tapchannel: enforce strict forwarding for asset invoices

Author: GeorgeTsagk

rfq/manager.go

@@ -53,6 +53,14 @@ type ScidAliasManager interface {
 		baseScid lnwire.ShortChannelID) error
 }
 
+type (
+	// BuyAcceptMap is a map of buy accepts, keyed by the serialised SCID.
+	BuyAcceptMap map[SerialisedScid]rfqmsg.BuyAccept
+
+	// SellAcceptMap is a map of sell accepts, keyed by the serialised SCID.
+	SellAcceptMap map[SerialisedScid]rfqmsg.SellAccept
+)
+
 // ManagerCfg is a struct that holds the configuration parameters for the RFQ
 // manager.
 type ManagerCfg struct {
@@ -760,7 +768,7 @@ func (m *Manager) UpsertAssetSellOrder(order SellOrder) error {
 // PeerAcceptedBuyQuotes returns buy quotes that were requested by our node and
 // have been accepted by our peers. These quotes are exclusively available to
 // our node for the acquisition of assets.
-func (m *Manager) PeerAcceptedBuyQuotes() map[SerialisedScid]rfqmsg.BuyAccept {
+func (m *Manager) PeerAcceptedBuyQuotes() BuyAcceptMap {
 	// Returning the map directly is not thread safe. We will therefore
 	// create a copy.
 	buyQuotesCopy := make(map[SerialisedScid]rfqmsg.BuyAccept)
@@ -782,9 +790,7 @@ func (m *Manager) PeerAcceptedBuyQuotes() map[SerialisedScid]rfqmsg.BuyAccept {
 // PeerAcceptedSellQuotes returns sell quotes that were requested by our node
 // and have been accepted by our peers. These quotes are exclusively available
 // to our node for the sale of assets.
-//
-//nolint:lll
-func (m *Manager) PeerAcceptedSellQuotes() map[SerialisedScid]rfqmsg.SellAccept {
+func (m *Manager) PeerAcceptedSellQuotes() SellAcceptMap {
 	// Returning the map directly is not thread safe. We will therefore
 	// create a copy.
 	sellQuotesCopy := make(map[SerialisedScid]rfqmsg.SellAccept)
@@ -806,7 +812,7 @@ func (m *Manager) PeerAcceptedSellQuotes() map[SerialisedScid]rfqmsg.SellAccept
 // LocalAcceptedBuyQuotes returns buy quotes that were accepted by our node and
 // have been requested by our peers. These quotes are exclusively available to
 // our node for the acquisition of assets.
-func (m *Manager) LocalAcceptedBuyQuotes() map[SerialisedScid]rfqmsg.BuyAccept {
+func (m *Manager) LocalAcceptedBuyQuotes() BuyAcceptMap {
 	// Returning the map directly is not thread safe. We will therefore
 	// create a copy.
 	buyQuotesCopy := make(map[SerialisedScid]rfqmsg.BuyAccept)
@@ -828,9 +834,7 @@ func (m *Manager) LocalAcceptedBuyQuotes() map[SerialisedScid]rfqmsg.BuyAccept {
 // LocalAcceptedSellQuotes returns sell quotes that were accepted by our node
 // and have been requested by our peers. These quotes are exclusively available
 // to our node for the sale of assets.
-//
-//nolint:lll
-func (m *Manager) LocalAcceptedSellQuotes() map[SerialisedScid]rfqmsg.SellAccept {
+func (m *Manager) LocalAcceptedSellQuotes() SellAcceptMap {
 	// Returning the map directly is not thread safe. We will therefore
 	// create a copy.
 	sellQuotesCopy := make(map[SerialisedScid]rfqmsg.SellAccept)

tapchannel/aux_invoice_manager.go

@@ -13,7 +13,9 @@ import (
 	"github.com/lightninglabs/taproot-assets/rfqmath"
 	"github.com/lightninglabs/taproot-assets/rfqmsg"
 	"github.com/lightninglabs/taproot-assets/taprpc"
+	"github.com/lightningnetwork/lnd/lnrpc"
 	"github.com/lightningnetwork/lnd/lnwire"
+	"github.com/lightningnetwork/lnd/routing/route"
 )
 
 // InvoiceHtlcModifier is an interface that abstracts the invoice HTLC
@@ -28,6 +30,32 @@ type InvoiceHtlcModifier interface {
 		handler lndclient.InvoiceHtlcModifyHandler) error
 }
 
+// RfqManager is an interface that abstracts the functionalities of the rfq
+// manager that are needed by AuxInvoiceManager.
+type RfqManager interface {
+	// PeerAcceptedBuyQuotes returns buy quotes that were requested by our
+	// node and have been accepted by our peers. These quotes are
+	// exclusively available to our node for the acquisition of assets.
+	PeerAcceptedBuyQuotes() rfq.BuyAcceptMap
+
+	// LocalAcceptedSellQuotes returns sell quotes that were accepted by our
+	// node and have been requested by our peers. These quotes are
+	// exclusively available to our node for the sale of assets.
+	LocalAcceptedSellQuotes() rfq.SellAcceptMap
+}
+
+// A compile time assertion to ensure that the rfq.Manager meets the expected
+// tapchannel.RfqManager interface.
+var _ RfqManager = (*rfq.Manager)(nil)
+
+// RfqLookup is an interface that abstracts away the process of performing
+// a lookup to the current set of existing RFQs.
+type RfqLookup interface {
+	// RfqPeerFromScid retrieves the peer associated with the RFQ id that
+	// is mapped to the provided scid, if it exists.
+	RfqPeerFromScid(scid uint64) (route.Vertex, error)
+}
+
 // InvoiceManagerConfig defines the configuration for the auxiliary invoice
 // manager.
 type InvoiceManagerConfig struct {
@@ -42,7 +70,7 @@ type InvoiceManagerConfig struct {
 	// RfqManager is the RFQ manager that will be used to retrieve the
 	// accepted quotes for determining the incoming value of invoice related
 	// HTLCs.
-	RfqManager *rfq.Manager
+	RfqManager RfqManager
 }
 
 // AuxInvoiceManager is a Taproot Asset auxiliary invoice manager that can be
@@ -110,6 +138,10 @@ func (s *AuxInvoiceManager) handleInvoiceAccept(_ context.Context,
 		AmtPaid:    req.ExitHtlcAmt,
 	}
 
+	if req.Invoice == nil {
+		return nil, fmt.Errorf("cannot handle empty invoice")
+	}
+
 	jsonBytes, err := taprpc.ProtoJSONMarshalOpts.Marshal(req.Invoice)
 	if err != nil {
 		return nil, fmt.Errorf("unable to decode response: %w", err)
@@ -121,6 +153,18 @@ func (s *AuxInvoiceManager) handleInvoiceAccept(_ context.Context,
 
 	// No custom record on the HTLC, so we have nothing to do.
 	if len(req.WireCustomRecords) == 0 {
+		// If there's no wire custom records and the invoice is an asset
+		// invoice do not settle the invoice. Since we are asking for
+		// assets in the invoice, we may not let this HTLC go through
+		// as it is not carrying assets. This could lead to undesired
+		// behavior where the asset invoice may be settled by accepting
+		// sats instead of assets.
+		//
+		// TODO(george): Strict-forwarding could be configurable?
+		if isAssetInvoice(req.Invoice, s) {
+			resp.CancelSet = true
+		}
+
 		return resp, nil
 	}
 
@@ -216,12 +260,15 @@ func (s *AuxInvoiceManager) priceFromQuote(rfqID rfqmsg.ID) (
 	sellQuote, isSell := acceptedSellQuotes[rfqID.Scid()]
 
 	switch {
+	// This is a normal invoice payment with multiple hops, so we expect to
+	// find a buy quote.
 	case isBuy:
-		log.Debugf("Found buy quote for ID %x / SCID %d: %#v",
-			rfqID[:], rfqID.Scid(), buyQuote)
+		log.Debugf("Found buy quote for ID %x / SCID %d: %#v", rfqID[:],
+			rfqID.Scid(), buyQuote)
 
 		return &buyQuote.AssetRate, nil
 
+	// This is a direct peer payment, so we expect to find a sell quote.
 	case isSell:
 		log.Debugf("Found sell quote for ID %x / SCID %d: %#v",
 			rfqID[:], rfqID.Scid(), sellQuote)
@@ -234,6 +281,54 @@ func (s *AuxInvoiceManager) priceFromQuote(rfqID rfqmsg.ID) (
 	}
 }
 
+// RfqPeerFromScid attempts to match the provided scid with a negotiated quote,
+// then it returns the RFQ peer's node id.
+func (s *AuxInvoiceManager) RfqPeerFromScid(scid uint64) (route.Vertex, error) {
+	acceptedBuyQuotes := s.cfg.RfqManager.PeerAcceptedBuyQuotes()
+
+	buyQuote, isBuy := acceptedBuyQuotes[rfqmsg.SerialisedScid(scid)]
+
+	if !isBuy {
+		return route.Vertex{}, fmt.Errorf("no peer found for RFQ "+
+			"SCID %d", scid)
+	}
+
+	return buyQuote.Peer, nil
+}
+
+// isAssetInvoice checks whether the provided invoice is an asset invoice. This
+// method checks whether the routing hints of the invoice match those created
+// when generating an asset invoice, and if that's the case we then check that
+// the scid matches an existing quote.
+func isAssetInvoice(invoice *lnrpc.Invoice, rfqLookup RfqLookup) bool {
+	hints := invoice.RouteHints
+
+	for _, hint := range hints {
+		for _, h := range hint.HopHints {
+			scid := h.ChanId
+			nodeId := h.NodeId
+
+			// Check if for this hop hint we can retrieve a valid
+			// rfq quote.
+			peer, err := rfqLookup.RfqPeerFromScid(scid)
+			if err != nil {
+				log.Debugf("invoice hop hint scid %v does not "+
+					"correspond to a valid RFQ quote", scid)
+
+				continue
+			}
+
+			// If we also have a nodeId match, we're safe to assume
+			// this is an asset invoice.
+			if peer.String() == nodeId {
+				return true
+			}
+		}
+	}
+
+	return false
+}
+
 // Stop signals for an aux invoice manager to gracefully exit.
 func (s *AuxInvoiceManager) Stop() error {
 	var stopErr error