Repository navigation
loopout: Accept blinded invoices for Loop Out - #1255
Merged
hieblmi merged 3 commits intoOct 22, 2026
Merged
Conversation
hieblmi
changed the title
hieblmi
marked this pull request as ready for review
October 21, 2026 07:24
claravanstaden
left a comment
claravanstaden
left a comment
Collaborator
There was a problem hiding this comment.
Nice! 👏🏻 Only one comment.
claravanstaden
approved these changes
Oct 21, 2026
Blinded invoices hide the payment address that Loop uses to authorize cancellation, routing reports and cooperative sweep signing. Accept the address separately from the authenticated server response and persist it with the swap so these operations also work after restart. Advertise support explicitly, preserve legacy invoice-derived addresses, and leave introduction-node pathfinding to LND for blinded payments.
Cover cancellation, routing reports and cooperative sweeping with blinded swap and prepay invoices so client compatibility can release before the server enables blinded paths. Preserve payment limits and contract checks, record the supported LND floor, and fix dependency and lint checks.
Read the stored swap secret when a manual cooperative sweep uses a blinded invoice, so recovery follows the same authentication path as normal sweeping. Cover successful signing and missing secrets, and deprecate the invoice-only helper without breaking external callers.
hieblmi
force-pushed
the
hai/blinded-loopout-invoices
branch
from
October 22, 2026 12:01
73331c9 to
7a9c753
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Loop Out currently requires a visible invoice payment address to authenticate
swap RPCs, so it cannot accept a bLIP 39 blinded swap invoice. Advertise
accept_blinded_invoices, accept a separate 32-bytepayment_addressfromthe server, and persist it for cancellation, routing reports and cooperative
sweeping, including after restart.
LND receives the complete swap and prepay invoices and handles blinded path
routing. Destination-based Loop routing plugins are bypassed for blinded
invoices; fee limits, timeouts, outgoing channel restrictions and multipart
limits are preserved. Invoice hash, swap fee and prepayment checks still
apply. Missing or malformed payment addresses are rejected, and separately
supplied addresses must match ordinary invoices.
This client change can ship independently of server support. Existing servers
ignore the additive capability flag and keep returning ordinary invoices.
Servers can enable blinded invoices later for clients that advertise support,
while keeping ordinary invoices for older clients. Existing swaps retain their
invoice-derived authentication address. No LND or lndclient change is needed;
Loop's existing minimum LND v0.19.0-beta supports blinded invoice payments,
including MPP. Path discovery, ranking and invoice construction remain server
responsibilities.
Includes SQLite/PostgreSQL and legacy-store persistence, protocol documentation
and release notes. Client tests cover blinded swap and prepay payments, payment
limits, routing reports, cancellation of either payment, database restart and
a complete cooperative sweep. The client unit fixtures use encoded invoices
with placeholder ciphertext; actual network forwarding is LND's responsibility.
Validation:
make fmtgo test -race ./... -timeout=10mgo test -race -tags=test_db_postgres ./loopdb -run TestSqliteLoopOutStore -count=1golangci-lint run --concurrency=4(zero issues)go mod tidy -diffmake commitmsg-lint range='upstream/master..HEAD'