ElementsProject / ElementsProject/lightning

Rune restrictions per unit of time and rune UX

Open
#7,308 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
3.1k
Forks
1k
Avg merge
4d 10h
Merged PRs (30d)
13

Description

Goal: to create a rune that can be rate limited to N times per hour

Documentation:

```
rate: the rate limit, per minute, e.g. "rate=60" is equivalent to "per=1sec".
```

First attempt:

```
lightning-cli decode string=$(lightning-cli createrune restrictions='[["per=1hour"]]' | jq -r '.rune')
{
"type": "rune",
"unique_id": "250",
"string": "XXXXXXXX:=250&per=1hour",
"restrictions": [
{
"alternatives": [
"per=1hour"
],
"summary": "per (unknown condition?) equal to '1hour'"
}
],
"valid": true
}
```

## Issue 1 (UX): Human readable output

createrune does not show human readable output. This means that I need to use `lightning-cli decode string=$rune` to interpret the rune in a way that a human can understand it

proposed fix: consider including the human readable summary or restrictions as part of the createrune output.

## Issue 2: createrune allows you to create invalid runes

```
lightning-cli createrune restrictions='foo'
{
"code": -32602,
"message": "restrictions: not a valid restriction (should be array): invalid token '\"foo\"'"
}

lightning-cli decode string=$(lightning-cli createrune restrictions='["foo=bar"]' | jq -r '.rune')
{
"type": "rune",
"unique_id": "255",
"string": "XXXXX:=255&foo=bar",
"restrictions": [
{
"alternatives": [
"foo=bar"
],
"summary": "foo (unknown condition?) equal to 'bar'"
}
],
"valid": true
}
```

suggested fix: Either don't allow creating runes with unknown conditions or issue a warning when issuing

## Issue 3 (UX) Warnings for runes that can drain funds

```
lightning-cli createrune
{
"rune": "XXXXX",
"unique_id": "256",
"warning_unrestricted_rune": "WARNING: This rune has no restrictions! Anyone who has access to this rune could drain funds from your node. Be careful when giving this to apps that you don't trust. Consider using the restrictions parameter to only allow access to specific rpc methods."
}

lightning-cli createrune restrictions='[["method=pay"]]'
{
"rune": "XXXXX",
"unique_id": "257"
}
```

suggested fix: both these runes will allow the user to drain all of the funds, but only the first one comes with a warning. Not quite sure how to fix this other then finding a way to communicate to the user what the rune will actually allow you to do.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.