AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 20 Bitcoin

add silent payments rpc methods, capability check and notification dispatch

Public commit record

What the developer wrote

Authored by Craig Raw

50/100 · Thin
add silent payments rpc methods, capability check and notification dispatch
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
The short version

What changed, and why it matters

This commit adds support for a new Bitcoin privacy feature called 'silent payments' in the Sparrow Wallet. It lets the wallet ask compatible servers to scan for silent-payment transactions and report them back. The change also improves how Sparrow detects what a server can do, and it makes one error type more specific when Bitcoin Core cannot handle silent payments. There is no obvious security bug in the diff, but it does involve sending private scanning keys to an external server, which is inherent to the silent-payments protocol and is now done through a new RPC call.

Recommended action

Review the silent-payments key-handling path to ensure scan_priv_key_hex is zeroed or minimized in memory where feasible, confirm server.features responses cannot spoof capability flags, and verify that Cormorant's server.features pruning field cannot be abused to force a rescan. Treat as a feature commit unless additional context shows a vulnerability.

Security signals we found

01

New RPC methods transmit scan_priv_key_hex to external Electrum server (protocol-required but sensitive)

02

New server.features capability handshake parses silent_payments version list

03

New exception type distinguishes unsupported vs. general bitcoind failures

04

No input sanitization changes visible; relies on existing JsonRpcClient/RetryLogic

05

No CVE, advisory, or vendor security disclosure present in commit or references

Risk score

Why this scored 20/100

Our methodology →
Potential impact 2/30
Exploitability 2/25
Stealth signal 3/15
Affected reach 4/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.