← Watch feed
db: hand amount_msat / amount_sat by copy, not pointer.
Public commit record
73/100 · Adequate
What the developer wrote
Authored by Rusty Russell
db: hand amount_msat / amount_sat by copy, not pointer.
This is how we handle amount_msat and amount_sat everywhere these days, and this
wasn't updated.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
What changed, and why it matters
This commit changes several database helper functions so they receive monetary amounts by copy (passing the value directly) instead of by pointer (passing a memory address). The commit message says this is just to match how the rest of the codebase now handles these types. There is no direct evidence in the diff or message that this fixes a security bug; it appears to be a code-consistency cleanup. Passing by copy can sometimes prevent certain classes of mistakes (for example, accidentally passing a NULL pointer or a pointer to uninitialized memory), but the diff does not show any such bug being fixed.
Recommended action
Treat as a routine refactoring commit. Reviewers may want to confirm that no call site relied on pointer semantics (e.g., passing NULL or modifying the bound value after binding), but the diff shows straightforward value-passing conversions. No immediate security response is indicated by the available materials.
Security signals we found
01
Pointer-to-value refactor in low-level database binding functions
02
No explicit security claim in commit message or diff
03
No new validation, bounds checks, or NULL guards added
04
Touches many wallet and payment-related call sites, but only changes argument passing style
Evidence from the diff
The patch updates db_bind_amount_msat() and db_bind_amount_sat() in db/bindings.c and db/bindings.h to take struct amount_msat / struct amount_sat by value rather than const pointer. All call sites in plugins/bkpr/recorder.c, wallet/invoices.c, and wallet/wallet.c are updated to pass the struct directly instead of its address. The change is syntactic and matches the current convention used elsewhere in Core Lightning. No NULL checks, validation logic, or behavioral changes are introduced. The commit message frames this as a convention update, not a security fix.
Changed components
db/bindings.cdb/bindings.hplugins/bkpr/recorder.cwallet/invoices.cwallet/wallet.cInspect captured patch +53 / −53
diff --git a/db/bindings.c b/db/bindings.c
index 9107bc5c..63a22458 100644
--- a/db/bindings.c
+++ b/db/bindings.c
@@ -227,15 +227,15 @@ void db_bind_psbt(struct db_stmt *stmt, const struct wally_psbt *psbt)
}
void db_bind_amount_msat(struct db_stmt *stmt,
- const struct amount_msat *msat)
+ struct amount_msat msat)
{
- db_bind_u64(stmt, msat->millisatoshis); /* Raw: low level function */
+ db_bind_u64(stmt, msat.millisatoshis); /* Raw: low level function */
}
void db_bind_amount_sat(struct db_stmt *stmt,
- const struct amount_sat *sat)
+ struct amount_sat sat)
{
- db_bind_u64(stmt, sat->satoshis); /* Raw: low level function */
+ db_bind_u64(stmt, sat.satoshis); /* Raw: low level function */
}
void db_bind_json_escape(struct db_stmt *stmt,
diff --git a/db/bindings.h b/db/bindings.h
index c4cbe707..910b07a3 100644
--- a/db/bindings.h
+++ b/db/bindings.h
@@ -46,9 +46,9 @@ void db_bind_timeabs(struct db_stmt *stmt, struct timeabs t);
void db_bind_tx(struct db_stmt *stmt, const struct wally_tx *tx);
void db_bind_psbt(struct db_stmt *stmt, const struct wally_psbt *psbt);
void db_bind_amount_msat(struct db_stmt *stmt,
- const struct amount_msat *msat);
+ struct amount_msat msat);
void db_bind_amount_sat(struct db_stmt *stmt,
- const struct amount_sat *sat);
+ struct amount_sat sat);
void db_bind_json_escape(struct db_stmt *stmt,
const struct json_escape *esc);
void db_bind_onionreply(struct db_stmt *stmt,
diff --git a/plugins/bkpr/recorder.c b/plugins/bkpr/recorder.c
index 83793bfd..02535cba 100644
--- a/plugins/bkpr/recorder.c
+++ b/plugins/bkpr/recorder.c
@@ -1549,9 +1549,9 @@ void log_channel_event(struct db *db,
db_bind_u64(stmt, acct->db_id);
db_bind_text(stmt, e->tag);
- db_bind_amount_msat(stmt, &e->credit);
- db_bind_amount_msat(stmt, &e->debit);
- db_bind_amount_msat(stmt, &e->fees);
+ db_bind_amount_msat(stmt, e->credit);
+ db_bind_amount_msat(stmt, e->debit);
+ db_bind_amount_msat(stmt, e->fees);
db_bind_text(stmt, e->currency);
if (e->payment_id)
db_bind_sha256(stmt, e->payment_id);
@@ -1703,8 +1703,8 @@ static void insert_chain_fees_diff(struct db *db,
db_bind_u64(stmt, acct_id);
db_bind_txid(stmt, txid);
- db_bind_amount_msat(stmt, &credit);
- db_bind_amount_msat(stmt, &debit);
+ db_bind_amount_msat(stmt, credit);
+ db_bind_amount_msat(stmt, debit);
db_bind_text(stmt, currency);
db_bind_u64(stmt, timestamp);
db_bind_int(stmt, ++update_count);
@@ -1876,7 +1876,7 @@ void maybe_record_rebalance(struct db *db,
" AND e.rebalance_id IS NULL"));
db_bind_sha256(stmt, out->payment_id);
- db_bind_amount_msat(stmt, &credit);
+ db_bind_amount_msat(stmt, credit);
db_query_prepared(stmt);
if (!db_step(stmt)) {
@@ -2189,9 +2189,9 @@ bool log_chain_event(struct db *db,
else
db_bind_null(stmt);
db_bind_text(stmt, e->tag);
- db_bind_amount_msat(stmt, &e->credit);
- db_bind_amount_msat(stmt, &e->debit);
- db_bind_amount_msat(stmt, &e->output_value);
+ db_bind_amount_msat(stmt, e->credit);
+ db_bind_amount_msat(stmt, e->debit);
+ db_bind_amount_msat(stmt, e->output_value);
db_bind_text(stmt, e->currency);
db_bind_u64(stmt, e->timestamp);
db_bind_int(stmt, e->blockheight);
diff --git a/wallet/invoices.c b/wallet/invoices.c
index c8364fe3..8122cac5 100644
--- a/wallet/invoices.c
+++ b/wallet/invoices.c
@@ -308,7 +308,7 @@ bool invoices_create(struct invoices *invoices,
db_bind_preimage(stmt, r);
db_bind_int(stmt, UNPAID);
if (msat)
- db_bind_amount_msat(stmt, msat);
+ db_bind_amount_msat(stmt, *msat);
else
db_bind_null(stmt);
db_bind_json_escape(stmt, label);
@@ -623,7 +623,7 @@ bool invoices_resolve(struct invoices *invoices,
" WHERE id=?;"));
db_bind_int(stmt, PAID);
db_bind_u64(stmt, pay_index);
- db_bind_amount_msat(stmt, &received);
+ db_bind_amount_msat(stmt, received);
db_bind_u64(stmt, paid_timestamp);
if (outpoint) {
db_bind_txid(stmt, &outpoint->txid);
diff --git a/wallet/wallet.c b/wallet/wallet.c
index 3687959b..e8533616 100644
--- a/wallet/wallet.c
+++ b/wallet/wallet.c
@@ -291,7 +291,7 @@ static bool wallet_add_utxo(struct wallet *w,
") VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);"));
db_bind_txid(stmt, &utxo->outpoint.txid);
db_bind_int(stmt, utxo->outpoint.n);
- db_bind_amount_sat(stmt, &utxo->amount);
+ db_bind_amount_sat(stmt, utxo->amount);
db_bind_int(stmt, wallet_output_type_in_db(type));
db_bind_int(stmt, OUTPUT_STATE_AVAILABLE);
db_bind_int(stmt, utxo->keyindex);
@@ -922,7 +922,7 @@ bool wallet_add_onchaind_utxo(struct wallet *w,
") VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?);"));
db_bind_txid(stmt, &outpoint->txid);
db_bind_int(stmt, outpoint->n);
- db_bind_amount_sat(stmt, &amount);
+ db_bind_amount_sat(stmt, amount);
db_bind_int(stmt, wallet_output_type_in_db(WALLET_OUTPUT_P2WPKH));
db_bind_int(stmt, OUTPUT_STATE_AVAILABLE);
db_bind_int(stmt, 0);
@@ -1423,8 +1423,8 @@ void wallet_inflight_add(struct wallet *w, struct channel_inflight *inflight)
db_bind_txid(stmt, &inflight->funding->outpoint.txid);
db_bind_int(stmt, inflight->funding->outpoint.n);
db_bind_int(stmt, inflight->funding->feerate);
- db_bind_amount_sat(stmt, &inflight->funding->total_funds);
- db_bind_amount_sat(stmt, &inflight->funding->our_funds);
+ db_bind_amount_sat(stmt, inflight->funding->total_funds);
+ db_bind_amount_sat(stmt, inflight->funding->our_funds);
db_bind_psbt(stmt, inflight->funding_psbt);
db_bind_int(stmt, inflight->remote_tx_sigs ? 1 : 0);
if (inflight->last_tx) {
@@ -1441,8 +1441,8 @@ void wallet_inflight_add(struct wallet *w, struct channel_inflight *inflight)
db_bind_int(stmt, inflight->lease_chan_max_ppt);
db_bind_int(stmt, inflight->lease_expiry);
db_bind_int(stmt, inflight->lease_blockheight_start);
- db_bind_amount_msat(stmt, &inflight->lease_fee);
- db_bind_amount_sat(stmt, &inflight->lease_amt);
+ db_bind_amount_msat(stmt, inflight->lease_fee);
+ db_bind_amount_sat(stmt, inflight->lease_amt);
} else {
db_bind_null(stmt);
db_bind_null(stmt);
@@ -2365,7 +2365,7 @@ static void wallet_channel_stats_incr_x(struct wallet *w,
struct db_stmt *stmt;
stmt = db_prepare_v2(w->db, query);
- db_bind_amount_msat(stmt, &msat);
+ db_bind_amount_msat(stmt, msat);
db_bind_u64(stmt, cdbid);
db_exec_prepared_v2(take(stmt));
@@ -2455,13 +2455,13 @@ static void wallet_channel_config_save(struct wallet *w,
" max_accepted_htlcs=?,"
" max_dust_htlc_exposure_msat=?"
" WHERE id=?;"));
- db_bind_amount_sat(stmt, &cc->dust_limit);
- db_bind_amount_msat(stmt, &cc->max_htlc_value_in_flight);
- db_bind_amount_sat(stmt, &cc->channel_reserve);
- db_bind_amount_msat(stmt, &cc->htlc_minimum);
+ db_bind_amount_sat(stmt, cc->dust_limit);
+ db_bind_amount_msat(stmt, cc->max_htlc_value_in_flight);
+ db_bind_amount_sat(stmt, cc->channel_reserve);
+ db_bind_amount_msat(stmt, cc->htlc_minimum);
db_bind_int(stmt, cc->to_self_delay);
db_bind_int(stmt, cc->max_accepted_htlcs);
- db_bind_amount_msat(stmt, &cc->max_dust_htlc_exposure_msat);
+ db_bind_amount_msat(stmt, cc->max_dust_htlc_exposure_msat);
db_bind_u64(stmt, cc->id);
db_exec_prepared_v2(take(stmt));
}
@@ -2604,11 +2604,11 @@ void wallet_channel_save(struct wallet *w, struct channel *chan)
db_bind_sha256d(stmt, &chan->funding.txid.shad);
db_bind_int(stmt, chan->funding.n);
- db_bind_amount_sat(stmt, &chan->funding_sats);
- db_bind_amount_sat(stmt, &chan->our_funds);
+ db_bind_amount_sat(stmt, chan->funding_sats);
+ db_bind_amount_sat(stmt, chan->our_funds);
db_bind_int(stmt, chan->remote_channel_ready);
- db_bind_amount_msat(stmt, &chan->push);
- db_bind_amount_msat(stmt, &chan->our_msat);
+ db_bind_amount_msat(stmt, chan->push);
+ db_bind_amount_msat(stmt, chan->our_msat);
db_bind_talarr(stmt, chan->shutdown_scriptpubkey[REMOTE]);
db_bind_u64(stmt, chan->final_key_idx);
@@ -2623,8 +2623,8 @@ void wallet_channel_save(struct wallet *w, struct channel *chan)
db_bind_int(stmt, chan->last_was_revoke);
db_bind_int(stmt, chan->min_possible_feerate);
db_bind_int(stmt, chan->max_possible_feerate);
- db_bind_amount_msat(stmt, &chan->msat_to_us_min);
- db_bind_amount_msat(stmt, &chan->msat_to_us_max);
+ db_bind_amount_msat(stmt, chan->msat_to_us_min);
+ db_bind_amount_msat(stmt, chan->msat_to_us_max);
db_bind_int(stmt, chan->feerate_base);
db_bind_int(stmt, chan->feerate_ppm);
db_bind_talarr(stmt, chan->remote_upfront_shutdown_script);
@@ -2652,8 +2652,8 @@ void wallet_channel_save(struct wallet *w, struct channel *chan)
db_bind_null(stmt);
db_bind_null(stmt);
}
- db_bind_amount_msat(stmt, &chan->htlc_minimum_msat);
- db_bind_amount_msat(stmt, &chan->htlc_maximum_msat);
+ db_bind_amount_msat(stmt, chan->htlc_minimum_msat);
+ db_bind_amount_msat(stmt, chan->htlc_maximum_msat);
db_bind_short_channel_id(stmt, *chan->alias[LOCAL]);
if (chan->alias[REMOTE] != NULL)
@@ -2667,8 +2667,8 @@ void wallet_channel_save(struct wallet *w, struct channel *chan)
db_bind_int(stmt, peer_update->fee_base);
db_bind_int(stmt, peer_update->fee_ppm);
db_bind_int(stmt, peer_update->cltv_delta);
- db_bind_amount_msat(stmt, &peer_update->htlc_minimum_msat);
- db_bind_amount_msat(stmt, &peer_update->htlc_maximum_msat);
+ db_bind_amount_msat(stmt, peer_update->htlc_minimum_msat);
+ db_bind_amount_msat(stmt, peer_update->htlc_maximum_msat);
} else {
db_bind_null(stmt);
db_bind_null(stmt);
@@ -3215,7 +3215,7 @@ void wallet_htlc_save_in(struct wallet *wallet,
db_bind_u64(stmt, chan->dbid);
db_bind_u64(stmt, in->key.id);
db_bind_int(stmt, DIRECTION_INCOMING);
- db_bind_amount_msat(stmt, &in->msat);
+ db_bind_amount_msat(stmt, in->msat);
db_bind_int(stmt, in->cltv_expiry);
db_bind_sha256(stmt, &in->payment_hash);
@@ -3289,7 +3289,7 @@ void wallet_htlc_save_out(struct wallet *wallet,
db_bind_u64(stmt, out->in->dbid);
else
db_bind_null(stmt);
- db_bind_amount_msat(stmt, &out->msat);
+ db_bind_amount_msat(stmt, out->msat);
db_bind_int(stmt, out->cltv_expiry);
db_bind_sha256(stmt, &out->payment_hash);
@@ -3311,7 +3311,7 @@ void wallet_htlc_save_out(struct wallet *wallet,
db_bind_u64(stmt, out->groupid);
}
- db_bind_amount_msat(stmt, &out->fees);
+ db_bind_amount_msat(stmt, out->fees);
db_bind_u64(stmt, min_u64(chan->next_index[LOCAL]-1,
chan->next_index[REMOTE]-1));
@@ -3834,7 +3834,7 @@ struct wallet_payment *wallet_add_payment(const tal_t *ctx,
else
db_bind_null(stmt);
- db_bind_amount_msat(stmt, &payment->msatoshi);
+ db_bind_amount_msat(stmt, payment->msatoshi);
db_bind_int(stmt, payment->timestamp);
if (payment->path_secrets != NULL)
@@ -3851,7 +3851,7 @@ struct wallet_payment *wallet_add_payment(const tal_t *ctx,
db_bind_null(stmt);
}
- db_bind_amount_msat(stmt, &payment->msatoshi_sent);
+ db_bind_amount_msat(stmt, payment->msatoshi_sent);
if (payment->label != NULL)
db_bind_text(stmt, payment->label);
@@ -3863,7 +3863,7 @@ struct wallet_payment *wallet_add_payment(const tal_t *ctx,
else
db_bind_null(stmt);
- db_bind_amount_msat(stmt, &payment->total_msat);
+ db_bind_amount_msat(stmt, payment->total_msat);
db_bind_u64(stmt, payment->partid);
if (payment->local_invreq_id != NULL)
@@ -4758,7 +4758,7 @@ void wallet_utxoset_add(struct wallet *w,
db_bind_null(stmt);
db_bind_int(stmt, txindex);
db_bind_blob(stmt, scriptpubkey, scriptpubkey_len);
- db_bind_amount_sat(stmt, &sat);
+ db_bind_amount_sat(stmt, sat);
db_exec_prepared_v2(take(stmt));
outpointfilter_add(w->utxoset_outpoints, outpoint);
@@ -4796,7 +4796,7 @@ void wallet_filteredblock_add(struct wallet *w, const struct filteredblock *fb)
db_bind_null(stmt);
db_bind_int(stmt, o->txindex);
db_bind_talarr(stmt, o->scriptPubKey);
- db_bind_amount_sat(stmt, &o->amount);
+ db_bind_amount_sat(stmt, o->amount);
db_exec_prepared_v2(take(stmt));
outpointfilter_add(w->utxoset_outpoints, &o->outpoint);
@@ -5191,10 +5191,10 @@ static bool wallet_forwarded_payment_update(struct wallet *w,
" WHERE in_htlc_id=? AND in_channel_scid=?"));
/* This may not work so don't increment index yet! */
db_bind_u64(stmt, w->ld->indexes[WAIT_SUBSYSTEM_FORWARD].i[WAIT_INDEX_UPDATED] + 1);
- db_bind_amount_msat(stmt, &in->msat);
+ db_bind_amount_msat(stmt, in->msat);
if (out) {
- db_bind_amount_msat(stmt, &out->msat);
+ db_bind_amount_msat(stmt, out->msat);
} else {
db_bind_null(stmt);
}
@@ -5306,9 +5306,9 @@ void wallet_forwarded_payment_add(struct wallet *w, const struct htlc_in *in,
db_bind_short_channel_id(stmt, *scid_out);
else
db_bind_null(stmt);
- db_bind_amount_msat(stmt, &in->msat);
+ db_bind_amount_msat(stmt, in->msat);
if (out)
- db_bind_amount_msat(stmt, &out->msat);
+ db_bind_amount_msat(stmt, out->msat);
else
db_bind_null(stmt);
@@ -5742,7 +5742,7 @@ void wallet_penalty_base_add(struct wallet *w, u64 chan_id,
db_bind_u64(stmt, pb->commitment_num);
db_bind_txid(stmt, &pb->txid);
db_bind_int(stmt, pb->outnum);
- db_bind_amount_sat(stmt, &pb->amount);
+ db_bind_amount_sat(stmt, pb->amount);
db_exec_prepared_v2(take(stmt));
}
@@ -6724,7 +6724,7 @@ void wallet_set_local_anchor(struct wallet *w,
db_bind_u64(stmt, remote_index);
db_bind_txid(stmt, &anchor->anchor_point.txid);
db_bind_int(stmt, anchor->anchor_point.n);
- db_bind_amount_sat(stmt, &anchor->commitment_fee);
+ db_bind_amount_sat(stmt, anchor->commitment_fee);
db_bind_int(stmt, anchor->commitment_weight);
db_exec_prepared_v2(stmt);
tal_free(stmt);
Risk score
Our methodology →Why this scored 17/100
Human-validated context
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
No validated notes yet.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.