AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 22 Bitcoin

common: add bolt12 payer proof support (decode)

Public commit record

What the developer wrote

Authored by Vincenzo Palazzo

68/100 · Adequate
common: add bolt12 payer proof support (decode)

[Adapted for my decode routines --RR]
Changelog-EXPERIMENTAL: JSON-RPC: `decode` now supports the `lnp` payer proof format.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds support for decoding a new experimental BOLT12 format called a 'payer proof' in the Core Lightning node's decode command and related API bindings. It is a feature addition that extends existing decoding logic to recognize and return fields for payer proofs, such as the payment preimage, signature, and merkle proof hashes. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be a protocol-support enhancement.

Recommended action

Treat as a normal feature commit. Review the new payer proof validation logic in plugins/offers.c for correct BOLT12 signature and merkle verification if a security review of BOLT12 support is underway, but no immediate patching is indicated.

Security signals we found

01

New experimental BOLT12 decode type added

02

Signature and preimage fields exposed in decode output

03

Merkle proof fields added for omitted TLV verification

04

Uses existing hex::decode().unwrap() pattern in gRPC conversion (consistent with surrounding code, not new risk)

05

No explicit security fix or vulnerability disclosure in commit message

Risk score

Why this scored 22/100

Our methodology →
Potential impact 2/30
Exploitability 3/25
Stealth signal 2/15
Affected reach 4/15
Confidence 8/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.