AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 48 Bitcoin

plugin: nwc: do budget accounting in msat

Public commit record

What the developer wrote

Authored by f321x

80/100 · Strong
plugin: nwc: do budget accounting in msat

Keep track of the spent amount in msat instead of sat to prevent
issues due to rounding.
The budget is still specified in sat.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This commit fixes a rounding bug in Electrum's NWC (Nostr Wallet Connect) plugin. The plugin lets users set a daily spending limit in satoshis, but it was internally tracking spent amounts in whole satoshis. Because Lightning invoices are priced in millisatoshis (one-thousandth of a satoshi), rounding down to satoshis could let a user or service spend slightly more than the intended daily limit over many small payments. The patch now tracks the budget in millisatoshis and converts the limit to millisatoshis for comparison, closing the rounding gap. It also migrates existing saved budget data from satoshis to millisatoshis.

Recommended action

Treat as a low-to-moderate security fix. Users relying on NWC daily spending limits should upgrade to a version containing this commit. Review whether any other plugins or wallet components compare satoshi and millisatoshi amounts without explicit conversion. No immediate emergency response is indicated because exploitation requires many authorized payments and only marginally exceeds the configured limit.

Security signals we found

01

Rounding-induced budget bypass in spending-limit enforcement

02

Unit mismatch between user-facing satoshi limit and Lightning-native millisatoshi amounts

03

Database migration to preserve and correct historical budget records

04

Use of keyword-only arguments to prevent accidental unit confusion in API

Risk score

Why this scored 48/100

Our methodology →
Potential impact 12/30
Exploitability 10/25
Stealth signal 8/15
Affected reach 7/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.