AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 35 Bitcoin

cln-currencyrate: switch algorithm to a more lazy one

Public commit record

What the developer wrote

Authored by daywalker90

73/100 · Adequate
cln-currencyrate: switch algorithm to a more lazy one

Instead of fetching prices on every request with a very short cache TTL
we now start a background task instead with a way longer cache TTL.
The background task fetches prices only from one source by default. If the price
has changed much we fetch from different sources until two sources agree on a price.
The background task exits if there wasn't a request for that currency in some time.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit rewrites the currency-rate plugin in Core Lightning so it no longer fetches fresh exchange rates on every request. Instead, it starts a background updater that keeps a longer-lived cache and only consults extra sources if prices from different sources drift too far apart. The change also normalizes currency codes to uppercase, rejects zero prices, adds source failure backoff, and stops background tasks when a currency hasn't been requested recently. There is no explicit security bug being fixed; it is a reliability and resource-usage improvement.

Recommended action

Treat as a routine reliability/defensive-hardening patch. Reviewers should verify that the background task correctly terminates (no task leak), that the 1% drift threshold is appropriate for the target currencies, and that the all-sources backoff reset cannot be abused by a transient network blip to hammer APIs. No urgent security deployment is indicated by the commit alone.

Security signals we found

01

Rejection of zero-price responses prevents a source from causing a zero or wildly wrong conversion result.

02

Currency codes are normalized to uppercase, reducing the chance of cache misses or source lookups due to case differences.

03

Source backoff and all-sources-backed-off reset reduce denial-of-service amplification against external APIs and self-DoS from repeated failing fetches.

04

Background refresh with drift-based cross-source validation is a defense-in-depth measure against a single compromised or erroneous price source.

05

No explicit vulnerability, CVE, or security advisory is mentioned in the commit or supplied references.

Risk score

Why this scored 35/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 6/15
Affected reach 7/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.