routerrpc: reject payment to invoice that don't have payment secret or blinded paths #9752

erickcestari · 2025-04-22T13:30:04Z

This PR introduces the initial phase of enforcing payment secret validation for invoices, as described in issue #9718.

Reject a payment to invoice that don't have a payment secret.

Change Description

Adds validation to extractIntentFromSendRequest to ensure that an invoice includes either a payment address (payment secret) or at least one blinded path when parsing the SendRequest details.

Related to: #9700, #9718

coderabbitai · 2025-04-22T13:30:12Z

Important

Review skipped

Auto reviews are limited to specific labels.

🏷️ Labels to auto review (1)

llm-review

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

🪧 Tips

Chat

There are 3 ways to chat with CodeRabbit:

Review comments: Directly reply to a review comment made by CodeRabbit. Example:
- I pushed a fix in commit <commit_id>, please review it.
- Explain this complex logic.
- Open a follow-up GitHub issue for this discussion.
Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
- @coderabbitai explain this code block.
- @coderabbitai modularize this function.
PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
- @coderabbitai gather interesting stats about this repository and render them as a table. Additionally, render a pie chart showing the language distribution in the codebase.
- @coderabbitai read src/utils.ts and explain its main purpose.
- @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
- @coderabbitai help me debug CodeRabbit configuration file.

Support

Need help? Create a ticket on our support page for assistance with any issues or questions.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

@coderabbitai pause to pause the reviews on a PR.
@coderabbitai resume to resume the paused reviews.
@coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
@coderabbitai full review to do a full review from scratch and review all the files again.
@coderabbitai summary to regenerate the summary of the PR.
@coderabbitai generate docstrings to generate docstrings for this PR.
@coderabbitai generate sequence diagram to generate a sequence diagram of the changes in this PR.
@coderabbitai resolve resolve all the CodeRabbit review comments.
@coderabbitai configuration to show the current CodeRabbit configuration for the repository.
@coderabbitai help to get help.

Other keywords and placeholders

Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
Add @coderabbitai anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (`.coderabbit.yaml`)

You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
Please see the configuration documentation for more information.
If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

Visit our Documentation for detailed information on how to use CodeRabbit.
Join our Discord Community to get help, request features, and share feedback.
Follow us on X/Twitter for updates and announcements.

MPins

Hello @erickcestari, could you please split the commit into two? One for the code changes and another for the documentation. Thanks!

lnrpc/routerrpc/router_backend.go

MPins

Hi @erickcestari , consider adding a test case to TestExtractIntentFromSendRequest in router_backend_test.go to cover this scenario.

MPins

That’s all from my side.

docs/release-notes/release-notes-0.20.0.md

lnrpc/routerrpc/router_backend_test.go

MPins · 2025-05-02T22:47:20Z

Hello @saubyk it would be nice to have the CI Workflow running for this PR.

lightninglabs-deploy · 2025-05-16T23:50:37Z

@erickcestari, remember to re-request review from reviewers when ready

MPins

I have just one final comment about the commit message. LGTM 🎉

@saubyk the CI needs approval to run.

lnrpc/routerrpc/router_backend.go

yyforyongyu · 2025-05-18T23:16:56Z

Approved CI.

Ensure that a payment is only sent if the invoice includes either a payment address (payment secret) or at least one blinded path.

Abdulkbk

tACK 🎉

Abdulkbk · 2025-05-23T09:33:35Z

lnrpc/routerrpc/router_backend_test.go

@@ -503,6 +503,13 @@ func TestExtractIntentFromSendRequest(t *testing.T) {
 		"g6aykds4ydvf2x9lpngqcfux3hv8qlraan9v3s9296r5w5eh959yzadgh5ck" +
 		"gjydgyfxdpumxtuk3p3caugmlqpz5necs"

+	const paymentReqMissingAddr = "lnbcrt100p1p70xwfzpp5qqqsyqcyq5rqwzqfq" +


docs/release-notes/release-notes-0.20.0.md

GustavoStingelin · 2025-06-02T19:15:50Z

lnrpc/routerrpc/router_backend_test.go

@@ -503,6 +503,13 @@ func TestExtractIntentFromSendRequest(t *testing.T) {
 		"g6aykds4ydvf2x9lpngqcfux3hv8qlraan9v3s9296r5w5eh959yzadgh5ck" +
 		"gjydgyfxdpumxtuk3p3caugmlqpz5necs"

+	const paymentReqMissingAddr = "lnbcrt100p1p70xwfzpp5qqqsyqcyq5rqwzqfq" +


Q: How are we handling this in LND to make sure this test doesn’t fail in 10 years when the invoice expires?

Good question, in this case we aren't handling it at all. Idk how exactly we should handle this.

@MPins

GustavoStingelin · 2025-06-02T19:16:01Z

lnrpc/routerrpc/router_backend.go

+		if payReq.PaymentAddr.IsNone() &&
+			len(payReq.BlindedPaymentPaths) == 0 {
+
+			return nil, errors.New("payment request must contain " +
+				"either a payment address or blinded paths")


Hey @erickcestari and @MPins, what do you think about adding this check directly in the invoice validation function? It could help make the invoice validation more complete in just one place

lnd/zpay32/invoice.go

Line 373 in f8e67c0

func validateInvoice(invoice *Invoice) error {

The idea here is to reject the payment only if it has no payment address or blinded paths. If we added this validation to validateInvoice, the decoding phase would also fail.

This is exactly what I'm suggesting. Why do we reject the payment instead of rejecting the creation of an invalid invoice in the first place? Are there any use cases where an invoice without a payment address or blinded paths is still valid and serves a purpose?

You can see more about the discussion here: #9702 (comment)

The main reason, however, is the one mentioned by @Roasbeef.

Sometimes you just want to decode an invoice. Many node management UIs support just decoding an invoice. Invoice validity (BOLT 11) is distinct from the feature bits and fields we deem mandatory.

It’s not clear to me that an invoice missing these fields should be considered well structured; however, if it’s planned to improve this later, I’m fine with it

GustavoStingelin

LGTM

Roasbeef · 2025-06-06T23:04:23Z

Approved CI run.

Roasbeef · 2025-06-06T23:05:15Z

Rebase conflict is preventing CI from running for some reason...

erickcestari force-pushed the reject-payment-without-invoice branch 2 times, most recently from ada4d4e to 69e180c Compare April 22, 2025 17:32

erickcestari marked this pull request as draft April 22, 2025 18:01

erickcestari force-pushed the reject-payment-without-invoice branch 2 times, most recently from 670fca4 to b37fe55 Compare April 22, 2025 18:17

erickcestari changed the title ~~cmd/payments: reject invoices without payment secret or blinded paths~~ routerrpc: reject invoices without payment secret or blinded paths Apr 22, 2025

erickcestari changed the title ~~routerrpc: reject invoices without payment secret or blinded paths~~ routerrpc: reject payment to invoice that don't have payment secret or blinded paths Apr 22, 2025

erickcestari force-pushed the reject-payment-without-invoice branch from b37fe55 to bb59d52 Compare April 22, 2025 18:21

erickcestari marked this pull request as ready for review April 22, 2025 18:24

MPins reviewed Apr 23, 2025

View reviewed changes

lnrpc/routerrpc/router_backend.go Outdated Show resolved Hide resolved

erickcestari force-pushed the reject-payment-without-invoice branch from bb59d52 to 50cc265 Compare April 24, 2025 14:06

saubyk assigned erickcestari Apr 24, 2025

saubyk added this to PR Review Priority Apr 24, 2025

saubyk moved this to Medium Priority in PR Review Priority Apr 24, 2025

saubyk added payments Related to invoices/payments invoices labels Apr 24, 2025

saubyk added this to the v0.20.0 milestone Apr 24, 2025

MPins reviewed May 1, 2025

View reviewed changes

erickcestari force-pushed the reject-payment-without-invoice branch from 50cc265 to 6e7034a Compare May 1, 2025 12:59

MPins reviewed May 1, 2025

View reviewed changes

docs/release-notes/release-notes-0.20.0.md Outdated Show resolved Hide resolved

lnrpc/routerrpc/router_backend_test.go Outdated Show resolved Hide resolved

erickcestari force-pushed the reject-payment-without-invoice branch 2 times, most recently from 2395167 to 51b1059 Compare May 1, 2025 17:22

erickcestari force-pushed the reject-payment-without-invoice branch from 51b1059 to ca77283 Compare May 13, 2025 11:00

MPins approved these changes May 17, 2025

View reviewed changes

lnrpc/routerrpc/router_backend.go Show resolved Hide resolved

routerrpc: reject invoices missing secret/path

3eda1f7

Ensure that a payment is only sent if the invoice includes either a payment address (payment secret) or at least one blinded path.

erickcestari force-pushed the reject-payment-without-invoice branch from ca77283 to c6abfff Compare May 19, 2025 12:08

Abdulkbk approved these changes May 23, 2025

View reviewed changes

erickcestari mentioned this pull request May 23, 2025

Remove payment secret workaround bitcoinfuzz/bitcoinfuzz#141

Open

GustavoStingelin suggested changes Jun 2, 2025

View reviewed changes

docs: add release notes for 9752

2de5604

erickcestari force-pushed the reject-payment-without-invoice branch from c6abfff to 2de5604 Compare June 3, 2025 12:04

GustavoStingelin approved these changes Jun 3, 2025

View reviewed changes

routerrpc: reject payment to invoice that don't have payment secret or blinded paths #9752

Are you sure you want to change the base?

routerrpc: reject payment to invoice that don't have payment secret or blinded paths #9752

Conversation

erickcestari commented Apr 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Change Description

Uh oh!

coderabbitai bot commented Apr 22, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review skipped

Chat

Support

CodeRabbit Commands (Invoked using PR comments)

Other keywords and placeholders

CodeRabbit Configuration File (.coderabbit.yaml)

Documentation and Community

Uh oh!

MPins left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

MPins left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

MPins left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

MPins commented May 2, 2025

Uh oh!

lightninglabs-deploy commented May 16, 2025

Uh oh!

MPins left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

yyforyongyu commented May 18, 2025

Uh oh!

Abdulkbk left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

GustavoStingelin left a comment

Choose a reason for hiding this comment

Uh oh!

Roasbeef commented Jun 6, 2025

Uh oh!

Roasbeef commented Jun 6, 2025

Uh oh!

Uh oh!

erickcestari commented Apr 22, 2025 •

edited

Loading

coderabbitai bot commented Apr 22, 2025 •

edited

Loading

CodeRabbit Configuration File (`.coderabbit.yaml`)

MPins left a comment •

edited

Loading

MPins left a comment •

edited

Loading

Abdulkbk left a comment •

edited

Loading