AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 17 Bitcoin

bookkeeper: make bookkeeper-currency dynamic.

Public commit record

What the developer wrote

Authored by Rusty Russell

68/100 · Adequate
bookkeeper: make bookkeeper-currency dynamic.

This means doing more work if we set it; in particular, we need to
clean up any old values. We define the empty string as "unset", since
setconfig has no other way to "unset" variables.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This change lets users turn the bookkeeper's currency conversion feature on or off while the program is running, instead of only at startup. It also cleans up old exchange-rate data when the currency setting changes, and adds a safety check so a late answer from a previous currency request doesn't get stored. There is no obvious security bug here; it is a normal feature improvement.

Recommended action

No security action required. This is a feature enhancement. If reviewing, consider validating the currency string in the `option_currency` callback as noted by the FIXME, and ensure the dynamic teardown path is covered by fuzz or stress tests for rapid config changes.

Security signals we found

01

Race-condition mitigation: currency lookup result is discarded if the configured currency changed while the RPC was in flight.

02

Dynamic reconfiguration now tears down pending commands and clears cached rates, reducing stale-data risk.

03

No input validation on the currency string is performed (acknowledged with a FIXME).

04

No memory-safety defects are visible in the diff; allocations are paired with `tal_free`.

Risk score

Why this scored 17/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 2/15
Confidence 8/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.