any sender can initiate htlc claim

According to AIP 102 only the recipient of a HTLC lock should be able to initiate the claiming of the locked amount, i.e. the recipientId of the lock transaction and the senderPublicKey of the claim transaction must be equal.

Only a recipient CAN claim the htlc_lock transaction. Meaning htlc_claim senderPublicKey MUST match htlc_lock recipientAddress

Looking at the htlc-claim handler no such check appears to be in place - any senders claim transaction will be accepted and forged (given that the secret is correct).

I’ll try to confirm the above later today.

PS: I’d be happy to submit a PR if the above should be the case.

[spkjp]

Initially the plan was to only allow the recipient to claim. But some concerns were brought up during implementation that it might be too inflexible and better to allow anyone claim the lock similar to refund. So yes, it is by design and the AIP outdated. Will be updated accordingly!

[dated]

Gotcha! Thanks for the follow up!