CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 30 Bitcoin

xpay: add a CLTV shadow for single non-blinded paths.

EP72f4cae8 View source ↗
Public commit record

What the developer wrote

Authored by Rusty Russell

73/100 · Adequate
xpay: add a CLTV shadow for single non-blinded paths.

BOLT 7 recommends this. pay did it: in fact, pay would also add sats,
but that's much more difficult and fraught, so only do CLTV.

Changelog-Added: Protocol: `xpay` now uses shadow CLTV additions to help mask final destination as per BOLT 7.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds a privacy feature to Core Lightning's xpay plugin. When making a payment over a single non-blinded path, xpay can now add extra CLTV (timelock) blocks as a 'shadow' to make it harder for an intermediate node to tell that it is the final hop. This follows a BOLT 7 recommendation and mirrors behavior already present in the older 'pay' plugin. The change is purely additive and opt-in via a hidden developer flag.

Recommended action

No immediate action required. This is a defensive privacy improvement. Operators interested in enhanced payment privacy over single non-blinded paths can experiment with the hidden `dev_use_shadow` option, understanding it is a developer feature. Reviewers should verify the CLTV shadow calculation does not cause payment failures due to excessive timelock deltas and that the hidden flag cannot be accidentally enabled in production.

Security signals we found

01

Privacy enhancement for single non-blinded payment paths

02

CLTV shadow added to final hop to obscure final destination

03

New hidden RPC parameter `dev_use_shadow` defaults to false

04

BOLT 7 recommendation implemented

05

No amount shadow added; only CLTV shadow

06

Generated schema/proto/model files updated consistently

Risk score

Why this scored 30/100

Our methodology →
Potential impact 3/30
Exploitability 2/25
Stealth signal 8/15
Affected reach 5/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Core Lightning

Related watches

Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

contrib: add jaonoctus's signing key

This commit simply adds a new person's PGP public-key fingerprint to the list of trusted release signers in two documentation files. It does not change any code, fix any bug, or alter any security behavior of the software itself.

41278b4eby jaonoctus+2−02 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 73 · Adequate
EP Elements ProjectCore Lightning BitcoinLightning Network

wallet: fixed timestamps for invented bookkeeper deposits

This is a tiny internal fix to make a bookkeeping migration produce stable event ordering. It changes the timestamp used when creating historical 'deposit' records during a one-time database migration, so the records sort consistently with…

498e5086by daywalker90+2−01 file
No security note in commit
Open full analysis →Source commit ↗
Informational 21 AI analysisMessage 85 · Strong
EP Elements ProjectCore Lightning BitcoinLightning Network

docs: document missing and fix erroneous JSON-RPC error codes

This commit is a documentation-only cleanup of the JSON-RPC command help files. It corrects which numeric error codes are listed for each command so the published schemas match what the software actually returns. No program logic, validati…

Documentation-only change with no executable code modificationsCorrects RPC schema error-code metadata to match actual handler behaviorNo change to input parsing, authorization, cryptography, or network behavior
d1b6963bby daywalker90+204−1224 files
No security note in commit
Open full analysis →Source commit ↗