Accepted findings
38
2 unique; 36 shared
gpt-6-luna
Candidate rows can merge into one accepted finding. Publish is the verifier decision; accepted attribution is recorded separately.
| PR | Finding | Verifier decision | Attribution | Report |
|---|---|---|---|---|
| #29409 | Unbounded recursive FoundBlock requests can exhaust the stacksrc/ipc/capnp/chain.cpp:83independent:1 | drop | Not accepted | report |
| #36167 | Alias lookup is only fixed for top-level RPC argumentssrc/rpc/util.cpp:774independent:1 | drop | Not accepted | report |
| #29491 | A stale script-check error can mark the next valid block invalidsrc/checkqueue.h:209independent:1 | publish | Accepted, shared | report |
| #35932 | Connections accepted during draining are not disconnected or drainedsrc/ipc/capnp/protocol.cpp:142independent:1 | undisposed | Not accepted | report |
| #10102 | CoinControl maximum depth is replaced by the minimum depth over IPCsrc/ipc/capnp/wallet.cpp:196independent:1 | publish | Accepted, shared | report |
| #25573 | The static-PIE linker flags are overwritten before CMake receives themcontrib/guix/libexec/build_linux.sh:48independent:1 | drop | Not accepted | report |
| #25573 | Static ELF checks use assertions that do not report failurescontrib/guix/symbol-check.py:342independent:2 | drop | Not accepted | report |
| #29418 | Sent counts include messages that were not fully writtensrc/net.cpp:1640independent:1 | publish | Accepted, shared | report |
| #30437 | Final tip comparison dereferences an empty optionalsrc/bitcoin-mine.cpp:159independent:1 | publish | Accepted, shared | report |
| #30951 | Automatic connections can still fall back to v1src/net.cpp:448independent:1 | drop | Not accepted | report |
| #30988 | A refused accepted socket stays registered until disconnect processingsrc/common/sockman.cpp:310independent:1 | drop | Not accepted | report |
| #36631 | PSBT mutations are truncated without preserving map boundariessrc/test/fuzz/util/psbt.cpp:478independent:1 | publish | Accepted, shared | report |
| #32468 | Fixed satoshi rewards are parsed with a zero-decimal limitsrc/rpc/mining.cpp:406independent:1 | drop | Not accepted | report |
| #33117 | Progress notifications stop before snapshot validation finishessrc/validation.cpp:5848independent:1 | undisposed | Not accepted | report |
| #33324 | A crashed per-file migration can leave a stale staged file that is activated as completesrc/node/blockstorage.cpp:1355independent:1 | drop | Not accepted | report |
| #36697 | P2SH-P2WPKH exports are rejected as unsolvablesrc/wallet/export.cpp:207independent:1 | drop | Not accepted | report |
| #34038 | `trace` is applied before `exclude`, despite the documented parameter ordersrc/rpc/node.cpp:296independent:1 | drop | Not accepted | report |
| #34534 | Startup pruning ignores `-prunelockheight`src/init.cpp:2132independent:1 | publish | Accepted, shared | report |
| #29491 | A worker can be counted twice before every batch is verifiedsrc/checkqueue.h:138independent:1 | publish | Accepted, shared | report |
| #35858 | Privacy guide omits the `-proxyrandomize` caveatdoc/privacy.md:25independent:1 | publish | Accepted, shared | report |
| #35858 | Privacy guide omits the `-proxyrandomize` caveatdoc/privacy.md:25independent:2 | publish | Accepted, shared | report |
| #36677 | Exclusive-create mode is not implemented for append modesrc/util/fs.cpp:46independent:1 | undisposed | Not accepted | report |
| #35071 | A stale checkpoint can skip newly added block filessrc/node/blockstorage.cpp:1326independent:1 | drop | Not accepted | report |
| #36521 | Empty vin with witness flags skips the encoded output countsrc/primitives/transaction.h:269independent:1 | drop | Not accepted | report |
| #35569 | Missed direct access prevents privatizing the transaction fieldssrc/test/fuzz/script_sign.cpp:109independent:1 | drop | Not accepted | report |
| #36122 | Opted-out v2 signatures use the Taproot sighash epochsrc/script/interpreter.cpp:145independent:1 | drop | Not accepted | report |
| #36607 | Eviction removes the guard for transactions that have not propagatedsrc/private_broadcast.cpp:41independent:1 | publish | Accepted, shared | report |
| #35994 | Completeness check can combine mismatched annotation groupscontrib/devtools/bitcoin-tidy/combine-assignments.cpp:146independent:1 | drop | Not accepted | report |
| #34400 | Queued filter checks can be stranded at interval boundariessrc/wallet/scan.cpp:507independent:1 | drop | Not accepted | report |
| #35558 | BSD and macOS congestion window is treated as bytessrc/util/sock.h:410independent:1 | drop | Not accepted | report |
| #35558 | TCP_INFO failures use the Windows error accessor on every platformsrc/util/sock.h:370independent:2 | drop | Not accepted | report |
| #36629 | Discarding an as-of spender leaves the output reported unspentsrc/rpc/blockchain.cpp:4097independent:1 | drop | Not accepted | report |
| #36434 | A failed socket-permission change leaves an active listener behindsrc/httpserver.cpp:827independent:1 | drop | Not accepted | report |
| #35728 | Explicit-block lookup can report an I/O error instead of a transaction-index hitsrc/node/transaction.cpp:164independent:1 | drop | Not accepted | report |
| #35642 | Negative clock spans can overflow the fallback header boundsrc/headerssync.cpp:595independent:1 | drop | Not accepted | report |
| #35511 | Explicit CAmount construction accepts unsigned values that wrapsrc/consensus/amount.h:36independent:1 | publish | Accepted, shared | report |
| #35511 | Arithmetic still permits unchecked signed overflowsrc/consensus/amount.h:50independent:2 | drop | Not accepted | report |
| #35355 | Kernel trace threshold cannot be selected before callback registrationsrc/kernel/bitcoinkernel.cpp:547independent:1 | drop | Not accepted | report |
| #35642 | Extreme legal inputs can overflow the buffer-size conversionsrc/headerssync.cpp:456independent:1 | drop | Not accepted | report |
| #36626 | Unsupported-version test only exercises version 3test/functional/rpc_psbt.py:845independent:1 | drop | Not accepted | report |
| #36690 | The 1023-character test passes the wrong checksum error labelsrc/test/bech32_tests.cpp:80independent:1 | drop | Not accepted | report |
| #35671 | Missing-transaction input has no effective byte-size limitsrc/node/tx_collection.cpp:80independent:1 | drop | Not accepted | report |
| #35713 | Collection assertion compares subrange objects rather than their elementssrc/test/util/framework.h:772independent:1 | drop | Not accepted | report |
| #35788 | Tapscript sigop cost is always reported as zerosrc/bitcoin-util.cpp:476independent:1 | drop | Not accepted | report |
| #36325 | Private key lookup can silently miss a cosigner after the wallet imports another multisigcontrib/multisig/wizard.py:267independent:1 | drop | Not accepted | report |
| #36628 | Data received at the deadline is still parsed and acted onsrc/privbcast/job.cpp:141independent:1 | drop | Not accepted | report |
| #35855 | The Windows GUI build still uses the old fatal-link-warning flagcontrib/guix/libexec/build_win.sh:53independent:1 | publish | Accepted, shared | report |
| #36629 | Confirmed history transactions bypass the shared byte budgetsrc/rpc/blockchain.cpp:3999independent:1 | drop | Not accepted | report |
| #36000 | Load blocks queued behind an in-flight read can discard the usable windowsrc/node/blockfetcher.cpp:41independent:1 | drop | Not accepted | report |
| #36002 | Legacy txindex misses discard pruned-block candidatessrc/index/txindex.cpp:228independent:1 | drop | Not accepted | report |
| #36677 | `x` is ignored for append mode on non-Linux POSIXsrc/util/fs.cpp:26independent:1 | drop | Not accepted | report |
| #36690 | The 3- and 4-change cases do not assert checksum failuresrc/test/bech32_tests.cpp:200independent:1 | drop | Not accepted | report |
| #36114 | Reject explicit Taproot SIGHASH_DEFAULT as unsafesrc/external_signer.cpp:105independent:1 | drop | Not accepted | report |
| #36677 | Append mode seeks on a descriptor already opened with O_APPENDsrc/util/fs.cpp:57independent:1 | drop | Not accepted | report |
| #36631 | Truncating serialized mutations can exceed libFuzzer's input buffersrc/test/fuzz/util/psbt.cpp:478independent:1 | drop | Not accepted | report |
| #36631 | Truncating serialized mutations can overrun libFuzzer's buffersrc/test/fuzz/util/psbt.cpp:478independent:1 | drop | Not accepted | report |
| #33904 | REST results can differ from request ordersrc/rest.cpp:987independent:1 | publish | Accepted, shared | report |
| #36677 | Preserve existing descriptor flags when setting close-on-execsrc/util/fs.cpp:27independent:1 | drop | Not accepted | report |
| #36631 | Truncating serialized mutations can overrun libFuzzer's output buffersrc/test/fuzz/util/psbt.cpp:478independent:1 | drop | Not accepted | report |
| #36608 | Receive-cap overflow can bypass the per-attempt byte limitsrc/privbcast/attempt.cpp:99independent:1 | drop | Not accepted | report |
| #36628 | Receive cap can be bypassed by a single large readsrc/privbcast/attempt.cpp:96independent:1 | drop | Not accepted | report |
| #33904 | Mixed mempool and index results do not preserve request ordersrc/rest.cpp:987independent:1 | publish | Accepted, shared | report |
| #33904 | Mixed lookups return results out of request ordersrc/rest.cpp:986independent:1 | publish | Accepted, shared | report |
| #36167 | `scanblocks` now treats an omitted start height as height zerosrc/rpc/blockchain.cpp:2658independent:1 | drop | Not accepted | report |
| #36082 | Set test configuration fields before accessing the environment section.github/ci-guix-test.py:39independent:1 | drop | Not accepted | report |
| #36677 | Fix the syntax errors in the Windows test branchsrc/test/fs_tests.cpp:157independent:1 | publish | Accepted, shared | report |
| #36628 | Receive cap is enforced after processing the allowed prefixsrc/privbcast/attempt.cpp:96independent:1 | drop | Not accepted | report |
| #35793 | Avoid narrowing the retarget interval to intsrc/validation.cpp:4111independent:1 | undisposed | Not accepted | report |
| #36683 | The maxconnections clamp note is rendered outside its bulletdoc/release-notes/release-notes-32.1.md:126independent:1 | undisposed | Not accepted | report |
| #36082 | Functional tests still resolve binaries from the workspace.github/ci-guix-test.py:42independent:1 | undisposed | Not accepted | report |
| #36677 | Windows inheritance assertion does not compilesrc/test/fs_tests.cpp:159independent:1 | undisposed | Not accepted | report |
| #36607 | Decide whether eviction should end the privacy guardsrc/private_broadcast.cpp:41independent:1 | publish | Accepted, shared | report |
| #36607 | Finished entries can forget a private-broadcast transaction while it is still livesrc/private_broadcast.cpp:18independent:1 | undisposed | Not accepted | report |
| #36681 | Sync prune-forced coins batches before committing the prune indexsrc/validation.cpp:2828independent:1 | publish | Accepted, shared | report |
| #36681 | Free selected prune files before the coins disk-space preflightsrc/validation.cpp:2829independent:2 | publish | Accepted, shared | report |
| #36607 | Eviction can erase the new transaction instead of the oldest finished entrysrc/private_broadcast.cpp:41independent:1 | drop | Not accepted | report |
| #36270 | Depends-path check omits Mach-O and PE binariescontrib/guix/symbol-check.py:282independent:1 | undisposed | Not accepted | report |
| #36603 | Sync the chainstate directory before writing the completion markersrc/node/utxo_snapshot.cpp:319independent:1 | publish | Accepted, shared | report |
| #36677 | Windows inheritance assertion does not compilesrc/test/fs_tests.cpp:159independent:1 | undisposed | Not accepted | report |
| #36292 | Nested files can prevent removal of the legacy directorysrc/index/coinstatsindex.cpp:98independent:1 | drop | Not accepted | report |
| #36677 | The new test does not compile on Windowssrc/test/fs_tests.cpp:142independent:1 | undisposed | Not accepted | report |
| #36326 | Make fatal-error rendering exhaustivesrc/validation.cpp:2147independent:1 | publish | Accepted, shared | report |
| #36180 | Include `-prev` writes in `setOption`'s success trackingsrc/qt/optionsmodel.cpp:509independent:1 | publish | Accepted, shared | report |
| #36180 | Include `-prev` writes in `setOption`'s success trackingsrc/qt/optionsmodel.cpp:509independent:2 | publish | Accepted, shared | report |
| #36677 | POSIX-only descriptor test breaks Windows buildssrc/test/fs_tests.cpp:142independent:1 | undisposed | Not accepted | report |
| #36380 | A mistyped `initialonly` silently disables all wallet broadcastingsrc/wallet/wallet.cpp:2939independent:1 | publish | Accepted, shared | report |
| #36002 | Legacy fallback hides known pruned candidate blockssrc/index/txindex.cpp:230independent:1 | drop | Not accepted | report |
| #36188 | Avoid rerunning global SHA dispatch during ECC context creationsrc/ecc_context.cpp:32independent:1 | publish | Accepted, shared | report |
| #36588 | Embedded-NUL Capitalize test compares different string lengthssrc/test/util_tests.cpp:1177independent:1 | drop | Not accepted | report |
| #35728 | Pruned txindex entries now turn unrelated lookups into errorssrc/index/txindex.cpp:198independent:1 | drop | Not accepted | report |
| #36481 | Clarify manual rebroadcast behavior while the chain is not readysrc/wallet/wallet.cpp:1842independent:1 | publish | Accepted, shared | report |
| #35713 | Collection compatibility macro requires range equalitysrc/test/util/framework.h:769independent:1 | drop | Not accepted | report |
| #36387 | Keep encrypted-wallet coverage for the signing cases in this testtest/functional/wallet_signrawtransactionwithwallet.py:49independent:1 | publish | Accepted, sole | report |
| #25573 | Static-PIE linker flags are overridden by the next CMake optioncontrib/guix/libexec/build_linux.sh:48independent:1 | undisposed | Not accepted | report |
| #36539 | Release note describes a compatibility break this PR removesdoc/release-notes-hwi-minver.md:10independent:1 | drop | Not accepted | report |
| #36612 | Keep the OpenBSD data-limit guidance actionabledoc/build-unix.md:105independent:1 | publish | Accepted, sole | report |
| #36481 | Rebroadcast eligibility admits conflicted transactionssrc/wallet/wallet.cpp:1865independent:1 | undisposed | Not accepted | report |
| #36481 | Rebroadcast action assumes a nonempty selectionsrc/qt/transactionview.cpp:404independent:2 | undisposed | Not accepted | report |
| #35558 | Retain malformed-prefill cases in the compact-block fuzzersrc/test/fuzz/cmpctblock.cpp:303independent:1 | drop | Not accepted | report |
| #31507 | clang-cl ARM64 configure rejects Visual Studio's processor nameCMakeLists.txt:329independent:1 | undisposed | Not accepted | report |
| #36670 | Release timestamps when transactions are cleaned upsrc/test/fuzz/private_broadcast.cpp:54independent:1 | unresolved | Not accepted | report |
| #36666 | Preserve ERR reporting for SEND-only waitssrc/util/sock.cpp:213independent:1 | publish | Accepted, shared | report |
| #36664 | 64-bit positions are narrowed by AllocateFileRange lengthsrc/util/fs_helpers.cpp:181independent:1 | drop | Not accepted | report |
| #36664 | SEND-only waits omit exception monitoring with `select()`src/util/sock.cpp:213independent:1 | publish | Accepted, shared | report |
| #36661 | Select misses error events for send-only socketssrc/util/sock.cpp:217independent:1 | publish | Accepted, shared | report |
| #33741 | Raw fee bucket ranges remain in BTC/kvB when `sat_vb` is false only, but switch representation incorrectly for large valuessrc/rpc/fees.cpp:242independent:1 | drop | Not accepted | report |
| #36658 | Preserve exception monitoring for send-only waitssrc/util/sock.cpp:222independent:1 | publish | Accepted, shared | report |
| #36664 | Select backend misses errors for SEND-only socketssrc/util/sock.cpp:213independent:1 | publish | Accepted, shared | report |
| #36658 | Send-only sockets no longer report exceptional eventssrc/util/sock.cpp:222independent:1 | drop | Not accepted | report |
| #36669 | Update format specifiers for widened position fieldssrc/flatfile.cpp:27independent:1 | drop | Not accepted | report |
| #35442 | Test funded transaction sequences for deprecated replaceable handlingtest/functional/wallet_deprecated_rbf.py:59independent:1 | publish | Accepted, shared | report |
| #36607 | A public announcement queued before private tracking can still leak the transactionsrc/net_processing.cpp:2491independent:1 | drop | Not accepted | report |
| #36629 | The output-index sort is not writablesrc/rpc/blockchain.cpp:3961independent:1 | drop | Not accepted | report |
| #36548 | Guard script-length addition against overflowsrc/node/blockstorage.cpp:1127independent:1 | drop | Not accepted | report |
| #36122 | Full-aggregation session ID collides for repeated key/noncesrc/script/sign.cpp:95independent:1 | drop | Not accepted | report |
| #36482 | Update the periodic-resubmission documentationsrc/wallet/wallet.cpp:1928independent:1 | unresolved | Not accepted | report |
| #35793 | BIP54 timestamp rule is gated by the previous block's deployment statesrc/validation.cpp:4118independent:1 | drop | Not accepted | report |
| #36641 | Assert the exact cap and retained FIFO windowsrc/wallet/test/scriptpubkeyman_tests.cpp:79independent:1 | publish | Accepted, shared | report |
| #29418 | Sent counts include messages that may not complete transmissionsrc/net.cpp:1640independent:1 | publish | Accepted, shared | report |
| #32387 | Treats a signaled child as an ordinary pipe errorsrc/ipc/libmultiprocess/src/mp/util.cpp:426independent:1 | unresolved | Not accepted | report |
| #32387 | Temporary-directory creation can loop forever on filesystem errorssrc/ipc/libmultiprocess/test/mp/test/socketlistener.h:116independent:2 | drop | Not accepted | report |
| #31507 | Guard x86-only intrinsic probes by target architecturecmake/introspection.cmake:91independent:1 | drop | Not accepted | report |
| #31507 | clang-cl is still classified as MSVC by vendored compiler checksCMakeLists.txt:336independent:1 | drop | Not accepted | report |
| #36645 | A matching high file-info key bypasses the allocation guardsrc/node/blockstorage.cpp:572independent:1 | publish | Accepted, shared | report |
| #36114 | Accepts undefined sighash encodings as safesrc/external_signer.cpp:114independent:1 | drop | Not accepted | report |
| #34400 | Scan can stop before processing queued matches after reaching the wallet tipsrc/wallet/scan.cpp:649independent:1 | drop | Not accepted | report |
| #34603 | Do not abort wallet listing when an entry disappearssrc/wallet/db.cpp:34independent:1 | drop | Not accepted | report |
| #36628 | Use the fresh clock when processing each ready streamsrc/privbcast/job.cpp:140independent:1 | drop | Not accepted | report |
| #33904 | Reject oversized requests before parsing all outpointssrc/rest.cpp:901independent:1 | drop | Not accepted | report |
| #36628 | A peer can announce before sending its required WTXIDRELAYsrc/privbcast/attempt.cpp:268independent:1 | drop | Not accepted | report |
| #36586 | Avoid a potentially throwing second space query in the warning pathsrc/validation.cpp:2841independent:1 | drop | Not accepted | report |
| #35139 | Failure formatting can read past a non-terminated char arraysrc/test/util/common.h:121independent:1 | publish | Accepted, shared | report |
| #36325 | Key-origin path parsing drops the first path componentcontrib/multisig/wizard.py:84independent:1 | drop | Not accepted | report |
| #36631 | Preserve trailing bytes when parsing a truncated mapsrc/test/fuzz/util/psbt.cpp:467independent:1 | drop | Not accepted | report |
| #36628 | A closed discovery stream can leave the job waiting until the discovery deadlinesrc/privbcast/job.cpp:134independent:1 | drop | Not accepted | report |
| #36480 | Legacy-format detection misses the serialized key prefixsrc/index/txospenderindex.cpp:52independent:1 | drop | Not accepted | report |
| #36628 | Count bytes received after the attempt deadlinesrc/privbcast/attempt.cpp:86independent:1 | drop | Not accepted | report |
| #35302 | sendall divides by zero when no recipients omit amountssrc/wallet/rpc/spend.cpp:1674independent:1 | drop | Not accepted | report |
| #36627 | Do not detect the bitcoin launcher by truthinesstest/functional/test_framework/usdt.py:27independent:1 | drop | Not accepted | report |
| #36626 | Unsupported-version test bypasses the test framework's own version assertiontest/functional/rpc_psbt.py:846independent:1 | drop | Not accepted | report |
| #36626 | Missing-version test removes a field that is not presenttest/functional/rpc_psbt.py:853independent:2 | drop | Not accepted | report |
| #33741 | Replace the existing fee-result descriptionssrc/rpc/net.cpp:724independent:1 | publish | Accepted, shared | report |
| #33741 | Raw-fee bucket ranges lose fractional sat/vB precisionsrc/rpc/fees.cpp:242independent:2 | drop | Not accepted | report |
| #36305 | Fail closed if Windows socket exclusivity cannot be setsrc/net.cpp:3400independent:1 | publish | Accepted, shared | report |
| #35558 | BSD congestion window is reported in bytes, not segmentssrc/util/sock.h:409independent:1 | unresolved | Not accepted | report |
Selection uses publish, drop and unresolved candidates; unassessed candidates are excluded.