AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 33 Bitcoin

contractcourt: use confheight instead of rescanning the chain

Public commit record

What the developer wrote

Authored by ziggie

50/100 · Thin
contractcourt: use confheight instead of rescanning the chain
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
The short version

What changed, and why it matters

This change removes a live blockchain rescan that waited for the commitment transaction to confirm, and instead uses a previously known confirmation height stored in the resolver. The main risk is that if the stored confirmation height is wrong or stale, the resolver may compute the wrong unlock time for locked funds, potentially causing premature or delayed sweeps. There is no direct evidence in the commit message or diff that this fixes an active security bug; it appears to be a simplification/optimization.

Recommended action

Verify that c.confirmHeight is always initialized from a trustworthy, confirmed source and is kept up to date across restarts and reorgs. If confirmHeight can be stale or zero, add validation before using it to compute unlockHeight. Consider adding a regression test for reorg or stale-height scenarios.

Security signals we found

01

Removal of on-chain confirmation wait before computing maturity height

02

Trust shift from observed confirmation event to stored confirmHeight field

03

Potential timing issue if confirmHeight does not match actual confirmation block

04

No explicit security framing or bug reference in commit message

Risk score

Why this scored 33/100

Our methodology →
Potential impact 8/30
Exploitability 4/25
Stealth signal 6/15
Affected reach 7/15
Confidence 5/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.