wallet: check swap provider liquidity for send change to ln
What the developer wrote
Authored by f321x
wallet: check swap provider liquidity for send change to ln
Check the swap providers liquidity as well if we try to send change to
lightning in `make_unsigned_transaction`. It is now expected that the
swap_manager is already initialized when calling
`make_unsigned_transaction`, otherwise no dummy output will get added.
What changed, and why it matters
This commit tightens the conditions under which Electrum automatically sends Bitcoin transaction change into a Lightning Network swap. Previously, the wallet only checked whether the Lightning node could receive the amount. Now it also verifies the swap provider actually has enough liquidity and that the amount meets minimum and maximum swap limits. Without this check, a user could create a transaction whose change is routed into a swap that cannot currently be fulfilled, potentially leaving funds stuck, failing the payment path, or producing a poor user experience. The change is defensive rather than a fix for an active exploit.
Treat as a hardening or bug-fix patch. Review whether any callers of `make_unsigned_transaction` with `send_change_to_lightning=True` need to be updated to ensure the swap manager is initialized first, as the commit message warns that otherwise the swap change output will silently not be added. Users relying on automatic change-to-Lightning should upgrade to avoid creating transactions with unfulfillable swap outputs.
Security signals we found
Business-logic validation added for swap provider liquidity bounds
Precondition introduced: swap_manager must be initialized before change-to-lightning conversion
Change output replacement now gated on both local LN receive capacity and remote swap limits
Potential for failed/stuck swaps or unexpected transaction composition if preconditions are not met
Evidence from the diff
In Abstract_Wallet.make_unsigned_transaction, when send_change_to_lightning is true, the code now requires self.lnworker.swap_manager.is_initialized to be set before replacing a change output with DummyAddress.SWAP. It then computes min_swap_amount from the swap manager and max_swap_amount from client_max_amount_forward_swap(), and only performs the replacement if the change amount lies within [min_swap_amount, max_swap_amount]. The prior logic only compared the change amount against lnworker.num_sats_can_receive(). The commit message notes that callers are now expected to have initialized the swap manager before invoking make_unsigned_transaction; otherwise no dummy swap output is added.
Changed components
electrum/wallet.pyAbstract_Wallet.make_unsigned_transactionLightning swap manager integrationInspect captured patch +5 / −2
diff --git a/electrum/wallet.py b/electrum/wallet.py
index c852603..0c608c9 100644
--- a/electrum/wallet.py
+++ b/electrum/wallet.py
@@ -2058,11 +2058,14 @@ class Abstract_Wallet(ABC, Logger, EventListener):
fee_estimator_vb=fee_estimator,
dust_threshold=self.dust_threshold(),
BIP69_sort=BIP69_sort)
- if self.lnworker and send_change_to_lightning:
+ if send_change_to_lightning and self.lnworker and self.lnworker.swap_manager.is_initialized.is_set():
+ sm = self.lnworker.swap_manager
change = tx.get_change_outputs()
if len(change) == 1:
amount = change[0].value
- if amount <= self.lnworker.num_sats_can_receive():
+ min_swap_amount = sm.get_min_amount()
+ max_swap_amount = sm.client_max_amount_forward_swap() or 0
+ if min_swap_amount <= amount <= max_swap_amount:
tx.replace_output_address(change[0].address, DummyAddress.SWAP)
if self.should_keep_reserve_utxo(tx.inputs(), tx.outputs(), is_anchor_channel_opening):
raise NotEnoughFunds()
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.