plugin: nwc: lookup_invoice: fix exc, include b11
What the developer wrote
Authored by f321x
plugin: nwc: lookup_invoice: fix exc, include b11
Fixes exception in lookup_invoice:
```
62.69 | E | plugins.nwc.nwcserver.NWCServer | Error handling nwc request
Traceback (most recent call last):
File "/home/user/code/vibecoding_vm/electrum/electrum/plugins/nwc/nwcserver.py", line 381, in run_request_task
await task
File "/home/user/code/vibecoding_vm/electrum/electrum/util.py", line 1211, in wrapper
return await func(*args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/home/user/code/vibecoding_vm/electrum/electrum/plugins/nwc/nwcserver.py", line 526, in handle_lookup_invoice
info = self.wallet.lnworker.get_payment_info(invoice.payment_hash, direction=RECEIVED)
^^^^^^^^^^^^^^^^^^^^
AttributeError: 'Invoice' object has no attribute 'payment_hash'
```
Always includes bolt11 invoice in response, even if the client already
sent it to us in the request. It doesn't seem useful and is marked
optional in the spec but https://sandbox.albylabs.com considers the
response invalid if the invoice is not included.
What changed, and why it matters
This commit fixes a crash in Electrum's Nostr Wallet Connect (NWC) plugin when a user looks up an existing incoming invoice. The code was trying to read a non-existent 'payment_hash' field and instead should use the invoice's existing 'rhash' value. It also changes the response so the BOLT11 invoice string is always included, rather than only when the client originally searched by payment hash. This improves compatibility with a third-party service (sandbox.albylabs.com) that rejects responses missing the invoice string. There is no indication this bug could be exploited by an attacker; it is a functional bug causing request failures.
Treat as a routine bug-fix commit. Reviewers may want to verify that invoice.rhash is always a valid hex string before bytes.fromhex is called, and confirm the always-include-invoice behavior does not leak invoice data to unauthorized clients. No urgent security action is indicated.
Security signals we found
Crash/exception in request handler due to incorrect attribute access
Behavioral change to always include BOLT11 invoice in NWC lookup_invoice response
No input validation, memory safety, or authorization changes observed
Evidence from the diff
In electrum/plugins/nwc/nwcserver.py, handle_lookup_invoice previously referenced invoice.payment_hash, which does not exist on the Invoice object, causing an AttributeError. The patch uses bytes.fromhex(invoice.rhash) to obtain the payment hash passed to lnworker.get_payment_info. Additionally, the response construction is changed so the ‘invoice’ (BOLT11) field is always populated in result, instead of conditionally added only when the request included a payment_hash. This aligns with real-world interop requirements from Alby’s sandbox, even though the field is optional per NIP-47.
Changed components
electrum/plugins/nwc/nwcserver.pyNWC (Nostr Wallet Connect) pluginhandle_lookup_invoice request handlerInspect captured patch +2 / −3
diff --git a/electrum/plugins/nwc/nwcserver.py b/electrum/plugins/nwc/nwcserver.py
index 2abffe7..9e278d0 100644
--- a/electrum/plugins/nwc/nwcserver.py
+++ b/electrum/plugins/nwc/nwcserver.py
@@ -523,7 +523,7 @@ class NWCServer(Logger, EventListener):
b11 = invoice.lightning_invoice
elif self.wallet.get_request(invoice.rhash):
direction = "incoming"
- info = self.wallet.lnworker.get_payment_info(invoice.payment_hash, direction=RECEIVED)
+ info = self.wallet.lnworker.get_payment_info(bytes.fromhex(invoice.rhash), direction=RECEIVED)
_, b11 = self.wallet.lnworker.get_bolt11_invoice(
payment_info=info,
message=invoice.message,
@@ -539,11 +539,10 @@ class NWCServer(Logger, EventListener):
"created_at": invoice.time,
"expires_at": invoice.get_expiration_date(),
"fees_paid": 0,
+ "invoice": b11,
"metadata": {}
}
}
- if payment_hash: # if client requested by payment hash we add the invoice
- response['result']['invoice'] = b11
if nip47_status := self.invoice_status_to_nip47_state(status):
response['result']['state'] = nip47_status
Why this scored 22/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.