AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 18 Bitcoin

lsp_plugin: add cleanup on "on_invoice_payment"

Public commit record

What the developer wrote

Authored by Peter Neuroth

68/100 · Adequate
lsp_plugin: add cleanup on "on_invoice_payment"

The `on_invoice_payment` hook is called when core-lightning successfully
collected all parts to an invoice. We'll use this to clean up the the
datastore when an invoice completes.

Caveat: This will be called on every succesfull invoice payment, we may
improve this in the future.

Signed-off-by: Peter Neuroth <pet.v.ne@gmail.com>
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds a cleanup step to the experimental LSPS (Lightning Service Provider Specification) plugin. When a JIT-channel invoice is fully paid, the plugin now deletes its stored record from Core Lightning's datastore. The change is defensive housekeeping rather than a fix for an active vulnerability, and the commit message does not describe any security issue.

Recommended action

No urgent action. If reviewing, consider whether silently ignoring `deldatastore` failures is acceptable, and confirm the datastore key cannot collide with or delete entries belonging to other invoices or plugins.

Security signals we found

01

New hook handler deletes datastore entries after invoice completion

02

Deletion errors are silently swallowed with `.ok()`, which could mask RPC failures

03

No input validation beyond hex decoding of the preimage

04

No commit message or vendor reference describes this as a security fix

Risk score

Why this scored 18/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 2/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.