AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 35 Bitcoin

mulit: don't set customData on the lnrpc route level

Public commit record

What the developer wrote

Authored by ziggie

65/100 · Adequate
mulit: don't set customData on the lnrpc route level

We now make sure we only set the custom channel data in the
lnrpc.Route only if it contains relevant data.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
The short version

What changed, and why it matters

This change fixes a display/logic bug in LND's RPC layer where ordinary custom payment data could be incorrectly labeled as 'custom channel data' when returned over the API. It only affects how information is presented to callers, not how funds are moved on the Lightning network. The patch makes the API more accurate but does not appear to be a direct funds-loss vulnerability.

Recommended action

Treat as a regular bug-fix commit. Reviewers should verify that callers of MarshallRoute no longer receive misleading CustomChannelData, and that custom-channel-aware parsers still populate the field when they actually transform data. No urgent security response is indicated by the diff alone.

Security signals we found

01

Information-disclosure-style API mislabeling: ordinary TLV records exposed under a custom-channel-specific field

02

RPC-layer only: no change to payment routing, HTLC wire handling, or on-disk payment state

03

Test expectation changed from equality check to require.Nil for CustomChannelData on non-custom-channel payments

04

No mention of CVE, security advisory, researcher credit, or exploit in commit message

Risk score

Why this scored 35/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 6/15
Affected reach 7/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.