common: use "foreign" in extra_tags to indicate a chain movement is injected.
What the developer wrote
Authored by Rusty Russell
common: use "foreign" in extra_tags to indicate a chain movement is injected.
This allows the bookkeeper plugin to know it's not actually a channel account.
Remove the "ignored" tag from the schema too: we removed it previously.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This change is a bookkeeping cleanup, not a security fix. It adds a new 'foreign' label to internal records that track on-chain money movements that don't belong to a Lightning channel account. It also removes an obsolete 'ignored' label from documentation and schemas. There is no indication this patch fixes an exploitable vulnerability.
No security action required; treat as routine maintenance. If auditing, verify that foreign deposits/withdrawals are still correctly excluded from channel balance calculations in the bookkeeper plugin.
Security signals we found
No memory-safety, cryptographic, or authorization changes
Tag addition is informational only
Bounds assertion added to mvt_tag_str() improves defensive coding
No CVE, advisory, or security disclosure referenced in commit
Evidence from the diff
The commit introduces MVT_FOREIGN as a secondary tag for chain_coin_mvt events produced by new_foreign_deposit() and new_foreign_withdrawal(). These events already existed; the only change is that they now carry an extra ‘foreign’ tag so the bookkeeper plugin can distinguish them from channel-account movements. The ‘ignored’ tag is removed from JSON schemas because it was no longer emitted. A bounds check is added to mvt_tag_str().
Changed components
common/coin_mvt.ccommon/coin_mvt.hcommon/test/run-coin_mvt.cplugins/bkpr/account.cdoc/schemas/listchainmoves.jsoncontrib/msggen/msggen/schema.jsonInspect captured patch +20 / −7
diff --git a/common/coin_mvt.c b/common/coin_mvt.c
index 49268f73..fd89444a 100644
--- a/common/coin_mvt.c
+++ b/common/coin_mvt.c
@@ -35,6 +35,7 @@ static const char *mvt_tags[] = {
"splice",
"penalty_adj",
"journal",
+ "foreign",
};
#define PRIMARY_TAG_BITS ((1ULL << MVT_DEPOSIT) | \
@@ -141,12 +142,16 @@ static enum mvt_tag mvt_tag_in_db(enum mvt_tag mvt_tag)
case MVT_JOURNAL:
BUILD_ASSERT(MVT_JOURNAL == 25);
return mvt_tag;
+ case MVT_FOREIGN:
+ BUILD_ASSERT(MVT_FOREIGN == 26);
+ return mvt_tag;
}
abort();
}
const char *mvt_tag_str(enum mvt_tag tag)
{
+ assert((unsigned)tag < NUM_MVT_TAGS);
return mvt_tags[tag];
}
@@ -539,7 +544,9 @@ struct chain_coin_mvt *new_foreign_deposit(const tal_t *ctx,
struct chain_coin_mvt *e;
e = new_chain_coin_mvt_sat(ctx, NULL, account, NULL, outpoint, NULL,
- blockheight, mk_mvt_tags(MVT_DEPOSIT), COIN_CREDIT,
+ blockheight,
+ mk_mvt_tags(MVT_DEPOSIT, MVT_FOREIGN),
+ COIN_CREDIT,
amount);
e->timestamp = timestamp;
return e;
@@ -556,7 +563,9 @@ struct chain_coin_mvt *new_foreign_withdrawal(const tal_t *ctx,
struct chain_coin_mvt *e;
e = new_chain_coin_mvt_sat(ctx, NULL, account, spend_txid, outpoint, NULL,
- blockheight, mk_mvt_tags(MVT_WITHDRAWAL), COIN_DEBIT,
+ blockheight,
+ mk_mvt_tags(MVT_WITHDRAWAL, MVT_FOREIGN),
+ COIN_DEBIT,
amount);
e->timestamp = timestamp;
return e;
diff --git a/common/coin_mvt.h b/common/coin_mvt.h
index 58bee3b8..dd16ca40 100644
--- a/common/coin_mvt.h
+++ b/common/coin_mvt.h
@@ -39,7 +39,8 @@ enum mvt_tag {
MVT_SPLICE = 23,
MVT_PENALTY_ADJ = 24,
MVT_JOURNAL = 25,
-#define NUM_MVT_TAGS (MVT_JOURNAL + 1)
+ MVT_FOREIGN = 26,
+#define NUM_MVT_TAGS (MVT_FOREIGN + 1)
};
struct mvt_tags {
diff --git a/common/test/run-coin_mvt.c b/common/test/run-coin_mvt.c
index 6746ad75..a61bcb73 100644
--- a/common/test/run-coin_mvt.c
+++ b/common/test/run-coin_mvt.c
@@ -181,6 +181,8 @@ static bool mvt_tag_is_primary(enum mvt_tag tag)
return true;
case MVT_JOURNAL:
return true;
+ case MVT_FOREIGN:
+ return false;
}
abort();
}
diff --git a/contrib/msggen/msggen/schema.json b/contrib/msggen/msggen/schema.json
index d9bd483b..68a5a44c 100644
--- a/contrib/msggen/msggen/schema.json
+++ b/contrib/msggen/msggen/schema.json
@@ -16677,11 +16677,11 @@
"items": {
"type": "string",
"enum": [
- "ignored",
"opener",
"leased",
"stealable",
- "splice"
+ "splice",
+ "foreign"
]
},
"description": [
diff --git a/doc/schemas/listchainmoves.json b/doc/schemas/listchainmoves.json
index 9b6ef9ed..d718b0b8 100644
--- a/doc/schemas/listchainmoves.json
+++ b/doc/schemas/listchainmoves.json
@@ -125,11 +125,11 @@
"items": {
"type": "string",
"enum": [
- "ignored",
"opener",
"leased",
"stealable",
- "splice"
+ "splice",
+ "foreign"
]
},
"description": [
diff --git a/plugins/bkpr/account.c b/plugins/bkpr/account.c
index 70ad1704..e5001b88 100644
--- a/plugins/bkpr/account.c
+++ b/plugins/bkpr/account.c
@@ -217,6 +217,7 @@ void maybe_update_account(struct command *cmd,
case MVT_SPLICE:
case MVT_PENALTY_ADJ:
case MVT_JOURNAL:
+ case MVT_FOREIGN:
/* Ignored */
break;
}
Why this scored 17/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.