The reviewed Lightning-receive path validates the inbound transfer before releasing an Operator's preimage share

What the evidence shows

Technical and product details

1. Documented behavior

   For a receive request, the pinned Operator handler parses the receiver identity, checks any stored preimage share belongs to that identity, and derives the invoice amount from the stored invoice when available. 1

   Supporting material shown on this page

   receive request and preimage-share validationPinned source code · github.com · checked 2026-08-24

   1334			err = h.validatePackageOnlySendRequest(validateCtx, req, inputs, invoiceAmount, receiverIdentityPubKey, false)
   1335		} else {
   1336			err = h.validateGetPreimageRequest(
   1337				validateCtx,
   1338				req.GetPaymentHash(),
   1339				inputs.validationCpfp,
   1340				inputs.validationDirect,

2. Documented behavior

   Before continuing, the handler validates the supplied transfer package. Its destination checks require the refund output to pay the expected receiver key and reject missing, mismatched, or unexpected outputs. 12

   Supporting material shown on this page

   receive request and preimage-share validationPinned source code · github.com · checked 2026-08-24

   1334			err = h.validatePackageOnlySendRequest(validateCtx, req, inputs, invoiceAmount, receiverIdentityPubKey, false)
   1335		} else {
   1336			err = h.validateGetPreimageRequest(
   1337				validateCtx,
   1338				req.GetPaymentHash(),
   1339				inputs.validationCpfp,
   1340				inputs.validationDirect,

   refund destination validationPinned source code · github.com · checked 2026-08-24

   485	}
   486	return h.validateGetPreimageRequestWithFrostServiceClientFactory(ctx, &defaultFrostServiceClientConnection{}, paymentHash, cpfpTransactions, directTransactions, directFromCpfpTransactions, invoiceAmountSats, counterpartyPubKey, destinations, feeSats, reason, validateNodeOwnership)
   487}
   488
   489// leafDestinations answers which key a given leaf's refund output must pay. v3 pays one
   490// counterparty for the whole swap; v4 may pay different receivers per leaf.
   491// Exactly one field carries the answer, and which one is set decides the mode: an unset single is

3. Documented behavior

   The validation path also checks transaction identifiers, duplicate operations, limits, and signature shares before the receive flow continues. 2

   Supporting material shown on this page

   refund destination validationPinned source code · github.com · checked 2026-08-24

   485	}
   486	return h.validateGetPreimageRequestWithFrostServiceClientFactory(ctx, &defaultFrostServiceClientConnection{}, paymentHash, cpfpTransactions, directTransactions, directFromCpfpTransactions, invoiceAmountSats, counterpartyPubKey, destinations, feeSats, reason, validateNodeOwnership)
   487}
   488
   489// leafDestinations answers which key a given leaf's refund output must pay. v3 pays one
   490// counterparty for the whole swap; v4 may pay different receivers per leaf.
   491// Exactly one field carries the answer, and which one is set decides the mode: an unset single is

Scope control

What this does not establish

• The checks protect the receiver and are evidence of protocol enforcement, not unilateral SSP discretion or abusive conduct. This record does not establish that Operators can redirect a valid package or that the receive flow is custodial. 12

Sources and excerpts

Primary sources

The relevant details and available source-code excerpts appear alongside the claims above. This list preserves the complete original-source trail for independent verification.