AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 32 Bitcoin

Add `onchain_payment_required` method

Public commit record

What the developer wrote

Authored by Elias Rohrer

58/100 · Thin
Add `onchain_payment_required` method

We previously had no way to reject requests in case the LSP requires
onchain payment while the client not providing
`refund_onchain_address`. Here we add a method allowing to do so.
✓ Descriptive subject✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds a new method so a Lightning Service Provider (LSP) can cleanly reject a customer's order when the LSP only accepts on-chain Bitcoin payments but the customer did not supply a refund address. Before this change, the code had no explicit way to reject such orders, which could have led to confused or stuck orders. The change is a defensive API improvement, not a fix for an active exploit.

Recommended action

Treat as a normal feature/defensive-hardening commit. LSP operators using rust-lightning's LSPS1 module should adopt this method and reject orders that require on-chain payment without a refund address. No urgent security patch is required, but downstream implementers should update their event handling to call onchain_payments_required when appropriate.

Security signals we found

01

Adds explicit validation/rejection path for missing refund_onchain_address when on-chain payment is required

02

Renames error constant from ORDER_MISMATCH to OPTION_MISMATCH to better cover option validation failures

03

Removes the 'require onchain payment and no refund address' case from order_failed_and_refunded documentation, centralizing rejection in the new method

04

No memory safety issues, cryptographic bugs, or privilege escalation observed

Risk score

Why this scored 32/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 5/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.