AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 34 Bitcoin

Generate direct-connect event for private offline peers

Public commit record

What the developer wrote

Authored by Valentine Wallace

73/100 · Adequate
Generate direct-connect event for private offline peers

Imagine an LSP with a mobile client. The LSP wants to pay an offer that client
issued. It generates an onion messages invreq and sends it. The OnionMessenger
notices it's not connected and searches the network graph. It doesn't find the
mobile client so doesn't create a direct connect event. The message gets
dropped and the payment fails.

Here we start generating the DC event irrespective of the network graph so the
LSP can use LSPS5 to wake the client.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This change fixes a functional bug where a Lightning Service Provider (LSP) could fail to pay a mobile client that issued a BOLT12 offer. Previously, if the client was offline and not publicly announced in the network graph, the onion messenger would silently drop the message instead of asking the application to connect to the peer. Now it always emits a 'please connect to this peer' event, even when no network-graph addresses are known, so the app can use a separate wake-up protocol (LSPS5) to reach the client. It is a reliability/availability improvement, not a cryptographic vulnerability.

Recommended action

Review as a normal functional/reliability improvement. No urgent security response is indicated. If deploying, ensure downstream handlers of ConnectionNeeded events tolerate empty address vectors and integrate with the intended wake-up mechanism (e.g., LSPS5).

Security signals we found

01

Behavioral change in message routing for unannounced/offline peers

02

ConnectionNeeded event now emitted without requiring network graph presence

03

No cryptographic, authentication, or memory-safety changes observed

04

No incident, CVE, or vendor security disclosure referenced in commit

Risk score

Why this scored 34/100

Our methodology →
Potential impact 8/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 7/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.