onion_message: verify ONION_MESSAGE feature on peer before forwarding
What the developer wrote
Authored by Sander van Grieken
onion_message: verify ONION_MESSAGE feature on peer before forwarding
What changed, and why it matters
This commit adds a safety check in Electrum's Lightning 'onion message' forwarding code. Before passing an encrypted message to the next peer in the chain, Electrum now verifies that the peer actually advertises support for onion messages. Without this check, Electrum could forward messages to peers that do not understand them, which could leak information about the route, waste bandwidth, or cause protocol confusion. The change is small and defensive.
Review whether other forwarded Lightning messages have similar feature-bit preconditions, and consider adding tests that exercise the new guard path. No urgent user action is required; update to the patched version when convenient.
Security signals we found
Missing capability check before protocol message forwarding
Lightning feature-bit validation added as defense-in-depth
Potential route-capability leak or protocol mismatch mitigated
Evidence from the diff
In electrum/onion_message.py, the OnionMessageManager’s forwarding loop now inspects next_peer.their_features for LnFeatures.OPTION_ONION_MESSAGE_OPT before calling next_peer.send_message(‘onion_message’, …). If the feature is absent, the forward is dropped and logged. This aligns forwarding behavior with the peer’s advertised feature bits, preventing transmission of onion_message to non-supporting nodes.
Changed components
electrum/onion_message.pyOnionMessageManagerLightning peer forwarding pathInspect captured patch +4 / −0
diff --git a/electrum/onion_message.py b/electrum/onion_message.py
index ffb4306..1212353 100644
--- a/electrum/onion_message.py
+++ b/electrum/onion_message.py
@@ -474,6 +474,10 @@ class OnionMessageManager(Logger):
onion_packet_b = onion_packet.to_bytes()
next_peer = self.lnwallet.peers.get(node_id)
+ if not next_peer.their_features.supports(LnFeatures.OPTION_ONION_MESSAGE_OPT):
+ self.logger.debug('forward dropped, next peer is not ONION_MESSAGE capable')
+ continue
+
next_peer.send_message(
"onion_message",
path_key=blinding,
Why this scored 48/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.