jsonrpc: fix recover command for BIP86 wallets
What the developer wrote
Authored by Sangbida Chaudhuri
jsonrpc: fix recover command for BIP86 wallets
The recover command checks if a node has already issued bitcoin
addresses before allowing recovery. This check only looked at
bip32_max_index, but with BIP86 wallets, newaddr() increments
bip86_max_index instead.
Also, the recover test asserted on hex but now it's asserting on codex32 instead. We should probably go in and fix the end point. @rustyrussell what do you think?
What changed, and why it matters
This commit fixes the 'recover' command in Core Lightning so it correctly detects whether a wallet has already generated Bitcoin addresses. Previously, the check only looked at one counter used by older wallets, but a newer type of wallet (BIP86) uses a separate counter. As a result, a BIP86 wallet that had already issued addresses could wrongly be allowed to run recovery, which could overwrite or confuse wallet state. The fix adds the missing check.
Apply the patch. Consider adding an explicit regression test that creates BIP86 addresses and then attempts recover, verifying it is rejected. Also review whether other empty-node checks elsewhere in the codebase need the same BIP86 counter treatment.
Security signals we found
Logic flaw in safety guard allowing recovery on non-empty wallet
Missing state variable check for new wallet type (BIP86)
Potential wallet state corruption or loss of funds if recovery proceeds on an already-used wallet
Evidence from the diff
The json_recover RPC handler in lightningd/jsonrpc.c verifies a node is ‘empty’ before permitting recovery. The original guard only tested db_get_intvar(…, ‘bip32_max_index’, 0). For BIP86 wallets, newaddr() increments ‘bip86_max_index’ rather than ‘bip32_max_index’, so an in-use BIP86 wallet could pass the empty-node check and proceed with recover. The patch adds an OR condition checking ‘bip86_max_index’ as well.
Changed components
lightningd/jsonrpc.crecover RPC commandBIP86 wallet address derivationInspect captured patch +2 / −1
diff --git a/lightningd/jsonrpc.c b/lightningd/jsonrpc.c
index de87489..cb73246 100644
--- a/lightningd/jsonrpc.c
+++ b/lightningd/jsonrpc.c
@@ -293,7 +293,8 @@ static struct command_result *json_recover(struct command *cmd,
"Only sqlite3 supported for recover command");
/* Check this is an empty node! */
- if (db_get_intvar(cmd->ld->wallet->db, "bip32_max_index", 0) != 0) {
+ if (db_get_intvar(cmd->ld->wallet->db, "bip32_max_index", 0) != 0
+ || db_get_intvar(cmd->ld->wallet->db, "bip86_max_index", 0) != 0) {
return command_fail(cmd, RECOVER_NODE_IN_USE,
"Node has already issued bitcoin addresses!");
}
Why this scored 34/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.