CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 22 Bitcoin

Use bitcoin-lib 0.47 (#3268)

AQ5e741b1a View source ↗
Public commit record

What the developer wrote

Authored by Fabrice Drouin

76/100 · Adequate
Use bitcoin-lib 0.47 (#3268)

* Use bitcoin-lib 0.47

* Add checksums for secp256k1-kmp 0.23.0

* der2compact() and compact2der() methods have been removed, new signInputCompact() method has been added

* Use Transaction.encodeWitnessEcdsaSig() instead of low-level calls

* Replace local der() methode with bitcoin-lib's encodeWitnessEcdsaSig()
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit updates Eclair to use a newer version of its underlying Bitcoin library (bitcoin-lib 0.47). Most changes are mechanical: replacing local helper functions with new library-provided equivalents for encoding signatures and signing transaction inputs. There is no direct evidence in the commit message or diff that this fixes a specific security vulnerability, but it does touch cryptographic code and updates a dependency, which can sometimes address bugs or weaknesses in the library itself.

Recommended action

Review the bitcoin-lib 0.47 and secp256k1-kmp 0.23.0 release notes or changelog for any security-related fixes. Verify that the new library APIs preserve low-s normalization and correct sighash behavior, since these are critical for Lightning transaction validity. Run the full transaction and signature test suites to ensure no regressions.

Security signals we found

01

Dependency version bump for bitcoin-lib and secp256k1-kmp

02

Refactor of ECDSA signature encoding/signing code paths

03

Removal of local DER conversion helpers in favor of library-provided methods

04

No explicit security fix or CVE referenced in commit message or diff

Risk score

Why this scored 22/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 3/15
Affected reach 5/15
Confidence 4/10
Evidence quality 2/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Eclair

Related watches

Low 47 AI analysisMessage 88 · Strong
AQ ACINQEclair BitcoinLightning Network

Ignore repeated invalid `tx_signatures` (#3328)

This update changes how the Eclair Lightning node handles repeated bad 'tx_signatures' messages from a peer during dual-funded channel opens and splices. Previously, every bad signature was processed and logged, which could waste CPU and d…

Rate-limiting of invalid peer messages (tx_signatures) to prevent repeated CPU/disk consumptionRemoval of unnecessary DB writes on shutdown receipt, reducing disk-wear and potential DoS surfaceNo channel force-close on invalid signatures; node remains open and waits for on-chain confirmation
823341e6by Bastien Teinturier+74−402 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Informational 22 AI analysisMessage 53 · Thin
AQ ACINQEclair BitcoinLightning Network

Use bitcoin-lib 0.48 (#3316)

This commit updates Eclair's underlying Bitcoin library from version 0.47 to 0.48 and makes small code adjustments to match the new library's API. The changes touch how private keys are derived and how test data is converted. There is no d…

Dependency version bump of cryptographic Bitcoin libraryPrivate key derivation code modifiedTaproot/MuSig2 test vector code adjusted
743dcdd1by Fabrice Drouin+8−44 files
No security note in commit
Open full analysis →Source commit ↗
Low 34 AI analysisMessage 100 · Strong
AQ ACINQEclair BitcoinLightning Network

Add support for zero-fee commitment format (#3192)

This commit adds an experimental new Lightning channel type to Eclair called 'zero-fee commitments.' It is a large feature patch implementing a draft BOLT specification (PR 1228), not a fix for a known vulnerability. The change introduces …

Large feature addition (+1618/-276 across 42 files) touching consensus-sensitive transaction construction and signingNew experimental channel type disabled by default; requires explicit opt-in via eclair.confImplements draft BOLT specification (lightning/bolts#1228), not a finalized standard
35403401by Bastien Teinturier+1618−27642 files
No security note in commit
Open full analysis →Source commit ↗