AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 20 Bitcoin

bkpr: forward utxo_deposit / utxo_spend notifications to new injectutxodeposit / injectutxospend calls.

Public commit record

What the developer wrote

Authored by Rusty Russell

73/100 · Adequate
bkpr: forward utxo_deposit / utxo_spend notifications to new injectutxodeposit / injectutxospend calls.

And thus we absorb them as normal when they come back as "foreign" entries.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit refactors the Core Lightning bookkeeper plugin so that incoming 'utxo_deposit' and 'utxo_spend' notifications are forwarded to new internal 'injectutxodeposit' / 'injectutxospend' RPC calls, then reprocessed as ordinary 'foreign' chain events. It is a code-cleanup and consistency change; it does not by itself introduce or fix a clear security vulnerability, though it changes how injected transactions are recorded and tagged.

Recommended action

Treat as a normal functional refactor. Reviewers should verify that the new injectutxodeposit/injectutxospend endpoints perform equivalent validation and idempotency checks to the removed inline handlers, and that marking events as foreign does not bypass any accounting or fee-calculation logic that should still apply.

Security signals we found

01

Change in how externally injected UTXO events are classified and logged

02

New boolean 'foreign' flag added to chain_event structure

03

Channel-open lookup skipped for foreign/injected events

04

Refactoring of notification handlers to use internal RPC calls

05

No explicit bounds, auth, or crypto changes visible in the diff

Risk score

Why this scored 20/100

Our methodology →
Potential impact 3/30
Exploitability 2/25
Stealth signal 2/15
Affected reach 4/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.