AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 36 Bitcoin

routerrpc: add DeleteForwardingHistory to Router proto

Public commit record

What the developer wrote

Authored by ziggie

73/100 · Adequate
routerrpc: add DeleteForwardingHistory to Router proto

In this commit, we define the DeleteForwardingHistory RPC in the Router
sub-server protocol and regenerate all derived Go stubs, JSON bindings,
and Swagger documentation.

The RPC uses a oneof for time specification, allowing callers to provide
either an absolute Unix timestamp (delete_before_time) or a relative
duration string (delete_before_duration, e.g. "-30d", "-1M"). The
response includes the count of deleted events and total fees earned in
millisatoshis, allowing operators to maintain financial records while
purging detailed routing surveillance data.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit only adds a new RPC definition called DeleteForwardingHistory to the protocol buffer (proto) layer of LND's router sub-server. It does not include the actual server-side implementation that would perform the deletion, nor any access-control or authentication changes. The new RPC is intended to let node operators purge old forwarding records for privacy/data-retention purposes. Because it is just an interface change, it does not by itself create a vulnerability, but it does expose a future destructive operation over the existing API surface, which will need careful implementation and permission checks in later commits.

Recommended action

Treat this as a protocol/interface change requiring follow-up review. When the implementation lands, verify that: (1) the RPC requires an appropriately restricted macaroon permission; (2) the duration parser rejects malformed or positive (future) durations; (3) deletion is bounded by batch sizes and transactions as described; (4) the endpoint is not reachable without authentication; and (5) audit logging is in place. No immediate action is needed solely from this commit.

Security signals we found

01

New destructive RPC added to API surface

02

No implementation or authorization logic included in this commit

03

Relative duration parsing logic is not visible in this patch; parsing behavior cannot be assessed

04

Response exposes aggregate fee metadata for deleted records

05

Generated gateway exposes endpoint over existing REST interface

Risk score

Why this scored 36/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 10/15
Confidence 8/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.