Accepted findings
28
3 unique; 25 shared
gpt-6-luna
Candidate rows can merge into one accepted finding. Publish is the verifier decision; accepted attribution is recorded separately.
| PR | Finding | Verifier decision | Attribution | Report |
|---|---|---|---|---|
| #29409 | Nested block lookups can return incomplete data for a missing descendantsrc/ipc/capnp/chain.cpp:74state:1 | drop | Not accepted | report |
| #36641 | A failed insertion can leave the eviction order inconsistentsrc/musig.cpp:132state:1 | drop | Not accepted | report |
| #29491 | Worker can hide a batch verification failure behind an earlier script errorsrc/checkqueue.h:209state:1 | drop | Not accepted | report |
| #29491 | Batch creation leaks the batch allocation when scratch creation failssrc/secp256k1/src/modules/batch/main_impl.h:121state:2 | drop | Not accepted | report |
| #35932 | Connections accepted during draining escape shutdown quiescencesrc/ipc/capnp/protocol.cpp:141state:1 | undisposed | Not accepted | report |
| #35354 | Snapshot sync can park filter requests until the peer times outsrc/net_processing.cpp:3579state:1 | publish | Accepted, shared | report |
| #10102 | CoinControl maximum depth is replaced by the minimum depth over IPCsrc/ipc/capnp/wallet.cpp:196state:1 | publish | Accepted, shared | report |
| #30437 | Final tip comparison dereferences an empty optionalsrc/bitcoin-mine.cpp:159state:1 | publish | Accepted, shared | report |
| #30437 | The functional test accepts a failed block submissiontest/functional/feature_mine.py:28state:2 | publish | Accepted, shared | report |
| #30988 | Paused receives are still performed on socket error readinesssrc/common/sockman.cpp:461state:1 | drop | Not accepted | report |
| #35444 | Failed descriptor update leaves in-memory descriptor inconsistent with script mapssrc/wallet/scriptpubkeyman.cpp:1749state:1 | drop | Not accepted | report |
| #32468 | Coinbase reward omits fees from explicitly supplied transactionssrc/rpc/mining.cpp:470state:1 | drop | Not accepted | report |
| #33117 | Progress fraction can divide by zero for an empty snapshotsrc/validation.cpp:5849state:1 | undisposed | Not accepted | report |
| #33324 | Interruption during activation can leave an unresumable mixed-key directorysrc/node/blockstorage.cpp:1364state:1 | drop | Not accepted | report |
| #36697 | Do not flag a valid private key as inconsistent when it derives to no child keysrc/script/descriptor.cpp:246state:1 | drop | Not accepted | report |
| #36673 | The extension check rejects valid PEM files containing the full certificate chain.github/workflows/code-signing-certificate.yml:39state:1 | drop | Not accepted | report |
| #34603 | Windows attribute lookup treats missing paths as an errorsrc/util/fs_helpers.cpp:347state:1 | drop | Not accepted | report |
| #29491 | Successful script checks can be skipped after another worker reports failuresrc/checkqueue.h:209state:1 | drop | Not accepted | report |
| #29491 | Batch context allocation failure is not handledsrc/batchverify.cpp:22state:2 | drop | Not accepted | report |
| #36673 | Issue search may silently miss existing expiry alerts.github/workflows/code-signing-certificate.yml:48state:1 | drop | Not accepted | report |
| #35071 | Out-of-range checkpoint silently starts a fresh scan without discarding saved orphanssrc/node/blockstorage.cpp:1326state:1 | drop | Not accepted | report |
| #36521 | Weight budget omits the transaction input/output count bytessrc/primitives/transaction.h:260state:1 | drop | Not accepted | report |
| #36122 | Opt-out witnesses ending in a marker byte are misclassified as aggregated spendssrc/script/interpreter.cpp:2038state:1 | drop | Not accepted | report |
| #36607 | Eviction removes the guard for transactions that have not propagatedsrc/private_broadcast.cpp:41state:1 | publish | Accepted, shared | report |
| #35994 | Fix-it can omit trailing annotated constructor argumentscontrib/devtools/bitcoin-tidy/combine-assignments.cpp:146state:1 | drop | Not accepted | report |
| #34400 | Parallel scan can stop before processing blocks that were already read aheadsrc/wallet/scan.cpp:649state:1 | drop | Not accepted | report |
| #35286 | Package RBF replacements are moved into the first per-tx result onlysrc/validation.cpp:1550state:1 | drop | Not accepted | report |
| #35558 | TCP_INFO failures use the Windows error accessor on Unixsrc/util/sock.h:371state:1 | drop | Not accepted | report |
| #35558 | BSD/macOS congestion window is treated as bytes without multiplying by MSSsrc/util/sock.h:411state:2 | drop | Not accepted | report |
| #36629 | As-of queries can report spentness from after the selected blocksrc/rpc/blockchain.cpp:4097state:1 | drop | Not accepted | report |
| #36628 | GETDATA before TX completion is counted as an extra request and never servedsrc/privbcast/attempt.cpp:243state:1 | drop | Not accepted | report |
| #36434 | Startup replaces an existing live Unix RPC socketsrc/netbase.cpp:801state:1 | publish | Accepted, shared | report |
| #35511 | Amount arithmetic can overflow before consensus range checkssrc/consensus/amount.h:51state:1 | drop | Not accepted | report |
| #35377 | Substitution loop can skip adjacent key providerssrc/script/descriptor.cpp:1225state:1 | drop | Not accepted | report |
| #35355 | Kernel and node logger definitions collide when linked togethersrc/kernel/bitcoinkernel.cpp:1001state:1 | drop | Not accepted | report |
| #35302 | Fee bump can silently lose a silent-payment outputsrc/wallet/feebumper.cpp:288state:1 | drop | Not accepted | report |
| #35302 | sendall accepts silent-payment destinations in the amountless set but does not validate them consistentlysrc/wallet/rpc/spend.cpp:1518state:2 | drop | Not accepted | report |
| #34132 | Fatal read diagnostics can omit the actual database pathsrc/dbwrapper.cpp:365state:1 | drop | Not accepted | report |
| #35642 | Runtime sizing overflows for clocks near the supported chrono rangesrc/headerssync.cpp:402state:1 | drop | Not accepted | report |
| #35728 | An unusable txindex row can prevent an explicit-block lookupsrc/node/transaction.cpp:164state:1 | publish | Accepted, shared | report |
| #35788 | Cannot select the TAPROOT sigversionsrc/bitcoin-util.cpp:295state:1 | drop | Not accepted | report |
| #36325 | Key-path validation drops the first path componentcontrib/multisig/wizard.py:84state:1 | drop | Not accepted | report |
| #36325 | Own-key discovery uses the same truncated origin pathcontrib/multisig/wizard.py:276state:2 | drop | Not accepted | report |
| #36628 | The receive cap can be bypassed by a peer closing on the over-cap readsrc/privbcast/attempt.cpp:103state:1 | drop | Not accepted | report |
| #35911 | `[[noreturn]]` is false when assertions are disabledsrc/test/util/net.cpp:237state:1 | drop | Not accepted | report |
| #36629 | Reads of block files can race pruningsrc/index/txoscriptindex.cpp:166state:1 | drop | Not accepted | report |
| #36000 | A missing-data gap permanently prevents read-ahead past that blocksrc/node/blockfetcher.cpp:58state:1 | drop | Not accepted | report |
| #36015 | Witness-heavy duplicates can still allocate unbounded deserialized memorysrc/node/txorphanage.cpp:397state:1 | drop | Not accepted | report |
| #36033 | Block import constructs a non-empty span from a nullable lengths pointersrc/kernel/bitcoinkernel.cpp:1345state:1 | publish | Accepted, sole | report |
| #36434 | Windows still attempts TCP-only socket options for Unix listenerssrc/httpserver.cpp:763state:1 | drop | Not accepted | report |
| #36677 | Append streams can lose append semantics after seekingsrc/util/fs.cpp:56state:1 | drop | Not accepted | report |
| #36114 | A request-only MuSig2 sighash can bypass the unsafe-sighash checksrc/external_signer.cpp:175state:1 | publish | Accepted, shared | report |
| #36677 | O_CLOEXEC is not available on every non-Linux POSIX targetsrc/util/fs.cpp:34state:1 | drop | Not accepted | report |
| #36122 | Transaction-level CISA verification strips annex data but hashes it as if absentsrc/script/interpreter.cpp:184state:1 | drop | Not accepted | report |
| #36434 | Socket permission change can follow a symlink swapped in after bindsrc/httpserver.cpp:846state:1 | publish | Accepted, sole | report |
| #36628 | A failed SOCKS5 reply is treated as a successful connectionsrc/privbcast/socks5.cpp:156state:1 | drop | Not accepted | report |
| #35793 | 64-byte transactions are rejected from mempool before BIP54 activatessrc/validation.cpp:812state:1 | drop | Not accepted | report |
| #33904 | REST results can differ from request ordersrc/rest.cpp:987state:1 | publish | Accepted, shared | report |
| #36608 | A package job does not cover a duplicate child-only submission while its parent is absentsrc/node/privbcast.cpp:427state:1 | drop | Not accepted | report |
| #36628 | Receive cap is enforced after parsing the entire readsrc/privbcast/attempt.cpp:96state:1 | drop | Not accepted | report |
| #33904 | Mixed mempool and index results do not preserve request ordersrc/rest.cpp:987state:1 | publish | Accepted, shared | report |
| #33904 | Mixed lookups return results out of request ordersrc/rest.cpp:986state:1 | publish | Accepted, shared | report |
| #36082 | macOS signing skips non-executable helper binaries.github/ci-guix-test.py:31state:1 | drop | Not accepted | report |
| #36677 | Fix the syntax errors in the Windows test branchsrc/test/fs_tests.cpp:157state:1 | publish | Accepted, shared | report |
| #36628 | A stream's buffered bytes can be discarded at a deadlinesrc/privbcast/job.cpp:145state:1 | drop | Not accepted | report |
| #36082 | Windows test runner invokes the wrong executable path.github/ci-guix-test.py:67state:1 | undisposed | Not accepted | report |
| #36677 | Windows test uses an undefined cast identifiersrc/test/fs_tests.cpp:157state:1 | undisposed | Not accepted | report |
| #36677 | Windows inheritance assertion is malformedsrc/test/fs_tests.cpp:159state:2 | undisposed | Not accepted | report |
| #36607 | Decide whether eviction should end the privacy guardsrc/private_broadcast.cpp:41state:1 | publish | Accepted, shared | report |
| #36607 | Eviction can remove an echoed transaction before its private connections disconnectsrc/private_broadcast.cpp:43state:1 | undisposed | Not accepted | report |
| #36681 | Free selected prune files before the coins disk-space preflightsrc/validation.cpp:2829state:1 | publish | Accepted, shared | report |
| #36681 | Sync prune-forced coins batches before committing the prune indexsrc/validation.cpp:2828state:2 | publish | Accepted, shared | report |
| #36607 | Re-adding a finished private transaction clears the privacy guardsrc/private_broadcast.cpp:33state:1 | drop | Not accepted | report |
| #36603 | Block-index changes are committed before snapshot activation can failsrc/validation.cpp:5763state:1 | drop | Not accepted | report |
| #36677 | Windows test uses an undeclared `reinterpret_case`src/test/fs_tests.cpp:157state:1 | undisposed | Not accepted | report |
| #36677 | Malformed `BOOST_CHECK` expression in Windows branchsrc/test/fs_tests.cpp:159state:2 | undisposed | Not accepted | report |
| #36292 | Legacy directory is left behind when it contains non-LevelDB filessrc/index/coinstatsindex.cpp:98state:1 | drop | Not accepted | report |
| #36326 | Make fatal-error rendering exhaustivesrc/validation.cpp:2147state:1 | publish | Accepted, shared | report |
| #36180 | Include `-prev` writes in `setOption`'s success trackingsrc/qt/optionsmodel.cpp:509state:1 | publish | Accepted, shared | report |
| #36628 | Receive cap is checked only after parsing the whole readsrc/privbcast/attempt.cpp:96state:1 | drop | Not accepted | report |
| #36628 | Attempt deadline is not enforced after every decoded messagesrc/privbcast/attempt.cpp:141state:2 | drop | Not accepted | report |
| #36539 | Release note overstates external signer incompatibilitydoc/release-notes-hwi-minver.md:4state:1 | undisposed | Not accepted | report |
| #36628 | A peer VERSION received before SOCKS CONNECT completes is discardedsrc/privbcast/attempt.cpp:63state:1 | drop | Not accepted | report |
| #36380 | A mistyped `initialonly` silently disables all wallet broadcastingsrc/wallet/wallet.cpp:2939state:1 | publish | Accepted, shared | report |
| #36481 | Check the selection before indexing itsrc/qt/transactionview.cpp:404state:1 | publish | Accepted, shared | report |
| #36481 | Clarify manual rebroadcast behavior while the chain is not readysrc/wallet/wallet.cpp:1842state:2 | publish | Accepted, shared | report |
| #35793 | 64-byte transaction rule is skipped during chainstate reindexsrc/validation.cpp:4179state:1 | unresolved | Not accepted | report |
| #36664 | Preserve ERR monitoring for send-only socketssrc/util/sock.cpp:213state:1 | publish | Accepted, shared | report |
| #36543 | An interrupted commitment hash lets IBD continue without checking the commitmentsrc/validation.cpp:3079state:1 | drop | Not accepted | report |
| #36661 | Select misses error events for send-only socketssrc/util/sock.cpp:217state:1 | publish | Accepted, shared | report |
| #36548 | Script length addition can wrap before the bounds checksrc/node/blockstorage.cpp:1127state:1 | drop | Not accepted | report |
| #36481 | Clarify manual rebroadcast behavior while the chain is not readysrc/wallet/wallet.cpp:1842state:1 | publish | Accepted, sole | report |
| #36122 | Finalizer accepts 65-byte half-aggregation signatures with an absent PSBT sighash fieldsrc/psbt.cpp:877state:1 | drop | Not accepted | report |
| #36122 | A finalized non-aggregated input can terminate an aggregation group during PSBT finalizationsrc/psbt.cpp:863state:2 | drop | Not accepted | report |
| #35793 | Mempool enforces BIP54 sigops before activationsrc/validation.cpp:894state:1 | drop | Not accepted | report |
| #35762 | Extended tests are not registered by setting the variable at CTest invocationtest/README.md:141state:1 | drop | Not accepted | report |
| #36645 | A matching high file-info key bypasses the allocation guardsrc/node/blockstorage.cpp:572state:1 | publish | Accepted, shared | report |
| #34400 | Pending verdicts can be stranded at the queue boundarysrc/wallet/scan.cpp:507state:1 | drop | Not accepted | report |
| #33904 | Preserve request order across mempool and index resultssrc/rest.cpp:968state:1 | publish | Accepted, shared | report |
| #36325 | Taproot key limit exceeds the consensus script-size limitcontrib/multisig/wizard.py:10state:1 | drop | Not accepted | report |
| #36629 | The output-index sort uses a non-writable transform viewsrc/rpc/blockchain.cpp:3959state:1 | drop | Not accepted | report |
| #36608 | Parent requests can be missed when GETDATA lists the child firstsrc/privbcast/attempt.cpp:289state:1 | drop | Not accepted | report |
| #33741 | Raw-fee bucket conversion can overflow at the CAmount boundarysrc/rpc/fees.cpp:244state:1 | drop | Not accepted | report |
| #33741 | Replace the existing fee-result descriptionssrc/rpc/net.cpp:724state:2 | publish | Accepted, shared | report |
| #35558 | Deadlocks when compact-block announcement is sent under cs_mainsrc/net_processing.cpp:2390state:1 | drop | Not accepted | report |
Selection uses publish, drop and unresolved candidates; unassessed candidates are excluded.