AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 29 Bitcoin

onion_message: pathfinding: ignore amount contraints

Public commit record

What the developer wrote

Authored by f321x

73/100 · Adequate
onion_message: pathfinding: ignore amount contraints

Ignore channel amount constraints when doing pathfinding for an
onion message. Onion messages don't need to move funds so pathfinding
shouldn't penalize channels based on fake payment amounts.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes a design bug in Electrum's Lightning onion-message routing. Previously, the app used a fake payment amount (10,000 millisatoshis) when finding a route for an onion message, which could cause it to reject valid message paths because real channels have minimum/maximum amount limits. The change lets onion-message pathfinding ignore those amount limits, since no actual money is being moved. It is a correctness/availability fix for a messaging feature, not a fix for theft of funds or remote code execution.

Recommended action

Treat as a routine bug-fix commit. Reviewers should verify that `ignore_amount_constraints` is only set when `invoice_amount_msat is None` and that callers cannot accidentally pass `None` for real payments. No urgent security response is indicated by the diff alone.

Security signals we found

01

Correctness fix in Lightning pathfinding logic

02

Removes hard-coded dummy payment amount used for onion messages

03

Adds regression test for amount-constraint bypass behavior

04

No evidence of memory corruption, cryptographic flaw, or remote exploit in the diff

Risk score

Why this scored 29/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 6/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.