AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 24 Bitcoin

common: coin movements for payments need group id as well as part id.

Public commit record

What the developer wrote

Authored by Rusty Russell

73/100 · Adequate
common: coin movements for payments need group id as well as part id.

The part id is *only* unique within a group. The payment_hash / partid / groupid tuple is unique.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-Added: Plugins: `coin_movement` notification with `part_id` field now always has `group_id` field.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This change fixes accounting data that Core Lightning sends to plugins. For multi-part payments, the existing 'part_id' alone was not unique; the same part number could appear in different payment groups. The commit adds a 'group_id' field so plugins can reliably match each coin movement to the correct payment. It is a correctness/audit fix rather than a direct funds-loss bug, but inaccurate accounting could mislead downstream tools.

Recommended action

Treat as a low-severity correctness fix. Operators and plugin authors relying on coin_movement events should update parsers to consume group_id alongside part_id. No urgent patching is required for direct fund safety, but accounting plugins should be reviewed for duplicate-key assumptions.

Security signals we found

01

Data-integrity fix for payment event correlation

02

Multi-part payment identifier ambiguity resolved

03

Plugin notification schema change adding group_id

04

No cryptographic, memory-safety, or authorization changes observed

Risk score

Why this scored 24/100

Our methodology →
Potential impact 4/30
Exploitability 2/25
Stealth signal 3/15
Affected reach 5/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.