What changed, and why it matters
This commit adds diagnostic tracing to the xpay plugin so developers can measure how long payments take. It does not change payment behavior, network handling, or access controls. There is no security issue visible in the change.
No security action required. This is an observability-only change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch introduces common/trace.h instrumentation in plugins/xpay/xpay.c. new_payment() now starts a trace span named ‘xpay/payment’, tags it with the payment hash, and suspends the span. The span is tied to the payment’s tal lifetime, so it is automatically cleaned up when the payment is freed. The added bitcoin/tx.h include appears unused for this change. No logic, cryptography, or trust boundary changes are present.
Changed components
plugins/xpay/xpay.cInspect captured patch +7 / −0
diff --git a/plugins/xpay/xpay.c b/plugins/xpay/xpay.c
index d9a3c297..9dc7b1cd 100644
--- a/plugins/xpay/xpay.c
+++ b/plugins/xpay/xpay.c
@@ -1,4 +1,5 @@
#include "config.h"
+#include <bitcoin/tx.h>
#include <ccan/array_size/array_size.h>
#include <ccan/crypto/siphash24/siphash24.h>
#include <ccan/htable/htable_type.h>
@@ -21,6 +22,7 @@
#include <common/pseudorand.h>
#include <common/randbytes.h>
#include <common/route.h>
+#include <common/trace.h>
#include <common/wireaddr.h>
#include <errno.h>
#include <inttypes.h>
@@ -2438,6 +2440,11 @@ static struct payment *new_payment(const tal_t *ctx,
{
struct xpay *xpay = xpay_of(cmd->plugin);
struct payment *payment = tal(ctx, struct payment);
+ /* Start tracing the payment until it is destroyed. */
+ trace_span_start("xpay/payment", payment);
+ trace_span_tag(payment, "payment_hash",
+ fmt_sha256(payment, payment_hash));
+ trace_span_suspend_may_free(payment);
payment->plugin = cmd->plugin;
payment->deadline = timemono_add(time_mono(), time_from_sec(retryfor));
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.