lnd icon indicating copy to clipboard operation
lnd copied to clipboard

[bug]: BOLT 11 Compliance: Invoice `r` field don't reject empty routing hints

Open erickcestari opened this issue 7 months ago • 0 comments

Background

After doing some differential fuzzing between CLN, rust-lightning and LND using bitcoinfuzz I noticed that LND currently accepts bolt11 invoices with empty routing hints in the r field, while CLN and rust-lightning rejects. This violates BOLT 11 specification requirements.

BOLT 11 Requirements:

  • r field "MUST contain one or more ordered entries, indicating the forward route from a public node to the final destination"
  • Each hop must contain exactly 51 bytes (pubkey: 33B, short_channel_id: 8B, fee_base_msat: 4B, fee_proportional_millionths: 4B, cltv_expiry_delta: 2B)

Current Behavior: The parseRouteHint function returns an empty slice without error when base256Data length is 0, since 0 % 51 = 0 passes the modulo check and the parsing loop never executes.

Expected Behavior: Reject invoices with empty r fields.

Impact:

  • Spec non-compliance
  • Inconsistent behavior between Lightning implementations

Proposed Fix: Add empty data check in parseRouteHint after bech32 conversion:

// Check for empty route hint
if len(base256Data) == 0 {
    return nil, fmt.Errorf("r field contains no hop data")
}

Example invoice:

lnbc1p5q54jjpp5fe0dhqdt4m97psq0fv3wjlk95cclnatvuvq49xtnc8rzrp0dysusdqqcqzzsxqrrs0fppqy6uew5229e67r9xzzm9mjyfwseclstdgsp5rnanj9x5rnanj9xnq28hhgd6c7yxlmh6lta047h6lqqqqqqqqqqqrqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqqq6qqqqqqqqqqqqqqqqqqq9kvnknh7ug5mttnqqqqqqqqq8849gwfhvnp9rqpe0cy97

erickcestari avatar Jun 06 '25 17:06 erickcestari