AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 46 Bitcoin

onion_messages: filter correct feature when creating paths

Public commit record

What the developer wrote

Authored by f321x

73/100 · Adequate
onion_messages: filter correct feature when creating paths

Filter channels/peers in `get_blinded_paths_to_me` depending on
the context (onion message or blinded payment path). Raise
according exceptions when no channel/peer is available.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes a bug in Electrum's Lightning code where the program sometimes picked the wrong type of peer when building private 'blinded paths' for messages or payments. Before the fix, a path meant for an onion message could accidentally require a payment-related feature, and a path meant for a payment could accidentally require a message-related feature. The patch makes the feature check match the actual purpose, and raises clear errors when no suitable peer exists instead of silently returning an empty path. It is a correctness fix that reduces the chance of failed or misrouted private routes, but the commit itself does not describe it as a security fix and no exploit is demonstrated.

Recommended action

Review and merge if part of normal maintenance; monitor for related Lightning protocol correctness issues. No urgent security response is indicated by the commit alone, but users relying on blinded payments or onion messages should run a version containing this fix to avoid route-construction failures.

Security signals we found

01

Logic bug in feature-bit filtering for blinded path construction

02

Potential mismatch between path purpose and required peer feature support

03

Silent empty-path return replaced with explicit exceptions

04

No vendor security disclosure or CVE referenced in commit

Risk score

Why this scored 46/100

Our methodology →
Potential impact 12/30
Exploitability 8/25
Stealth signal 7/15
Affected reach 8/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.