Security poc token exposure - #110

Open

silentknight46 wants to merge 1563 commits into

buildonspark:mainfrom

silentknight46:security-poc-token-exposure

This pull request is big! We're only showing the most recent 250 commits

Commits on Jan 21, 2026

When finalizing a deposit only add node to internal cache if

carsonp6
authored and
Lightspark Eng
committed
6edeb9f
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
a02fbec
Sync from private repository

mohamedwane
authored and
Lightspark Eng
committed
f453004
Update integration tests to handle new fund availability logic correctly

reverendken
authored and
Lightspark Eng
committed
e658a54
Add .github back (#98)

coreymartin
and
Lightspark Eng
authored
211f36b
Sync from private repository

coreymartin
authored and
Lightspark Eng
committed
7a0d378
Sync from private repository

lightsparkmax
authored and
Lightspark Eng
committed
5d5b7bd
Implement swap v3

carsonp6
authored and
Lightspark Eng
committed
105f080
Update proto

keenan-lightspark
authored and
Lightspark Eng
committed
e1c7a3a
Remove leaf ids after each transfer job

carsonp6
authored and
Lightspark Eng
committed
c998652

Commits on Jan 22, 2026

Sync from private repository

yellowred
authored and
Lightspark Eng
committed
ff89300
Sync from private repository

akanter
authored and
Lightspark Eng
committed
6ade575
Sync from private repository

changli2023
authored and
Lightspark Eng
committed
fd56de5
Add .github back (#99)

coreymartin
and
Lightspark Eng
authored
569d5ae
Sync from private repository

mhrheaume
authored and
Lightspark Eng
committed
84c6345
Sync from private repository

turkycat
authored and
Lightspark Eng
committed
8bfbe97
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
b38293f
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
8aabd72
Sync from private repository

alexjweil
authored and
Lightspark Eng
committed
4002d37
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
93a4d12
Sync from private repository

alexjweil
authored and
Lightspark Eng
committed
57bbc59
Sync from private repository

changli2023
authored and
Lightspark Eng
committed
f3d296a
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
c3afd2b

Commits on Jan 23, 2026

Sync from private repository

coreymartin
authored and
Lightspark Eng
committed
bb0dab4
Sync from private repository

changli2023
authored and
Lightspark Eng
committed
b65799c
Update test suite to reduce the time some integration tests take to complete

reverendken
authored and
Lightspark Eng
committed
9e76205
Sync from private repository

turkycat
authored and
Lightspark Eng
committed
019d3a5
Passing connector tx into coop exit request grpc endpoint and validate the structure of the connector tx. The SDK already has the connector tx, this code just passes it to the grpc endpoint.

DhruvPareek
authored and
Lightspark Eng
committed
1c22e0d
Don't construct direct refund if zero node leaf

carsonp6
authored and
Lightspark Eng
committed
14dc270
Sync from private repository

DhruvPareek
authored and
Lightspark Eng
committed
f047465

Commits on Jan 25, 2026

Increase timeout for creating an invoice in RN test

carsonp6
authored and
Lightspark Eng
committed
26702a1

Commits on Jan 26, 2026

Sync from private repository

peterrojs
authored and
Lightspark Eng
committed
298c6e6
Sync from private repository

santidmar
authored and
Lightspark Eng
committed
6b34199
Sync from private repository

DhruvPareek
authored and
Lightspark Eng
committed
48fb0f5
Sync from private repository

reverendken
authored and
Lightspark Eng
committed
f0eb51e
[proto] additional validation for max tx hashes in one rpc

peterrojs
authored and
Lightspark Eng
committed
7becb2f
Sync from private repository

carsonp6
authored and
Lightspark Eng
committed
aae54e6
Sync from private repository

carsonp6
authored and
Lightspark Eng
committed
5e1fe55
Better lockfile check (#101)
coreymartin
authored
a42f0b9

Commits on Jan 27, 2026

Sync from private repository

benwgold
authored and
Lightspark Eng
committed
32bfd5b
Connector TX for coop-exit requests are no longer passed to the backend. I removed these changes so that we can get the backend fix merged into main, then once the backend fix is in main I can add …

DhruvPareek
authored and
Lightspark Eng
committed
c44feae
Sync from private repository

DhruvPareek
authored and
Lightspark Eng
committed
e1e132f
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
aa2c659
Sync from private repository

turkycat
authored and
Lightspark Eng
committed
0820b82
Sync from private repository

DhruvPareek
authored and
Lightspark Eng
committed
f5ee084
Sync from private repository

DhruvPareek
authored and
Lightspark Eng
committed
06ad383
Sync from private repository

akanter
authored and
Lightspark Eng
committed
effb0c8
Add SSP coop exit integration tests

carsonp6
authored and
Lightspark Eng
committed
3ec5704
The sighash for coop-exits was being calculated with a single input after stripping the connector input. Now the sighash is calculated with the connector input in the SDK.

DhruvPareek
authored and
Lightspark Eng
committed
3b89ede
Sync from private repository

keenan-lightspark
authored and
Lightspark Eng
committed
54d240d
Sync from private repository

reverendken
authored and
Lightspark Eng
committed
af4613e
New CLI example project

carsonp6
authored and
Lightspark Eng
committed
a73aa43
Update periodic transfer claim to ignore swaps

carsonp6
authored and
Lightspark Eng
committed
919a252
Verify VSS proof length

keenan-lightspark
authored and
Lightspark Eng
committed
4bf574e
Sync from private repository

peterrojs
authored and
Lightspark Eng
committed
f7710a5

Commits on Jan 28, 2026

Sync from private repository

benwgold
authored and
Lightspark Eng
committed
36b6e87
Sync from private repository

keenan-lightspark
authored and
Lightspark Eng
committed
7d50a0d
Sync from private repository

mhrheaume
authored and
Lightspark Eng
committed
23a7b31
Sync from private repository

mhrheaume
authored and
Lightspark Eng
committed
0a835df
Sync from private repository

mhrheaume
authored and
Lightspark Eng
committed
29d736d
Sync from private repository

mhrheaume
authored and
Lightspark Eng
committed
9bae858
Better Node.js version management for workspaces

coreymartin
authored and
Lightspark Eng
committed
6355257
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
093d6d4
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
398a6eb
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
a48ed03
During the test, it is noticed that when using lighting send to

changli2023
authored and
Lightspark Eng
committed
983f93e
Sync from private repository

mhrheaume
authored and
Lightspark Eng
committed
f48a559
[spark-sdk] regenerate js proto

peterrojs
authored and
Lightspark Eng
committed
3e1539c
Sync from private repository

DhruvPareek
authored and
Lightspark Eng
committed
c0f6753
Sync from private repository

keenan-lightspark
authored and
Lightspark Eng
committed
5524a0c
Sync from private repository

reverendken
authored and
Lightspark Eng
committed
75e5544
[proto] remove outdated network comment

peterrojs
authored and
Lightspark Eng
committed
3cabc4c
Sync from private repository

keenan-lightspark
authored and
Lightspark Eng
committed
4cb4be6
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
a6fb738
Sync from private repository

alexjweil
authored and
Lightspark Eng
committed
85f05eb
Update proto

keenan-lightspark
authored and
Lightspark Eng
committed
e2ae9f9
[SO] cleanup of QueryTokenOutputs handler

peterrojs
authored and
Lightspark Eng
committed
eeeaadb
Validate VSS proof length on SDK

keenan-lightspark
authored and
Lightspark Eng
committed
0fe2c0f

Commits on Jan 29, 2026

[spark-vite-app] Enable public access to dev server

coreymartin
authored and
Lightspark Eng
committed
bf44119
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
76d6b5f
Sync from private repository

santidmar
authored and
Lightspark Eng
committed
9d1e6a5
[spark-sdk] Remove static initialization block not support on

coreymartin
authored and
Lightspark Eng
committed
7306043
[spark-vite-app] More features and better UI

coreymartin
authored and
Lightspark Eng
committed
a95531c
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
cbbb2a3
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
61a6129
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
dc9af11
Sync from private repository

akanter
authored and
Lightspark Eng
committed
37ecce8
Sync from private repository

akanter
authored and
Lightspark Eng
committed
d97adf3
Sync from private repository

akanter
authored and
Lightspark Eng
committed
da96915
Sync from private repository

akanter
authored and
Lightspark Eng
committed
3a9d8c5
Sync from private repository

akanter
authored and
Lightspark Eng
committed
ca96a86
Sync from private repository

akanter
authored and
Lightspark Eng
committed
e5c0763
Sync from private repository

akanter
authored and
Lightspark Eng
committed
155356f
Sync from private repository

akanter
authored and
Lightspark Eng
committed
04fae08
Sync from private repository

akanter
authored and
Lightspark Eng
committed
85f02c8
Sync from private repository

akanter
authored and
Lightspark Eng
committed
1e8d92c
Sync from private repository

akanter
authored and
Lightspark Eng
committed
463d2de
Sync from private repository

akanter
authored and
Lightspark Eng
committed
37c2635
Sync from private repository

akanter
authored and
Lightspark Eng
committed
7250904
Sync from private repository

akanter
authored and
Lightspark Eng
committed
2539b5f
Introduces new simplified flow for claiming non-static deposits

reverendken
authored and
Lightspark Eng
committed
aefef36
Sync from private repository

reverendken
authored and
Lightspark Eng
committed
b64e35a
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
5c23021
Sync from private repository

carsonp6
authored and
Lightspark Eng
committed
ea4c913
Sync from private repository

yellowred
authored and
Lightspark Eng
committed
9eb4d46

Commits on Jan 30, 2026

Version packages

carsonp6
authored and
Lightspark Eng
committed
5f1d5ab
Add SE withdrawal signature fields to token outputs for offline L1 exit capability

akanter
authored and
Lightspark Eng
committed
194fb02
Sync from private repository

lightsparkmax
authored and
Lightspark Eng
committed
ee030d9
Sync from private repository

akanter
authored and
Lightspark Eng
committed
6c2f820
Sync from private repository

akanter
authored and
Lightspark Eng
committed
578b87b
Update proto

keenan-lightspark
authored and
Lightspark Eng
committed
b51e445
Sync from private repository

changli2023
authored and
Lightspark Eng
committed
9053806
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
c14471d
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
be759a3
Add map to structured hashing

keenan-lightspark
authored and
Lightspark Eng
committed
d6df847
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
33bd358
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
1094e43
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
41492f5
Sync from private repository

akanter
authored and
Lightspark Eng
committed
7d150e8
Sync from private repository

keenan-lightspark
authored and
Lightspark Eng
committed
1808aee
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
2c5c02c
Sync from private repository

akanter
authored and
Lightspark Eng
committed
eb06ed3
Sync from private repository

ch-brian
authored and
Lightspark Eng
committed
7b87654
Sync from private repository

keenan-lightspark
authored and
Lightspark Eng
committed
a75a982

Commits on Jan 31, 2026

Update proto

keenan-lightspark
authored and
Lightspark Eng
committed
55a3e07
Sync from private repository

akanter
authored and
Lightspark Eng
committed
a3b6318
Sync from private repository

akanter
authored and
Lightspark Eng
committed
8d744fc
Sync from private repository

akanter
authored and
Lightspark Eng
committed
cdd7431
Sync from private repository

akanter
authored and
Lightspark Eng
committed
20965a2
Sync from private repository

akanter
authored and
Lightspark Eng
committed
bf38906
Sync from private repository

akanter
authored and
Lightspark Eng
committed
80311f5
[SO] pending_outbound query_token_outputs implementation

peterrojs
authored and
Lightspark Eng
committed
2c8965d

Commits on Feb 2, 2026

Sync from private repository

DhruvPareek
authored and
Lightspark Eng
committed
6308f22
Sync from private repository

keenan-lightspark
authored and
Lightspark Eng
committed
7d2f87a
Sync from private repository

ch-brian
authored and
Lightspark Eng
committed
2146aa4
Sync from private repository

zhenlu
authored and
Lightspark Eng
committed
d5db443
Sync from private repository

step-step2
authored and
Lightspark Eng
committed
863baee
Allow embedding a spark invoice in a lightning invoice for

jklein24
authored and
Lightspark Eng
committed
2ff0e60
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
248d4b9
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
4c358fb
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
4985e2b
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
8ff9ce4
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
a450c37

Commits on Feb 3, 2026

Sync from private repository

akanter
authored and
Lightspark Eng
committed
422e23a
Sync from private repository

reverendken
authored and
Lightspark Eng
committed
57387ed
Sync from private repository

changli2023
authored and
Lightspark Eng
committed
4e741d1
Add CLI support for embedding a spark invoice in a lightning

jklein24
authored and
Lightspark Eng
committed
a57f37c
Sync from private repository

coreymartin
authored and
Lightspark Eng
committed
710fce9
Update SO1 to breeze SO

carsonp6
authored and
Lightspark Eng
committed
8c58a48
Sync from private repository

coreymartin
authored and
Lightspark Eng
committed
1ffbeb1
Extend UTXOSwap schema to support instant static deposits.

lightsparkmax
authored and
Lightspark Eng
committed
46a316f
Sync from private repository

akanter
authored and
Lightspark Eng
committed
39778ac
Sync from private repository

step-step2
authored and
Lightspark Eng
committed
bfb8383
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
3d1b721
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
1afe70b
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
02256f5
Sync from private repository

akanter
authored and
Lightspark Eng
committed
258ed92
Sync from private repository

lightsparkmax
authored and
Lightspark Eng
committed
8dad7f0
Sync from private repository

step-step2
authored and
Lightspark Eng
committed
c624585
Usually the SSP returns "UTXO is spent or not found" when the UTXO is already

yellowred
authored and
Lightspark Eng
committed
4eb8c70

Commits on Feb 4, 2026

Sync from private repository

changli2023
authored and
Lightspark Eng
committed
c7e8480
Sync from private repository

akanter
authored and
Lightspark Eng
committed
d2679fc
Sync from private repository

mohamedwane
authored and
Lightspark Eng
committed
acbb379
[js] Add more details and examples to package READMEs

coreymartin
authored and
Lightspark Eng
committed
324ec5b
Sync from private repository

changli2023
authored and
Lightspark Eng
committed
5001b00
Sync from private repository

DhruvPareek
authored and
Lightspark Eng
committed
b1bea80
Sync from private repository

coreymartin
authored and
Lightspark Eng
committed
4a0bb1a
[js] Version packages

coreymartin
authored and
Lightspark Eng
committed
ac9e0ea
Sync from private repository

coreymartin
authored and
Lightspark Eng
committed
f7a5835
Revert workflow changes (#102)
coreymartin
authored
0032b10
Sync from private repository

coreymartin
authored and
Lightspark Eng
committed
9262ac6
Sync from private repository

github-actions[bot]
authored and
Lightspark Eng
committed
2bfaa31
[js] Update package READMEs

coreymartin
authored and
Lightspark Eng
committed
f6f6f31
Switch SDK to V2 hash variant

keenan-lightspark
authored and
Lightspark Eng
committed
9066cb0
Adding idempotency support for payling lightning invoices

step-step2
authored and
Lightspark Eng
committed
b4cf053
Sync from private repository

akanter
authored and
Lightspark Eng
committed
568c591

Commits on Feb 5, 2026

Sync from private repository

mohamedwane
authored and
Lightspark Eng
committed
661c101
Remove setting the 30th bit when creating trees from the sdk.

lightsparkmax
authored and
Lightspark Eng
committed
27956e9
[js] Add intro from docs to package READMEs

coreymartin
authored and
Lightspark Eng
committed
1ec228a
Sync from private repository

mohamedwane
authored and
Lightspark Eng
committed
64f00da
Expose createhodlinvoice in js sdk, all local tested.

changli2023
authored and
Lightspark Eng
committed
6a7b1c5
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
d0b8067

Commits on Feb 6, 2026

[js] Update lockfile for synced public dependency changes (#100)

github-actions[bot]
and
lightspark-bot
authored
1ec80f7
Update version packages

lightsparkmax
authored and
Lightspark Eng
committed
b5c31cf
Similarly to how lightning invoices can be created on behalf of any spark identity pubkey, spark invoices can be created for any receiver. However, in those scenarios, the invoice will be unsigned.…

jklein24
authored and
Lightspark Eng
committed
55a51e2
[sdk] eslint echo not implemented

peterrojs
authored and
Lightspark Eng
committed
4b8430b
[SO] move validation from proto to strictly Go

peterrojs
authored and
Lightspark Eng
committed
63fb319
Plumbing the `sparkInvoice` field up from the Transfer proto to

jklein24
authored and
Lightspark Eng
committed
8e13bc1
Sync from private repository

lightsparkmax
authored and
Lightspark Eng
committed
9bb05c7
Sync from private repository

step-step2
authored and
Lightspark Eng
committed
5058c7b
Sync from private repository

akanter
authored and
Lightspark Eng
committed
2e98831
Sync from private repository

mhrheaume
authored and
Lightspark Eng
committed
9df8d30

Commits on Feb 7, 2026

[spark-sdk] pending_outbound implementation

peterrojs
authored and
Lightspark Eng
committed
ab4eca8
[js] Update lockfile for synced public dependency changes (#104)

github-actions[bot]
and
lightspark-bot
authored
1aa19c3
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
3863c61
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
9e19763

Commits on Feb 9, 2026

Sync from private repository

zhenlu
authored and
Lightspark Eng
committed
f6e3f4c
Sync from private repository

DhruvPareek
authored and
Lightspark Eng
committed
6b2314c
Add an endpoint for claim transfer in one call.

zhenlu
authored and
Lightspark Eng
committed
66c8fcf
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
a77c4d1
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
4c15d15
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
0fae092
Proactively reauth with SOs

carsonp6
authored and
Lightspark Eng
committed
c57edc4
Version packages

carsonp6
authored and
Lightspark Eng
committed
4fe97d0
Sync from private repository

lightsparkmax
authored and
Lightspark Eng
committed
409759e

Commits on Feb 10, 2026

Version packages

carsonp6
authored and
Lightspark Eng
committed
577ea78
Remove obsolete integration tests for lightning.

zhenlu
authored and
Lightspark Eng
committed
b940692
Sync from private repository

turkycat
authored and
Lightspark Eng
committed
58dd7ab
Sync from private repository

lightsparkmax
authored and
Lightspark Eng
committed
6a4d88b
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
25fd3ed
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
d9ae711
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
ef4c053
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
a8f7797
Sync from private repository

zhenlu
authored and
Lightspark Eng
committed
f64925e
[spark-sdk] change local lock expiry time to 20s

peterrojs
authored and
Lightspark Eng
committed
51d0bf6
Include wall clock check when determining to evict auth token

carsonp6
authored and
Lightspark Eng
committed
661f260
Sync from private repository

zhenlu
authored and
Lightspark Eng
committed
3f3d621
Sync from private repository

lightsparkmax
authored and
Lightspark Eng
committed
8fe22ed
Sync from private repository

benwgold
authored and
Lightspark Eng
committed
ff5dc3e
Sync from private repository

zhenlu
authored and
Lightspark Eng
committed
f814f82

Commits on Feb 11, 2026

Version packages

carsonp6
authored and
Lightspark Eng
committed
b369597
Sync from private repository

lightspark-bot
authored and
Lightspark Eng
committed
0f74ce9
[js] Update lockfile for synced public dependency changes (#105)

github-actions[bot]
and
lightspark-bot
authored
df6dcdf
Sync from private repository

coreymartin
authored and
Lightspark Eng
committed
ff95cba
[spark-sdk] add support for multi token type transactions

peterrojs
authored and
Lightspark Eng
committed
2f51a57
Sync from private repository

lightsparkmax
authored and
Lightspark Eng
committed
b4fde0e
Add a new endpoint to share preimage with coordinator SO.

zhenlu
authored and
Lightspark Eng
committed
45bfefa
[spark-sdk] Upgrade @lightsparkdev/core to 1.4.9 to remove

coreymartin
authored and
Lightspark Eng
committed
1870fb8
Sync from private repository

lightspark-bot
authored and
Lightspark Eng
committed
a579b43
Sync from private repository

reverendken
authored and
Lightspark Eng
committed
82cf36a
Sync from private repository

reverendken
authored and
Lightspark Eng
committed
8c411fe

Commits on Feb 12, 2026

Sync from private repository

zhenlu
authored and
Lightspark Eng
committed
e9642ed
SDK change for sharing preimage coordinator flow.

zhenlu
authored and
Lightspark Eng
committed
d3a1797
[copybara] Sync rc and stable SSP schemas (#5227)

coreymartin
authored and
Lightspark Eng
committed
9fecc81
Poll instead of wait for hermetic tests (#5239)

step-step2
authored and
Lightspark Eng
committed
03b596a
[spark-sdk] Clear auth tokens from before server time was known (#5236)

carsonp6
authored and
Lightspark Eng
committed
db2bedd
Remove knob gate and rename BroadcastTokenTransactionInternal to SignTokenTransaction

benwgold
authored and
Lightspark Eng
committed
0637ae4
add transfer_sender and transfer_receiver edges to transfer_leaf (#5254)

turkycat
authored and
Lightspark Eng
committed
91fee23
[so][events] Add new event for for sender transfer updates. Rename old 'transfer' event 'receiver_transfer' (#5077)

carsonp6
authored and
Lightspark Eng
committed
d9513ff
Implement traction construction in rust signer.

zhenlu
authored and
Lightspark Eng
committed
df831d2
Fix error wrapping for JIT finalization validation

benwgold
authored and
Lightspark Eng
committed
ca14d56
Implement adaptor signature in rust signer.

zhenlu
authored and
Lightspark Eng
committed
336417e
Fix Concurrency pattern matching (#5259)

DhruvPareek
authored and
Lightspark Eng
committed
1c754c2

Commits on Feb 13, 2026

Fix migration ordering after sync - rename to 20260213000000

benwgold
authored and
Lightspark Eng
committed
8c3dc18
[spark-sdk] Create read only client for unauthed requests and master wallets (#5230)

carsonp6
authored and
Lightspark Eng
committed
9e51df8
[cli] Implement read only commands (#5232)

carsonp6
authored and
Lightspark Eng
committed
be948e1
ci: update JS SDK test workflow with improved logging
silentknight46
committed
9504ca7

Commits on Mar 5, 2026

ci: update JS SDK test workflow
silentknight46
committed
d423ac1

Commits on Mar 10, 2026