Skip to content

Add currency conversion support for BOLT 12 offers#3833

Open
shaavan wants to merge 6 commits intolightningdevkit:mainfrom
shaavan:currency
Open

Add currency conversion support for BOLT 12 offers#3833
shaavan wants to merge 6 commits intolightningdevkit:mainfrom
shaavan:currency

Conversation

@shaavan
Copy link
Member

@shaavan shaavan commented Jun 7, 2025

This PR adds support for currency-denominated Offers in LDK’s BOLT 12 offer-handling flow.

Previously, Offers could only specify their amount in millisatoshis. However, BOLT 12 allows Offers to be denominated in other currencies such as fiat. Supporting this requires converting those currency amounts into millisatoshis at runtime when validating payments and constructing invoices.

Because exchange rates are external, time-dependent, and application-specific, LDK cannot perform these conversions itself. Instead, this PR introduces a CurrencyConversion trait which allows applications to provide their own logic for resolving currency-denominated amounts into millisatoshis. LDK remains exchange-rate agnostic and simply invokes this trait whenever a currency amount must be resolved.

To make this conversion logic available throughout the BOLT 12 flow, OffersMessageFlow is parameterized over a CurrencyConversion implementation and the abstraction is threaded through the offer handling pipeline.

With this in place:

  • OfferBuilder can now create Offers whose amounts are denominated in currencies instead of millisatoshis

InvoiceRequest handling can resolve Offer amounts when validating requests

InvoiceBuilder enforces that the final invoice amount satisfies the Offer’s requirements after resolving any currency denomination

Currency validation is intentionally deferred until invoice construction when necessary, keeping earlier stages focused on structural validation while ensuring the final payable amount is correct.

Tests are added to cover the complete Offer → InvoiceRequest → Invoice flow when the original Offer amount is specified in a currency.

@ldk-reviews-bot
Copy link

ldk-reviews-bot commented Jun 7, 2025

👋 Thanks for assigning @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

@shaavan
Copy link
Member Author

shaavan commented Jun 7, 2025

cc @jkczyz

@ldk-reviews-bot
Copy link

🔔 1st Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@joostjager
Copy link
Contributor

Is this proposed change a response to a request from a specific user/users?

@shaavan
Copy link
Member Author

shaavan commented Jun 11, 2025

Hi @joostjager!

This PR is actually a continuation of the original thread that led to the OffersMessageFlow: link to thread.

The motivation behind it was to provide users with the ability to handle InvoiceRequests asynchronously—just like we already allow for Bolt12Invoices. However, adding more events into the middle of the ChannelManager flow felt suboptimal.

So, as a first step, we worked on refactoring most of the Offers-related code out of ChannelManager into the new OffersMessageFlow (#3639). Now that the refactor is complete, this PR picks up the original goal again: to let users asynchronously handle both InvoiceRequests and Invoices. This not only gives them more flexibility in analyzing these Offer messages, but also opens the door for creating custom interfaces—for example, to support Offers in different currency denominations.

Hope that gives a clear picture of the intent behind this! Let me know if you have any thoughts or suggestions—would love to hear them. Thanks a lot!

@jkczyz
Copy link
Contributor

jkczyz commented Jun 11, 2025

Another use case is Fedimint, where they'll want to include their own payment hash in the Bolt12Invoice.

@valentinewallace
Copy link
Contributor

Another use case is Fedimint, where they'll want to include their own payment hash in the Bolt12Invoice.

Does Fedimint plan to use the OffersMessageFlow without a ChannelManager?

@jkczyz
Copy link
Contributor

jkczyz commented Jun 11, 2025

Does Fedimint plan to use the OffersMessageFlow without a ChannelManager?

I believe with one.

@ldk-reviews-bot
Copy link

🔔 2nd Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 3rd Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 4th Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 5th Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 6th Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 7th Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 8th Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 9th Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 10th Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 11th Reminder

Hey @joostjager! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@jkczyz jkczyz removed the request for review from joostjager July 2, 2025 13:38
@jkczyz
Copy link
Contributor

jkczyz commented Jul 2, 2025

Removing @joostjager for now to stop bot spam. @shaavan and I have been working through some variations of this approach.

Copy link
Contributor

@vincenzopalazzo vincenzopalazzo left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Concept ACK for me

I was just looking around to sync with this Offer Flow

@shaavan shaavan changed the title Introduce Event Model for Offers Flow Introduce Synchronous Currency Conversion Support in Offers Aug 2, 2025
@codecov
Copy link

codecov bot commented Aug 2, 2025

Codecov Report

❌ Patch coverage is 90.32258% with 33 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.37%. Comparing base (6749bc6) to head (a4742bd).
⚠️ Report is 85 commits behind head on main.

Files with missing lines Patch % Lines
lightning/src/offers/flow.rs 79.01% 16 Missing and 1 partial ⚠️
lightning/src/offers/offer.rs 61.53% 5 Missing ⚠️
lightning/src/offers/invoice.rs 94.36% 3 Missing and 1 partial ⚠️
lightning/src/offers/invoice_request.rs 94.44% 3 Missing ⚠️
lightning/src/ln/channelmanager.rs 92.30% 1 Missing and 1 partial ⚠️
lightning/src/ln/offers_tests.rs 97.70% 1 Missing and 1 partial ⚠️
Additional details and impacted files
@@            Coverage Diff             @@
##             main    #3833      +/-   ##
==========================================
+ Coverage   89.34%   89.37%   +0.02%     
==========================================
  Files         180      180              
  Lines      138480   140045    +1565     
  Branches   138480   140045    +1565     
==========================================
+ Hits       123730   125164    +1434     
- Misses      12129    12295     +166     
+ Partials     2621     2586      -35     
Flag Coverage Δ
fuzzing 35.13% <4.10%> (-0.84%) ⬇️
tests 88.71% <90.32%> (+<0.01%) ⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@shaavan shaavan requested a review from TheBlueMatt January 15, 2026 08:25
@TheBlueMatt
Copy link
Collaborator

Hmm, yea, its an interesting question. Naively it seems like going the async direction makes sense - fetching currency conversion is likely something that happens via the internet so it should be async. But once we complete the event pipeline (presumably by bubbling these new events up as top-level Events) I think the DoS risk of it is gonna be pretty severe. Once we issue an offer, someone can spam us with as many InvocieRequests as they want. While our message processing will get rate-limited and they shouldn't (in theory) be able to cause too much in the way of problems, it gets more complicated with events. Our Event pipeline (via the background processor) is currently entirely single-threaded and if we get a flood of events for something like currency conversion we'll end up blocking stuff like payment claims. Now, we can limit the event buffer size for onion message-related events, which is fine, but if currency conversion is actually async in response to every request even a fairly tight limit is gonna be too much. Thus, it seems likely we really want to force devs into caching the currency conversion values anyway.

On the flip side, doing currency conversion via a sync (cached) API doesn't seem so bad when you look at actual currency conversion APIs. Instead of being individual APIs that you hit to request the conversion from currency A to B, my glance through available options seems to mostly point to them being a single request that returns a JSON map of all the known currencies to their value in some fixed base currency (eg see https://openexchangerates.org/). Thus, in practice caching should be quite simple/a single up-front request.

This does leave some complexity in ensuring you dont block the node on startup waiting for the conversion API response but presumably we want a fallible API anyway...

@TheBlueMatt TheBlueMatt removed their request for review January 15, 2026 16:58
@shaavan
Copy link
Member Author

shaavan commented Jan 22, 2026

Thanks for the thoughtful points, @TheBlueMatt

On currency conversion specifically, I agree that a synchronous API is the better default. In practice it nudges users toward exactly the model they should be using anyway: cached, pre-fetched rates rather than just-in-time lookups.

That said, I wanted to discuss one broader issue around Flow events in general.

Our Event pipeline (via the background processor) is currently entirely single-threaded and if we get a flood of events for something like currency conversion we'll end up blocking stuff like payment claims

I think this is a very fair criticism of the event-based model as it stands. Even if we move currency conversion to a synchronous, flow-owned API, we still seem to want some mechanism that lets a user “catch” an InvoiceRequest or Invoice, analyse it based on custom logic before deciding how (or whether) to respond.

For example, @jkczyz mentioned a Fedimint use case that would require exactly this kind of interception and analysis.

One idea we had explored was keeping a separate event queue inside OffersMessageFlow, distinct from ChannelManager’s Event queue, and having the background processor drive a separate handler for it. But if event handling is fundamentally single-threaded anyway, that separation may not actually buy us much in practice.

So the one question left is this:

How should we introduce Flow-events, or a Flow-event-like mechanism, that allows users to asynchronously inspect and reason about InvoiceRequest / Invoice messages before responding, without creating DoS or head-of-line blocking risks for the rest of the node?

Would love to get your thoughts on this!

@shaavan shaavan requested a review from TheBlueMatt January 22, 2026 17:34
@ldk-reviews-bot
Copy link

🔔 1st Reminder

Hey @TheBlueMatt! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 2nd Reminder

Hey @TheBlueMatt! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 3rd Reminder

Hey @TheBlueMatt! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@ldk-reviews-bot
Copy link

🔔 4th Reminder

Hey @TheBlueMatt! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

@TheBlueMatt
Copy link
Collaborator

Oops sorry took me a minute to get back to this. Its a really good question I don't have a great answer for.

In general in the OffersMessageFlow, ISTM we're generally "returning" the "events" from the methods that generate them - when code wants to manually process a Bolt12Invoice, that code code calls OffersMessageFlow::verify_bolt12_invoice and can then do what they want with it (similar to OffersMessageFlow::verify_invoice_request). There's no need for actual events as the code driving the OffersMessageFlow simply gets back the validation result and/or response message and can do what they want with it.

This doesn't, of course, help us in ChannelManager. There, we get back a message but are in the middle of an *OnionMessageHandler call and can't "return" the response to some downstream code. I think there's roughly three options for that side:

  • For non-default handling, we could use Events (relying on downstream code to clear them quickly and dropping incoming messages if the event queue gets too large). We definitely can't do this for any default message handling, and there's perf questions.
  • We could require some new trait, which implies a new generic bound on ChannelManager for probably-not-a-common-case, but at least the perf questions aren't so bad,
  • We could simply not allow for super non-default behavior in ChannelManager, requiring that folks who want to do strange things intercept the messages and pass them directly to OffersMessageFlow, handling the responses by hand. This is great cause we don't have to do anything but makes using the more manual options way more challenging.

IMO we should generally default to the last option, avoiding adding any specific handling until we have a real specific use-case in mind and can see how to implement for that clearly. eg the fedi logic may well often run without a channelmanager or at least can punt the offers message handling out to a flow anyway.

@TheBlueMatt TheBlueMatt removed their request for review February 2, 2026 17:34
@shaavan shaavan force-pushed the currency branch 2 times, most recently from c0bf606 to 1668749 Compare March 6, 2026 18:24
@shaavan
Copy link
Member Author

shaavan commented Mar 6, 2026

Updated .10 → .11

Changes:

  • Switch to the synchronous currency conversion approach.

See the updated PR description for full details.

@shaavan shaavan requested review from TheBlueMatt and jkczyz March 6, 2026 18:25
Adds a `CurrencyConversion` trait allowing users to provide logic for
converting currency-denominated amounts into millisatoshis.

LDK itself cannot perform such conversions as exchange rates are
external, time-dependent, and application-specific. Instead, the
conversion logic must be supplied by the user.

This trait forms the foundation for supporting Offers denominated in
fiat currencies while keeping exchange-rate handling outside the core
protocol logic.
@shaavan shaavan changed the title Support Currency-Based Offers and Async Invoice Handling via FlowEvents Add currency conversion support for BOLT 12 offers Mar 8, 2026
@ldk-reviews-bot
Copy link

🔔 1st Reminder

Hey @TheBlueMatt @jkczyz! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

1 similar comment
@ldk-reviews-bot
Copy link

🔔 1st Reminder

Hey @TheBlueMatt @jkczyz! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

Copy link
Collaborator

@TheBlueMatt TheBlueMatt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think this looks good, yea.

/// This convention ensures amounts remain precise and purely integer-based when parsing and
/// validating BOLT12 invoice requests.
pub trait CurrencyConversion {
/// Returns the conversion rate in **msats per minor unit** for the given
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this actually enough precision? For USD its fine (result of ~14K these days), but there's some currencies where this is a much lower value (Lebanese Pound this is something like 16 currently, afaict). If LBP inflates a bit more its pretty easy to see this getting into the mid/low single digits, which would make this too low precision.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I can think of a few possible approaches to address this:

  1. Return msats_per_major_unit.
    This would be the simplest option. However, it doesn't fully solve the precision issue for very weak currencies such as LBP, where even the major unit may still map to a relatively small number of msats.

  2. Return microsats_per_major_unit.
    This increases the resolution while keeping the API relatively simple. It should provide sufficient precision for most currencies in the near future without significantly complicating the interface.

  3. Return a rational conversion rate, e.g. (numerator: u128, denominator: u128), where:

1 CUR = (numerator / denominator) * 1 msat

This is the most flexible approach and would preserve precision even for extremely weak currencies. The trade-off is that it introduces a bit more complexity to the API.

Happy to hear thoughts on which direction would make the most sense here.

/// This represents a user-level policy (e.g., allowance for exchange-rate
/// drift or cached data) and does not directly affect fiat-to-msat conversion
/// outside of range computation.
fn tolerance_percent(&self) -> u8;
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This doesn't appear to be called in the current patchset? Also the docs aren't nearly clear enough on how this is (will be?) used.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I kept tolerance_percent here mainly to discuss whether this is the right place to introduce the tolerance mechanism.

The idea is to account for possible exchange-rate drift between the payer and the payee by deriving a small acceptable range around the converted msat value. The intended usage would roughly be as follows.

If we are the payee and receive an InvoiceRequest for a fiat-denominated offer:

If the amount is specified in the InvoiceRequest, we accept it as long as:

invoice_request_amount ≥ offer.resolved_amount() - tolerance

If the amount is not specified in the InvoiceRequest, we simply set:

invoice_amount = offer.resolved_amount()

If we are the payer, we can set:

invoice_request_amount = offer.resolved_amount() + tolerance

This gives the payee some headroom when constructing the invoice, ensuring the payment does not fail if the exchange rate shifts slightly between the time the InvoiceRequest is created and when the invoice is issued.

InvoiceBuilder::<DerivedSigningPubkey>::amount_msats(&invoice_request.inner)?;
let amount_msats = InvoiceBuilder::<DerivedSigningPubkey>::amount_msats(
&invoice_request.inner,
conversion,
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Do we want to allow for a more flexible API in the flow itself? eg leaving amount_msats alone and having the logic here do the currency conversion by hand instead so that someone could use an OffersMessageFlow with their own currency conversion logic?

shaavan added 5 commits March 10, 2026 20:04
Makes OffersMessageFlow generic over a CurrencyConversion implementation,
propagating the parameter through to ChannelManager.

Upcoming changes will introduce currency conversion support in BOLT 12
message handling, which requires access to conversion logic from both
ChannelManager and OffersMessageFlow.

By threading the conversion abstraction through OffersMessageFlow now,
subsequent commits can use it directly without introducing temporary
plumbing or refactoring the type hierarchy later.
Extends `OfferBuilder` to allow creating Offers whose amount is
denominated in a fiat currency instead of millisatoshis.

To ensure such Offers can later be processed correctly, currency
amounts may only be set when the caller provides a `CurrencyConversion`
implementation capable of resolving the amount into millisatoshis.

Since amount correctness checks are now performed directly in the
amount setters, they can be removed from the `build()` method.

This introduces the first layer of currency support in Offers,
allowing them to be created with currency-denominated amounts.
To support currency-denominated Offers, the InvoiceRequest builder
needs to resolve the Offer amount at multiple points during construction.
This occurs when explicitly setting `amount_msats` and again when the
InvoiceRequest is finalized via `build()`.

To avoid repeatedly passing a `CurrencyConversion` implementation into
these checks, the builder now stores a reference to it at creation time.
This allows the builder to resolve currency-denominated Offer amounts
whenever validation requires it.

As part of this change, `InvoiceRequest::amount_msats()` is updated to
use the provided `CurrencyConversion` to resolve the underlying Offer
amount when necessary.
Adds currency conversion support when responding to an `InvoiceRequest`
and constructing the `InvoiceBuilder`.

When the underlying Offer specifies its amount in a currency denomination,
the `CurrencyConversion` implementation is used to resolve the payable
amount into millisatoshis and ensure the invoice amount satisfies the
Offer's requirements.

This reintroduces the currency validation intentionally skipped during
`InvoiceRequest` parsing, keeping parsing focused on structural
validation while enforcing amount correctness at the time the Invoice
is constructed.
Adds tests covering Offers whose amounts are denominated in fiat
currencies. These tests verify that:

* currency-denominated Offer amounts can be created
* InvoiceRequests correctly resolve amounts using CurrencyConversion
* Invoice construction validates and enforces the payable amount

This ensures the full Offer → InvoiceRequest → Invoice flow works
correctly when the original Offer amount is specified in currency.

Co-authored By: CodeX
@shaavan
Copy link
Member Author

shaavan commented Mar 10, 2026

Updated .11 → .12

Changes:

  • Made Offer::build infallible.
  • Fix CI.
  • Improve documentation.
  • Improve test coverage.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

7 participants