According to BOLT 07 the node accountment message looks like this:
- type: 257 (
where the addresses are of the following form:
- The following
address descriptortypes are defined:
1: ipv4; data =
2: ipv6; data =
3: Tor v2 onion service; data =
- version 2 onion service addresses; Encodes an 80-bit, truncated
SHA-1hash of a 1024-bit
RSApublic key for the onion service (a.k.a. Tor hidden service).
4: Tor v3 onion service; data =
- version 3 (prop224) onion service addresses; Encodes:
[32:32_byte_ed25519_pubkey] || [2:checksum] || [1:version], where
checksum = sha3(".onion checksum" | pubkey || version)[:2].
taking this into consideration I could announce my node to have the IP address of another existing lightning node or even some arbitrary IP address. While it is clear that no one could connect to me as I don't control the IP address I wonder how the implementations would cope with such a behavior.
Even if implementations do not struggle with such spoofing an attacker could probably use this for fishing to trick a user into paying an invoice as it comes from a node_id that is connected to an IP-address from a well known service where the attacked person might even be a customer.
Is there anything else that could go wrong with such a spoofing behavior? Maybe there would even be benefits from it?