Severity: Medium (privacy; partial secret exposure)
LDK logs a full payment preimage at TRACE on the duplicative-fulfill path (rust-lightning, lightning/src/ln/outbound_payment.rs:2346). The app sets the LDK log level to TRACE unconditionally, with no build-type gating (Env.kt:33), and persists every log line to both logcat and session files with 60-day / 500 MB retention (Logger.kt:130-206). Release builds ship with minify disabled and no log stripping (app/build.gradle.kts; the proguard file only keeps JNI symbols).
Beyond preimages, TRACE continuously records payment hashes, amounts, channel points, peer pubkeys, onchain addresses, and invoice contents: a near-complete financial activity record on disk. The log files are app-private (backup is disabled) but exportable via the in-app log export after launch auth, and visible via logcat for ADB/root.
Steps to reproduce:
- Make a few Lightning payments.
- Use the in-app log export (or
adb logcat on a debuggable build).
- Grep the output for
payment_preimage, amounts, and node pubkeys.
Suggested fix:
- Set the production LDK log level to INFO or WARN; gate TRACE behind a debug-only flag.
- Redact the preimage log line upstream, or filter
payment_preimage-shaped arguments in the app's LogWriter.
- Enable minify with
-assumenosideeffects rules stripping verbose/debug logs in release, or drop the file sink for levels below INFO in release builds.
Sibling issue: synonymdev/bitkit-ios#661 (same TRACE level and preimage log there).
Severity: Medium (privacy; partial secret exposure)
LDK logs a full payment preimage at TRACE on the duplicative-fulfill path (
rust-lightning,lightning/src/ln/outbound_payment.rs:2346). The app sets the LDK log level to TRACE unconditionally, with no build-type gating (Env.kt:33), and persists every log line to both logcat and session files with 60-day / 500 MB retention (Logger.kt:130-206). Release builds ship with minify disabled and no log stripping (app/build.gradle.kts; the proguard file only keeps JNI symbols).Beyond preimages, TRACE continuously records payment hashes, amounts, channel points, peer pubkeys, onchain addresses, and invoice contents: a near-complete financial activity record on disk. The log files are app-private (backup is disabled) but exportable via the in-app log export after launch auth, and visible via logcat for ADB/root.
Steps to reproduce:
adb logcaton a debuggable build).payment_preimage, amounts, and node pubkeys.Suggested fix:
payment_preimage-shaped arguments in the app's LogWriter.-assumenosideeffectsrules stripping verbose/debug logs in release, or drop the file sink for levels below INFO in release builds.Sibling issue: synonymdev/bitkit-ios#661 (same TRACE level and preimage log there).