AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 19 Bitcoin

decode: don't treat every failure as a rune.

Public commit record

What the developer wrote

Authored by Rusty Russell

68/100 · Adequate
decode: don't treat every failure as a rune.

If we can't decode something, and it decodes as a rune (and all bech32
strings do!), then we would usually just complain it was a malformed
rune. Be a big more useful, when the parameter looks like somthing else.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Fixed: JSON-RPC: `decode` is now more informative with malformed strings (won't claim everything is a malformed rune!).
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit improves the 'decode' command in Core Lightning so that when it receives a malformed string, it no longer incorrectly labels every failure as a 'malformed rune'. It adds logic to guess the intended type of the input (e.g., a BOLT11 invoice, BOLT12 offer, emergency recovery string, or rune) and returns a more useful error message. There is no direct security vulnerability being fixed; it is a usability and diagnostic improvement.

Recommended action

No urgent security action required. Treat as a normal bugfix/usability improvement. Reviewers may optionally verify that guess_type() correctly handles edge cases and that the new error paths do not leak sensitive decoder internals.

Security signals we found

01

No memory safety, authentication, authorization, or cryptographic flaw is evident in the diff.

02

Change is purely diagnostic/usability: better error messages for malformed decode input.

03

The commit message and changelog explicitly frame this as a user-facing fix for misleading error reporting.

04

No new attack surface is introduced; input is still parsed by existing decoders.

Risk score

Why this scored 19/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.