instantout: enforce the accepted swap fee

Carry the accepted quote into each request, persist it, and reject
invoices above that limit. Preserve compatibility for requests that
omit the cap while distinguishing an explicit zero.

cmd/loop/instantout.go

@@ -183,6 +183,8 @@ func instantOut(ctx context.Context, cmd *cli.Command) error {
 
 	fmt.Println("Starting instant swap out")
 
+	maxSwapFee := quote.ServiceFeeSat
+
 	// Now we can request the instant out swap.
 	instantOutRes, err := client.InstantOut(
 		ctx,
@@ -190,6 +192,9 @@ func instantOut(ctx context.Context, cmd *cli.Command) error {
 			ReservationIds:  selectedReservations,
 			OutgoingChanSet: outgoingChanSet,
 			DestAddr:        cmd.String("addr"),
+			MaxSwapFee: &looprpc.InstantOutRequest_MaxSwapFeeSat{
+				MaxSwapFeeSat: maxSwapFee,
+			},
 		},
 	)
 	if err != nil {

cmd/loop/testdata/sessions/instantout/02_loop-instantout.json

@@ -139,7 +139,8 @@
             "Mu65fbhayEtRzougKLBnoeRN8f+tEM1+O9QuNvUIfbI="
           ],
           "outgoing_chan_set": [],
-          "dest_addr": ""
+          "dest_addr": "",
+          "max_swap_fee_sat": "4800"
         }
       }
     },

cmd/loop/testdata/sessions/instantout/07_loop-instantout-channel.json

@@ -148,7 +148,8 @@
           "outgoing_chan_set": [
             "125344325763072"
           ],
-          "dest_addr": ""
+          "dest_addr": "",
+          "max_swap_fee_sat": "3200"
         }
       }
     },

cmd/loop/testdata/sessions/instantout/08_loop-instantout-select-index.json

@@ -162,7 +162,8 @@
             "cSfKVONNmsK9+p4Uc5nc3ZtE+37uOODHeq1vprhh/x4="
           ],
           "outgoing_chan_set": [],
-          "dest_addr": ""
+          "dest_addr": "",
+          "max_swap_fee_sat": "1600"
         }
       }
     },

instantout/actions.go

@@ -20,6 +20,7 @@ import (
 	"github.com/lightningnetwork/lnd/lnrpc/walletrpc"
 	"github.com/lightningnetwork/lnd/lntypes"
 	"github.com/lightningnetwork/lnd/lnwallet"
+	"github.com/lightningnetwork/lnd/lnwire"
 )
 
 const (
@@ -65,6 +66,7 @@ type InitInstantOutCtx struct {
 	outgoingChanSet loopdb.ChannelSet
 	protocolVersion ProtocolVersion
 	sweepAddress    btcutil.Address
+	maxSwapFee      *btcutil.Amount
 }
 
 // RecoverInstantOutCtx marks an action as being resumed after restart.
@@ -85,7 +87,7 @@ func (f *FSM) InitInstantOutAction(ctx context.Context,
 	}
 
 	var (
-		reservationAmt uint64
+		reservationAmt btcutil.Amount
 		reservationIds = make([][]byte, 0, len(initCtx.reservations))
 		reservations   = make(
 			[]*reservation.Reservation, 0, len(initCtx.reservations),
@@ -106,7 +108,7 @@ func (f *FSM) InitInstantOutAction(ctx context.Context,
 				"locked", reservationId))
 		}
 
-		reservationAmt += uint64(res.Value)
+		reservationAmt += res.Value
 		reservationIds = append(reservationIds, resId[:])
 		reservations = append(reservations, res)
 
@@ -168,6 +170,11 @@ func (f *FSM) InitInstantOutAction(ctx context.Context,
 		return f.HandleError(fmt.Errorf("invalid swap invoice hash: "+
 			"expected %x got %x", preimage.Hash(), payReq.Hash))
 	}
+	if err := validateInstantOutInvoiceAmount(
+		payReq.Value, reservationAmt, initCtx.maxSwapFee,
+	); err != nil {
+		return f.HandleError(err)
+	}
 	serverPubkey, err := btcec.ParsePubKey(instantOutResponse.SenderKey)
 	if err != nil {
 		return f.HandleError(err)
@@ -186,6 +193,11 @@ func (f *FSM) InitInstantOutAction(ctx context.Context,
 	}
 
 	// Now we can create the instant out.
+	var maxSwapFee btcutil.Amount
+	if initCtx.maxSwapFee != nil {
+		maxSwapFee = *initCtx.maxSwapFee
+	}
+
 	instantOut := &InstantOut{
 		SwapHash:         swapHash,
 		swapPreimage:     preimage,
@@ -195,7 +207,8 @@ func (f *FSM) InitInstantOutAction(ctx context.Context,
 		CltvExpiry:       initCtx.cltvExpiry,
 		clientPubkey:     keyRes.PubKey,
 		serverPubkey:     serverPubkey,
-		Value:            btcutil.Amount(reservationAmt),
+		Value:            reservationAmt,
+		MaxSwapFee:       maxSwapFee,
 		htlcFeeRate:      feeRate,
 		swapInvoice:      instantOutResponse.SwapInvoice,
 		Reservations:     reservations,
@@ -213,6 +226,37 @@ func (f *FSM) InitInstantOutAction(ctx context.Context,
 	return OnInit
 }
 
+// validateInstantOutInvoiceAmount verifies that the server invoice doesn't
+// charge more than the client-approved swap fee. Sub-satoshi fees are rounded
+// up so the cap cannot be bypassed with millisatoshi precision.
+func validateInstantOutInvoiceAmount(invoiceAmount lnwire.MilliSatoshi,
+	swapAmount btcutil.Amount, maxSwapFee *btcutil.Amount) error {
+
+	// Omitting the cap preserves the behavior of clients that predate this
+	// field. In-tree callers set it explicitly after accepting a quote.
+	if maxSwapFee == nil {
+		return nil
+	}
+
+	if *maxSwapFee < 0 {
+		return fmt.Errorf("maximum swap fee must not be negative")
+	}
+
+	swapAmountMsat := lnwire.NewMSatFromSatoshis(swapAmount)
+	if invoiceAmount <= swapAmountMsat {
+		return nil
+	}
+
+	swapFeeMsat := invoiceAmount - swapAmountMsat
+	swapFeeSat := btcutil.Amount((int64(swapFeeMsat)-1)/1000 + 1)
+	if swapFeeSat > *maxSwapFee {
+		return fmt.Errorf("instant out swap fee %d exceeds maximum %d",
+			swapFeeSat, *maxSwapFee)
+	}
+
+	return nil
+}
+
 // PollPaymentAcceptedAction locks the reservations, sends the payment to the
 // server and polls the server for the payment status.
 func (f *FSM) PollPaymentAcceptedAction(ctx context.Context,

instantout/instantout.go

@@ -60,6 +60,9 @@ type InstantOut struct {
 	// Value is the amount that is swapped.
 	Value btcutil.Amount
 
+	// MaxSwapFee is the maximum off-chain swap fee accepted by the client.
+	MaxSwapFee btcutil.Amount
+
 	// keyLocator is the key locator that is used for the swap.
 	keyLocator keychain.KeyLocator
 

instantout/instantout_test.go

@@ -11,6 +11,7 @@ import (
 	"github.com/lightninglabs/loop/fsm"
 	"github.com/lightninglabs/loop/instantout/reservation"
 	"github.com/lightningnetwork/lnd/input"
+	"github.com/lightningnetwork/lnd/lnwire"
 	"github.com/stretchr/testify/require"
 )
 
@@ -189,3 +190,72 @@ func TestPushPreimageRejectsExpiringHtlc(t *testing.T) {
 		"instant out HTLC expires at height 105",
 	)
 }
+
+// TestValidateInstantOutInvoiceAmount verifies enforcement of the fee cap at
+// millisatoshi precision.
+func TestValidateInstantOutInvoiceAmount(t *testing.T) {
+	const swapAmount = btcutil.Amount(100_000)
+
+	maxSwapFee := btcutil.Amount(200)
+	zeroSwapFee := btcutil.Amount(0)
+	negativeSwapFee := btcutil.Amount(-1)
+
+	tests := []struct {
+		name          string
+		invoiceAmount lnwire.MilliSatoshi
+		maxSwapFee    *btcutil.Amount
+		expectErr     bool
+	}{
+		{
+			name: "exact fee cap",
+			invoiceAmount: lnwire.NewMSatFromSatoshis(
+				swapAmount + maxSwapFee,
+			),
+			maxSwapFee: &maxSwapFee,
+		},
+		{
+			name: "one millisatoshi over fee cap",
+			invoiceAmount: lnwire.NewMSatFromSatoshis(
+				swapAmount+maxSwapFee,
+			) + 1,
+			maxSwapFee: &maxSwapFee,
+			expectErr:  true,
+		},
+		{
+			name: "discounted invoice",
+			invoiceAmount: lnwire.NewMSatFromSatoshis(
+				swapAmount - 1,
+			),
+			maxSwapFee: &zeroSwapFee,
+		},
+		{
+			name: "negative cap",
+			invoiceAmount: lnwire.NewMSatFromSatoshis(
+				swapAmount,
+			),
+			maxSwapFee: &negativeSwapFee,
+			expectErr:  true,
+		},
+		{
+			name: "omitted cap",
+			invoiceAmount: lnwire.NewMSatFromSatoshis(
+				swapAmount + maxSwapFee + 1,
+			),
+			maxSwapFee: nil,
+		},
+	}
+
+	for _, tc := range tests {
+		t.Run(tc.name, func(t *testing.T) {
+			err := validateInstantOutInvoiceAmount(
+				tc.invoiceAmount, swapAmount, tc.maxSwapFee,
+			)
+			if tc.expectErr {
+				require.Error(t, err)
+				return
+			}
+
+			require.NoError(t, err)
+		})
+	}
+}

instantout/manager.go

@@ -20,6 +20,20 @@ var (
 	ErrSwapDoesNotExist  = errors.New("swap does not exist")
 )
 
+type newInstantOutOptions struct {
+	maxSwapFee *btcutil.Amount
+}
+
+// NewInstantOutOption customizes an instant out request.
+type NewInstantOutOption func(*newInstantOutOptions)
+
+// WithMaxSwapFee limits the off-chain fee accepted for an instant out.
+func WithMaxSwapFee(maxSwapFee btcutil.Amount) NewInstantOutOption {
+	return func(options *newInstantOutOptions) {
+		options.maxSwapFee = &maxSwapFee
+	}
+}
+
 // Manager manages the instantout state machines.
 type Manager struct {
 	sync.Mutex
@@ -136,7 +150,21 @@ func (m *Manager) recoverInstantOuts(ctx context.Context) error {
 
 // NewInstantOut creates a new instantout.
 func (m *Manager) NewInstantOut(ctx context.Context,
-	reservations []reservation.ID, sweepAddress string) (*FSM, error) {
+	reservations []reservation.ID, sweepAddress string,
+	options ...NewInstantOutOption) (*FSM, error) {
+
+	requestOptions := &newInstantOutOptions{}
+	for _, option := range options {
+		if option != nil {
+			option(requestOptions)
+		}
+	}
+
+	if requestOptions.maxSwapFee != nil &&
+		*requestOptions.maxSwapFee < 0 {
+
+		return nil, fmt.Errorf("maximum swap fee must not be negative")
+	}
 
 	var (
 		sweepAddr btcutil.Address
@@ -159,6 +187,7 @@ func (m *Manager) NewInstantOut(ctx context.Context,
 		initationHeight: m.currentHeight,
 		protocolVersion: CurrentProtocolVersion(),
 		sweepAddress:    sweepAddr,
+		maxSwapFee:      requestOptions.maxSwapFee,
 	}
 
 	instantOut, err := NewFSM(m.cfg, ProtocolVersionFullReservation)

instantout/store.go

@@ -104,7 +104,7 @@ func (s *SQLStore) CreateInstantLoopOut(ctx context.Context,
 		AmountRequested:  int64(instantOut.Value),
 		CltvExpiry:       instantOut.CltvExpiry,
 		MaxMinerFee:      0,
-		MaxSwapFee:       0,
+		MaxSwapFee:       int64(instantOut.MaxSwapFee),
 		InitiationHeight: instantOut.initiationHeight,
 		ProtocolVersion:  int32(instantOut.protocolVersion),
 		Label:            "",
@@ -368,6 +368,7 @@ func (s *SQLStore) sqlInstantOutToInstantOut(ctx context.Context,
 		protocolVersion:  ProtocolVersion(row.ProtocolVersion),
 		initiationHeight: row.InitiationHeight,
 		Value:            btcutil.Amount(row.AmountRequested),
+		MaxSwapFee:       btcutil.Amount(row.MaxSwapFee),
 		keyLocator: keychain.KeyLocator{
 			Family: keychain.KeyFamily(row.ClientKeyFamily),
 			Index:  uint32(row.ClientKeyIndex),

loopd/swapclient_server.go

@@ -1763,8 +1763,15 @@ func (s *swapClientServer) InstantOut(ctx context.Context,
 		reservationIds[i] = resId
 	}
 
+	var options []instantout.NewInstantOutOption
+	if req.GetMaxSwapFee() != nil {
+		options = append(options, instantout.WithMaxSwapFee(
+			btcutil.Amount(req.GetMaxSwapFeeSat()),
+		))
+	}
+
 	instantOutFsm, err := s.instantOutManager.NewInstantOut(
-		ctx, reservationIds, req.DestAddr,
+		ctx, reservationIds, req.DestAddr, options...,
 	)
 	if err != nil {
 		return nil, err

looprpc/client.pb.go

@@ -4467,7 +4467,11 @@ type InstantOutRequest struct {
 	OutgoingChanSet []uint64 `protobuf:"varint,2,rep,packed,name=outgoing_chan_set,json=outgoingChanSet,proto3" json:"outgoing_chan_set,omitempty"`
 	// An optional address to sweep the onchain funds to. If not set, the funds
 	// will be swept to the wallet's internal address.
-	DestAddr      string `protobuf:"bytes,3,opt,name=dest_addr,json=destAddr,proto3" json:"dest_addr,omitempty"`
+	DestAddr string `protobuf:"bytes,3,opt,name=dest_addr,json=destAddr,proto3" json:"dest_addr,omitempty"`
+	// Types that are valid to be assigned to MaxSwapFee:
+	//
+	//	*InstantOutRequest_MaxSwapFeeSat
+	MaxSwapFee    isInstantOutRequest_MaxSwapFee `protobuf_oneof:"max_swap_fee"`
 	unknownFields protoimpl.UnknownFields
 	sizeCache     protoimpl.SizeCache
 }
@@ -4523,6 +4527,36 @@ func (x *InstantOutRequest) GetDestAddr() string {
 	return ""
 }
 
+func (x *InstantOutRequest) GetMaxSwapFee() isInstantOutRequest_MaxSwapFee {
+	if x != nil {
+		return x.MaxSwapFee
+	}
+	return nil
+}
+
+func (x *InstantOutRequest) GetMaxSwapFeeSat() int64 {
+	if x != nil {
+		if x, ok := x.MaxSwapFee.(*InstantOutRequest_MaxSwapFeeSat); ok {
+			return x.MaxSwapFeeSat
+		}
+	}
+	return 0
+}
+
+type isInstantOutRequest_MaxSwapFee interface {
+	isInstantOutRequest_MaxSwapFee()
+}
+
+type InstantOutRequest_MaxSwapFeeSat struct {
+	// The maximum off-chain swap fee that may be charged for the swap. If
+	// this field is omitted, no fee cap is applied for compatibility with
+	// clients that predate this field. An explicitly set value of zero
+	// rejects any positive swap fee.
+	MaxSwapFeeSat int64 `protobuf:"varint,4,opt,name=max_swap_fee_sat,json=maxSwapFeeSat,proto3,oneof"`
+}
+
+func (*InstantOutRequest_MaxSwapFeeSat) isInstantOutRequest_MaxSwapFee() {}
+
 type InstantOutResponse struct {
 	state protoimpl.MessageState `protogen:"open.v1"`
 	// The hash of the swap preimage.
@@ -6964,11 +6998,13 @@ const file_client_proto_rawDesc = "" +
 	"\x06amount\x18\x03 \x01(\x04R\x06amount\x12\x13\n" +
 	"\x05tx_id\x18\x04 \x01(\tR\x04txId\x12\x12\n" +
 	"\x04vout\x18\x05 \x01(\rR\x04vout\x12\x16\n" +
-	"\x06expiry\x18\x06 \x01(\rR\x06expiry\"\x85\x01\n" +
+	"\x06expiry\x18\x06 \x01(\rR\x06expiry\"\xc0\x01\n" +
 	"\x11InstantOutRequest\x12'\n" +
 	"\x0freservation_ids\x18\x01 \x03(\fR\x0ereservationIds\x12*\n" +
 	"\x11outgoing_chan_set\x18\x02 \x03(\x04R\x0foutgoingChanSet\x12\x1b\n" +
-	"\tdest_addr\x18\x03 \x01(\tR\bdestAddr\"t\n" +
+	"\tdest_addr\x18\x03 \x01(\tR\bdestAddr\x12)\n" +
+	"\x10max_swap_fee_sat\x18\x04 \x01(\x03H\x00R\rmaxSwapFeeSatB\x0e\n" +
+	"\fmax_swap_fee\"t\n" +
 	"\x12InstantOutResponse\x12(\n" +
 	"\x10instant_out_hash\x18\x01 \x01(\fR\x0einstantOutHash\x12\x1e\n" +
 	"\vsweep_tx_id\x18\x02 \x01(\tR\tsweepTxId\x12\x14\n" +
@@ -7490,6 +7526,9 @@ func file_client_proto_init() {
 		(*SweepHtlcResponse_Published)(nil),
 		(*SweepHtlcResponse_Failed)(nil),
 	}
+	file_client_proto_msgTypes[48].OneofWrappers = []any{
+		(*InstantOutRequest_MaxSwapFeeSat)(nil),
+	}
 	type x struct{}
 	out := protoimpl.TypeBuilder{
 		File: protoimpl.DescBuilder{

looprpc/client.proto

@@ -1685,6 +1685,16 @@ message InstantOutRequest {
     will be swept to the wallet's internal address.
     */
     string dest_addr = 3;
+
+    oneof max_swap_fee {
+        /*
+        The maximum off-chain swap fee that may be charged for the swap. If
+        this field is omitted, no fee cap is applied for compatibility with
+        clients that predate this field. An explicitly set value of zero
+        rejects any positive swap fee.
+        */
+        int64 max_swap_fee_sat = 4;
+    }
 }
 
 message InstantOutResponse {

looprpc/client.swagger.json

@@ -1917,6 +1917,11 @@
         "dest_addr": {
           "type": "string",
           "description": "An optional address to sweep the onchain funds to. If not set, the funds\nwill be swept to the wallet's internal address."
+        },
+        "max_swap_fee_sat": {
+          "type": "string",
+          "format": "int64",
+          "description": "The maximum off-chain swap fee that may be charged for the swap. If\nthis field is omitted, no fee cap is applied for compatibility with\nclients that predate this field. An explicitly set value of zero\nrejects any positive swap fee."
         }
       }
     },

looprpc/client_test.go

@@ -0,0 +1,32 @@
+package looprpc
+
+import (
+	"testing"
+
+	"google.golang.org/protobuf/proto"
+)
+
+// TestInstantOutMaxSwapFeePresence verifies that an omitted fee cap remains
+// distinguishable from an explicitly encoded zero while retaining the scalar
+// field's original wire representation.
+func TestInstantOutMaxSwapFeePresence(t *testing.T) {
+	request := &InstantOutRequest{}
+	if err := proto.Unmarshal(nil, request); err != nil {
+		t.Fatalf("unable to unmarshal omitted cap: %v", err)
+	}
+	if request.GetMaxSwapFee() != nil {
+		t.Fatal("omitted cap unexpectedly has presence")
+	}
+
+	// Field four, encoded as a varint with value zero. This is the same wire
+	// representation used before the field gained presence semantics.
+	if err := proto.Unmarshal([]byte{0x20, 0x00}, request); err != nil {
+		t.Fatalf("unable to unmarshal explicit zero cap: %v", err)
+	}
+	if request.GetMaxSwapFee() == nil {
+		t.Fatal("explicit zero cap lost presence")
+	}
+	if request.GetMaxSwapFeeSat() != 0 {
+		t.Fatalf("expected zero cap, got %d", request.GetMaxSwapFeeSat())
+	}
+}