, and MailKit

02

Replacement of custom output-descriptor parsing with a simpler path-conversion wrapper

03

Removal of explicit handling for many descriptor types (pkh, sh, wpkh, wsh, tr, multi) in legacy parser

04

Test case changed from single-path `/0/*` to multi-path `/<0;1>/*` descriptor

05

UI documentation updated to recommend `/**` descriptors with master fingerprints

Risk score

Why this scored 34/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 6/15
Affected reach 7/15
Confidence 5/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from BTCPay Server

Related watches

Informational 15 AI analysisMessage 18 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Update Changelog

This commit only edits the wording of a changelog entry for BTCPay Server 2.4.2. It does not change any code, configuration, or executable files. The edit makes the release sound more urgent, but the commit itself is purely documentation a…

Changelog language changed to describe a critical, actively exploited vulnerability in release 2.4.2No code, configuration, or dependency changes present in the commitSecurity issue is referenced but not fixed or explained in this diff
fbf761f3by Nicolas Dorier+1−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 49 AI analysisMessage 28 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Disabled unwanted routes

This commit marks several public methods on ASP.NET Core controllers with [NonAction], which prevents them from being exposed as web-accessible HTTP routes. Without this attribute, these helper methods could be reached directly via URL, po…

Public controller methods exposed as unintended HTTP routesRouting-level access-control hardeningPotential bypass of intended controller action flow
6689cad4by Nicolas Dorier+9−05 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 64 AI analysisMessage 38 · Opaque
BT BTCPay ServerBTCPay Server BitcoinLightning NetworkPayment infrastructure

Changelog for 2.4.2

This commit is a version bump and changelog for BTCPay Server 2.4.2. The changelog describes two security-related changes: disabling Basic authentication by default shortly after account creation, and fixing a TOTP two-factor authenticatio…

Vendor describes security fixes in changelogTOTP two-factor authentication bypass via Greenfield Basic authenticationBasic authentication disabled by default after account creation
3e2928cfby Nicolas Dorier+29−12 files
Vendor flagged security relevance
Open full analysis →Source commit ↗