AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 18 Bitcoin

Include invoice_slot in OfferPathsRequest message

Public commit record

What the developer wrote

Authored by Valentine Wallace

68/100 · Adequate
Include invoice_slot in OfferPathsRequest message

In the initially-merged version of the static invoice server protocol, the
static invoice server would sometimes have to find a specific static invoice
based on (recipient_id, invoice_slot) and sometimes based on (recipient_id,
invoice_id). This made the API harder to use in terms of how the server would
index into the KVStore.

We'd like to transition to the server always finding a specific invoice based on
(recipient_id, invoice_slot) and get rid of the invoice_id concept.

Now that the invoice_slot is in the initial paths request, the server will be
able to include the slot in the offer paths that they create in response,
allowing the slot to be surfaced instead of the invoice_id when the invoice
request comes in, in upcoming commits.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit changes an internal Lightning protocol message so that a wallet tells a static invoice server which database 'slot' to use when storing an invoice. It is a protocol/API simplification, not a security fix. There is no evidence it prevents or fixes any exploit.

Recommended action

No security action required; review as normal protocol/API refactoring.

Security signals we found

01

Protocol message field added to an async-payments onion message

02

No validation, authorization, or cryptographic changes present

03

No mention of security, vulnerability, CVE, or bug in commit message

Risk score

Why this scored 18/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 2/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.