fix(security): attest settled payments when destination appears

[cursor]

Bug and impact

A Lightning payment could enter the local settlement ledger as Settled before BTCPay exposed a usable BOLT11 destination. The first sync skipped payee attestation because there was no invoice to decode, and later syncs did not retry because the payment status stayed Settled. That let a payment to an unexpected Lightning node avoid the wallet payee mismatch incident path.

Root cause

SettlementLedgerService::shouldAttestPayment() retried attestation only for newly-created rows or payment_status changes. It did not treat the first appearance of a destination on an already-settled row as an attestation-worthy transition.

Fix

• Persist the first usable Lightning destination from the payment payload, falling back to the method-level destination BTCPay provides.
• Re-run payee attestation for settled Lightning rows when the persisted destination changes/materializes.
• Add a regression test for a same-status Settled payment whose destination appears on a later sync.

Validation

• APP_KEY=$(php -r 'echo "base64:".base64_encode(random_bytes(32));') BTCPAY_BASE_URL=https://btcpay.test BTCPAY_API_KEY=test php artisan test --filter=PayeeAttestationTest
• git diff --check

Note: Docker and graphify were not available in this runner (docker: command not found, graphify: command not found), so validation used local PHP dependencies with dummy test env values.

  

[coderabbitai]

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Advanced

Run ID: 300e9be6-3a5d-4e40-b97b-ca99b68b0be3

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}