What the developer wrote
Authored by Rusty Russell
offers: allow quantity_max = 1
If you're doing just-in-time stock management, it would be annoying to
discover this wasn't allowed!
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit removes a small restriction in Core Lightning's BOLT 12 'offers' feature. Previously, when creating an offer, you were not allowed to set 'quantity_max' to exactly 1. The code now permits that value. The change is described by the author as a convenience for just-in-time stock management, not as a security fix. There is no evidence in the commit or supplied references that this addresses a vulnerability.
No security action required. Treat as a normal feature/usability change. Reviewers may optionally verify that downstream invoice/payment handling already accepts quantity_max == 1 correctly, since the guard was only at offer creation time.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The patch deletes a guard in plugins/offers_offer.c that rejected offer creation when quantity_max == 1. The BOLT 12 offer format already supports quantity_max, and the value 1 is semantically valid (it means the buyer may request at most one unit). The change simply stops treating 1 as a bad parameter. No other logic is modified, and no security boundary is crossed.
Changed components
plugins/offers_offer.cBOLT 12 offer creation (json_offer)Inspect captured patch +0 / −5
diff --git a/plugins/offers_offer.c b/plugins/offers_offer.c
index 635e26b5..e7c7ded1 100644
--- a/plugins/offers_offer.c
+++ b/plugins/offers_offer.c
@@ -445,11 +445,6 @@ struct command_result *json_offer(struct command *cmd,
NULL))
return command_param_failed();
- /* Doesn't make sense to have max quantity 1. */
- if (offer->offer_quantity_max && *offer->offer_quantity_max == 1)
- return command_fail_badparam(cmd, "quantity_max",
- buffer, params,
- "must be 0 or > 1");
/* BOLT #12:
*
* - if the chain for the invoice is not solely bitcoin:
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.