AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 28 Bitcoin

multi: remove HaveNodeAnnouncement field from Node

Public commit record

What the developer wrote

Authored by Elle Mouton

70/100 · Adequate
multi: remove HaveNodeAnnouncement field from Node

Remove the 2 sources of truth here. If we have a signature for the
node, then we have the announcement.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Names security-relevant behavior explicitly
The short version

What changed, and why it matters

This commit removes a redundant flag called HaveNodeAnnouncement from LND's internal node records and replaces it with a simple rule: if a node has a stored signature, it has an announcement. It is a code-quality/refactoring change that eliminates two conflicting ways of answering the same question. There is no direct evidence in the commit that this fixes an active security vulnerability, but inconsistent state can historically lead to subtle bugs in how node information is stored, forwarded, or validated.

Recommended action

Treat as a defensive refactoring commit. Review the devrpc ImportGraph workaround (AuthSigBytes: []byte{0}) to ensure it does not bypass signature validation or cause invalid signed announcements to be generated/forwarded. Verify that SQL and KV migration paths correctly preserve the distinction between shell nodes and fully announced nodes, and that HaveAnnouncement() cannot be spoofed by malformed database state.

Security signals we found

01

Elimination of dual sources of truth for node-announcement state

02

New HaveAnnouncement() predicate depends solely on presence of AuthSigBytes

03

Workaround in devrpc ImportGraph sets a dummy one-byte signature to force persistence of node metadata

04

Legacy on-disk marker retained in KV store for backward compatibility

05

No explicit security framing or CVE reference in commit message or diff

Risk score

Why this scored 28/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 5/15
Confidence 5/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.