wallet: print error, don't just abort, on unknown tags.
What the developer wrote
Authored by Rusty Russell
wallet: print error, don't just abort, on unknown tags.
Lisa *told* me about this on review, and I ignored it. Fool: took an extra day to get the account.db which was triggering this so I could see the problem.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This commit fixes a crash during database migration. Previously, if the migration code encountered an unknown 'tag' value in the old account database, it would call abort() and terminate the program abruptly with no explanation. Now it calls db_fatal(), which prints a clear error message about the unknown tag before stopping. This is a robustness improvement that helps diagnose migration failures but does not by itself prevent them or create a security vulnerability.
No urgent action required. Treat as a normal code-quality/diagnostic improvement. If deploying, ensure migration logs capture db_fatal() output to diagnose any unknown tag issues in legacy account databases.
Security signals we found
Defensive hardening: replaces silent abort() with informative fatal error
Migration robustness improvement
No input validation bypass or memory safety issue visible in diff
Evidence from the diff
In wallet/account_migration.c, two calls to abort() when mvt_tag_parse() fails are replaced with db_fatal() calls that include the offending tag string. The change affects migrate_from_account_db() during chain_moves and channel_moves migration. This converts a silent SIGABRT into a logged fatal error, aiding debugging and potentially allowing higher-level error handling. There is no evidence of an exploitable vulnerability; the change is defensive and improves diagnostics.
Changed components
wallet/account_migration.cmigrate_from_account_db()mvt_tag_parse() error pathInspect captured patch +4 / −2
diff --git a/wallet/account_migration.c b/wallet/account_migration.c
index a4bf08d1..60e5bced 100644
--- a/wallet/account_migration.c
+++ b/wallet/account_migration.c
@@ -435,7 +435,8 @@ void migrate_from_account_db(struct lightningd *ld, struct db *db)
id = chain_mvt_index_created(ld, db, account, ev->credit, ev->debit);
db_bind_u64(stmt, id);
if (!mvt_tag_parse(ev->tag, strlen(ev->tag), &tag))
- abort();
+ db_fatal(db, "Unknown tag '%s' in chain_moves migration!",
+ ev->tag);
tags = tag_to_mvt_tags(tag);
if (tag == MVT_CHANNEL_OPEN && ev->we_opened)
mvt_tag_set(&tags, MVT_OPENER);
@@ -521,7 +522,8 @@ void migrate_from_account_db(struct lightningd *ld, struct db *db)
db_bind_mvt_account_id(stmt, db, account);
db_bind_credit_debit(stmt, ev->credit, ev->debit);
if (!mvt_tag_parse(ev->tag, strlen(ev->tag), &tag))
- abort();
+ db_fatal(db, "Unknown tag '%s' in channel_moves migration!",
+ ev->tag);
db_bind_mvt_tags(stmt, tag_to_mvt_tags(tag));
db_bind_u64(stmt, ev->timestamp);
if (ev->payment_id)
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.