Skip to content

BitWindow orchestrator wallet: 15 fixes from a security review - #2142

Open
giaki3003 wants to merge 16 commits into
LayerTwo-Labs:masterfrom
giaki3003:fix/w5-area-orch-wallet
Open

giaki3003 wants to merge 16 commits into
LayerTwo-Labs:masterfrom
giaki3003:fix/w5-area-orch-wallet

Conversation

@giaki3003

Copy link
Copy Markdown
Contributor

A set of 15 independent fixes to the BitWindow orchestrator wallet, stacked on one branch so they can be reviewed together and cherry-picked individually. Based on current master; the branch builds and its tests pass at the tip (25 files changed, 1168 insertions(+), 89 deletions(-)).

Fixes (oldest first)

  • 7bbfcd550 drivechain-frontends ElectrumBackend cachedScan tip outage lets CreateCpfp spend an already-confirmed parent
  • da2bbfc07 BIP47 feature byte 79 is accepted but ignored during sends
  • 1b21ca1a1 ChangePassword non-atomic wallet/metadata write window permanently locks wallet
  • d119270c1 sidechain-orchestrator DeleteWallet leaves Core wallet loaded
  • 650e97034 Mainnet Electrum server switching rejects every Electrum endpoint
  • 47626fb4e CPFP sizes a BIP47 P2PKH parent input as the wallet's P2WPKH kind and misses the requested package rate
  • c8a398eb7 Fixed watch-only descriptors are imported with an invalid range
  • aa5e02239 orchestrator WalletEngine.coreWallets cache survives bitcoind restart that unloads load_on_startup=false Core wallets
  • a0d7db223 BIP47 reserved-byte aliases split state and reuse payment addresses
  • b3cee69bc restored Core-derived sidechain starter is imported at "now"
  • ec7b848a0 Orchestrator wallet lock omits stream state notification
  • c2b494332 Core watch-only taproot descriptor defaults to native-segwit receive
  • a183758ba first upgraded network permanently selects whether legacy enforcer account is watched
  • a6aa696c5 CreateDeposit records can be filed under the target network after a concurrent swap
  • 1facbfdc3 testnet startup panics while migrating a matching legacy enforcer wallet

Reconciliation

One commit reconciles fixes that each pass alone but interact when combined (kept every fix; the change is minimal and additive):

  • 449f328b0 reconcile orch-wallet — Forget test stub must clear the load-aware core fake

Each commit is self-contained — git cherry-pick <sha> works for any of them. Happy to split, reorder, or drop any. Finding reports for individual fixes available on request.

giaki3003 and others added 16 commits August 30, 2026 22:34
…ets `CreateCpfp` spend an already-confirmed parent

Bug: w5-20260727-2143-kimiclaw-confirm-openclaw- (primary)
Finding: findings/20260727-2143-kimiclaw-confirm-openclaw-drivechain-frontends-electrum-outage-cpfp-confirmed-parent.md
Severity: R3-T2

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 3c472d4)
Bug: w5-20260617-2033-kimiclaw-confirm-openclaw- (primary)
Finding: findings/20260617-2033-kimiclaw-confirm-openclaw-drivechain-frontends-bip47-feature-byte-ignored.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e389f64)
…ly locks wallet

Bug: w5-20260620-2233-kimiclaw-confirm-glmclaw-d (primary)
Finding: findings/20260620-2233-kimiclaw-confirm-glmclaw-drivechain-frontends-bitwindow-changepassword-nonatomic-wallet-metadata-write.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit d44b457)
Bug: w5-20260622-1925-glmclaw-confirm-kimiclaw-d (primary)
Finding: findings/20260622-1925-glmclaw-confirm-kimiclaw-drivechain-frontends-delete-wallet-core-leak.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit d0bead9)
Bug: w5-20260712-1245-kimiclaw-confirm-openclaw- (primary)
Finding: findings/20260712-1245-kimiclaw-confirm-openclaw-drivechain-frontends-electrum-server-switch-http-validator.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit e6fcac6)
…d and misses the requested package rate

Bug: w5-20260713-2145-openclaw-confirm-kimiclaw- (primary)
Finding: findings/20260713-2145-openclaw-confirm-kimiclaw-drivechain-frontends-cpfp-bip47-parent-input-vsize-underpay.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 90340b4)
Bug: w5-20260728-0431-kimiclaw-confirm-openclaw- (primary)
Finding: findings/20260728-0431-kimiclaw-confirm-openclaw-drivechain-frontends-fixed-watch-descriptor-range.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 7dddfe2)
…start that unloads `load_on_startup=false` Core wallets

Bug: w5-20260804-0017-kimiclaw-confirm-glmclaw-d (primary)
Finding: findings/20260804-0017-kimiclaw-confirm-glmclaw-drivechain-frontends-orchestrator-corewallets-cache-survives-bitcoind-restart-unload.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 6a9b079)
Bug: w5-20260810-0946-kimiclaw-confirm-openclaw- (primary)
Finding: findings/20260810-0946-kimiclaw-confirm-openclaw-drivechain-frontends-bip47-reserved-byte-state-split.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 2d8c6df)
Bug: w5-20260814-2152-openclaw-confirm-glmclaw-d (primary)
Finding: findings/20260814-2152-openclaw-confirm-glmclaw-drivechain-frontends-restored-sidechain-starter-now.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 633eec1)
Bug: w5-20260820-1852-openclaw-confirm-kimiclaw- (primary)
Finding: findings/20260820-1852-openclaw-confirm-kimiclaw-drivechain-frontends-orchestrator-lock-notify-stale-stream.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit abdd0fd)
…eive

Bug: w5-20260822-1254-openclaw-confirm-kimiclaw- (primary)
Finding: findings/20260822-1254-openclaw-confirm-kimiclaw-drivechain-frontends-core-watchonly-taproot-default-receive-kind.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 628c64f)
…er account is watched

Bug: w5-20260822-2004-openclaw-confirm-glmclaw-d (primary)
Finding: findings/20260822-2004-openclaw-confirm-glmclaw-drivechain-frontends-migration-firstboot-network-companion-blind.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit a3f2d5a)
…r a concurrent swap

Bug: w5-20260822-2058-openclaw-confirm-glmclaw-d (primary)
Finding: findings/20260822-2058-openclaw-confirm-glmclaw-drivechain-frontends-deposit-record-network-swap-misfile.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit aa90d0b)
…r wallet

Bug: w5-20260829-0149-openclaw-confirm-glmclaw-d (primary)
Finding: findings/20260829-0149-openclaw-confirm-glmclaw-drivechain-frontends-testnet-enforcer-migration-panic.md
Severity: R3-T4

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
(cherry picked from commit 87107b8)
…re core fake

Two independently-correct fixes meet in wallet/core_backend_test.go:

  - "DeleteWallet leaves Core wallet loaded" adds CoreBackend.Forget and
    TestCoreBackendForgetUnloadsWallet, whose stub answers unloadwallet with
    an empty result.
  - "coreWallets cache survives bitcoind restart" rewrites stubEnsureFlow into
    a stateful fake: listwallets reports what createwallet/loadwallet actually
    loaded, and createwallet refuses a wallet already on disk. Ensure now
    confirms a cached wallet is still loaded before serving it.

Under the load-aware fake, the Forget test's unloadwallet stub left the wallet
recorded as loaded and on disk, so the second Ensure found it still present,
took the adopt path, and called an unstubbed listdescriptors instead of
re-creating the wallet from scratch as the test asserts.

Forget both unloads the wallet and moves its directory aside, so model that in
the stub: drop the wallet from the fake's loaded and on-disk sets. Test-only;
neither fix's behaviour changes.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant