btcpayserver / btcpayserver/BTCPayServer.Lightning

VerifySignature should be called in the BOLT11PaymentRequest ctor

Open
#21 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
C#
Stars
106
Forks
52
Avg merge
2d 1h
Merged PRs (30d)
4

Description

As far as I can see, the signature is not verified by the constructor. Why not call `VerifySignature` iff `ExplicitPayeePubKey != null` and throw an exception if the signature does not match explicit pubkey?

Alternatively, the signature could also be verified in `Parse`/`TryParse`.

Contributor guide

No contributing guide indexed for this repository

Research direction

Locate the BOLT11PaymentRequest constructor and the VerifySignature, Parse, and TryParse entry points. Read how ExplicitPayeePubKey and signature errors are currently handled, then inspect existing tests around payment-request parsing or validation. Done means the chosen construction or parsing path verifies signatures when an explicit payee key is present and rejects mismatches.

Written by the indexing model from the issue text.

Assessment

Tech stack
csharp
Domain
cryptography, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.