AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 23 Bitcoin

lnwire: add onion message type

Public commit record

What the developer wrote

Authored by Gijs van Dam

60/100 · Adequate
lnwire: add onion message type

This message type is a message that carries an onion-encrypted payload
used for BOLT12 messages.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
The short version

What changed, and why it matters

This commit adds a new network message type called OnionMessage to the Lightning Network Daemon (LND). It is a protocol-level feature for carrying encrypted BOLT12 messages, not a fix for a known security flaw. The change itself is straightforward wiring: it registers the message type, adds encode/decode logic, and includes tests. There is no direct evidence in the commit that this introduces a vulnerability, but any new message parser adds a small amount of attack surface.

Recommended action

Treat as a routine feature commit. Review the OnionMessage handler/consumer code (not shown here) to ensure the onion blob is passed safely into the Sphinx/BOLT4 parsing path and that resource limits are enforced before expensive decryption. Continue monitoring fuzz results for the new FuzzOnionMessage target.

Security signals we found

01

New wire message parser added (OnionMessage.Decode)

02

Variable-length byte field parsed from network input (uint16 length prefix)

03

Public key parsed from network input without explicit curve-point validation at this layer

04

Fuzz test added for the new parser

05

No bounds check beyond uint16 length, which caps the blob at 65,535 bytes

Risk score

Why this scored 23/100

Our methodology →
Potential impact 2/30
Exploitability 2/25
Stealth signal 3/15
Affected reach 4/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.