What the developer wrote
Authored by Rusty Russell
offers: use xpay.
Changelog-Changed: offers: we now use `xpay` not `pay` for paying invoices made with invoicerequest().
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This is a routine internal change to which payment plugin Core Lightning uses when automatically paying invoices created via the experimental 'invoicerequest' flow. It switches from the older 'pay' plugin to the newer 'xpay' plugin and updates the corresponding test expectation. There is no security issue visible in the commit.
No security action required; treat as normal functional change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit changes plugins/offers_inv_hook.c so that invoice-request-generated invoices are paid by calling the ‘xpay’ JSON-RPC method instead of ‘pay’, and passes the invoice string via the ‘invstring’ parameter instead of ‘bolt11’. The test is updated only to match xpay’s different error wording when no route exists. This is a feature migration, not a vulnerability fix.
Changed components
plugins/offers_inv_hook.ctests/test_pay.pyInspect captured patch +3 / −3
diff --git a/plugins/offers_inv_hook.c b/plugins/offers_inv_hook.c
index ff2014e3..3e5d6cc1 100644
--- a/plugins/offers_inv_hook.c
+++ b/plugins/offers_inv_hook.c
@@ -194,9 +194,9 @@ static struct command_result *listinvreqs_done(struct command *cmd,
fmt_amount_msat(tmpctx, amt),
fmt_sha256(tmpctx, &inv->invreq_id));
- req = jsonrpc_request_start(cmd, "pay",
+ req = jsonrpc_request_start(cmd, "xpay",
pay_done, pay_error, inv);
- json_add_string(req->js, "bolt11", invoice_encode(tmpctx, inv->inv));
+ json_add_string(req->js, "invstring", invoice_encode(tmpctx, inv->inv));
json_add_sha256(req->js, "localinvreqid", &inv->invreq_id);
return send_outreq(req);
}
diff --git a/tests/test_pay.py b/tests/test_pay.py
index 93e45416..e870acb6 100644
--- a/tests/test_pay.py
+++ b/tests/test_pay.py
@@ -4936,7 +4936,7 @@ def test_fetchinvoice_autoconnect(node_factory, bitcoind):
invreq = l2.rpc.call('invoicerequest', {'amount': '2msat',
'description': 'simple test'})
# Ofc l2 can't actually pay it!
- with pytest.raises(RpcError, match='pay attempt failed: "Ran out of routes to try'):
+ with pytest.raises(RpcError, match='pay attempt failed: "Failed: There is no connection between source and destination at all"'):
l3.rpc.call('sendinvoice', {'invreq': invreq['bolt12'], 'label': 'payme!'})
assert l3.rpc.listpeers(l2.info['id'])['peers'] != []
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.