What the developer wrote
Authored by f321x
lnurl: fail lnurl-pay on successAction field
Fail the lnurl flow if a `successAction` field is present in the
lnurl callback response.
This prevents users from losing their payment until we properly
implement showing LUD-09 responses in the GUI.
See https://github.com/lnurl/luds/blob/luds/09.md.
Related: https://github.com/spesmilo/electrum/issues/10269
What changed, and why it matters
This commit makes Electrum refuse LNURL-pay payments when the payment service includes a 'successAction' response. The change is a temporary safety measure: Electrum does not yet know how to display these follow-up actions to the user, so it blocks the payment rather than silently ignore the action. This prevents a scenario where a user might believe a payment completed successfully but miss an important post-payment message or instruction.
Treat as a hardening/defensive change, not an active vulnerability fix. Users on affected versions should upgrade if they use lnurl-pay. Developers should prioritize implementing full LUD-09 support with appropriate GUI presentation so legitimate successAction flows are no longer blocked.
Security signals we found
Defensive fail-closed behavior for unimplemented protocol feature
Prevents silent omission of LUD-09 successAction responses
Could be interpreted as mitigating social-engineering or payment-confirmation risks where a successAction is used to mislead users
No cryptographic, memory-safety, or remote-code-execution signals present
Evidence from the diff
The patch adds a check in electrum/lnurl.py’s callback_lnurl() that raises LNURLError if the LNURL callback JSON contains a ‘successAction’ field. LUD-09 defines successAction as an optional post-payment action (message, URL, or AES-encrypted payload) that a service can return after an lnurl-pay. Electrum had not implemented GUI handling for these actions, so the commit fails the flow explicitly instead of silently dropping the field. It is a defensive, partial fix rather than a full implementation of LUD-09.
Changed components
electrum/lnurl.pyLNURL-pay callback handlingInspect captured patch +3 / −0
diff --git a/electrum/lnurl.py b/electrum/lnurl.py
index 603ff20..f1f4212 100644
--- a/electrum/lnurl.py
+++ b/electrum/lnurl.py
@@ -248,6 +248,9 @@ async def callback_lnurl(url: str, params: dict) -> dict:
status = response.get("status")
if status and status == "ERROR":
raise UntrustedLNURLError(f"LNURL request encountered an error: {response.get('reason', '<missing reason>')}")
+ # TODO: implement LUD-09 (https://github.com/lnurl/luds/blob/luds/09.md), e.g. useful for paying offline devices
+ if 'successAction' in response:
+ raise LNURLError("successAction are not yet supported by Electrum.")
# TODO: handling of specific errors (validate fields, e.g. for lnurl6)
return response
Why this scored 43/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.