AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 18 Bitcoin

bkpr: use the in-memory event descriptions, not the database ones.

Public commit record

What the developer wrote

Authored by Rusty Russell

73/100 · Adequate
bkpr: use the in-memory event descriptions, not the database ones.

The new access APIs are more symmetrical:

1. edit_utxo_description -> add_utxo_description
2. add_payment_hash_desc -> add_payment_hash_description

And to read it, instead of accessing ->ev_desc (now removed) we use
chain_event_description() & channel_event_description(), threading bkpr though
as needed.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit refactors the bookkeeper plugin so that event descriptions (like invoice memos or user-edited notes) are kept in memory and looked up on demand, instead of being copied into and out of the database on every chain/channel event. It removes the old `ev_desc` database column usage, renames a couple of internal functions for consistency, and adds helper functions to fetch descriptions when needed. There is no obvious security vulnerability here; it is a code-quality and data-model cleanup.

Recommended action

No immediate security action required. Treat as normal code maintenance. If deploying, verify that the new in-memory description store is persisted/restored across plugin restarts as intended, since descriptions are no longer in the event tables.

Security signals we found

01

Removal of duplicated sensitive-ish data (user-supplied descriptions) from persistent DB rows

02

Refactoring of internal description storage; no new attack surface visible in diff

03

No input validation changes, no memory allocation hardening changes, no privilege boundary changes

Risk score

Why this scored 18/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 2/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.