routerrpc: reject payment to invoice that don't have payment secret or blinded paths by erickcestari · Pull Request #9752 · lightningnetwork/lnd

erickcestari · 2025-04-22T13:30:04Z

This PR introduces the initial phase of enforcing payment secret validation for invoices, as described in issue #9718.

Reject a payment to invoice that don't have a payment secret.

Change Description

Adds validation to extractIntentFromSendRequest to ensure that an invoice includes either a payment address (payment secret) or at least one blinded path when parsing the SendRequest details.

Related to: #9700, #9718

coderabbitai · 2025-04-22T13:30:12Z

Important

Review skipped

Auto reviews are limited to specific labels.

🏷️ Labels to auto review (1)

llm-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

MPins

Hello @erickcestari, could you please split the commit into two? One for the code changes and another for the documentation. Thanks!

lnrpc/routerrpc/router_backend.go

MPins

Hi @erickcestari , consider adding a test case to TestExtractIntentFromSendRequest in router_backend_test.go to cover this scenario.

MPins

That’s all from my side.

docs/release-notes/release-notes-0.20.0.md

lnrpc/routerrpc/router_backend_test.go

MPins · 2025-05-02T22:47:20Z

Hello @saubyk it would be nice to have the CI Workflow running for this PR.

lightninglabs-deploy · 2025-05-16T23:50:37Z

@erickcestari, remember to re-request review from reviewers when ready

MPins

I have just one final comment about the commit message. LGTM 🎉

@saubyk the CI needs approval to run.

lnrpc/routerrpc/router_backend.go

yyforyongyu · 2025-05-18T23:16:56Z

Approved CI.

Abdulkbk

tACK 🎉

lnrpc/routerrpc/router_backend_test.go

Roasbeef · 2025-06-06T23:05:15Z

Rebase conflict is preventing CI from running for some reason...

erickcestari · 2025-06-09T12:15:29Z

Rebase conflict is preventing CI from running for some reason...

Rebased

ellemouton

looking good!

lnrpc/routerrpc/router_backend.go

lnrpc/routerrpc/router_backend_test.go

ziggie1984 · 2025-06-15T06:16:41Z

Needs to update buildroute as well so that we do not allow building a route without a payment_secret:

lnd/lnrpc/routerrpc/router_server.go

Lines 1506 to 1511 in fe40542

    
           if len(req.PaymentAddr) != 0 { 
        
           	var backingPayAddr [32]byte 
        
           	copy(backingPayAddr[:], req.PaymentAddr) 
        
           	payAddr = fn.Some(backingPayAddr) 
        
           }

ziggie1984 · 2025-06-16T19:16:25Z

Missing payment_addr enforcement also for the following RPC calls:

QueryRoutes
SendToRoute

With the restriction on decoding we have to be careful because all our keysend payments inject an invoice with a zero payment_addr into our invoice store, so they do not have a valid payment_addr but we should still be able to decode them.

All those changes can be done in a followup PR as well imo.

erickcestari · 2025-06-18T12:27:48Z

Needs to update buildroute as well so that we do not allow building a route without a payment_secret:

lnd/lnrpc/routerrpc/router_server.go

Lines 1506 to 1511 in fe40542

if len(req.PaymentAddr) != 0 {

var backingPayAddr [32]byte

copy(backingPayAddr[:], req.PaymentAddr)

payAddr = fn.Some(backingPayAddr)

}

Does keysend use the BuildRoute function? If so, requiring a payment_secret would break keysend functionality.

ziggie1984 · 2025-06-18T13:07:00Z

Does keysend use the BuildRoute function? If so, requiring a payment_secret would break keysend functionality.

No we do not support it:

lnd/routing/router.go

Line 1409 in 79294df

records: nil,

ziggie1984 · 2025-06-18T13:08:41Z

But probably all the adoption of RPC should be done in a follow-up. And I am not sure whether we can ever can remove the decoding. Tho I do not see a need to do so anyways. Why not keep the decoding at least available.

erickcestari · 2025-06-18T13:49:33Z

Yes, I agree. Since keysend relies on invoices with zero payment addresses, phase 2 might be problematic.

Reject decoding invoices that don't have a payment secret.

Maybe we could focus on completing phase 1 across the other payment RPCs first? We might be able to achieve the spec goals through payment validation alone while keeping things working for keysend.

ziggie1984

Pending comments, then gtg 🤝

lnrpc/routerrpc/router_backend_test.go

docs/release-notes/release-notes-0.20.0.md

ellemouton

looks good! one or two style nits

rpcserver.go

lnrpc/routerrpc/router_backend.go

ellemouton · 2025-06-20T08:58:37Z

lnrpc/routerrpc/router_backend.go

 	expiry := payReq.Expiry()
 	validUntil := payReq.Timestamp.Add(expiry)
-	if time.Now().After(validUntil) {
+	if clock.Now().After(validUntil) {


Refactors payment request expiry validation to use an injected clock dependency instead of calling time.Now() directly.

Ensure that a payment is only sent if the invoice includes either a payment address (payment secret) or at least one blinded path.

ziggie1984

LGTM 🫡

ellemouton

thanks 🙏 LGTM

erickcestari force-pushed the reject-payment-without-invoice branch 2 times, most recently from ada4d4e to 69e180c Compare April 22, 2025 17:32

erickcestari marked this pull request as draft April 22, 2025 18:01

erickcestari force-pushed the reject-payment-without-invoice branch 2 times, most recently from 670fca4 to b37fe55 Compare April 22, 2025 18:17

erickcestari changed the title ~~cmd/payments: reject invoices without payment secret or blinded paths~~ routerrpc: reject invoices without payment secret or blinded paths Apr 22, 2025

erickcestari changed the title ~~routerrpc: reject invoices without payment secret or blinded paths~~ routerrpc: reject payment to invoice that don't have payment secret or blinded paths Apr 22, 2025

erickcestari force-pushed the reject-payment-without-invoice branch from b37fe55 to bb59d52 Compare April 22, 2025 18:21

erickcestari marked this pull request as ready for review April 22, 2025 18:24

MPins reviewed Apr 23, 2025

View reviewed changes

lnrpc/routerrpc/router_backend.go Outdated Show resolved Hide resolved

erickcestari force-pushed the reject-payment-without-invoice branch from bb59d52 to 50cc265 Compare April 24, 2025 14:06

saubyk assigned erickcestari Apr 24, 2025

saubyk added this to PR Review Priority Apr 24, 2025

saubyk moved this to Medium Priority in PR Review Priority Apr 24, 2025

saubyk added payments Related to invoices/payments invoices labels Apr 24, 2025

saubyk added this to the v0.20.0 milestone Apr 24, 2025

MPins reviewed May 1, 2025

View reviewed changes

erickcestari force-pushed the reject-payment-without-invoice branch from 50cc265 to 6e7034a Compare May 1, 2025 12:59

MPins reviewed May 1, 2025

View reviewed changes

docs/release-notes/release-notes-0.20.0.md Outdated Show resolved Hide resolved

lnrpc/routerrpc/router_backend_test.go Outdated Show resolved Hide resolved

erickcestari force-pushed the reject-payment-without-invoice branch 2 times, most recently from 2395167 to 51b1059 Compare May 1, 2025 17:22

erickcestari force-pushed the reject-payment-without-invoice branch from 51b1059 to ca77283 Compare May 13, 2025 11:00

MPins approved these changes May 17, 2025

View reviewed changes

lnrpc/routerrpc/router_backend.go Show resolved Hide resolved

erickcestari force-pushed the reject-payment-without-invoice branch from ca77283 to c6abfff Compare May 19, 2025 12:08

Abdulkbk approved these changes May 23, 2025

View reviewed changes

lnrpc/routerrpc/router_backend_test.go Show resolved Hide resolved

erickcestari force-pushed the reject-payment-without-invoice branch from 2de5604 to 36675bd Compare June 9, 2025 12:14

ellemouton reviewed Jun 10, 2025

View reviewed changes

lnrpc/routerrpc/router_backend.go Show resolved Hide resolved

lnrpc/routerrpc/router_backend_test.go Show resolved Hide resolved

erickcestari force-pushed the reject-payment-without-invoice branch 3 times, most recently from c5ca026 to 3e7a64c Compare June 10, 2025 20:00

ziggie1984 mentioned this pull request Jun 16, 2025

[feature]: Support MPP record (alias Payment_Address) for more RPC calls #9952

Open

erickcestari force-pushed the reject-payment-without-invoice branch from 3e7a64c to 0966b27 Compare June 18, 2025 12:19

erickcestari force-pushed the reject-payment-without-invoice branch 2 times, most recently from b5d3d43 to d2634a6 Compare June 18, 2025 14:46

ziggie1984 reviewed Jun 18, 2025

View reviewed changes

lnrpc/routerrpc/router_backend_test.go Outdated Show resolved Hide resolved

docs/release-notes/release-notes-0.20.0.md Outdated Show resolved Hide resolved

docs/release-notes/release-notes-0.20.0.md Outdated Show resolved Hide resolved

ziggie1984 requested a review from ellemouton June 20, 2025 08:54

ellemouton reviewed Jun 20, 2025

View reviewed changes

erickcestari added 3 commits June 20, 2025 09:23

routerrpc: inject clock for testable expiry validation

c01a667

Refactors payment request expiry validation to use an injected clock dependency instead of calling time.Now() directly.

routerrpc: reject invoices missing secret/path

118e0a9

Ensure that a payment is only sent if the invoice includes either a payment address (payment secret) or at least one blinded path.

docs: add release notes for 9752

831fefe

erickcestari force-pushed the reject-payment-without-invoice branch from d2634a6 to 831fefe Compare June 20, 2025 12:23

ziggie1984 requested a review from ellemouton June 24, 2025 09:38

ziggie1984 approved these changes Jun 24, 2025

View reviewed changes

Roasbeef mentioned this pull request Jun 26, 2025

itest coverage increase following the spec update regarding MPP payments #9990

Merged

ellemouton approved these changes Jun 30, 2025

View reviewed changes

ellemouton merged commit e8213db into lightningnetwork:master Jun 30, 2025
38 checks passed

github-project-automation bot moved this from Medium Priority to High Priority in PR Review Priority Jun 30, 2025

Conversation

erickcestari commented Apr 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change Description

Uh oh!

coderabbitai bot commented Apr 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

MPins left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MPins left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MPins left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

MPins commented May 2, 2025

Uh oh!

lightninglabs-deploy commented May 16, 2025

Uh oh!

MPins left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

yyforyongyu commented May 18, 2025

Uh oh!

Abdulkbk left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Roasbeef commented Jun 6, 2025

Uh oh!

erickcestari commented Jun 9, 2025

Uh oh!

ellemouton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ziggie1984 commented Jun 15, 2025

Uh oh!

ziggie1984 commented Jun 16, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

erickcestari commented Jun 18, 2025

Uh oh!

ziggie1984 commented Jun 18, 2025

Uh oh!

ziggie1984 commented Jun 18, 2025

Uh oh!

erickcestari commented Jun 18, 2025

Uh oh!

ziggie1984 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

ellemouton left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

ellemouton Jun 20, 2025

Choose a reason for hiding this comment

Uh oh!

erickcestari commented Apr 22, 2025 •

edited

Loading

coderabbitai bot commented Apr 22, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)

MPins left a comment •

edited

Loading

MPins left a comment •

edited

Loading

Abdulkbk left a comment •

edited

Loading

ziggie1984 commented Jun 16, 2025 •

edited

Loading