java-topology/whitepaper/outreach/electrum-0002.md

Electrum — CWE-407 Disclosure Brief (electrum-0002)

2026-04-13 · Patch available — awaiting upstream merge

Finding

One O(F*H) linear-scan defect in Electrum's Lightning Network forwarding lookup. Patched. Patch ready for upstream review.

The Defects

electrum-0002 (PATCHED — MEDIUM): electrum/lnworker.py:3029

# In is_forwarded_htlc() — fires for every HTLC:
def is_forwarded_htlc(self, htlc_key):
    for payment_key, htlcs in self.active_forwardings.items():
        if htlc_key in htlcs:
            return payment_key
    return None

For each HTLC lookup, the function iterates all active forwardings (F entries) and for each checks membership in the HTLC set (H entries). Total cost: O(F*H) per lookup.

Complexity Proof

At F=100 active forwardings, H=10 HTLCs each:

• Defective: 100 x 10 = 1,000 comparisons per lookup
• Fixed: 1 lookup (reverse index)
• 1,000x op reduction per HTLC lookup.

Impact

Electrum's Lightning Network wallet handles HTLC forwarding for routing nodes. Active routing nodes process many HTLCs per second, and each lookup scans all active forwardings.

The Fix

Maintain a reverse index _htlc_to_forwarding mapping HTLC keys directly to payment keys:

# Before
for payment_key, htlcs in self.active_forwardings.items():
    if htlc_key in htlcs:
        return payment_key

# After
return self._htlc_to_forwarding.get(htlc_key)

Patch

Fix available: defects/electrum-0002/patch/electrum-0002.patch

Single-file patch on electrum/lnworker.py. 1,000x speedup at F=100, H=10.

What We Ask

A patch is ready for review.

1. Confirm receipt and assign a GitHub issue reference (spesmilo/electrum).
2. Assess severity — fires for every HTLC in Lightning routing.
3. Coordinate a disclosure date — we are targeting 90 days from first contact.
4. We will credit the Electrum team in the public disclosure. Preferred acknowledgment format welcome.

Contact: see cover email. This brief is confidential until coordinated disclosure.