AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 31 Bitcoin

wallet: make datastore helpers self-wrap a wallet transaction

Public commit record

What the developer wrote

Authored by Sangbida Chaudhuri

85/100 · Strong
wallet: make datastore helpers self-wrap a wallet transaction

The four wallet_datastore_{get,create,update,remove} helpers used to
require the caller to be inside a wallet transaction; otherwise the
underlying db_prepare_v2 fatals at db/utils.c:103 with "Attempting to
prepare a db_stmt outside of a transaction".

watchman persists its pending bwatch ops through these helpers from
plugin callbacks that run outside any transaction, so wrap one on
demand.

Co-authored-by: Cursor <cursoragent@cursor.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This change fixes a crash bug in Core Lightning's wallet datastore helpers. Previously, four datastore functions required the caller to already be inside a database transaction, and would fatally crash if called outside one. The patch makes these helpers automatically start and commit a transaction when needed. The commit message says this specifically fixes crashes in the watchman plugin, which saves pending operations through these helpers from plugin callbacks that run outside any transaction.

Recommended action

Treat as a routine stability/bug-fix patch. No immediate security response required, but include in normal release notes as a crash fix. Review whether other wallet helpers have the same implicit transaction requirement and consider a broader audit if crashes persist.

Security signals we found

01

Fixes fatal assertion/crash in database statement preparation

02

Resolves transaction-context mismatch in wallet datastore helpers

03

watchman plugin persistence path was affected

04

No input validation, authorization, or cryptographic changes present

05

Co-authored by an AI coding assistant (Cursor)

Risk score

Why this scored 31/100

Our methodology →
Potential impact 8/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 5/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.