AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 20 Bitcoin

Expose sources for pending outbound HTLCs

Public commit record

What the developer wrote

Authored by Joost Jager

68/100 · Adequate
Expose sources for pending outbound HTLCs

Pending outbound HTLC details do not identify which payment or
inbound HTLC produced them. A payment hash cannot provide that
mapping when multiple parts of a multipart payment share both a hash
and route.

Expose an optional source enum containing the payment ID for locally
initiated HTLCs, the inbound HTLC for normal forwards, or all inbound
HTLCs aggregated by a trampoline forward. Derive it from the existing
HTLC source for committed and holding-cell HTLCs.

Serialize the source as an optional upgradable TLV so older data
remains readable and unknown future source variants degrade to None.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds extra bookkeeping information to Lightning payment records so users can tell which incoming payment caused each outgoing payment. It is a feature/enhancement change, not a fix for an active security bug. The new data is exposed through existing read-only APIs and serialized in a backward-compatible way, so it does not appear to introduce a vulnerability.

Recommended action

No security action required. Treat as a normal feature/API enhancement; review the new public types for API stability and documentation completeness during regular code review.

Security signals we found

01

No memory-safety issues, input validation changes, or cryptographic modifications observed.

02

New public fields expose existing internal identifiers; this is an informational API change.

03

Serialization is backward/forward-compatible via optional upgradable TLV.

04

No bug fix, bounds check, or permission change present in the diff.

Risk score

Why this scored 20/100

Our methodology →
Potential impact 2/30
Exploitability 0/25
Stealth signal 0/15
Affected reach 5/15
Confidence 9/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.