What the developer wrote
Authored by SomberNight
lnworker: add docstring to pay_invoice
LLM vuln report spam keeps thinking that getting a swapserver to *call* the pay_invoice method is a huge security issue.
What changed, and why it matters
This commit only adds comments and a docstring to an existing Lightning Network payment function. No code behavior changes. The commit message explicitly says the change is meant to counter mistaken automated vulnerability reports, not to fix a real bug.
No action required. This is a documentation-only change with no security relevance.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The diff adds inline comments to parameters and a docstring to LNWallet.pay_invoice() explaining that HTLCs are conditional contracts requiring preimage revelation. There are no logic, control-flow, or data-handling changes. The function body is identical except for whitespace/comment additions.
Changed components
electrum/lnworker.pyInspect captured patch +10 / −3
diff --git a/electrum/lnworker.py b/electrum/lnworker.py
index 7cb80d7..659a684 100644
--- a/electrum/lnworker.py
+++ b/electrum/lnworker.py
@@ -1861,12 +1861,19 @@ class LNWallet(Logger):
@log_exceptions
async def pay_invoice(
self, invoice: Invoice, *,
- amount_msat: int = None,
+ amount_msat: int = None, # to overwrite amt in invoice
attempts: int = None, # used only in unit tests
full_path: LNPaymentPath = None,
- channels: Optional[Sequence[Channel]] = None,
- budget: Optional[PaymentFeeBudget] = None,
+ channels: Optional[Sequence[Channel]] = None, # my own direct channels
+ budget: Optional[PaymentFeeBudget] = None, # to limit max fee
) -> Tuple[bool, List[HtlcLog]]:
+ """Attempt to pay a Lightning invoice (find routes, do MPP, send HTLCs).
+
+ Note: this does NOT directly send money, it sends HTLC(s), which is a conditional contract.
+ The intended recipient (or any node) can only claim the HTLCs by revealing the correct preimage.
+ When paying a hold-invoice, or during a submarine swap, it is often the case that the recipient
+ does not YET know the preimage, and hence they cannot take the money until later.
+ """
bolt11 = invoice.lightning_invoice
lnaddr = self._check_bolt11_invoice(bolt11, amount_msat=amount_msat)
min_final_cltv_delta = lnaddr.get_min_final_cltv_delta()
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.