Electrum

This commit fixes a bug in Electrum's Lightning channel backups for 'anchor' channels. Previously, the backup did not store enough secret key information, so users with non-deterministic Lightning wallets who restored from a backup could not recover funds if the remote party force-closed the channel. The fix adds a new backup version (v3) that includes the needed private key and warns users with older backups to export fresh ones. It is a recovery/bug-fix patch, not an exploitable vulnerability in live software.

This commit changes how Electrum's Lightning wallet advertises and accepts 'zeroconf' channels when payment forwarding is enabled. Zeroconf channels are opened instantly without waiting for on-chain confirmations, which is useful for receiving payments quickly but risky if the wallet also forwards payments for others. The patch prevents forwarding wallets from acting as zeroconf clients and from accepting zeroconf channels, likely to stop a situation where a forwarding node could be tricked into losing money on an unconfirmed channel.

This patch fixes a bug in Electrum's Lightning channel handling where a malicious or misbehaving server could trick the wallet into deleting a funded channel by claiming the funding transaction was no longer confirmed. The fix makes the wallet remember that a funding transaction was once mined and refuse to downgrade that status to 'unconfirmed,' preventing accidental loss of access to funds stored in the channel.

This is a minor code cleanup in Electrum's Lightning Network peer handling. It simplifies how an inner trampoline onion packet is processed, replacing an if-statement with a conditional expression. There is no visible security change: the same operations happen in the same order and with the same conditions as before.

This commit only updates Python type hints to explicitly mark parameters and variables that can be None. It does not change any program logic, runtime behavior, or security checks. It is a code-quality and documentation improvement with no security impact.

This commit fixes a bug in the Electrum Bitcoin wallet where, if the user had disabled change addresses, funds from 'sweep' transactions (such as recovering Lightning channel funds or claiming submarine swaps) could accidentally be sent back to an address controlled by someone else instead of to the user's own wallet. The fix forces the creation of a wallet-owned change address whenever a sweep is involved, even when change addresses are normally disabled.

This change fixes a bug in Electrum's mobile/QML wallet interface where paid Lightning invoices were being deleted from the wallet's records. The fix moves the 'don't delete paid invoices' protection into the core wallet code so it applies consistently, and it also prevents deletion of invoices that are still 'in flight' (payment pending). Keeping paid invoice records is important because they are needed to show transaction history and to prove a payment was made. Deleting them could cause confusion, accounting problems, or loss of payment evidence.

This commit fixes a bug in the Electrum Bitcoin wallet where deleting a paid or in-flight Lightning invoice/request could incorrectly erase important payment records. The change now preserves those records when a payment has already completed or is still pending, preventing loss of payment history and avoiding a minor privacy leak if an in-flight payment later fails.

This change tightens up Electrum's crash reporter so it cannot be flooded with an unbounded number of exceptions. Before the patch, every unhandled exception was placed in an internal queue with no size limit, which could slowly consume memory if something kept crashing. The patch caps that queue at 100 entries and logs exceptions immediately instead of silently holding them. It is a hardening fix rather than a fix for an active attack.

This commit refactors how Electrum stores Lightning channel backups on disk. It converts backup records from a flexible JSON-style format into a stricter binary format, and adds a one-time database upgrade routine. The change is primarily a code-quality and data-format cleanup, not a fix for an active security flaw. However, any database migration that touches sensitive key material carries a small risk of corruption or mis-handling of secrets if the conversion has bugs.

This commit only adds a new automated test. It does not change any production wallet code, fix a bug, or alter how user funds are handled. The test verifies that Electrum can correctly upgrade an old test wallet database containing Lightning channel backups from database version 71 to version 72. It is a quality-assurance change, not a security patch.