docs: add release note for same-peer onion message cycle drop
What the developer wrote
Authored by Gijs van Dam
docs: add release note for same-peer onion message cycle drop
Record the onion-message same-peer cycle drop from #10754 under a new
Robustness subsection in the 0.21.0 release notes.
What changed, and why it matters
This commit only updates the release notes to describe a fix made in a separate pull request. The actual code change (in PR #10754) prevents a type of network message from being bounced back to the sender, which could otherwise be abused to amplify traffic. The commit itself is documentation-only, so it does not change any running code.
Review PR #10754 directly to assess the actual implementation of the onion-message cycle drop. This documentation commit does not require deployment action on its own.
Security signals we found
Release note describes a traffic-amplification mitigation
Fix prevents onion messages from cycling back to the same peer
Covers both direct next-node-ID and SCID-resolved forwarding paths
Evidence from the diff
The commit adds a ‘Robustness’ section to the LND 0.21.0 release notes documenting PR #10754, which drops onion messages when the resolved next hop equals the peer that sent the message. This mitigates a traffic-amplification vector across both next-node-ID and SCID-resolution paths. The commit contains no functional code changes; the security fix is in the referenced pull request, not in this diff.
Changed components
docs/release-notes/release-notes-0.21.0.mdOnion message forwarding subsystem (referenced by PR #10754, not changed here)Inspect captured patch +11 / −0
diff --git a/docs/release-notes/release-notes-0.21.0.md b/docs/release-notes/release-notes-0.21.0.md
index b8a3778..8407724 100644
--- a/docs/release-notes/release-notes-0.21.0.md
+++ b/docs/release-notes/release-notes-0.21.0.md
@@ -16,6 +16,7 @@
- [Testing](#testing)
- [Database](#database)
- [Code Health](#code-health)
+ - [Robustness](#robustness)
- [Tooling and Documentation](#tooling-and-documentation)
- [Contributors (Alphabetical Order)](#contributors)
@@ -423,6 +424,16 @@
`lnutils.ContextFromQuit` helper bridges the existing `quit` channels to
`context.Context`, so all gossip awaits now respect shutdown uniformly.
+## Robustness
+
+* [Drop onion messages that would cycle back to the sending
+ peer](https://github.com/lightningnetwork/lnd/pull/10754). When the
+ resolved next hop of an incoming onion message is the same peer that
+ delivered it, the message is now dropped instead of being forwarded
+ back over the connection it arrived on. This closes a trivial
+ traffic-amplification vector and covers both the direct next-node-ID
+ and SCID-resolved paths.
+
## Tooling and Documentation
* [Added missing `lncli:` tags](https://github.com/lightningnetwork/lnd/pull/10658)
Why this scored 37/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.