rust-lightning

Avoid re-locking same UTXO future

UtxoLookup implementations may cache and return the same async future
for repeated requests for a short channel id. When a replacement channel
announcement arrives while that future is in-flight, the pending-entry
comparison may point back to the future state already held by the async
path.

Detect that case with Arc::ptr_eq inside check_replace_previous_entry
and compare against the held messages instead of taking the mutex again.
This keeps duplicate-announcement filtering intact while letting
replacement announcements update the pending entry without re-entering
the lock.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Report LSPS5 fallback persistence

When a prunable client gains state before removal, persist() now reports
that the forced peer-state write reached the store.

Co-Authored-By: HAL 9000

Report LSPS2 fallback persistence

When a prunable peer gains state before removal, persist() now reports
that the forced peer-state write reached the store.

Co-Authored-By: HAL 9000

Document LiquidityManager persist result

Clarify the return value so callers know it reports whether the
forced peer-state write reached the store.

Co-Authored-By: HAL 9000

Verify Electrum transaction responses before use

Electrum confirmations must reject transaction_get responses whose body
does not compute the requested txid. Otherwise a malicious server can
substitute an unrelated transaction and provide matching Merkle data for
the substituted body.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Check Esplora Merkle leaf risk by base size

Esplora confirmation checks must use the non-witness transaction size
for the 64-byte Merkle leaf guard. Witness padding can otherwise raise
total_size without changing the serialization hashed into the txid and
Merkle tree.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Check Electrum Merkle leaf risk by base size

Electrum confirmation checks must reject transactions whose non-witness
serialization is 64 bytes, since txids and Merkle leaves are computed
from that serialization. Witness padding can otherwise move total_size
above 64 without removing the inner-node ambiguity.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Document that Route::route_params will be required soon

This field was always set since 0.0.117, so in the next version we're going to
make it officially required.

Revert "Prevent stale fs-store writes after lock cleanup"

This reverts commit 2c09a2610d1231b78704ae3e26d42136e8e89e90,
7106181ad1d7b7a33837efb251f871d44fc5664a, and
7b36bc8beb5809562abe3120bf28188bd1a7190d.

The `KVStore` API does not, and can not, provide any ordering
guarantees within the runtime of `write` methods. Only after a
`write` method returns is there any ordering guarantees provided
against future `write` calls. The additional test changes are only
noise and likely somewhat brittle against future changes.

We also revert the change itself, for simplicity.

Avoid leaking stale filesystem store temp files

Async filesystem writes may be awaited out of order, making older writes stale after their temporary data has already been created. Clean up stale or failed write attempts on a best-effort basis so they do not leave historical plaintext data in *.tmp files, without reporting cleanup failures as persistence failures.

Co-Authored-By: HAL 9000

This finding was discovered by Project Loupe

Reject case-varied LSPS5 replay signatures

LSPS5 webhook signatures are zbase32 strings, and the verifier
accepts case aliases when decoding them. The replay cache compared
raw header strings, so a case-only change could bypass immediate
replay detection even though it represented the same signature bytes.

Canonicalize the verified signature text before cache lookup and
storage. Keying the replay cache on decoded signature bytes would be
the semantic ideal, but doing that locally would decode once in the
validator and again inside message_signing::verify. This keeps the
fix local while matching the verifier's identity semantics. Add
regression coverage for the case-varied replay.

Fix underflow in blinded path amt_to_forward

If we have a high (200%+) proportional fee as an intermediate blinded node
combined with a low inbound amount, we previously had some code that calculated
the outbound amount of the forward that would've underflowed. This would've
caused a panic in debug builds and caused us to relay a payment that should've
been rejected (due to being unable to cover our high fee) in release builds.

Reported by Project Loupe.

Fix: reject fake scids with invalid vout

Previously, we would spuriously allow fake scids that had a vout with the high
byte set to pass our is_valid_{phantom,intercept,etc}_scid checks, even though
our fake vouts only ever set the lowest 3 bits of the 2-byte vout.

This can't really be exploited since HTLCs that pass this check would still
fail later on in the pipeline, and attackers that want to craft fake scids to
pass our checks can still do so after this fix, either via brute force or by
reusing a valid fake scid from a previously issued invoice. But at least this
makes it harder for them to do so, and makes the check more correct than it was
before. Plus invalid fake crafted scids like this could theoretically cause us
to generate a spurious HTLCIntercepted event, which wouldn't be ideal.

Reported by Project Loupe.

Clear duplicate monitor-pending RAA on signer resend

The `chanmon_consistency` fuzz target found a reconnect ordering where
`signer_pending_revoke_and_ack` and `monitor_pending_revoke_and_ack`
could both describe the same owed `revoke_and_ack`.

The channel first received a `commitment_signed` whose monitor update
completed, but the signer could not provide the next point or secret,
leaving `signer_pending_revoke_and_ack` set. Later, receiving the peer
`revoke_and_ack` freed holding-cell HTLCs and produced a held monitor
update. While that monitor update was still blocked,
`channel_reestablish` saw the peer one state behind and recorded
`monitor_pending_revoke_and_ack`, plus the corresponding monitor-pending
`commitment_signed`, so the messages could be replayed once monitor
updating was restored.

If the signer unblocked before the held monitor update was released,
`signer_maybe_unblocked` generated and sent the already monitor-safe RAA
using `signer_pending_revoke_and_ack`. The monitor-pending flag was not
cleared at that point, so `monitor_updating_restored` later generated
the same RAA again when the held update completed. The peer had already
advanced after accepting the signer-unblocked RAA, so it rejected the
duplicate secret as not corresponding to its current pubkey and
force-closed.

Fix this by clearing `monitor_pending_revoke_and_ack` in the
signer-resume path only once a signer-pending RAA is actually being
returned.

(Actually) remove incorrect `*mut` cast in net-tokio

In ae62fa377a0a139d937ce2c7d87d3eb1612732af we removed an incorrect
`&mut`, but failed to actually resolve the mut aliasing bug - there
remained a deref of a `*mut` which is similarly invalid. Here we
actually fix the bug and also DRY up code marginally.

Reported by Project Loupe.

Fix `Borrow`/`Hash` inconsistency on `Payment*` types

`Borrow`'d values are required to `Hash` identically to the
original object so that a `Borrow`ed key can be used in place of an
owned one in a `HashMap` lookup.

We'd violated this on our `Payment*` types, which we fix here. Note
that changing the `Hash` implementation is generally not considered
an API-breaking change and this seems like a useful fix.

Reported by Project Loupe.

Remove nonce from outbound payment OffersContexts

Now that the payer nonce is included in the payer metadata of
InvoiceRequest and Refund, Bolt12Invoice verification no longer needs
the nonce from the blinded path's OffersContext. Remove it from
OffersContext::OutboundPaymentForOffer and
OffersContext::OutboundPaymentForRefund, along with
enqueue_invoice_request's nonce parameter, which only existed to supply
it. The nonce in RetryableInvoiceRequest is no longer used either but
is still persisted -- and retained when reading state written by prior
versions -- so that such versions can retry the payment and verify the
resulting invoice after a downgrade.

The payment_id is kept in both variants, however. While no longer needed
to confirm the invoice is for an invoice request or refund we created,
it is checked against the payment id recovered from a received
Bolt12Invoice's payer metadata to ensure the invoice arrived over the
blinded path created for that payment. This prevents an attacker from
reusing the blinded path of one of our payments to deliver another
payment's invoice and correlate the two as ours.

Co-Authored-By: Claude <noreply@anthropic.com>

Remove unnecessary (and incorrect) `&mut` cast in net-tokio

The owned `Waker` wake method assumed it had the only reference to
the sender as the `Waker` is owned at that point, however our
`Waker`s can be `clone`d, leaving multiple references to the inner
`Sender` (held in an `Arc`).

Thus, the `&mut` cast is technically undefined behavior. However,
as this patch demonstrates, its only use is in calling an `&self`
method which derefs an internal `Arc` in tokio, so its highly
unlikely to lead to miscompilation.

Reported by Project Loupe.

fuzz: model chanmon mempool mining

Route chanmon broadcasts through an explicit harness mempool so relay,
mining, wallet updates, and chain delivery share one path. This lets
broadcast transactions enter the mempool before a modeled block confirms
them.

On restart, sync loaded monitors and managers from their own persisted
best blocks so raw monitors catch up without rewinding ChannelManager
state. Cap modeled mining before unresolved HTLC timeout deadlines
and use the LDK anti-reorg depth for setup confirmations.

Report the sending peer in Event::OnionMessageIntercepted

When the OnionMessenger intercepts an onion message to forward, it now reports
which peer sent us the message via a new `prev_hop` field, so handlers can
apply source-based policy when deciding whether to forward.

`prev_hop` is `None` when the forward is enqueued by a message handler (the
BOLT 12 static-invoice-server flow), which isn't given the sending node;
otherwise it is the node we received the message from.

Co-Authored-By: Claude <noreply@anthropic.com>

Intercept onion messages for unknown SCID hops

Allow integrations to intercept blinded onion-message hops that identify
the next node by short channel id, so LSPS-style protocols can resolve
those hops out of band instead of dropping the message.

Co-Authored-By: HAL 9000

Include payer nonce in payer metadata again

InvoiceRequest and Refund have payer metadata consisting of an
encrypted payment id and, originally, a nonce used to derive the payer
signing keys and authenticate any corresponding invoices. The nonce was
elided to save space once it was included in the OffersContext of
blinded reply paths, but that means verifying a Bolt12Invoice requires
state outside the invoice itself. Upcoming payment proofs (#4297) need
the invoice signing keys derivable from the invoice request alone, so
include the nonce in the payer metadata again and verify invoices using
it rather than the context's nonce.

This breaks verification of invoices for invoice requests and refunds
with blinded paths created by prior versions, as their payer metadata
lacks the nonce; such payments will fail and must be retried with a new
payment id. Refunds without blinded paths are unaffected, as their
metadata always included the nonce.

Co-Authored-By: Claude <noreply@anthropic.com>

f - Prevent stale fs-store writes

Exercise the stale-write race through the stored filesystem bytes so the
regression test covers the user-visible overwrite bug.

Co-Authored-By: HAL 9000

f - Prevent stale fs-store writes

Move the version-allocation ordering note to the allocation it
describes so the cleanup invariant is easier to follow.

Co-Authored-By: HAL 9000

Add fees value for recent payments

Introduce fields `pending_fee_msat` for `RecentPaymentDetails::Pending`
and `fee_paid_msat` for `RecentPaymentDetails::Fulfilled`.