test(invoice): add new BOLT11 test vector to test public-key recovery high-S signature
What the developer wrote
Authored by Erick Cestari
test(invoice): add new BOLT11 test vector to test public-key recovery high-S signature
What changed, and why it matters
This commit only adds a new test case to the rust-lightning invoice test suite. It exercises how the library handles a BOLT11 invoice containing a high-S signature during public-key recovery. There is no code change to the actual invoice parsing or signature logic, so by itself this commit does not fix or introduce a security issue. It is a test-only addition.
No immediate action required. Treat as routine test coverage. If reviewing a broader change set, verify that any related high-S signature handling in the production parser is already correct and that this test passes.
Security signals we found
High-S signature mentioned in commit title and message
Public-key recovery mentioned in commit title and message
Test-only change: no source code modification
No advisory, CVE, or vendor security disclosure referenced
Evidence from the diff
The diff adds one new test vector to lightning-invoice/tests/ser_de.rs. The vector is a BOLT11 invoice whose signature is a recoverable high-S ECDSA signature. The test data is constructed with a specific RecoverableSignature and RecoveryId, then compared against the expected parsed invoice. No library source code is modified. The commit message explicitly frames this as adding a test vector for public-key recovery with a high-S signature.
Changed components
lightning-invoice/tests/ser_de.rsInspect captured patch +20 / −0
diff --git a/lightning-invoice/tests/ser_de.rs b/lightning-invoice/tests/ser_de.rs
index 2266706..b4d3fa7 100644
--- a/lightning-invoice/tests/ser_de.rs
+++ b/lightning-invoice/tests/ser_de.rs
@@ -373,6 +373,26 @@ fn get_test_tuples() -> Vec<(String, SignedRawBolt11Invoice, bool, bool)> {
false, // Different features than set in InvoiceBuilder
true, // Some unknown fields
),
+ (
+ "lnbc1pvjluezsp5zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zyg3zygspp5qqqsyqcyq5rqwzqfqqqsyqcyq5rqwzqfqqqsyqcyq5rqwzqfqypqdpl2pkx2ctnv5sxxmmwwd5kgetjypeh2ursdae8g6twvus8g6rfwvs8qun0dfjkxaq9qrsgq357wnc5r2ueh7ck6q93dj32dlqnls087fxdwk8qakdyafkq3yap2r09nt4ndd0unm3z9u5t48y6ucv4r5sg7lk98c77ctvjczkspk5qprc90gx".to_owned(),
+ InvoiceBuilder::new(Currency::Bitcoin)
+ .duration_since_epoch(Duration::from_secs(1496314658))
+ .payment_secret(PaymentSecret([0x11; 32]))
+ .payment_hash(sha256::Hash::from_str(
+ "0001020304050607080900010203040506070809000102030405060708090102"
+ ).unwrap())
+ .description("Please consider supporting this project".to_owned())
+ .build_raw()
+ .unwrap()
+ .sign(|_| {
+ RecoverableSignature::from_compact(
+ &<Vec<u8>>::from_hex("8d3ce9e28357337f62da0162d9454df827f83cfe499aeb1c1db349d4d8112742a1bcb35d66d6bf93dc445e51753935cc32a3a411efd8a7c7bd85b25815a01b50").unwrap(),
+ RecoveryId::from_i32(1).unwrap()
+ )
+ }).unwrap(),
+ false, // Different features than set in InvoiceBuilder
+ false, // Some unknown fields
+ ),
]
}
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.