AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 24 Bitcoin

Merge pull request #11065 from ellemouton/agent/walletrpc-create-account

Public commit record

What the developer wrote

Authored by Yong

73/100 · Adequate
Merge pull request #11065 from ellemouton/agent/walletrpc-create-account

walletrpc: add XCreateAccount for wallet-derived accounts
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit adds a new, clearly marked experimental RPC and command-line option called XCreateAccount that lets an LND user create a separate, named pocket of on-chain funds within the same wallet. It is not a security patch and does not fix a vulnerability. The main risk is user error: money sent to one of these accounts cannot be found again with only the wallet seed, so the user must separately save extra recovery details. The feature is gated behind an explicit 'I know what I am doing' flag on release builds to reduce accidental misuse.

Recommended action

No urgent action. Operators should treat this as a new experimental feature with recovery caveats. If running a node with untrusted RPC access, review macaroon permissions because the new RPC creates wallet state and derives keys; restrict access appropriately. Users who create such an account must securely record the derivation path, key scope, account index, and issued address count alongside their seed.

Security signals we found

01

New RPC adds wallet account-creation surface area

02

Feature is explicitly experimental and gated by i_know_what_i_am_doing on release builds

03

Documentation warns that seed-only restore does not recover these accounts

04

Server-side rejections for duplicate, reserved, empty names and unsupported address schema

05

No vulnerability fix, bounds check, authentication change, or cryptographic hardening visible

Risk score

Why this scored 24/100

Our methodology →
Potential impact 2/30
Exploitability 3/25
Stealth signal 2/15
Affected reach 5/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.