Enforce minimum witness program length for fallback addresses in BOLT11 parsing#8219
Merged
rustyrussell merged 1 commit intoElementsProject:masterfrom Apr 15, 2025
Conversation
erickcestari
force-pushed
the
minimun-witness-fallback
branch
from
3848898 to
1ab463f
Compare
…dresses BIP-141 specifies that a witness program must be between 2 and 40 bytes in length. In our fallback address parsing, we were already checking the upper bound, but missing the lower bound check. This commit adds validation to ensure fallback address witness programs are at least 2 bytes long, bringing our implementation in line with the spec and other implementations like rust-lightning. Changelog-Fixed: Enforced minimum witness program length of 2 bytes for fallback addresses to comply with BIP-141 and prevent invalid decodings.
erickcestari
force-pushed
the
minimun-witness-fallback
branch
from
1ab463f to
693b277
Compare
vincenzopalazzo
approved these changes
Apr 8, 2025
Collaborator
vincenzopalazzo
left a comment
vincenzopalazzo
left a comment
There was a problem hiding this comment.
ACK 693b277
The CI changes looks like unrelated
Contributor
|
Thanks! |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR fixes an issue with BOLT11 fallback address validation discovered through differential fuzzing between Lightning implementations. Core Lightning was accepting invoices with non-standard witness address fallbacks that other implementations correctly reject.
While comparing parse results from LND, LDK, and Core Lightning using the bitcoinfuzz PR #132, I found that Core Lightning enforces the 40-byte upper limit for witness programs as per BIP-141, but doesn't check the 2-byte minimum length requirement.
The fix is minimal: adding a lower bound check to ensure witness programs are at least 2 bytes long, bringing Core Lightning in line with both the BIP-141 specification and other Lightning implementations.
Checklist
Before submitting the PR, ensure the following tasks are completed. If an item is not applicable to your PR, please mark it as checked: