From c5d89d75cc199ea318c6e9e9216e0e769a43720c Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Wed, 27 May 2026 18:20:43 +0930 Subject: [PATCH 1/2] BOLT 4: don't allow gratuitous overpayment. @michael1011 noets a Boltz complaint where users end up largely overpaying due to stuck payments and retrying from a different wallet. @TheBlueMatt points out that our rule could be stricter, requiring rejection of any "unnecessary" parts of the payment for little extra cost. Signed-off-by: Rusty Russell --- 04-onion-routing.md | 10 +++++++++- 1 file changed, 9 insertions(+), 1 deletion(-) diff --git a/04-onion-routing.md b/04-onion-routing.md index 63fbdf34f..636425298 100644 --- a/04-onion-routing.md +++ b/04-onion-routing.md @@ -395,7 +395,8 @@ The final node: all HTLCs in the set. - if the total `amt_to_forward` of this HTLC set is equal to or greater than `total_msat`: - - SHOULD fulfill all HTLCs in the HTLC set + - SHOULD fulfill the minimal subset of those HTLCs in the HTLC set which are required for payment + - SHOULD reject other "unnecessary" HTLCs in the HTLC set. - otherwise, if the total `amt_to_forward` of this HTLC set is less than `total_msat`: - MUST NOT fulfill any HTLCs in the HTLC set @@ -436,6 +437,13 @@ otherwise meets the amount criterion (eg. some other failure, or invoice timeout), however if it were to fulfill only some of them, intermediary nodes could simply claim the remaining ones. +There are cases where the sender attempts payments for the same invoice from multiple wallets +(usually because one part of the first payment is stuck). For example, a wallet could send +50% of the payment in one part which arrives at the destination, and another 50% which does +not. The sender tries another wallet, which pays 100% of the payment. In this case, the 50% +HTLC should be rejected, as the 100% is sufficient. This can be determined by ordering the +HTLCs in the set in descending amount order, and iterating until the amount requirement is fulfilled. + ## Route Blinding 1. subtype: `blinded_path` From ed5b1c18687b782e58a5e3474c58c27b3b75228c Mon Sep 17 00:00:00 2001 From: Rusty Russell Date: Wed, 27 May 2026 18:20:55 +0930 Subject: [PATCH 2/2] BOLT 4: don't allow double payment, allow "reasonable excess fees". @michael1011 reports that they have had user complaints about gross overpayment, so tighten the requirements to 1% of 5000 sats, which are comparable with reasonable network fees. Signed-off-by: Rusty Russell --- 04-onion-routing.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/04-onion-routing.md b/04-onion-routing.md index 636425298..e550f97d6 100644 --- a/04-onion-routing.md +++ b/04-onion-routing.md @@ -1526,7 +1526,7 @@ An _intermediate hop_ MUST NOT, but the _final node_: - if the payment hash is unknown: - MUST fail the HTLC. - MUST return an `incorrect_or_unknown_payment_details` error. - - if the amount paid is more than twice the amount expected: + - if the amount paid exceeds the expected about by more than 5000msat or 1% (whatever is greater): - SHOULD fail the HTLC. - SHOULD return an `incorrect_or_unknown_payment_details` error. - Note: this allows the origin node to reduce information leakage by