wallet: don't warn if ignored is unset in accounts.db.
What the developer wrote
Authored by Rusty Russell
wallet: don't warn if ignored is unset in accounts.db.
Note that this can only happen if you ran a master commit before rc1:
```
2025-08-21T10:03:03.255Z **BROKEN** lightningd: bookkeper migration: Accessing a null column e.ignored/15 in query SELECT e.id, e.account_id, a.name, e.origin, e.tag, e.credit, e.debit, e.output_value, e.currency, e.timestamp, e.blockheight, e.utxo_txid, e.outnum, e.spending_txid, e.payment_id, e.ignored, e.stealable, e.ev_desc, e.spliced, a.closed_count, a.peer_id, a.we_opened FROM chain_events e LEFT OUTER JOIN accounts a ON e.account_id = a.id ORDER BY e.timestamp, e.id;
```
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit fixes a database migration bug where Core Lightning could crash with a 'BROKEN' error when reading old bookkeeping records that had a missing 'ignored' value. The fix treats a missing value as 'false' instead of causing a fatal null-column access. It is a stability fix for an internal migration path, not an externally exploitable security vulnerability.
Treat as a routine stability/bug-fix patch. Users who never ran a pre-rc1 master build are unaffected. If backporting, include only to prevent startup failures on nodes with legacy migration state.
Security signals we found
Fixes a null-column access that aborts daemon startup (availability impact)
Only reachable during local database migration from pre-release master builds
No attacker-controlled input path identified
No memory corruption, privilege escalation, or remote code execution signal
Evidence from the diff
In wallet/account_migration.c, stmt2chain_event() previously called db_col_int() directly on the e.ignored column. If a user had run a pre-rc1 master build, that column could be NULL, causing a fatal ‘Accessing a null column’ error during the bookkeeper migration. The patch adds a null check: if e.ignored is NULL, it sets e->ignored = false; otherwise it reads the integer as before. No other columns are changed, and the crash only affects migration of local chain_events data.
Changed components
wallet/account_migration.cbookkeeper migration pathchain_events table in accounts.dbInspect captured patch +5 / −1
diff --git a/wallet/account_migration.c b/wallet/account_migration.c
index 344a3e4e..f22c6693 100644
--- a/wallet/account_migration.c
+++ b/wallet/account_migration.c
@@ -124,7 +124,11 @@ static struct chain_event *stmt2chain_event(const tal_t *ctx, struct db_stmt *st
} else
e->spending_txid = NULL;
- e->ignored = db_col_int(stmt, "e.ignored") == 1;
+ /* If they ran master before this, ignored might be null! */
+ if (db_col_is_null(stmt, "e.ignored"))
+ e->ignored = false;
+ else
+ e->ignored = db_col_int(stmt, "e.ignored") == 1;
e->stealable = db_col_int(stmt, "e.stealable") == 1;
if (!db_col_is_null(stmt, "e.ev_desc"))
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.