AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 42 Bitcoin

lightningd: scan outputs for BIP86 addresses

Public commit record

What the developer wrote

Authored by Sangbida Chaudhuri

80/100 · Strong
lightningd: scan outputs for BIP86 addresses

This commit fixes an issue where BIP86 addresses were not being
discovered during wallet recovery/rescan operations.

The root cause was that init_txfilter() only populated the transaction
filter with BIP32-derived keys, preventing lightningd from recognizing
BIP86 UTXOs during blockchain scans. Now both BIP32 and BIP86 derived
scripts are included in the filter when BIP86 derivation is enabled.

This ensures that wallets restored from BIP39 mnemonics can properly
discover and display previously funded BIP86 addresses without requiring
manual address generation first.

[ We also move the slightly-lost comment about libbacktrace so it is
where we actually include <backtrace.h> --RR ]
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This commit fixes a wallet-recovery bug in Core Lightning. When a user restored a wallet that used BIP86 (a modern Bitcoin address type), the node failed to scan the blockchain for those addresses, so previously received funds would appear missing until the user manually generated an address. The patch makes the rescan process look for both BIP32 and BIP86 addresses.

Recommended action

Treat as a functional bug fix rather than an exploitable vulnerability. Users relying on BIP86 wallets should upgrade to ensure restored wallets discover all historical funds during rescan. No immediate incident-response action is indicated.

Security signals we found

01

Funds-availability/recovery bug

02

Missing address type in blockchain scan filter

03

BIP86 Taproot output discovery gap

Risk score

Why this scored 42/100

Our methodology →
Potential impact 12/30
Exploitability 5/25
Stealth signal 6/15
Affected reach 8/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.