verify psbt silent payment metadata against the input hash of every input, not only the eligible ones
What the developer wrote
Authored by Craig Raw
verify psbt silent payment metadata against the input hash of every input, not only the eligible ones
What changed, and why it matters
This commit updates a submodule called 'drongo' with a one-line change whose message says it now checks silent payment metadata against every transaction input, not just the eligible ones. Silent payments are a privacy feature for Bitcoin. The change sounds like a security fix because verifying only some inputs could let a malicious or malformed PSBT (a partially-signed Bitcoin transaction) slip past checks. However, the actual code change is just a submodule pointer bump, so we cannot see the real code fix from this commit alone.
Inspect the actual diff inside the drongo submodule between the two commits to determine what validation logic changed, whether it addresses a known vulnerability, and whether it needs a CVE or advisory. Treat as a potential security fix until the submodule contents are reviewed.
Security signals we found
Validation scope widened from 'eligible inputs' to 'every input'
Silent payment metadata verification in PSBT parsing
Submodule-only change obscures actual code diff
Evidence from the diff
The commit bumps the drongo submodule from b89da20bc92c4fceb4d67ff53daaf56d7b29d94e to 7facf4ca371f8df16f6da60913b45d375d5593a8. The commit title states the change verifies PSBT silent payment metadata against the input hash of every input rather than only eligible inputs. This implies a validation gap in silent payment handling where some inputs were excluded from metadata verification, potentially allowing a crafted PSBT to present inconsistent silent payment data. Without the submodule diff, the exact mechanism and severity cannot be confirmed.
Changed components
drongo submodulePSBT silent payment metadata verificationInspect captured patch +1 / −1
### drongo
@@ -1 +1 @@
-Subproject commit b89da20bc92c4fceb4d67ff53daaf56d7b29d94e
+Subproject commit 7facf4ca371f8df16f6da60913b45d375d5593a8Why this scored 55/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.