AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 26 Bitcoin

lightningd: add generic scriptpubkey watches.

Public commit record

What the developer wrote

Authored by Rusty Russell

68/100 · Adequate
lightningd: add generic scriptpubkey watches.

The wallet has "our_addresses" which contains our own addresses; this
adds a more generic callback mechanism which can be used for funding
txs and splices.

This will map better onto bwatch, which won't have ability to watch by
txid.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds a new internal mechanism for Core Lightning to watch for Bitcoin transactions that pay to specific addresses (scriptpubkeys). It is a feature/refactoring change intended to support future funding and splicing workflows. There is no direct evidence in the commit that it fixes an active security bug, but it changes how the node detects incoming funds and includes a small logging improvement to help diagnose mismatched transactions.

Recommended action

Treat as a normal feature/refactoring commit. Reviewers should verify that watch_check_tx_outputs correctly handles reorgs, duplicate scriptpubkey watches, and asset types other than mainchain Bitcoin, and that the new callbacks cannot be triggered by adversarially crafted transactions that partially match the watch criteria.

Security signals we found

01

New callback-driven watch subsystem added to chain topology

02

Exact-match validation on scriptpubkey, txid, outnum, and amount before invoking callback

03

Logging added for mismatched txid, amount, or output number referencing GitHub issue #8892

04

Hash table iteration is locked to prevent re-entrant inserts during callbacks

05

No removal of existing txid/txo watches; functionality is additive

Risk score

Why this scored 26/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 5/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.