AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 19 Bitcoin

currencyrate: propagate http errors to currencyrate rpc if a source is provided

Public commit record

What the developer wrote

Authored by daywalker90

83/100 · Strong
currencyrate: propagate http errors to currencyrate rpc if a source is provided

specifically coindesk was constantly hitting API rate limits causing our tests to fail
so lets unit tests all endpoints with a snapshot of real responses and only allow for http
error 401/429 in integration tests

Also fix a flake in test_bkpr_currencyrate_persisted that would pick up a cached rate from CLN's own caching

Changelog-None
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
The short version

What changed, and why it matters

This commit improves error reporting in the currency-rate plugin. Previously, when a price source like CoinDesk returned an HTTP error (for example, rate-limiting or authentication failure), the plugin treated it as a generic failure and did not tell the user what actually went wrong. Now the HTTP status code and response body are passed through to the RPC caller. It also adds unit tests using saved real-world API responses and fixes a flaky test by waiting out an internal cache. There is no indication this fixes an exploitable vulnerability; it is a reliability and diagnostics improvement.

Recommended action

No security action required. Treat as a normal reliability/diagnostics improvement. Reviewers may want to confirm that logging the full HTTP response body does not leak sensitive data in production logs, although the sources are public price APIs.

Security signals we found

01

Improved error transparency for failed external HTTP requests

02

No change to authentication, authorization, or cryptographic handling

03

No input parsing of untrusted data beyond existing JSON price extraction

04

Test-only change to permitted live API failure modes (401/429)

05

No patch for an identified vulnerability

Risk score

Why this scored 19/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.