fix: fail closed without vss auth by ben-kaufman · Pull Request #1156 · synonymdev/bitkit-android

ben-kaufman · 2026-08-12T19:09:26Z

This PR fails closed when LNURL-auth is missing so wallet backups cannot fall back to unauthenticated VSS.

Description

Removes the unauthenticated VSS client fallback. If LNURL-auth is not configured, backup setup and Lightning node build now error instead of using a public encryption key or fixed-header VSS.

Env currently always sets an LNURL-auth URL, so this is a footgun fix rather than a user-visible change on production configs.

Related: synonymdev/audit#55 (BITKIT-SEC-003). Library-side rejection is in synonymdev/vss-rust-client-ffi.

Preview

N/A

QA Notes

Manual Tests

1. Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.
2.regression: empty LNURL-auth URL → VSS setup and node build fail instead of using unauthenticated VSS.

Automated Checks

Existing VssBackupClientTest.kt coverage for mnemonic-missing setup is unchanged.

Made with Cursor

greptile-apps · 2026-08-12T19:12:36Z

Greptile Summary

This PR removes unauthenticated VSS fallbacks and adds a typed failure when LNURL-auth configuration is missing.

Requires LNURL-auth when initializing both application and LDK VSS clients.
Prevents Lightning node construction through fixed-header VSS when authentication is absent.
Adds VssAuthRequired and documents the security hardening in the changelog.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new fail-closed checks reject whitespace-only configuration as well.

The authenticated VSS path is enforced for current fixed environment URLs, and the new error propagates safely through existing Result and lifecycle handling; only the narrow isEmpty validation remains.

Files Needing Attention: app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt, app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt, app/src/main/java/to/bitkit/services/LightningService.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated client fallback and requires an LNURL-auth URL, though the new guard does not treat whitespace-only values as missing.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Adds the same fail-closed precondition before initializing authenticated LDK VSS persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Removes fixed-header VSS node construction and propagates VssAuthRequired before building the node.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
changelog.d/next/fail-closed.security.md	Accurately records removal of the unauthenticated VSS fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
Start["VSS or Lightning setup"] --> Check{"LNURL-auth URL empty?"}
Check -->|Yes| Error["Throw VssAuthRequired"]
Check -->|No| Auth["Construct authenticated VSS client"]
Auth --> Backup["Application backup persistence"]
Auth --> LDK["LDK channel-state persistence"]

_{Reviews (1): Last reviewed commit: "fix: fail closed without vss auth" | Re-trigger Greptile}

jvsena42 · 2026-08-13T13:25:39Z

@ben-kaufman conflict

ben-kaufman · 2026-08-13T14:22:41Z

Rebased onto master after #1155. Kept fail-closed VSS and dropped the stale-monitor retry.

ovitrif · 2026-08-18T10:16:05Z

#1164 bumps vss-rust-client-ffi to 0.5.23

Co-authored-by: Cursor <cursoragent@cursor.com>

ovitrif

Fail-closed LNURL-auth is enforced on app VSS, LDK VSS, and Lightning node build; the unauthenticated fallback is gone.

ben-kaufman · 2026-08-12T19:09:26Z

This PR fails closed when LNURL-auth is missing so wallet backups cannot fall back to unauthenticated VSS.

Description

Removes the unauthenticated VSS client fallback. If LNURL-auth is not configured, backup setup and Lightning node build now error instead of using a public encryption key or fixed-header VSS.

Env currently always sets an LNURL-auth URL, so this is a footgun fix rather than a user-visible change on production configs.

Related: synonymdev/audit#55 (BITKIT-SEC-003). Library-side rejection is in synonymdev/vss-rust-client-ffi.

Preview

N/A

QA Notes

Manual Tests

1. Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.
2.regression: empty LNURL-auth URL → VSS setup and node build fail instead of using unauthenticated VSS.

Automated Checks

Existing VssBackupClientTest.kt coverage for mnemonic-missing setup is unchanged.

Made with Cursor

greptile-apps · 2026-08-12T19:12:36Z

Greptile Summary

This PR removes unauthenticated VSS fallbacks and adds a typed failure when LNURL-auth configuration is missing.

Requires LNURL-auth when initializing both application and LDK VSS clients.
Prevents Lightning node construction through fixed-header VSS when authentication is absent.
Adds VssAuthRequired and documents the security hardening in the changelog.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new fail-closed checks reject whitespace-only configuration as well.

The authenticated VSS path is enforced for current fixed environment URLs, and the new error propagates safely through existing Result and lifecycle handling; only the narrow isEmpty validation remains.

Files Needing Attention: app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt, app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt, app/src/main/java/to/bitkit/services/LightningService.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated client fallback and requires an LNURL-auth URL, though the new guard does not treat whitespace-only values as missing.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Adds the same fail-closed precondition before initializing authenticated LDK VSS persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Removes fixed-header VSS node construction and propagates VssAuthRequired before building the node.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
changelog.d/next/fail-closed.security.md	Accurately records removal of the unauthenticated VSS fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
Start["VSS or Lightning setup"] --> Check{"LNURL-auth URL empty?"}
Check -->|Yes| Error["Throw VssAuthRequired"]
Check -->|No| Auth["Construct authenticated VSS client"]
Auth --> Backup["Application backup persistence"]
Auth --> LDK["LDK channel-state persistence"]

_{Reviews (1): Last reviewed commit: "fix: fail closed without vss auth" | Re-trigger Greptile}

jvsena42 · 2026-08-13T13:25:39Z

@ben-kaufman conflict

ben-kaufman · 2026-08-13T14:22:41Z

Rebased onto master after #1155. Kept fail-closed VSS and dropped the stale-monitor retry.

ovitrif · 2026-08-18T10:16:05Z

#1164 bumps vss-rust-client-ffi to 0.5.23

Co-authored-by: Cursor <cursoragent@cursor.com>

ovitrif

Fail-closed LNURL-auth is enforced on app VSS, LDK VSS, and Lightning node build; the unauthenticated fallback is gone.

ben-kaufman · 2026-08-12T19:09:26Z

This PR fails closed when LNURL-auth is missing so wallet backups cannot fall back to unauthenticated VSS.

Description

Removes the unauthenticated VSS client fallback. If LNURL-auth is not configured, backup setup and Lightning node build now error instead of using a public encryption key or fixed-header VSS.

Env currently always sets an LNURL-auth URL, so this is a footgun fix rather than a user-visible change on production configs.

Related: synonymdev/audit#55 (BITKIT-SEC-003). Library-side rejection is in synonymdev/vss-rust-client-ffi.

Preview

N/A

QA Notes

Manual Tests

1. Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.
2.regression: empty LNURL-auth URL → VSS setup and node build fail instead of using unauthenticated VSS.

Automated Checks

Existing VssBackupClientTest.kt coverage for mnemonic-missing setup is unchanged.

Made with Cursor

greptile-apps · 2026-08-12T19:12:36Z

Greptile Summary

This PR removes unauthenticated VSS fallbacks and adds a typed failure when LNURL-auth configuration is missing.

Requires LNURL-auth when initializing both application and LDK VSS clients.
Prevents Lightning node construction through fixed-header VSS when authentication is absent.
Adds VssAuthRequired and documents the security hardening in the changelog.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new fail-closed checks reject whitespace-only configuration as well.

The authenticated VSS path is enforced for current fixed environment URLs, and the new error propagates safely through existing Result and lifecycle handling; only the narrow isEmpty validation remains.

Files Needing Attention: app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt, app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt, app/src/main/java/to/bitkit/services/LightningService.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated client fallback and requires an LNURL-auth URL, though the new guard does not treat whitespace-only values as missing.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Adds the same fail-closed precondition before initializing authenticated LDK VSS persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Removes fixed-header VSS node construction and propagates VssAuthRequired before building the node.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
changelog.d/next/fail-closed.security.md	Accurately records removal of the unauthenticated VSS fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
Start["VSS or Lightning setup"] --> Check{"LNURL-auth URL empty?"}
Check -->|Yes| Error["Throw VssAuthRequired"]
Check -->|No| Auth["Construct authenticated VSS client"]
Auth --> Backup["Application backup persistence"]
Auth --> LDK["LDK channel-state persistence"]

_{Reviews (1): Last reviewed commit: "fix: fail closed without vss auth" | Re-trigger Greptile}

jvsena42 · 2026-08-13T13:25:39Z

@ben-kaufman conflict

ben-kaufman · 2026-08-13T14:22:41Z

Rebased onto master after #1155. Kept fail-closed VSS and dropped the stale-monitor retry.

ovitrif · 2026-08-18T10:16:05Z

#1164 bumps vss-rust-client-ffi to 0.5.23

Co-authored-by: Cursor <cursoragent@cursor.com>

ovitrif

Fail-closed LNURL-auth is enforced on app VSS, LDK VSS, and Lightning node build; the unauthenticated fallback is gone.

ben-kaufman · 2026-08-12T19:09:26Z

This PR fails closed when LNURL-auth is missing so wallet backups cannot fall back to unauthenticated VSS.

Description

Removes the unauthenticated VSS client fallback. If LNURL-auth is not configured, backup setup and Lightning node build now error instead of using a public encryption key or fixed-header VSS.

Env currently always sets an LNURL-auth URL, so this is a footgun fix rather than a user-visible change on production configs.

Related: synonymdev/audit#55 (BITKIT-SEC-003). Library-side rejection is in synonymdev/vss-rust-client-ffi.

Preview

N/A

QA Notes

Manual Tests

1. Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.
2.regression: empty LNURL-auth URL → VSS setup and node build fail instead of using unauthenticated VSS.

Automated Checks

Existing VssBackupClientTest.kt coverage for mnemonic-missing setup is unchanged.

Made with Cursor

greptile-apps · 2026-08-12T19:12:36Z

Greptile Summary

This PR removes unauthenticated VSS fallbacks and adds a typed failure when LNURL-auth configuration is missing.

Requires LNURL-auth when initializing both application and LDK VSS clients.
Prevents Lightning node construction through fixed-header VSS when authentication is absent.
Adds VssAuthRequired and documents the security hardening in the changelog.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new fail-closed checks reject whitespace-only configuration as well.

The authenticated VSS path is enforced for current fixed environment URLs, and the new error propagates safely through existing Result and lifecycle handling; only the narrow isEmpty validation remains.

Files Needing Attention: app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt, app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt, app/src/main/java/to/bitkit/services/LightningService.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated client fallback and requires an LNURL-auth URL, though the new guard does not treat whitespace-only values as missing.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Adds the same fail-closed precondition before initializing authenticated LDK VSS persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Removes fixed-header VSS node construction and propagates VssAuthRequired before building the node.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
changelog.d/next/fail-closed.security.md	Accurately records removal of the unauthenticated VSS fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
Start["VSS or Lightning setup"] --> Check{"LNURL-auth URL empty?"}
Check -->|Yes| Error["Throw VssAuthRequired"]
Check -->|No| Auth["Construct authenticated VSS client"]
Auth --> Backup["Application backup persistence"]
Auth --> LDK["LDK channel-state persistence"]

_{Reviews (1): Last reviewed commit: "fix: fail closed without vss auth" | Re-trigger Greptile}

jvsena42 · 2026-08-13T13:25:39Z

@ben-kaufman conflict

ben-kaufman · 2026-08-13T14:22:41Z

Rebased onto master after #1155. Kept fail-closed VSS and dropped the stale-monitor retry.

ovitrif · 2026-08-18T10:16:05Z

#1164 bumps vss-rust-client-ffi to 0.5.23

Co-authored-by: Cursor <cursoragent@cursor.com>

ovitrif

Fail-closed LNURL-auth is enforced on app VSS, LDK VSS, and Lightning node build; the unauthenticated fallback is gone.

ben-kaufman · 2026-08-12T19:09:26Z

This PR fails closed when LNURL-auth is missing so wallet backups cannot fall back to unauthenticated VSS.

Description

Removes the unauthenticated VSS client fallback. If LNURL-auth is not configured, backup setup and Lightning node build now error instead of using a public encryption key or fixed-header VSS.

Env currently always sets an LNURL-auth URL, so this is a footgun fix rather than a user-visible change on production configs.

Related: synonymdev/audit#55 (BITKIT-SEC-003). Library-side rejection is in synonymdev/vss-rust-client-ffi.

Preview

N/A

QA Notes

Manual Tests

1. Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.
2.regression: empty LNURL-auth URL → VSS setup and node build fail instead of using unauthenticated VSS.

Automated Checks

Existing VssBackupClientTest.kt coverage for mnemonic-missing setup is unchanged.

Made with Cursor

greptile-apps · 2026-08-12T19:12:36Z

Greptile Summary

This PR removes unauthenticated VSS fallbacks and adds a typed failure when LNURL-auth configuration is missing.

Requires LNURL-auth when initializing both application and LDK VSS clients.
Prevents Lightning node construction through fixed-header VSS when authentication is absent.
Adds VssAuthRequired and documents the security hardening in the changelog.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new fail-closed checks reject whitespace-only configuration as well.

The authenticated VSS path is enforced for current fixed environment URLs, and the new error propagates safely through existing Result and lifecycle handling; only the narrow isEmpty validation remains.

Files Needing Attention: app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt, app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt, app/src/main/java/to/bitkit/services/LightningService.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated client fallback and requires an LNURL-auth URL, though the new guard does not treat whitespace-only values as missing.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Adds the same fail-closed precondition before initializing authenticated LDK VSS persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Removes fixed-header VSS node construction and propagates VssAuthRequired before building the node.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
changelog.d/next/fail-closed.security.md	Accurately records removal of the unauthenticated VSS fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
Start["VSS or Lightning setup"] --> Check{"LNURL-auth URL empty?"}
Check -->|Yes| Error["Throw VssAuthRequired"]
Check -->|No| Auth["Construct authenticated VSS client"]
Auth --> Backup["Application backup persistence"]
Auth --> LDK["LDK channel-state persistence"]

_{Reviews (1): Last reviewed commit: "fix: fail closed without vss auth" | Re-trigger Greptile}

jvsena42 · 2026-08-13T13:25:39Z

@ben-kaufman conflict

ben-kaufman · 2026-08-13T14:22:41Z

Rebased onto master after #1155. Kept fail-closed VSS and dropped the stale-monitor retry.

ovitrif · 2026-08-18T10:16:05Z

#1164 bumps vss-rust-client-ffi to 0.5.23

Co-authored-by: Cursor <cursoragent@cursor.com>

ovitrif

Fail-closed LNURL-auth is enforced on app VSS, LDK VSS, and Lightning node build; the unauthenticated fallback is gone.

ben-kaufman · 2026-08-12T19:09:26Z

This PR fails closed when LNURL-auth is missing so wallet backups cannot fall back to unauthenticated VSS.

Description

Removes the unauthenticated VSS client fallback. If LNURL-auth is not configured, backup setup and Lightning node build now error instead of using a public encryption key or fixed-header VSS.

Env currently always sets an LNURL-auth URL, so this is a footgun fix rather than a user-visible change on production configs.

Related: synonymdev/audit#55 (BITKIT-SEC-003). Library-side rejection is in synonymdev/vss-rust-client-ffi.

Preview

N/A

QA Notes

Manual Tests

1. Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.
2.regression: empty LNURL-auth URL → VSS setup and node build fail instead of using unauthenticated VSS.

Automated Checks

Existing VssBackupClientTest.kt coverage for mnemonic-missing setup is unchanged.

Made with Cursor

greptile-apps · 2026-08-12T19:12:36Z

Greptile Summary

This PR removes unauthenticated VSS fallbacks and adds a typed failure when LNURL-auth configuration is missing.

Requires LNURL-auth when initializing both application and LDK VSS clients.
Prevents Lightning node construction through fixed-header VSS when authentication is absent.
Adds VssAuthRequired and documents the security hardening in the changelog.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new fail-closed checks reject whitespace-only configuration as well.

The authenticated VSS path is enforced for current fixed environment URLs, and the new error propagates safely through existing Result and lifecycle handling; only the narrow isEmpty validation remains.

Files Needing Attention: app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt, app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt, app/src/main/java/to/bitkit/services/LightningService.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated client fallback and requires an LNURL-auth URL, though the new guard does not treat whitespace-only values as missing.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Adds the same fail-closed precondition before initializing authenticated LDK VSS persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Removes fixed-header VSS node construction and propagates VssAuthRequired before building the node.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
changelog.d/next/fail-closed.security.md	Accurately records removal of the unauthenticated VSS fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
Start["VSS or Lightning setup"] --> Check{"LNURL-auth URL empty?"}
Check -->|Yes| Error["Throw VssAuthRequired"]
Check -->|No| Auth["Construct authenticated VSS client"]
Auth --> Backup["Application backup persistence"]
Auth --> LDK["LDK channel-state persistence"]

_{Reviews (1): Last reviewed commit: "fix: fail closed without vss auth" | Re-trigger Greptile}

jvsena42 · 2026-08-13T13:25:39Z

@ben-kaufman conflict

ben-kaufman · 2026-08-13T14:22:41Z

Rebased onto master after #1155. Kept fail-closed VSS and dropped the stale-monitor retry.

ovitrif · 2026-08-18T10:16:05Z

#1164 bumps vss-rust-client-ffi to 0.5.23

Co-authored-by: Cursor <cursoragent@cursor.com>

ovitrif

Fail-closed LNURL-auth is enforced on app VSS, LDK VSS, and Lightning node build; the unauthenticated fallback is gone.

ben-kaufman · 2026-08-12T19:09:26Z

This PR fails closed when LNURL-auth is missing so wallet backups cannot fall back to unauthenticated VSS.

Description

Removes the unauthenticated VSS client fallback. If LNURL-auth is not configured, backup setup and Lightning node build now error instead of using a public encryption key or fixed-header VSS.

Env currently always sets an LNURL-auth URL, so this is a footgun fix rather than a user-visible change on production configs.

Related: synonymdev/audit#55 (BITKIT-SEC-003). Library-side rejection is in synonymdev/vss-rust-client-ffi.

Preview

N/A

QA Notes

Manual Tests

1. Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.
2.regression: empty LNURL-auth URL → VSS setup and node build fail instead of using unauthenticated VSS.

Automated Checks

Existing VssBackupClientTest.kt coverage for mnemonic-missing setup is unchanged.

Made with Cursor

greptile-apps · 2026-08-12T19:12:36Z

Greptile Summary

This PR removes unauthenticated VSS fallbacks and adds a typed failure when LNURL-auth configuration is missing.

Requires LNURL-auth when initializing both application and LDK VSS clients.
Prevents Lightning node construction through fixed-header VSS when authentication is absent.
Adds VssAuthRequired and documents the security hardening in the changelog.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new fail-closed checks reject whitespace-only configuration as well.

The authenticated VSS path is enforced for current fixed environment URLs, and the new error propagates safely through existing Result and lifecycle handling; only the narrow isEmpty validation remains.

Files Needing Attention: app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt, app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt, app/src/main/java/to/bitkit/services/LightningService.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated client fallback and requires an LNURL-auth URL, though the new guard does not treat whitespace-only values as missing.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Adds the same fail-closed precondition before initializing authenticated LDK VSS persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Removes fixed-header VSS node construction and propagates VssAuthRequired before building the node.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
changelog.d/next/fail-closed.security.md	Accurately records removal of the unauthenticated VSS fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
Start["VSS or Lightning setup"] --> Check{"LNURL-auth URL empty?"}
Check -->|Yes| Error["Throw VssAuthRequired"]
Check -->|No| Auth["Construct authenticated VSS client"]
Auth --> Backup["Application backup persistence"]
Auth --> LDK["LDK channel-state persistence"]

_{Reviews (1): Last reviewed commit: "fix: fail closed without vss auth" | Re-trigger Greptile}

jvsena42 · 2026-08-13T13:25:39Z

@ben-kaufman conflict

ben-kaufman · 2026-08-13T14:22:41Z

Rebased onto master after #1155. Kept fail-closed VSS and dropped the stale-monitor retry.

ovitrif · 2026-08-18T10:16:05Z

#1164 bumps vss-rust-client-ffi to 0.5.23

Co-authored-by: Cursor <cursoragent@cursor.com>

ovitrif

Fail-closed LNURL-auth is enforced on app VSS, LDK VSS, and Lightning node build; the unauthenticated fallback is gone.

ben-kaufman · 2026-08-12T19:09:26Z

This PR fails closed when LNURL-auth is missing so wallet backups cannot fall back to unauthenticated VSS.

Description

Removes the unauthenticated VSS client fallback. If LNURL-auth is not configured, backup setup and Lightning node build now error instead of using a public encryption key or fixed-header VSS.

Env currently always sets an LNURL-auth URL, so this is a footgun fix rather than a user-visible change on production configs.

Related: synonymdev/audit#55 (BITKIT-SEC-003). Library-side rejection is in synonymdev/vss-rust-client-ffi.

Preview

N/A

QA Notes

Manual Tests

1. Fresh wallet → backup/Lightning start with current Env LNURL-auth URL: setup still succeeds.
2.regression: empty LNURL-auth URL → VSS setup and node build fail instead of using unauthenticated VSS.

Automated Checks

Existing VssBackupClientTest.kt coverage for mnemonic-missing setup is unchanged.

Made with Cursor

greptile-apps · 2026-08-12T19:12:36Z

Greptile Summary

This PR removes unauthenticated VSS fallbacks and adds a typed failure when LNURL-auth configuration is missing.

Requires LNURL-auth when initializing both application and LDK VSS clients.
Prevents Lightning node construction through fixed-header VSS when authentication is absent.
Adds VssAuthRequired and documents the security hardening in the changelog.

Confidence Score: 4/5

The PR appears safe to merge, with a non-blocking opportunity to make the new fail-closed checks reject whitespace-only configuration as well.

The authenticated VSS path is enforced for current fixed environment URLs, and the new error propagates safely through existing Result and lifecycle handling; only the narrow isEmpty validation remains.

Files Needing Attention: app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt, app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt, app/src/main/java/to/bitkit/services/LightningService.kt

Important Files Changed

Filename	Overview
app/src/main/java/to/bitkit/data/backup/VssBackupClient.kt	Removes the unauthenticated client fallback and requires an LNURL-auth URL, though the new guard does not treat whitespace-only values as missing.
app/src/main/java/to/bitkit/data/backup/VssBackupClientLdk.kt	Adds the same fail-closed precondition before initializing authenticated LDK VSS persistence.
app/src/main/java/to/bitkit/services/LightningService.kt	Removes fixed-header VSS node construction and propagates VssAuthRequired before building the node.
app/src/main/java/to/bitkit/utils/Errors.kt	Adds the typed VssAuthRequired service precondition error.
changelog.d/next/fail-closed.security.md	Accurately records removal of the unauthenticated VSS fallback.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
Start["VSS or Lightning setup"] --> Check{"LNURL-auth URL empty?"}
Check -->|Yes| Error["Throw VssAuthRequired"]
Check -->|No| Auth["Construct authenticated VSS client"]
Auth --> Backup["Application backup persistence"]
Auth --> LDK["LDK channel-state persistence"]

_{Reviews (1): Last reviewed commit: "fix: fail closed without vss auth" | Re-trigger Greptile}

jvsena42 · 2026-08-13T13:25:39Z

@ben-kaufman conflict

ben-kaufman · 2026-08-13T14:22:41Z

Rebased onto master after #1155. Kept fail-closed VSS and dropped the stale-monitor retry.

ovitrif · 2026-08-18T10:16:05Z

#1164 bumps vss-rust-client-ffi to 0.5.23

Co-authored-by: Cursor <cursoragent@cursor.com>

ovitrif

Fail-closed LNURL-auth is enforced on app VSS, LDK VSS, and Lightning node build; the unauthenticated fallback is gone.

greptile-appsBot reviewed Aug 12, 2026
View reviewed changes

Comment threadapp/src/main/java/to/bitkit/data/backup/VssBackupClient.kt Outdated

jvsena42 assigned ben-kaufman Aug 13, 2026

ben-kaufman force-pushed the fix/fail-closed-unauthenticated-vss branch from 5ab507b to 378bcaeCompare August 13, 2026 14:22

ovitrif mentioned this pull request Aug 18, 2026
fix: consume vss-client 0.5.23 #1164
Merged
1 task

ovitrif self-requested a review August 18, 2026 12:56

ben-kaufmanand others added 3 commits August 18, 2026 15:02

fix: fail closed without vss auth
98deb34
Co-authored-by: Cursor <cursoragent@cursor.com>

chore: rename changelog fragment
ddeabd1
Co-authored-by: Cursor <cursoragent@cursor.com>

fix: treat blank vss auth urls as missing
1c05a92
Co-authored-by: Cursor <cursoragent@cursor.com>

ovitrif force-pushed the fix/fail-closed-unauthenticated-vss branch from 378bcae to 1c05a92Compare August 18, 2026 13:03

ovitrif approved these changes Aug 18, 2026
View reviewed changes

ovitrif merged commit b408e04 into masterAug 18, 2026
18 checks passed

ovitrif deleted the fix/fail-closed-unauthenticated-vss branch August 18, 2026 13:47

piotr-iohk mentioned this pull request Aug 21, 2026
chore: bump version 2.4.1 #1174
Closed

piotr-iohk mentioned this pull request Aug 31, 2026
chore: sync 2.4.1 onto master #1197
Merged