AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 27 Bitcoin

payments/migration1: handle legacy payments with nil HTLC hash

Public commit record

What the developer wrote

Authored by ziggie

73/100 · Adequate
payments/migration1: handle legacy payments with nil HTLC hash

For legacy payments, the HTLC Hash field may be nil in the bbolt
backend. Previously, the migration would fail with "HTLC attempt X
missing payment hash" when encountering such payments.

This commit fixes the migration by falling back to the parent payment
hash when the HTLC-specific hash is nil. This is consistent with how
the router handles legacy payments (see patchLegacyPaymentHash in
payment_lifecycle.go).

The validation logic is also updated to apply the same fallback when
comparing bbolt data with migrated SQL data, ensuring the comparison
succeeds.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes a database migration bug in LND's payment storage upgrade. Older Lightning payments sometimes didn't store a payment hash on each individual HTLC (payment attempt). The migration to a new SQL database previously failed when it encountered these legacy records. The fix simply falls back to the parent payment's hash, matching how the rest of LND already treats legacy payments. This is a reliability fix, not an exploitable security vulnerability.

Recommended action

Treat as a normal bug-fix/maintenance patch. Include in release notes as a migration reliability improvement. No urgent security response required.

Security signals we found

01

Migration failure could block node upgrades or leave databases in a partially migrated state

02

Fix aligns data handling with existing router behavior for legacy payments

03

No input validation bypass, privilege escalation, or cryptographic weakness introduced

Risk score

Why this scored 27/100

Our methodology →
Potential impact 8/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 5/15
Confidence 9/10
Evidence quality 5/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.