AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 19 Bitcoin

rm bip70 support

Public commit record

What the developer wrote

Authored by SomberNight

69/100 · Adequate
rm bip70 support

- could not find a single project that still actually cares about bip70 [0]
- well except maybe BitPay.
- but I cannot test with BitPay:
- they have a testnet3 staging environment on test.bitpay.com
- but the SSL cert they use for bip70 has expired in 2021
- the webUI probably also has not been updated since then...
- they claim to have added LN support in 2022 in a blog post,
but it's not there on test.bitpay.com
- on mainnet, they require KYC before payment
- < ... angry noises >
- their loss then, I don't care.
- this is code that no one wants to maintain

- this does not yet delete the signed bip70 payment data for historical txs
- but it is no longer possible to export it from the GUI

[0]: https://bitcoinops.org/en/topics/bip70-payment-protocol/
✓ Subject identifies a change✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit removes the BIP70 payment protocol from Electrum. BIP70 was the feature that let users pay merchants who sent signed payment requests (like BitPay invoices). The change deletes the code that fetched, verified, and sent those requests, along with the RSA and protobuf code that only BIP70 used. It is a feature-removal cleanup, not a security patch, and it does not introduce a vulnerability.

Recommended action

No security action required. Users who still need BIP70 (e.g., legacy BitPay invoices) will lose that capability and should migrate to BIP21/lightning invoices. Reviewers may verify that no remaining code path still calls deleted BIP70 functions.

Security signals we found

01

Large feature removal reducing attack surface

02

Deletion of X.509/RSA certificate-chain verification code

03

Deletion of network payment-request fetch and merchant notification code

04

No new input parsing, no new network listeners, no new crypto introduced

Risk score

Why this scored 19/100

Our methodology →
Potential impact 0/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 5/15
Confidence 9/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.