AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 25 Bitcoin

lnrpc: SendOnionMessage rpc endpoint

Public commit record

What the developer wrote

Authored by Gijs van Dam

35/100 · Opaque
lnrpc: SendOnionMessage rpc endpoint
✓ Descriptive subject! No meaningful explanatory body
The short version

What changed, and why it matters

This commit adds a new gRPC API endpoint called SendOnionMessage to the LND Lightning node, along with a matching subscription stream for incoming onion messages. It only changes the protocol definition and generated code; it does not include the actual server-side implementation that would process these messages. Because the implementation is missing, the change by itself does not create or fix a security vulnerability, but it does expose a new network-facing capability that will need careful review once the backend logic lands.

Recommended action

Treat this as a surface-only change requiring follow-up review. When the backend implementation is merged, audit it for onion packet length limits, path-key validation, peer authorization, rate limiting, and prevention of free routing/DoS via arbitrary onion messages. Until then, no immediate patch is required for this commit alone.

Security signals we found

01

New network-exposed RPC surface added (SendOnionMessage / SubscribeOnionMessages)

02

Raw onion packet bytes accepted from API caller with no visible validation in this commit

03

Blinded-path path_key is exposed to the API and forwarded to peer logic

04

Generated gateway/swagger changes expose the endpoint to REST clients

05

No implementation, tests, or access-control changes are included in the diff

Risk score

Why this scored 25/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 5/15
Confidence 3/10
Evidence quality 2/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.