lnworker: export_channel_backup: document design in more detail
What the developer wrote
Authored by SomberNight
lnworker: export_channel_backup: document design in more detail
follow-up 7a6a39d1aa9423b608b0bc3d505323464735fa34
What changed, and why it matters
This commit only adds explanatory comments to existing code. It does not change any behavior. The new comments describe how encrypted lightning channel backups work in Electrum and note that the wallet's public key (xpub) is somewhat sensitive because someone with both the xpub and an encrypted backup could force-close a channel. This is documentation, not a fix.
No action needed for this commit. Treat as non-security documentation. Consider the TODO for future design hardening if relevant to your roadmap.
Security signals we found
Documentation-only change
Mentions sensitivity of xpub + encrypted channel backup
Adds TODO about hardened-path derived secret for future improvement
Evidence from the diff
The diff updates the docstring of LNWallet.export_channel_backup() in electrum/lnworker.py. It clarifies that static channel backups contain the LN node private key, which is needed to open a BOLT-08 transport and request a force-close, and that possession of both the wallet xpub and an encrypted backup enables those actions. It adds a TODO suggesting future use of a seed-derived secret along a hardened path instead of the xpub. No code logic is modified.
Changed components
electrum/lnworker.pyLNWallet.export_channel_backup()Inspect captured patch +11 / −3
diff --git a/electrum/lnworker.py b/electrum/lnworker.py
index 1a705d5..6e65cf6 100644
--- a/electrum/lnworker.py
+++ b/electrum/lnworker.py
@@ -3734,12 +3734,20 @@ class LNWallet(Logger):
to have lightning channels. Since these wallets do not have
private keys, we use their master public key to encrypt
channel backups. This allows users to import channel backups
- in these wallets. Note that these are static backups: they
- only allow to request a force close (and, in some scenarios,
- to sweep funds after a channel has been force closed).
+ in these wallets.
The creation of lightning channels in watching-only wallets
has been disabled for anchor channels.
+
+ Note that these are static backups: they
+ only allow requesting a force close (and, in some scenarios,
+ sweeping funds after a channel has been force closed).
+ The LN node privkey is also contained (needed to establish a BOLT-08 transport with
+ the counterparty and request the force-close).
+
+ This makes the xpub somewhat sensitive: having *both* the wallet xpub
+ and an encrypted-channel-backup allows the above actions.
+ TODO instead of xpub, encrypt with a secret derived from the seed along a dedicated hardened path?
"""
xpub = self.wallet.get_fingerprint()
backup_bytes = self.create_channel_backup(channel_id).to_bytes()
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.