Mention `user_channel_id` uniqueness in `invoice_params_generated` docs
What the developer wrote
Authored by Elias Rohrer
Mention `user_channel_id` uniqueness in `invoice_params_generated` docs
We update the docs of `invoice_params_generated` and mention that
`user_channel_id` needs to be unique value.
What changed, and why it matters
This commit only changes documentation comments in a Rust source file. It adds a note reminding developers that a user-supplied identifier (user_channel_id) must be unique and that channel creation should be idempotent based on it. No code behavior was changed, so there is no direct security vulnerability or fix in the commit itself.
No action required for this commit. Treat it as a documentation clarification. Developers using this API should review their handling of user_channel_id to ensure uniqueness and idempotency, but that is a design/implementation responsibility, not a patchable flaw.
Security signals we found
Documentation-only change
Mentions uniqueness requirement for user_channel_id
Mentions idempotency requirement for create_channel calls
Evidence from the diff
The diff updates doc comments for invoice_params_generated and its wrapper in lightning-liquidity/src/lsps2/service.rs. It clarifies that the LSP must supply a locally unique user_channel_id, that the same value will later surface in events, and that implementors must ensure ChannelManager::create_channel calls are idempotent with respect to this identifier. No logic, API signatures, or runtime behavior are modified.
Changed components
lightning-liquidity/src/lsps2/service.rsInspect captured patch +10 / −4
diff --git a/lightning-liquidity/src/lsps2/service.rs b/lightning-liquidity/src/lsps2/service.rs
index ba3f54e..deadf7a 100644
--- a/lightning-liquidity/src/lsps2/service.rs
+++ b/lightning-liquidity/src/lsps2/service.rs
@@ -757,12 +757,18 @@ where
}
}
- /// Used by LSP to provide the client with the intercept scid and
- /// `cltv_expiry_delta` to include in their invoice. The intercept scid
- /// must be retrieved from [`ChannelManager::get_intercept_scid`].
+ /// Used by LSP to provide the client with the intercept scid, a unique `user_channel_id`, and
+ /// `cltv_expiry_delta` to include in their invoice.
+ ///
+ /// The intercept scid must be retrieved from [`ChannelManager::get_intercept_scid`]. The given
+ /// `user_channel_id` must be locally unique and will eventually be returned via events to be
+ /// used when opening the channel via [`ChannelManager::create_channel`]. Note implementors
+ /// will need to ensure their calls to [`ChannelManager::create_channel`] are idempotent based
+ /// on this identifier.
///
/// Should be called in response to receiving a [`LSPS2ServiceEvent::BuyRequest`] event.
///
+ /// [`ChannelManager::create_channel`]: lightning::ln::channelmanager::ChannelManager::create_channel
/// [`ChannelManager::get_intercept_scid`]: lightning::ln::channelmanager::ChannelManager::get_intercept_scid
/// [`LSPS2ServiceEvent::BuyRequest`]: crate::lsps2::event::LSPS2ServiceEvent::BuyRequest
#[allow(clippy::await_holding_lock)]
@@ -1815,7 +1821,7 @@ where
)
}
- /// Used by LSP to provide the client with the intercept scid and
+ /// Used by LSP to provide the client with the intercept scid, a unique `user_channel_id`, and
/// `cltv_expiry_delta` to include in their invoice.
///
/// Wraps [`LSPS2ServiceHandler::invoice_parameters_generated`].
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.