CommitWatch RSS
EP
← All projectsElements Project

libwally-core

Cross-platform wallet primitives for keys, addresses, transactions, PSBT, and Elements.

BitcoinCryptographic librariesSoftware walletsNormal
Source repository ↗
Repository coverage

96 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

15security candidates27second-pass queue9AI analyses
15commits · 30 days
22commits · 60 days
74commits · 180 days
96commits · 365 days
Backfill bands
Aug 5 → Feb 622 seen3 candidatesComplete
Feb 6 → Jun 652 seen3 candidatesComplete
Jun 6 → Jul 67 seen0 candidatesComplete
Jul 6 → Aug 514 seen1 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

61/100 average clarity
11Strong · 80–100
42Adequate · 60–79
33Thin · 40–59
10Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Jon Griffiths81137059
Ondřej Češka111050
Erick Cestari1110100
dependabot[bot]500093
odudex200062
Daniel Newton200055
pythcoiner100055
Greg Sanders100068
Leonardo Comandini100060
longhutianjie100072
Analysis record

Published AI watches

Last scanned 43 minutes ago

Informational 15 AI analysisMessage 73 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

crypto: add ec_public_key_compress to produce a compressed pubkey

This commit adds a new public-key compression function to a cryptographic library and updates the existing decompression function so both can accept already-compressed or already-uncompressed keys as input. It also adds tests and language …

03351cc9by Jon Griffiths+92−1610 files
No security note in commit
Open full analysis →Source commit ↗
Moderate 62 AI analysisMessage 85 · Strong
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

sign: disallow overlong der encodings and zero r or s values

This commit tightens signature validation in a cryptographic library. It now rejects malformed DER-encoded signatures that are longer than allowed, or where one of the signature numbers (R or S) is zero. Previously, the underlying secp256k…

Cryptographic input validation hardeningRejection of overlong DER-encoded ECDSA signaturesRejection of zero R or S signature components
e7894ee6by Jon Griffiths+6−11 file
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 27 AI analysisMessage 78 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

descriptor: support elements confidential wallet policies

This commit adds support in libwally-core for a new Elements/Liquid confidential-wallet policy format. It lets wallet policies include a special '@B' blinding key placeholder, kept separate from ordinary derivation keys. The change is a fe…

Descriptor/miniscript parsing code modifiedCryptographic key validation logic changedNew input validation rules added for '@B' blinding key
6bbe9eebby Jon Griffiths+90−331 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 50 · Thin
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

bip32: add some of the new bip32 checks to bip32_key_unserialize

This commit adds a safety check when loading BIP32 extended keys. Before, the code accepted any 33-byte public key bytes without verifying they form a valid public key. Now it calls a public-key validation function and rejects invalid keys…

New input-validation call (wally_ec_public_key_verify) added to deserialization pathRejection of invalid public-key bytes before key material is copied into output structAddition of BIP32 Test Vector 5 invalid-key test cases
2b74c8d7by Ondřej Češka+65−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 100 · Strong
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

build: add fuzzing infrastructure for security testing

This commit only adds new build options and a test harness for fuzzing (automated security testing). It does not change any existing library code that handles PSBTs or other data, so it cannot by itself introduce a security vulnerability o…

c824172aby Erick Cestari+108−07 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Low 44 AI analysisMessage 45 · Thin
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

psbt: handle allocation failures in set_global_tx

This commit fixes a memory-management bug in the library's Partially Signed Bitcoin Transaction (PSBT) handling. When the code failed to allocate memory for new transaction inputs or outputs, it could leave behind partially initialized dat…

Allocation-failure handling added (NULL checks before array initialization)Resource cleanup improved (element-level free before array free)Potential use of uninitialized/freed memory path removed in OOM case
e45f553dby Jon Griffiths+26−141 file
No security note in commit
Open full analysis →Source commit ↗
Moderate 59 AI analysisMessage 60 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

psbt: fix check for too many witnesses

This commit fixes a parsing bug in how the library reads Bitcoin-style witness data from a transaction or PSBT. Before the fix, a malformed input could claim there were millions of witnesses while only providing a few bytes. The code would…

Out-of-bounds read / buffer over-read in a core deserialization routinePotential memory allocation failure or integer overflow from attacker-controlled witness countNew negative test case added for malformed PSBT with excessive witness count
a3fd0aa8by Jon Griffiths+11−03 files
Vendor flagged security relevance
Open full analysis →Source commit ↗
Moderate 61 AI analysisMessage 60 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

psbt: fix check for short buffers

This commit fixes a bug in how the library reads compact size numbers from PSBT (Partially Signed Bitcoin Transaction) data. Before the fix, the code could read past the end of a short input buffer when checking how many bytes a variable-l…

Out-of-bounds read in variable-length integer parsingShort/truncated input buffer not validated before length inspectionNew negative test case added for short PSBT bytes
a1de7372by Jon Griffiths+9−13 files
No security note in commit
Open full analysis →Source commit ↗
Low 35 AI analysisMessage 60 · Adequate
EP Elements Projectlibwally-core BitcoinCryptographic librariesSoftware wallets

psbt: use control block verification call internally

This commit replaces a simple length check on Taproot control blocks with a dedicated verification function. The change is likely a hardening or correctness improvement rather than a clear-cut security fix. The old check only ensured the c…

Replaced length-only validation with a dedicated BIP341 control-block verification routineRemoved duplicated inline length check in favor of a centralized validation callParsing and serialization paths for Taproot leaf scripts now share the same validation logic
944f2660by Jon Griffiths+3−91 file
No security note in commit
Open full analysis →Source commit ↗
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedbuild(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 in /src/wasm_packageby dependabot[bot] · d3f6adf0 · Aug 5, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps-dev): bump fast-uri from 3.1.4 to 3.1.5 in /src/wasm_package

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.4 to 3.1.5.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.4...v3.1.5)

---
updated-dependencies:
- dependency-name: fast-uri
dependency-version: 3.1.5
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedtests: add tests for parsing invalid der sigsby Jon Griffiths · 824e8a33 · Jul 31, 2026 · 1 fileMessage 55 · ThinTriage 12Details
Commit message · Jon Griffiths

tests: add tests for parsing invalid der sigs

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedbuild(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 in /src/wasm_packageby dependabot[bot] · c25fc5fd · Jul 25, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps-dev): bump fast-uri from 3.1.2 to 3.1.4 in /src/wasm_package

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.2 to 3.1.4.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.2...v3.1.4)

---
updated-dependencies:
- dependency-name: fast-uri
dependency-version: 3.1.4
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump version to 1.5.6by Jon Griffiths · 0c41f38f · Jul 11, 2026 · 9 filesMessage 38 · OpaqueTriage 0Details
Commit message · Jon Griffiths

Bump version to 1.5.6

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedBump version to 1.5.5by Jon Griffiths · 78499f00 · Jul 9, 2026 · 9 filesMessage 38 · OpaqueTriage 0Details
Commit message · Jon Griffiths

Bump version to 1.5.5

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedBump version to 1.5.4by Jon Griffiths · c5591834 · Jun 16, 2026 · 9 filesMessage 38 · OpaqueTriage 0Details
Commit message · Jon Griffiths

Bump version to 1.5.4

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedcmake: add missing definesby Jon Griffiths · be278177 · May 27, 2026 · 2 filesMessage 35 · OpaqueTriage 0Details
Commit message · Jon Griffiths

cmake: add missing defines

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedbuild: remove distutils dependencyby Jon Griffiths · dbaa9393 · May 25, 2026 · 1 fileMessage 47 · ThinTriage 0Details
Commit message · Jon Griffiths

build: remove distutils dependency

47/100 · ThinMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
second-pass: broader security terminology
AI review queuedbuild(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 in /src/wasm_packageby dependabot[bot] · 32a17131 · May 9, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps-dev): bump fast-uri from 3.1.0 to 3.1.2 in /src/wasm_package

Bumps [fast-uri](https://github.com/fastify/fast-uri) from 3.1.0 to 3.1.2.
- [Release notes](https://github.com/fastify/fast-uri/releases)
- [Commits](https://github.com/fastify/fast-uri/compare/v3.1.0...v3.1.2)

---
updated-dependencies:
- dependency-name: fast-uri
dependency-version: 3.1.2
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedjs: regenerate wrappersby Jon Griffiths · 019385e5 · Apr 15, 2026 · 1 fileMessage 28 · OpaqueTriage 0Details
Commit message · Jon Griffiths

js: regenerate wrappers

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedBump version to 1.5.3by Jon Griffiths · 43b97bed · Apr 13, 2026 · 9 filesMessage 38 · OpaqueTriage 0Details
Commit message · Jon Griffiths

Bump version to 1.5.3

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedtx: fix output clearing size on tx_input_init_alloc failureby Jon Griffiths · 2b5fc0ec · Apr 9, 2026 · 1 fileMessage 73 · AdequateTriage 12Details
Commit message · Jon Griffiths

tx: fix output clearing size on tx_input_init_alloc failure

Reported-by: Jordan Mecom (@jmecom) via https://github.com/jmecom/odo

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedtx: add missing check for NULL written paramby Jon Griffiths · 53284275 · Apr 9, 2026 · 1 fileMessage 68 · AdequateTriage 12Details
Commit message · Jon Griffiths

tx: add missing check for NULL written param

Reported-by: Jordan Mecom (@jmecom) via https://github.com/jmecom/odo

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Links an issue, advisory, or supporting reference
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedbuild(deps): bump serialize-javascript and terser-webpack-pluginby dependabot[bot] · a24d8fcd · Mar 19, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps): bump serialize-javascript and terser-webpack-plugin

Removes [serialize-javascript](https://github.com/yahoo/serialize-javascript). It's no longer used after updating ancestor dependency [terser-webpack-plugin](https://github.com/webpack/terser-webpack-plugin). These dependencies need to be updated together.


Removes `serialize-javascript`

Updates `terser-webpack-plugin` from 5.3.16 to 5.4.0
- [Release notes](https://github.com/webpack/terser-webpack-plugin/releases)
- [Changelog](https://github.com/webpack/terser-webpack-plugin/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webpack/terser-webpack-plugin/compare/v5.3.16...v5.4.0)

---
updated-dependencies:
- dependency-name: serialize-javascript
dependency-version:
dependency-type: indirect
- dependency-name: terser-webpack-plugin
dependency-version: 5.4.0
dependency-type: indirect
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedtx: pre-allocate the full number of witnesses when deserializingby Jon Griffiths · 455ec5b0 · Mar 5, 2026 · 3 filesMessage 73 · AdequateTriage 20Details
Commit message · Jon Griffiths

tx: pre-allocate the full number of witnesses when deserializing

Prevents quadratic resizing for deserializing non-standard txs with
many witnesses. Note in the transaction.c case, analyze_tx has already
run and validated that the number of witnesses is sane.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
defensive validationsigning or wallet pathsecond-pass: near security thresholdsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI review queuedfuzz: add support for fuzzing tx parsingby Jon Griffiths · 9e8f9459 · Feb 12, 2026 · 4 filesMessage 55 · ThinTriage 17Details
Commit message · Jon Griffiths

fuzz: add support for fuzzing tx parsing

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI review queuedtx: tidy up ensure_ checksby Jon Griffiths · 6c6ef504 · Feb 12, 2026 · 1 fileMessage 60 · AdequateTriage 12Details
Commit message · Jon Griffiths

tx: tidy up ensure_ checks

Don't take a dst parameter where not needed.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedtx: fix check for short commitmentsby Jon Griffiths · 8ea4815a · Feb 12, 2026 · 1 fileMessage 60 · AdequateTriage 12Details
Commit message · Jon Griffiths

tx: fix check for short commitments

Thanks to @erickcestari for reporting and suggesting a fix.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedtx: prevent an asan false positiveby Jon Griffiths · 2583c931 · Feb 12, 2026 · 1 fileMessage 68 · AdequateTriage 17Details
Commit message · Jon Griffiths

tx: prevent an asan false positive

asan doesn't like math on NULL pointers, even when the result is unused.

This causes fuzzing to report false memory leaks when asan trips, so
trivially avoid it.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: security-sensitive path
AI review queuedbuild(deps-dev): bump webpack in /src/wasm_packageby dependabot[bot] · 8f1d9c34 · Feb 10, 2026 · 1 fileMessage 93 · StrongTriage 0Details
Commit message · dependabot[bot]

build(deps-dev): bump webpack in /src/wasm_package

Bumps [webpack](https://github.com/webpack/webpack) from 5.94.0 to 5.105.0.
- [Release notes](https://github.com/webpack/webpack/releases)
- [Changelog](https://github.com/webpack/webpack/blob/main/CHANGELOG.md)
- [Commits](https://github.com/webpack/webpack/compare/v5.94.0...v5.105.0)

---
updated-dependencies:
- dependency-name: webpack
dependency-version: 5.105.0
dependency-type: direct:development
...

Signed-off-by: dependabot[bot] <support@github.com>

93/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
Why it was queued
automated dependency-update discountsecond-pass: broader security terminology
AI review queuedBump version to 1.5.2by Jon Griffiths · 6439e6ef · Feb 1, 2026 · 10 filesMessage 38 · OpaqueTriage 0Details
Commit message · Jon Griffiths

Bump version to 1.5.2

38/100 · OpaqueMessage clarity
✓ Subject identifies a change✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI review queuedtests: transaction: deserialize ELIP203 test vectorsby Leonardo Comandini · 833d2cc5 · Jan 21, 2026 · 2 filesMessage 60 · AdequateTriage 17Details
Commit message · Leonardo Comandini

tests: transaction: deserialize ELIP203 test vectors

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidencesigning or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI review queuedtaproot: add bip341_control_block_verifyby Jon Griffiths · 7ecf1fa4 · Nov 13, 2025 · 9 filesMessage 35 · OpaqueTriage 12Details
Commit message · Jon Griffiths

taproot: add bip341_control_block_verify

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI review queuedbuild: fix clear sizes and index typeby Jon Griffiths · 1c482b85 · Nov 13, 2025 · 2 filesMessage 57 · ThinTriage 12Details
Commit message · Jon Griffiths

build: fix clear sizes and index type

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI review queuedelements: fix enable-elements-abi=no buildby Jon Griffiths · 05c3903d · Sep 28, 2025 · 2 filesMessage 45 · ThinTriage 12Details
Commit message · Jon Griffiths

elements: fix enable-elements-abi=no build

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path