AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 34 Bitcoin

Add per-peer profit scoring (#3247)

Public commit record

What the developer wrote

Authored by Bastien Teinturier

76/100 · Adequate
Add per-peer profit scoring (#3247)

We create a new set of actors that keep track of payment statistics
across our peers and rank them to identify the top profit earners.
Based on those statistics, the actors issue recommendations to:

- allocate more liquidity towards nodes that are generating revenue and
may run out of liquidity in the next few days
- reclaim liquidity from inactive channels
- change our relay fees to optimize increases or decreases in outgoing
flow and volume
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit adds a new optional 'peer profit scoring' feature to the Eclair Lightning node. When enabled, it automatically tracks payment statistics, ranks peers by profitability, and can automatically open channels, close idle channels, and adjust relay fees. By default all automatic actions are disabled, so the change is primarily an operational automation feature rather than an immediate security patch or vulnerability. The main security consideration is that enabling the automatic actions gives the node software control over on-chain funds and channel pricing, which could in theory be abused or misconfigured, but the commit itself does not introduce a known exploit.

Recommended action

Treat this as a feature review, not a vulnerability fix. Operators who enable peer-scoring should carefully review the auto-fund/auto-close/auto-update-fees thresholds, ensure access controls around the configurePeerScorer API, and monitor on-chain transactions and relay-fee changes. Code reviewers should verify that the heuristics cannot be manipulated by payment patterns to force unwanted channel opens/closes or fee changes, and that the new API requires appropriate authentication.

Security signals we found

01

New feature adds automated on-chain spending (channel funding) and channel closing based on heuristics

02

Automatic relay-fee updates are persisted to the peers DB and broadcast to channels

03

All automatic actions are opt-in and disabled by default

04

Multiple safety thresholds exist: min/max funding amounts, max per-peer capacity, min on-chain balance, max feerate, funding cooldown, rate-limits, balance thresholds for closing

05

No mention of security bug, CVE, or independent researcher attribution in commit or supplied references

06

Large feature addition (+2344 lines) increases attack surface and operational risk if misconfigured

Risk score

Why this scored 34/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 4/15
Affected reach 6/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.