AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 28 Bitcoin

proto: remove deprecated SendPayment, SendToRoute, TrackPayment RPCs

Public commit record

What the developer wrote

Authored by Erick Cestari

73/100 · Adequate
proto: remove deprecated SendPayment, SendToRoute, TrackPayment RPCs

Remove the following deprecated RPC definitions that were announced for
removal in 0.21 via the 0.20 release notes:

lnrpc:
- SendPayment (bidirectional streaming)
- SendPaymentSync
- SendToRoute (bidirectional streaming)
- SendToRouteSync

routerrpc:
- SendPayment (streaming)
- SendToRoute
- TrackPayment (streaming)

Also remove the now-unused PaymentState enum and PaymentStatus message
that were only used by the deprecated TrackPayment response stream, plus
the corresponding REST annotations from the yaml files.

Drop the now-orphan routerrpc.SendToRouteResponse message that was only
referenced by the deleted routerrpc.SendToRoute RPC.

Also remove the deprecated outgoing_chan_id field from
lnrpc.QueryRoutesRequest (tag 14) and routerrpc.SendPaymentRequest
(tag 8); their tag numbers are now reserved. Callers must use the
multi-channel outgoing_chan_ids field introduced in 0.20.

Drop the compat fallback in router_backend.go that previously consumed
the field, and regenerate all protobuf, gRPC, REST gateway, JSON, and
swagger files.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit removes several old, previously-deprecated payment-related API methods from the Lightning Network Daemon (LND). It is a planned cleanup that breaks backward compatibility for clients still using those old methods. There is no indication in the commit that this fixes an active security vulnerability; it is primarily a maintenance and API-surface reduction change.

Recommended action

Operators and integrators should verify that no client software still depends on the removed RPCs or the removed outgoing_chan_id field before upgrading. Review the 0.20 and 0.21 release notes for migration guidance to the replacement routerrpc.SendPaymentV2 / TrackPaymentV2 and multi-channel outgoing_chan_ids fields.

Security signals we found

01

Removal of deprecated RPC surface reduces attack/exposure surface

02

No new code paths or privilege changes introduced

03

No memory-safety, cryptographic, or authorization changes visible

04

Hard backward-compatibility break for old clients

Risk score

Why this scored 28/100

Our methodology →
Potential impact 5/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 10/15
Confidence 9/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.