Skip to content

Production LDK TRACE logging persists preimages and full payment metadata to on-disk logs #1145

Description

@coreyphillips

Severity: Medium (privacy; partial secret exposure)

LDK logs a full payment preimage at TRACE on the duplicative-fulfill path (rust-lightning, lightning/src/ln/outbound_payment.rs:2346). The app sets the LDK log level to TRACE unconditionally, with no build-type gating (Env.kt:33), and persists every log line to both logcat and session files with 60-day / 500 MB retention (Logger.kt:130-206). Release builds ship with minify disabled and no log stripping (app/build.gradle.kts; the proguard file only keeps JNI symbols).

Beyond preimages, TRACE continuously records payment hashes, amounts, channel points, peer pubkeys, onchain addresses, and invoice contents: a near-complete financial activity record on disk. The log files are app-private (backup is disabled) but exportable via the in-app log export after launch auth, and visible via logcat for ADB/root.

Steps to reproduce:

  1. Make a few Lightning payments.
  2. Use the in-app log export (or adb logcat on a debuggable build).
  3. Grep the output for payment_preimage, amounts, and node pubkeys.

Suggested fix:

  • Set the production LDK log level to INFO or WARN; gate TRACE behind a debug-only flag.
  • Redact the preimage log line upstream, or filter payment_preimage-shaped arguments in the app's LogWriter.
  • Enable minify with -assumenosideeffects rules stripping verbose/debug logs in release, or drop the file sink for levels below INFO in release builds.

Sibling issue: synonymdev/bitkit-ios#661 (same TRACE level and preimage log there).

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions