lightning-hsmtool: Fix getsecret does not show mnemonic after typing passphrase
What the developer wrote
Authored by ekzyis
lightning-hsmtool: Fix getsecret does not show mnemonic after typing passphrase
Changelog-Fixed: `lightning-hsmtool`: `getsecret` does not show mnemonic after typing passphrase
What changed, and why it matters
This is a bug fix in a command-line helper tool used by Core Lightning node operators. The `getsecret` command was accidentally refusing to show the wallet recovery words (mnemonic) when the wallet was protected by a passphrase. After the fix, users who correctly type their passphrase can see their mnemonic again. There is no attacker-controlled path; it is a usability/availability issue for legitimate owners, not a security vulnerability that lets someone steal funds.
No security response required. Treat as a normal bug fix. Users relying on passphrase-protected mnemonic backups should upgrade to a version containing this commit so they can recover secrets with `getsecret`.
Security signals we found
Functional bug in secret-recovery path
Error path blocked legitimate mnemonic recovery
No input validation, memory-safety, or cryptographic change
No privilege boundary crossed
Evidence from the diff
In tools/lightning-hsmtool.c, the print_secret() function previously treated HSM_SECRET_MNEMONIC_WITH_PASS as an error case (errx(ERROR_USAGE, "hsm_secret with passphrase")). The patch moves that enum value into the same branch as HSM_SECRET_MNEMONIC_NO_PASS, so after the passphrase is already accepted elsewhere the mnemonic is printed. This restores intended functionality without changing cryptography, authentication, or access control.
Changed components
tools/lightning-hsmtool.clightning-hsmtool getsecret subcommandInspect captured patch +1 / −2
diff --git a/tools/lightning-hsmtool.c b/tools/lightning-hsmtool.c
index 0de1920..95d0b26 100644
--- a/tools/lightning-hsmtool.c
+++ b/tools/lightning-hsmtool.c
@@ -280,12 +280,11 @@ static void print_secret(const char *hsm_secret_path, const char *id, bool must_
case HSM_SECRET_ENCRYPTED:
errx(ERROR_USAGE, "Encrypted hsm_secret");
case HSM_SECRET_MNEMONIC_NO_PASS:
+ case HSM_SECRET_MNEMONIC_WITH_PASS:
if (must_be_oldstyle)
errx(ERROR_USAGE, "Cannot use getcodexsecret with modern nodes: use getsecret");
printf("%s\n", hsms->mnemonic);
return;
- case HSM_SECRET_MNEMONIC_WITH_PASS:
- errx(ERROR_USAGE, "hsm_secret with passphrase");
case HSM_SECRET_PLAIN:
if (id == NULL)
errx(ERROR_USAGE, "Must set 'id' for a codex32 secret");
Why this scored 25/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.