AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 23 Bitcoin

cmd: add deletefwdhistory CLI command

Public commit record

What the developer wrote

Authored by ziggie

68/100 · Adequate
cmd: add deletefwdhistory CLI command

In this commit, we add the lncli deletefwdhistory command that wraps
the DeleteForwardingHistory RPC. The command accepts a time
specification in one of two forms:

--age=<duration> relative duration, e.g. "-90d", "-1M", "-720h"
--before=<unix> absolute Unix timestamp in seconds

An interactive confirmation prompt is shown before deletion proceeds,
which can be suppressed with --force/-f for unattended automation.
The --batch_size flag controls events deleted per database transaction
(default 10000, max 50000).

The response is printed as JSON, consistent with other lncli commands.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds a new command-line tool called `deletefwdhistory` to LND's `lncli` utility. It lets node operators permanently delete old payment forwarding history records from their own node database, either by age (e.g., older than 30 days) or by a specific Unix timestamp. The command asks for confirmation unless the user passes `--force`. It is a privacy/data-retention feature, not a network protocol change, and does not by itself create a vulnerability. The main risk is accidental or malicious local data loss if an attacker already has access to run `lncli` commands.

Recommended action

No immediate security patch is required. Operators should protect `lncli` access (macaroons, RPC TLS, OS permissions) because any party that can run `lncli deletefwdhistory --force` can irreversibly delete local forwarding records. Consider logging or auditing use of destructive commands and ensuring backups/compaction policies are in place.

Security signals we found

01

Destructive local operation gated by interactive confirmation and --force flag

02

Wraps pre-existing DeleteForwardingHistory RPC; no new RPC authorization logic shown

03

No input validation or sanitization visible in the CLI layer beyond requiring exactly one of --age/--before

04

Potential for accidental/malicious data loss if an attacker can execute lncli with --force

Risk score

Why this scored 23/100

Our methodology →
Potential impact 2/30
Exploitability 3/25
Stealth signal 2/15
Affected reach 4/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.