AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 42 Bitcoin

onion_message: fix route construction to ip

Public commit record

What the developer wrote

Authored by f321x

68/100 · Adequate
onion_message: fix route construction to ip

Don't include first hop of the path,
this is the hop from us to the first node and we don't
need a payload for ourselves.

Also adds unittest checking this.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes how Electrum builds encrypted routes for sending private messages over the Lightning network. Previously, the code accidentally included the sender's own first hop in the encrypted onion path, which could cause message delivery to fail or produce an invalid route. The fix removes that unnecessary first hop and adds a unit test to confirm the route is built correctly.

Recommended action

Treat as a normal bug-fix commit. Reviewers should verify that the new loop bounds correctly align `hops_data` indices with `hop_shared_secrets` and `blinded_node_ids`, and that the direct-peer case still hands the onion to the correct peer with the right path key.

Security signals we found

01

Incorrect route/payload construction in onion-message routing

02

Potential message delivery failure or malformed onion packet

03

Fix accompanied by regression unit test

04

Lightning Network BOLT12/blinded-path message privacy feature affected

Risk score

Why this scored 42/100

Our methodology →
Potential impact 12/30
Exploitability 8/25
Stealth signal 7/15
Affected reach 6/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.