lnurlw: accept "null" minWithdrawable in response
What the developer wrote
Authored by f321x
lnurlw: accept "null" minWithdrawable in response
Accept a `null` value as response for the `minWithdrawable` field in the
lnurlw response. Some servers seem to set this to `null` instead of 0
when having no minimum withdrawal amount.
What changed, and why it matters
This is a tiny compatibility fix for the Electrum Bitcoin wallet's handling of LNURL-withdraw (a way to withdraw bitcoins from a service). Some LNURL servers send a 'null' value for the minimum withdrawal amount instead of the number 0. Previously, Electrum would crash when converting 'null' to an integer. The change treats 'null' as 0 so the wallet can continue. It is not a security fix and does not introduce an obvious vulnerability.
No security action required. Treat as a normal interoperability bugfix. If reviewing, consider whether maxWithdrawable should also tolerate null, and ensure downstream callers handle a zero minimum correctly.
Security signals we found
No security-relevant keywords in commit title or message
Change is a null-safety compatibility fix, not a vulnerability patch
Input validation (assert max > 0, max >= min) remains in place
No attacker-controlled bypass introduced by the diff
Evidence from the diff
In electrum/lnurl.py, _parse_lnurl3_response now uses int(lnurl_response[‘minWithdrawable’] or 0) instead of int(lnurl_response[‘minWithdrawable’]). This handles JSON null by coalescing to 0 before conversion. The maxWithdrawable field remains unchanged and is still validated to be positive and not less than minWithdrawable. The patch is defensive and improves interoperability with non-conforming LNURL servers.
Changed components
electrum/lnurl.pyLNURL withdrawal response parsingInspect captured patch +1 / −1
diff --git a/electrum/lnurl.py b/electrum/lnurl.py
index 9bfd059..a95bf8b 100644
--- a/electrum/lnurl.py
+++ b/electrum/lnurl.py
@@ -179,7 +179,7 @@ def _parse_lnurl3_response(lnurl_response: dict) -> LNURL3Data:
raise UntrustedLNURLError(f"Missing k1 value in LNURL3 response: {lnurl_response=}")
default_description = lnurl_response.get('defaultDescription', '')
try:
- min_withdrawable_sat = int(lnurl_response['minWithdrawable']) // 1000
+ min_withdrawable_sat = int(lnurl_response['minWithdrawable'] or 0) // 1000
max_withdrawable_sat = int(lnurl_response['maxWithdrawable']) // 1000
assert max_withdrawable_sat >= min_withdrawable_sat, f"Invalid amounts: max < min amount"
assert max_withdrawable_sat > 0, f"Invalid max amount: {max_withdrawable_sat} sat"
Why this scored 19/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.