Fix payee attestation on settlement transition

[cursor]

Bug and impact

A Lightning payment can arrive in BTCPay as Processing on InvoiceReceivedPayment, which creates a local store_settlements row before the payment is final. When the later InvoicePaymentSettled/InvoiceSettled webhook updates that same payment row to Settled, payee attestation did not run because it was tied to wasRecentlyCreated only. That left a concrete security blind spot where a payment signed by an unknown Lightning node could settle without raising a wallet security incident.

Root cause

SettlementLedgerService::syncPaymentMethod() upserts BTCPay payment rows for all positive-value payments, including non-settled states, but only called PayeeAttestationService when the ledger row was first inserted.

Fix

The ledger now records the previous settlement status before the upsert and runs payee attestation when a Lightning payment is first observed as Settled, whether that is on insert or on a later status transition.

Validation

• php artisan test --filter=PayeeAttestationTest
• php artisan test --filter=StoreSettlementTest
• ./vendor/bin/pint --test app/Services/Boltz/SettlementLedgerService.php tests/Feature/PayeeAttestationTest.php

Note: local PHPUnit emitted existing environment warnings for a missing Vite manifest and one deprecated doc-comment metadata annotation, but all assertions passed.

  

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 65fbf972-1c9b-4c9a-b472-69a0c8649587

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}