Bump bitcoin-payment-instructions to fork to accept non-compliant LNURL servers#40
Merged
Merged
Conversation
Point at the `2025-12-ldk-node-base` branch (rev bc7d03f) of our fork, which includes a patch to accept LNURL-pay BOLT11 invoices that ship a plain `d` description tag instead of the LUD-06-required `h = sha256(metadata)` tag. Unblocks payouts to Bringin lightning addresses (e.g. vincenzopalazzo@bringin.xyz) and any other LNURL servers with the same non-compliance. See moneydevkit/bitcoin-payment-instructions#2. Builds clean; verified live against vincenzopalazzo@bringin.xyz which previously failed with "BOLT 11 invoice resolved via LNURL must have a matching description hash" and now returns a valid invoice. Note: ldk-node still transitively pins rev 6796e87 of the same crate, so `cargo tree -d` shows two copies of bitcoin-payment-instructions until ldk-node is bumped in a follow-up.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
bitcoin-payment-instructionsdependency from crates.io0.5.0to the moneydevkit fork at revbc7d03f(on the2025-12-ldk-node-basebranch).6796e87: it accepts LNURL-pay BOLT11 invoices that ship a plainddescription tag instead of the LUD-06-requiredh = sha256(metadata). See Accept LNURL-pay invoices without matching description_hash bitcoin-payment-instructions#2.Motivation
Real-world LNURL-pay servers like
bringin.xyzmint BOLT11 invoices withd = "Topup <N> sats"and nohtag. Strike pays these fine; upstreambitcoin-payment-instructionsrejects them with"BOLT 11 invoice resolved via LNURL must have a matching description hash", so moneydevkit payouts to those addresses currently fail.Tradeoff
LUD-06 requires the invoice's
htag to commit tosha256(metadata)so the payer's wallet can prove the invoice matches the metadata it displayed. Dropping the check means a malicious or buggy LNURL host can swap the description out from under the user. Acceptable to unblock payouts.Test plan
cargo buildclean on this branchvincenzopalazzo@bringin.xyzviaHTTPHrnResolverreturned a valid BOLT11 (lnbc230u1p4qkjf0...) where upstream returned the description-hash errorpay_to_addressintegration against bringin from a built binary (manual, post-merge)Followup (not in this PR)
cargo tree -dshows two copies ofbitcoin-payment-instructionsbecauseldk-node(via its own Cargo.toml at rev4309f47) still pins6796e87of this crate. Bumpingldk-nodeto also point atbc7d03fin a separate PR will dedup. Both copies are at v0.6.0 with identical APIs, so this is a hygiene issue, not a correctness one.