AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 46 Bitcoin

Merge pull request #10945 from accumulator/stale_utxo_data_fixes

Public commit record

What the developer wrote

Authored by Felix

58/100 · Thin
Merge pull request #10945 from accumulator/stale_utxo_data_fixes

Stale utxo data fixes
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Links an issue, advisory, or supporting reference! No meaningful explanatory body
The short version

What changed, and why it matters

This commit fixes cases where Electrum's wallet cache could hold onto outdated information about coins and transactions after blockchain reorganizations or mempool changes. For example, if a transaction was previously thought to be mined but later returned to the mempool, the wallet might still treat it as confirmed and display an incorrect 'short ID' for it. The patch adds cache invalidation calls and makes the code consistently check whether a transaction is actually mined before showing a compact short ID. It is a correctness/bug-fix change rather than a direct remote-exploitable vulnerability, but stale cached state could mislead users or downstream logic about confirmation status.

Recommended action

Treat as a bug-fix/correctness patch. Users and downstream integrators should upgrade to avoid stale UTXO metadata after reorgs. Review any custom code that reads txin.block_height/block_txpos directly and migrate to set_mined_info()/has_short_id() to keep behavior consistent. No immediate emergency response is warranted, but the patch should be included in the next release.

Security signals we found

01

stale cached state after reorg/mempool eviction

02

incorrect confirmation metadata displayed to users

03

cache invalidation added at multiple state transitions

04

short ID generation made conditional on mined + SPV-verified status

05

no direct memory corruption or cryptographic weakness

Risk score

Why this scored 46/100

Our methodology →
Potential impact 12/30
Exploitability 5/25
Stealth signal 8/15
Affected reach 10/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.