ln/refactor: rename shared secret and populate in HTLCPreviousHopData
What changed, and why it matters
This is a small internal code cleanup in the Lightning Dev Kit library. It renames a field from 'incoming_shared_secret' to 'trampoline_shared_secret' and makes sure the shared secret is also stored in a related data structure. There is no indication this fixes a security bug or changes behavior in a way that protects users.
No security action needed. Treat as normal code maintenance. If reviewing a larger series, consider whether this refactor enables a subsequent security-relevant change.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit refactors how the trampoline onion shared secret is named and propagated. In channelmanager.rs, the PendingHTLCRouting::TrampolineForward variant’s field is renamed from incoming_shared_secret to trampoline_shared_secret, and its serialization mapping is updated. In onion_payment.rs, the construction of TrampolineForward uses the new field name. Additionally, the trampoline_shared_secret is now populated from both Receive and TrampolineForward variants when building HTLCPreviousHopData. This appears to be a preparatory or consistency refactor rather than a security patch.
Changed components
lightning/src/ln/channelmanager.rslightning/src/ln/onion_payment.rsInspect captured patch +9 / −5
diff --git a/lightning/src/ln/channelmanager.rs b/lightning/src/ln/channelmanager.rs
index 7dd9d84..9b627d4 100644
--- a/lightning/src/ln/channelmanager.rs
+++ b/lightning/src/ln/channelmanager.rs
@@ -222,11 +222,12 @@ pub enum PendingHTLCRouting {
},
/// An HTLC which should be forwarded on to another Trampoline node.
TrampolineForward {
- /// The onion shared secret we build with the sender (or the preceding Trampoline node) used
- /// to decrypt the onion.
+ /// The onion shared secret we build with the node that forwarded us this trampoline
+ /// forward (either the original sender, or a preceding Trampoline node), used to decrypt
+ /// the inner trampoline onion.
///
/// This is later used to encrypt failure packets in the event that the HTLC is failed.
- incoming_shared_secret: [u8; 32],
+ trampoline_shared_secret: [u8; 32],
/// The onion which should be included in the forwarded HTLC, telling the next hop what to
/// do with the HTLC.
onion_packet: msgs::TrampolineOnionPacket,
@@ -465,6 +466,9 @@ impl PendingAddHTLCInfo {
PendingHTLCRouting::Receive { trampoline_shared_secret, .. } => {
trampoline_shared_secret
},
+ PendingHTLCRouting::TrampolineForward { trampoline_shared_secret, .. } => {
+ Some(trampoline_shared_secret)
+ },
_ => None,
};
@@ -17483,7 +17487,7 @@ impl_writeable_tlv_based_enum!(PendingHTLCRouting,
(11, invoice_request, option),
},
(3, TrampolineForward) => {
- (0, incoming_shared_secret, required),
+ (0, trampoline_shared_secret, required),
(2, onion_packet, required),
(4, blinded, option),
(6, node_id, required),
diff --git a/lightning/src/ln/onion_payment.rs b/lightning/src/ln/onion_payment.rs
index 5111f69..bb5b8f2 100644
--- a/lightning/src/ln/onion_payment.rs
+++ b/lightning/src/ln/onion_payment.rs
@@ -249,7 +249,7 @@ pub(super) fn create_fwd_pending_htlc_info(
hmac: next_hop_hmac,
};
PendingHTLCRouting::TrampolineForward {
- incoming_shared_secret: shared_secret.secret_bytes(),
+ trampoline_shared_secret: shared_secret.secret_bytes(),
onion_packet: outgoing_packet,
node_id: next_trampoline,
incoming_cltv_expiry: msg.cltv_expiry,
Why this scored 11/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.