Successful payment preimages are logged at INFO

[ben-kaufman]

TLDR

After an outbound payment succeeds, LDK Node writes the complete payment preimage to the INFO log.

Payment preimages are proof-of-payment and correlation material. Including them in ordinary logs unnecessarily exposes them to log collectors, support bundles, crash reports, backups, and anyone with log access.

Affected code

src/event.rs:1222:

self.payment_store.get(&payment_id).map(|payment| {
	let amount_msat = payment.amount_msat.expect(
		"outbound payments should record their amount before they can succeed",
	);
	log_info!(
		self.logger,
		"Successfully sent payment of {}msat{} from \
		payment hash {:?} with preimage {:?}",
		amount_msat,
		// ...
		hex_utils::to_string(&payment_hash.0),
		hex_utils::to_string(&payment_preimage.0)
	);
});

The default log level includes INFO records:

src/config.rs:54:

/// The default log level.
pub const DEFAULT_LOG_LEVEL: LogLevel = LogLevel::Debug;

Impact

Anyone who obtains the logs can recover payment preimages for successful outbound payments and associate them with payment hashes, amounts, fees, and timestamps.

A settled preimage is not a wallet private key and does not normally allow spending wallet funds. However, it can serve as proof that a specific invoice was paid and may expose payment relationships or other application-sensitive information.

Proposed fix

Do not log payment preimages at any log level.

The success record can retain the payment ID or payment hash for diagnostics:

log_info!(
	self.logger,
	"Successfully sent payment of {}msat{} with payment hash {}",
	amount_msat,
	fee_description,
	hex_utils::to_string(&payment_hash.0),
);

The preimage should remain available through the structured payment and event APIs where applications explicitly require it.

[elnafateh]

i'd like to work on this issue