AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 34 Bitcoin

lnworker: add invoice features to PaymentInfo class

Public commit record

What the developer wrote

Authored by f321x

73/100 · Adequate
lnworker: add invoice features to PaymentInfo class

Adds the invoice features to the `PaymentInfo` class so we can check if
the sender respects our requested features (e.g. if they tried to send
mpp if we requested no mpp).
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit changes how Electrum stores and uses Lightning invoice features. It records which features (like multi-part payments, or MPP) were advertised in an invoice, so the wallet can later check whether the sender followed those rules. The change also fixes a minor bug where the wallet read from the wrong config object. There is no direct evidence in the commit that this fixes an active exploit, but it is a defensive hardening change that prevents a sender from ignoring the receiver's invoice rules.

Recommended action

Treat as a defensive hardening patch. Review whether the new invoice_features field is actually consulted during incoming payment validation (the commit only stores it; enforcement may be in a follow-up). Ensure the DB migration default feature set is appropriate for all existing invoices. Verify the config reference fix does not affect other call sites.

Security signals we found

01

Defensive feature-enforcement data structure change

02

Database schema migration for stored payment metadata

03

Invoice feature logic centralized to avoid recomputation drift

04

Minor config object reference correction

05

Commit message describes security-relevant intent: checking sender compliance with requested features

Risk score

Why this scored 34/100

Our methodology →
Potential impact 8/30
Exploitability 6/25
Stealth signal 5/15
Affected reach 7/15
Confidence 5/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.