Fix payee attestation on settled payment transitions

[cursor]

Bug and impact

Lightning payment rows can first be written while BTCPay still reports them as Processing, then later update to Settled under the same payment identity. The previous attestation gate only ran on newly created ledger rows, so the settled transition could skip payee attestation entirely. If the early row had no usable BOLT11 destination, a later settled payment to an unknown node would not raise the wallet-security incident; with no canary allow-list, an unsettled payment could also seed trust too early.

Root cause

SettlementLedgerService::syncPaymentMethod() invoked PayeeAttestationService based only on $row->wasRecentlyCreated, without requiring the payment to be settled or considering an existing row whose payment_status changed to Settled.

Fix

• Gate payee attestation to settled Lightning payments.
• Run attestation on newly inserted settled rows and on existing rows whose payment_status transitions to Settled.
• Added regression tests for a Processing -> Settled row that gains its BOLT11 destination later, and for avoiding first-payee allow-list learning from an unsettled payment.

Validation

• APP_KEY=base64:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA= BTCPAY_BASE_URL=https://btcpay.example.com BTCPAY_API_KEY=dummy php artisan test --filter=PayeeAttestationTest
• php -l app/Services/Boltz/SettlementLedgerService.php
• php -l tests/Feature/PayeeAttestationTest.php
• git diff --check

Note: Docker and graphify metadata were unavailable in this runner, so validation used the local PHP fallback and graphify update . was skipped.

  

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 94fe4022-2536-44f3-864d-2b351368f723

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}