Low 42 Bitcoin Committed Feb 2, 2026 · 00:01 UTC

pytest: test for crash when enableoffer called on a used single-use offer.

e2d17cea View source ↗

Public commit record

What the developer wrote

Authored by Rusty Russell

83/100 · Strong

pytest: test for crash when enableoffer called on a used single-use offer.

Assertion happens here:

newstatus = offer_status_in_db(s | OFFER_STATUS_ACTIVE_F);

Since OFFER_STATUS_SINGLE_F|OFFER_STATUS_USED_F|OFFER_STATUS_ACTIVE_F
is not a valid combination:

```
lightningd-3 2026-01-28T04:45:21.184Z **BROKEN** lightningd: offer_status_in_db: 7 is invalid
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: FATAL SIGNAL 6 (version v25.12-92-g7fff32d-modded)
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: common/daemon.c:83 (crashdump) 0x5a883759dbb7
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0 ((null)) 0x79a2b0c4532f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./nptl/pthread_kill.c:44 (__pthread_kill_implementation) 0x79a2b0c9eb2c
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./nptl/pthread_kill.c:78 (__pthread_kill_internal) 0x79a2b0c9eb2c
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./nptl/pthread_kill.c:89 (__GI___pthread_kill) 0x79a2b0c9eb2c
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ../sysdeps/posix/raise.c:26 (__GI_raise) 0x79a2b0c4527d
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./stdlib/abort.c:79 (__GI_abort) 0x79a2b0c288fe
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/log.c:1054 (fatal_vfmt) 0x5a8837509557
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/log.c:1064 (fatal) 0x5a88375095fe
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ./wallet/wallet.h:1451 (offer_status_in_db) 0x5a88375491dc
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: wallet/wallet.c:6160 (offer_status_in_db) 0x5a8837555388
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: wallet/wallet.c:6162 (wallet_offer_enable) 0x5a8837555388
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/offer.c:288 (json_enableoffer) 0x5a8837540939
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:769 (command_exec) 0x5a8837503198
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:910 (rpc_command_hook_final) 0x5a8837503198
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:884 (rpc_command_hook_final) 0x5a8837503198
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:243 (hook_done) 0x5a8837535383
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/plugin_hook.c:343 (plugin_hook_call_next) 0x5a8837535383
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:998 (plugin_hook_call_rpc_command) 0x5a8837503c4f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:1123 (parse_request) 0x5a8837503c4f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/jsonrpc.c:1217 (read_json) 0x5a8837503c4f
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:60 (next_plan) 0x5a88375eca38
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:422 (do_plan) 0x5a88375eca38
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/io.c:439 (io_ready) 0x5a88375eca38
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ccan/ccan/io/poll.c:470 (io_loop) 0x5a88375eead5
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/io_loop_with_timers.c:22 (io_loop_with_timers) 0x5a8837501f8e
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: lightningd/lightningd.c:1492 (main) 0x5a88374d3c27
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ../sysdeps/nptl/libc_start_call_main.h:58 (__libc_start_call_main) 0x79a2b0c2a1c9
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: ../csu/libc-start.c:360 (__libc_start_main_impl) 0x79a2b0c2a28a
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0x5a88374d5aa4
lightningd-3 2026-01-28T04:45:21.260Z **BROKEN** lightningd: backtrace: (null):0 ((null)) 0xffffffffffffffff
```

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification

The short version

What changed, and why it matters

This commit adds a test that exposes a bug in Core Lightning: if you try to re-enable a single-use offer that has already been used, the daemon hits an internal assertion and crashes. The test is marked as expected-to-fail for now, meaning the actual crash is not fixed by this commit—it only documents the failure. A user with RPC access could trigger a denial-of-service by calling enableoffer on a used single-use offer.

Recommended action

Treat this as a known bug needing a follow-up fix. The enableoffer path should reject or clear OFFER_STATUS_USED_F before setting OFFER_STATUS_ACTIVE_F, or explicitly forbid re-enabling used single-use offers and return the OFFER_USED_SINGLE_USE RPC error. Until fixed, restrict RPC access to trusted callers.

Security signals we found

Daemon abort/fatal assertion triggered through RPC

Denial-of-service via crafted enableoffer call

State-machine validation gap in offer status transitions

Test-only commit marking issue as expected failure

Technical analysis

Evidence from the diff

The commit modifies tests/test_pay.py to add a regression test for wallet_offer_enable / json_enableoffer. When enableoffer is invoked on a single-use offer whose status is OFFER_STATUS_SINGLE_F|OFFER_STATUS_USED_F, the code sets OFFER_STATUS_ACTIVE_F, producing the combined status value 7. offer_status_in_db treats that combination as invalid and calls fatal(), aborting the daemon. The test asserts the RPC should instead return error code 1007 (OFFER_USED_SINGLE_USE). It is annotated with @pytest.mark.xfail(strict=True), so the patch records the bug rather than resolving it.

Changed components

lightningd/offer.c (json_enableoffer)wallet/wallet.c (wallet_offer_enable)wallet/wallet.h (offer_status_in_db)tests/test_pay.py

Inspect captured patch +12 / −3

diff --git a/tests/test_pay.py b/tests/test_pay.py
index bf03297a..980f3935 100644
--- a/tests/test_pay.py
+++ b/tests/test_pay.py
@@ -4509,6 +4509,7 @@ def test_fetchinvoice_3hop(node_factory, bitcoind):
     l1.rpc.call('fetchinvoice', {'offer': offer1['bolt12']})
 
 
+@pytest.mark.xfail(strict=True)
 def test_fetchinvoice(node_factory, bitcoind):
     # We remove the conversion plugin on l3, causing it to get upset.
     l1, l2, l3 = node_factory.line_graph(3, wait_for_announce=True,
@@ -4570,9 +4571,11 @@ def test_fetchinvoice(node_factory, bitcoind):
     assert 'msat' not in inv1['changes']
 
     # Single-use invoice can be fetched multiple times, only paid once.
-    offer2 = l3.rpc.call('offer', {'amount': '1msat',
-                                   'description': 'single-use test',
-                                   'single_use': True})['bolt12']
+    offer2_ret = l3.rpc.call('offer', {'amount': '1msat',
+                                       'description': 'single-use test',
+                                       'single_use': True})
+    offer2 = offer2_ret['bolt12']
+    offer2_id = offer2_ret['offer_id']
 
     # We've done 3 onion calls: sleep now to avoid hitting ratelimit!
     time.sleep(1)
@@ -4593,6 +4596,12 @@ def test_fetchinvoice(node_factory, bitcoind):
     with pytest.raises(RpcError, match='Offer no longer available'):
         l1.rpc.call('fetchinvoice', {'offer': offer2})
 
+    # Can't enable it either!
+    OFFER_USED_SINGLE_USE = 1007
+    with pytest.raises(RpcError) as excinfo:
+        l3.rpc.enableoffer(offer_id=offer2_id)
+    assert excinfo.value.error['code'] == OFFER_USED_SINGLE_USE
+
     # Now, test amount in different currency!
     plugin = os.path.join(os.path.dirname(__file__), 'plugins/currencyUSDAUD5000.py')
     l3.rpc.plugin_start(plugin)

Risk score

Why this scored 42/100

Our methodology →

Potential impact 12/30

Exploitability 8/25

Stealth signal 5/15

Affected reach 6/15

Confidence 7/10

Evidence quality 4/5

Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

What the developer wrote

What changed, and why it matters

Security signals we found

Evidence from the diff

Changed components

Why this scored 42/100

Community notes

Related watches

contrib: add jaonoctus's signing key

wallet: fixed timestamps for invented bookkeeper deposits

docs: document missing and fix erroneous JSON-RPC error codes