AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 20 Bitcoin

Report the sending peer in Event::OnionMessageIntercepted

Public commit record

What the developer wrote

Authored by Jeffrey Czyz

85/100 · Strong
Report the sending peer in Event::OnionMessageIntercepted

When the OnionMessenger intercepts an onion message to forward, it now reports
which peer sent us the message via a new `prev_hop` field, so handlers can
apply source-based policy when deciding whether to forward.

`prev_hop` is `None` when the forward is enqueued by a message handler (the
BOLT 12 static-invoice-server flow), which isn't given the sending node;
otherwise it is the node we received the message from.

Co-Authored-By: Claude <noreply@anthropic.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This commit adds a new prev_hop field to an existing event type so that applications using the Lightning Dev Kit can see which peer sent an intercepted onion message. It is a feature enhancement that improves policy control; it does not by itself fix a vulnerability or introduce a clear security bug.

Recommended action

No security action required; treat as a normal API/feature update. Review downstream consumers of Event::OnionMessageIntercepted for compilation impact due to the new prev_hop field.

Security signals we found

01

New optional field added to an existing public event variant

02

Serialization/deserialization updated with TLV backwards-compatibility handling

03

No change to cryptographic validation, access control, or resource limits

04

No mention of vulnerability, CVE, or security bug in commit message or diff

Risk score

Why this scored 20/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 9/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.