chainntfs: zero out pkscript in logging when taproot is enabled
What the developer wrote
Authored by ziggie
chainntfs: zero out pkscript in logging when taproot is enabled
What changed, and why it matters
This commit changes a log message in LND's transaction notifier so that when a taproot public-key script is used, the log prints a placeholder instead of the actual script bytes. It is a hardening/logging hygiene change, not a fix for an active vulnerability. There is no evidence it prevents exploitation on its own.
Treat as a minor defensive cleanup. Review whether other log sites print raw PkScript and consider consistent redaction, but no urgent action is required.
Security signals we found
Logging of potentially sensitive script data is sanitized for an unsupported taproot sentinel
Code comment states taproot pk scripts are not supported for notifications
No functional validation or consensus logic is changed
Evidence from the diff
SpendRequest.String() in chainntnfs/txnotifier.go is modified to detect the sentinel ZeroTaprootPkScript and replace it with ‘
Changed components
chainntnfs/txnotifier.go: SpendRequest.String()Inspect captured patch +15 / −4
diff --git a/chainntnfs/txnotifier.go b/chainntnfs/txnotifier.go
index 57eee84..af85c29 100644
--- a/chainntnfs/txnotifier.go
+++ b/chainntnfs/txnotifier.go
@@ -356,11 +356,22 @@ func NewSpendRequest(op *wire.OutPoint, pkScript []byte) (SpendRequest, error) {
// String returns the string representation of the SpendRequest.
func (r SpendRequest) String() string {
- if r.OutPoint != ZeroOutPoint {
- return fmt.Sprintf("outpoint=%v, script=%v", r.OutPoint,
- r.PkScript)
+ var (
+ outpointStr = fmt.Sprintf("%v", r.OutPoint)
+ scriptStr = fmt.Sprintf("%v", r.PkScript)
+ )
+
+ if r.OutPoint == ZeroOutPoint {
+ outpointStr = "<zero>"
}
- return fmt.Sprintf("outpoint=<zero>, script=%v", r.PkScript)
+
+ // If the pk script is all zeros, we blank the pk script.
+ // Currently we do not support taproot pk scripts for notifications.
+ if r.PkScript == ZeroTaprootPkScript {
+ scriptStr = "<zero> (taproot pk script not supported)"
+ }
+
+ return fmt.Sprintf("outpoint=%s, script=%s", outpointStr, scriptStr)
}
// MatchesTx determines whether the given transaction satisfies the spend
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.