CommitWatch RSS
AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 19 Bitcoin

Include the `node_id` of channel peers in payment events (#3243)

AQff7a24c5 View source ↗
Public commit record

What the developer wrote

Authored by Bastien Teinturier

81/100 · Strong
Include the `node_id` of channel peers in payment events (#3243)

When scoring peers, we don't really care about individual channels but
rather about the peer itself, who is identified by its `node_id`. We
update payment events to include the `node_id` of our channel peer, to
make it easier to compute statistics about each of our peers.

We also rework the events in `PaymentEvents.scala` to be more consistent
now that we've added support for trampoline, splicing, liquidity ads and
on-the-fly funding, which are all the features we had planned that can
impact peer scoring.

Note that we don't yet update the schema of the `AuditDb`, which means
that some of the data isn't stored and is currently filled with a dummy
value. We will include *all* updates to the DB schema in a future PR and
will fix this.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit is a refactoring and observability improvement for the Eclair Lightning node. It adds the node identifier (node_id) of channel peers to various payment events and restructures how payment events are represented in code. It does not fix a security vulnerability, nor does it introduce obvious new attack surface. The database schema is intentionally not yet updated, so some stored data uses a placeholder node_id. The change touches many files but is mostly internal plumbing for metrics and audit logging.

Recommended action

No immediate security action required. Reviewers should verify that the new remoteNodeId values are correctly populated at all event emission sites and that the codec backward-compatibility path preserves data integrity when loading old channel states. When the future database schema migration lands, ensure the placeholder dummy node_id is replaced with persisted values and that migration/rollback is handled.

Security signals we found

01

Large refactor across payment event pipeline

02

Codec format change for persisted upstream origins (new typecodes 0x04/0x05, backward-compatible readers for 0x02/0x03)

03

Database reads return placeholder public key for node_id fields not yet stored

04

No input validation, authorization, or cryptographic changes observed

Risk score

Why this scored 19/100

Our methodology →
Potential impact 2/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 5/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.

More from Eclair

Related watches

Low 25 AI analysisMessage 81 · Strong
AQ ACINQEclair BitcoinLightning Network

Upgrade postgresql client from 42.7.11 to 42.7.12 (#3330)

This commit updates the PostgreSQL database driver used by Eclair from version 42.7.11 to 42.7.12. It is a routine dependency bump by an automated tool. The commit itself does not say what bugs the new driver fixes, but small point-release…

Dependency version bump of a database driverPoint-release upgrade may include upstream security fixes, but none are named in the commitNo application code changes or direct vulnerability evidence in the diff
972dfe99by dependabot[bot]+3−12 files
No security note in commit
Open full analysis →Source commit ↗
Low 31 AI analysisMessage 58 · Thin
AQ ACINQEclair BitcoinLightning Network

Use bitcoin-kmp 0.49 (depends on bitcoin-kmp 0.32.0 and secp256k1-kmp 0.24.0) (#3362)

This commit updates Eclair's Bitcoin library dependency from version 0.48 to 0.49, which internally uses newer versions of bitcoin-kmp and secp256k1-kmp. The code changes only replace old property accesses (like `.txid`) with new method ca…

Dependency version bump for Bitcoin and secp256k1 cryptographic librariesSource changes are API adaptations (.txid -> .getTxid), not logic changesSecurity-critical validation code is touched (PSBT/transaction integrity checks against malicious Bitcoin Core)
6162e2aaby Fabrice Drouin+22−44 files
No security note in commit
Open full analysis →Source commit ↗
Informational 15 AI analysisMessage 86 · Strong
AQ ACINQEclair BitcoinLightning Network

Update build to improve release process (#3381)

This commit is a routine build-system update. It upgrades several Maven plugin versions, removes the git commit ID from one jar manifest field to avoid a build-time circular dependency, and adds an optional build profile for a fuzz-testing…

c3e9f5d6by Fabrice Drouin+834−105 files
No security note in commit
Open full analysis →Source commit ↗