LL
← All projectsLightning Labs

LND

Go implementation of a complete Lightning Network node.

BitcoinLightning NetworkNormal
Repository coverage

1239 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

116security candidates168second-pass queue990AI analyses
55commits · 30 days
169commits · 60 days
828commits · 180 days
1227commits · 365 days
Backfill bands
Aug 5 → Feb 6405 seen5 candidatesComplete
Feb 6 → Jun 6665 seen28 candidatesComplete
Jun 6 → Jul 689 seen4 candidatesComplete
Jul 6 → Aug 569 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
279Strong · 80–100
562Adequate · 60–79
367Thin · 40–59
31Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Olaoluwa Osuntokun19940162474
ziggie41015330164
Jared Tobin908171
Elle Mouton26731207067
Erick Cestari26726070
bitromortac46543067
yyforyongyu55345065
saubyk15213070
Oli727057
Suheb323075
elnosh323071
George Tsagkarelis32120066
Analysis record

Published AI watches

Last scanned 55 minutes ago

Moderate 63 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11024 from ziggie1984/invoices-update-validation

This commit tightens how LND processes invoice payments, especially for newer multi-path (MPP) and AMP invoices, keysend payments, and replayed payments. It adds checks that ensure the right payment preimage is used for each invoice type a…

Preimage validation added for AMP and regular invoice replaysAMP invoices forced into MPP update path, preventing legacy-path processingLegacy settlement now fails when invoice-level preimage is missing
61f3b5a7by ziggieXXX+482−114 files
No security note in commit
Moderate 59 AI analysisMessage 35 · Opaque
LL Lightning LabsLND BitcoinLightning Network

invoices: refine update handling

This commit tightens how LND handles invoice payment updates, especially for newer 'AMP' invoices and old-style 'keysend' payments. It adds checks so that the wrong kind of payment cannot be processed against the wrong kind of invoice, and…

Added preimage/hash mismatch checks for both regular and AMP invoice replaysAMP records now require an MPP payload, preventing AMP processing on the legacy pathLegacy path now rejects AMP invoices and invoices missing invoice-level preimages
6be6350eby ziggie+476−113 files
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
LL Lightning LabsLND BitcoinLightning Network

docs: update 0.21.2 release notes

This commit only updates the release notes document for version 0.21.2. It adds a bullet point describing a previously merged code change about invoice handling and adds a contributor name to the credits list. No actual code was changed, s…

758bbb8eby ziggie+6−01 file
No security note in commit
Informational 15 AI analysisMessage 57 · Thin
LL Lightning LabsLND BitcoinLightning Network

docs: move gossip bounds note to v0.21.2

This commit only moves an existing release-note entry from one version's notes (v0.22.0) to another (v0.21.2). It does not change any code, build files, configuration, or tests. The change is purely editorial documentation bookkeeping.

83e7eb8cby ziggie+11−112 files
No security note in commit
High 72 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

discovery: bound channel range reply buffering

This change fixes a way a malicious or buggy peer could make an LND node use an unpredictable amount of memory while syncing the Lightning channel graph. Before the fix, the node only limited the size of one compressed reply message, but a…

Resource exhaustion / unbounded memory growth in gossip syncRemote peer can influence memory allocation via ReplyChannelRange streamMissing aggregate limit on decoded working set
ceff94faby Olaoluwa Osuntokun+335−153 files
Vendor flagged security relevance
Low 33 AI analysisMessage 47 · Thin
LL Lightning LabsLND BitcoinLightning Network

docs: update release notes

This commit updates the release notes for LND 0.21.2 to describe a fix for a bug in the HTLC interceptor RPC. The bug caused LND to fail to forward payments in blinded routes when the next hop was identified by node ID instead of channel I…

Blinded route forwarding failure could disrupt payment routing or be used to probe path structure.Sentinel value change in RPC API could cause client misclassification of forwards if not handled.Release notes describe the change as a fix for a forwarding issue, not as a security vulnerability.
f42b4298by bitromortac+20−01 file
No security note in commit
Informational 14 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

itest: cover blinded route next_node_id forwarding

This commit only adds new integration tests for an existing feature in LND: forwarding blinded payments where the next hop is identified by node ID rather than channel ID. It does not change production code, fix a bug, or introduce any new…

da6a40c0by bitromortac+432−02 files
No security note in commit
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

witness beacon: report node-ID next hop to the on-chain HTLC interceptor

This change fixes a reporting gap in LND's 'witness beacon,' a component that watches on-chain transactions and tells the HTLC interceptor where a payment should go next. Previously, when the next hop was identified by a node ID rather tha…

Missing security-critical metadata in on-chain interception pathBehavioral parity between on-chain and off-chain HTLC interceptionPotential misclassification of node-ID forwards as final receives
9c4b8bfeby bitromortac+59−52 files
No security note in commit
Moderate 59 AI analysisMessage 81 · Strong
LL Lightning LabsLND BitcoinLightning Network

htlcswitch: forward node-ID blinded hops via non-strict forwarding

This commit fixes a bug in LND's payment forwarding for 'blinded routes'—a privacy feature in the Lightning Network. Previously, if the next hop was identified by node ID rather than a specific channel ID, the payment could not be forwarde…

Fixes a functional forwarding failure for blinded-route payments using node-ID next hops (issue #10937).Prevents private channel SCID leakage in failure messages for node-ID blinded hops by returning FailUnknownNextPeer instead of a channel_update.Adds circular-route filtering for node-ID next hops before non-strict forwarding selection.
dbc57040by bitromortac+334−416 files
No security note in commit
Informational 19 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

htlcswitch+lnrpc: report node-ID next hop to the off-chain HTLC interceptor

This change improves how the Lightning Network Daemon (LND) reports forwarding details to external plugins that inspect HTLCs (payment packets). For a new type of blinded route where the next hop is identified by node ID rather than a spec…

Information-correctness fix for HTLC interceptor APIPrevents misclassification of node-ID forwards as exit hopsAdds explicit sentinel to disambiguate zero SCID semantics
32373b76by bitromortac+29−13 files
No security note in commit
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

htlcswitch: classify a node-ID forward as a forward event

This commit fixes a bookkeeping bug in LND's HTLC event stream. When a payment is forwarded to a 'blinded' next hop identified only by a node public key (not a channel ID), and it fails before the switch picks an outgoing channel, the even…

Event misclassification in HTLC event stream (forward reported as receive)Blinded/node-ID forwarding path introduced prior to this fixFailure and resolution packets dropped next-hop metadata before fix
a4844ef5by bitromortac+149−04 files
No security note in commit
Low 29 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

htlcswitch/hop: decode next_node_id blinded hops

This commit adds support in LND for a different way of identifying the next hop in a private ('blinded') Lightning payment route. Previously LND expected the next hop to be identified by a channel ID; now it also accepts the next node's pu…

New validation enforces BOLT 4 mutual exclusivity of short_channel_id and next_node_id in blinded route dataPreviously ambiguous or unhandled next_node_id forwarding case now explicitly decodedNo memory-safety, cryptographic, or authorization changes observed
4fd4289aby bitromortac+471−86 files
No security note in commit
Moderate 60 AI analysisMessage 78 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnwire: cap decoded short channel IDs

This commit tightens a safety limit in LND's Lightning wire protocol parser. Previously, a compressed network message could decompress into an unbounded number of short channel IDs, potentially consuming far more memory than the wire messa…

Resource-limit bypass: compressed-input bound did not bound decoded outputMemory-exhaustion risk from zlib decompression of peer-supplied dataTruncated/corrupt zlib streams previously accepted as valid partial results
d1622919by Olaoluwa Osuntokun+271−502 files
No security note in commit
Informational 18 AI analysisMessage 85 · Strong
LL Lightning LabsLND BitcoinLightning Network

lnrpc/routerrpc: add outgoing_node_id to HTLC intercept request

This commit only updates the API definition and auto-generated code for LND's HTLC interceptor. It adds a new optional field, outgoing_requested_node_id, and documents that when a blinded route uses a node ID instead of a channel ID, the e…

No runtime logic changed; only protobuf schema and generated stubsNew field is explicitly documented as unpopulated until later commitsSentinel value (MaxUint64) introduced to prevent misclassification of final receive vs node-addressed forward
14640a50by bitromortac+48−73 files
No security note in commit
Informational 18 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

multi: represent the blinded forwarding next hop as an fn.Either

This commit is a behind-the-scenes code cleanup in the LND Lightning node. It changes how the 'next hop' for forwarding payments is stored internally so that, in the future, blinded routes can identify the next hop by a node's public key i…

Refactor of core HTLC forwarding data structure (ForwardingInfo.NextHop)Preparation for blinded route next-hop identification by node public keyEncapsulation of Either type behind IsExit() and NextHopChannel() to centralize exit-hop detection
d28a7176by bitromortac+83−2612 files
No security note in commit
Low 44 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

htlcswitch: key the aux traffic shaper on the evaluated channel

This commit fixes a routing bug in LND's Lightning payment forwarding. When a payment could take any of several parallel channels to the same next peer, the node was accidentally asking an optional 'auxiliary traffic shaper' about the chan…

Logic error: wrong channel identifier used for auxiliary policy/bandwidth checkPotential information disclosure: real SCID could leak if passed to shaper-driven wire messages; commit explicitly prevents thisParallel-channel forwarding correctness issue
b1667800by bitromortac+133−12 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

github: bump gateway code-review to v0.6.0

This commit updates a GitHub Actions workflow that runs an optional code-review bot called 'gateway'. It only changes two pinned version numbers (SHA hashes) for the bot's action and its runtime, moving from v0.5.0 to v0.6.0. There is no c…

17a4d42fby Suheb+4−41 file
No security note in commit
Moderate 58 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

channeldb: recover missing db version

This patch fixes a database migration bug in LND's channel database. Some databases were created without recording their schema version number, which could cause future mandatory upgrades to be skipped. The fix detects that missing version…

Database schema version key can be absent due to an init-ordering regressionMissing version key previously caused migration selection to treat DB as latest, potentially skipping mandatory migrationsFix recovers baseline from last mandatory version before the regression (33)
68264c70by Elle Mouton+176−33 files
Vendor flagged security relevance
Informational 22 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

channeldb: make waiting proof migration repeatable

This commit fixes a database migration in LND so it can safely run twice. Previously, if a certain recovery process re-ran migration 35 on a database that already had newer-format 'waiting proof' records, the migration would likely fail or…

Database migration idempotency/robustness fixPotential data corruption or node startup failure if migration re-run against mixed-format bucketNo input validation of attacker-controlled data; issue is local/state-recovery only
3aff61aeby Elle Mouton+93−02 files
No security note in commit
Moderate 54 AI analysisMessage 76 · Adequate
LL Lightning LabsLND BitcoinLightning Network

channeldb: preserve db version during init

This commit fixes a database initialization bug in LND's channel database. Previously, creating an empty metadata bucket during setup could trick the code into thinking an old or partially-created database was already fully up-to-date, pot…

Database version detection logic flawPotential migration skip due to incorrect initialized-state detectionNew explicit error for missing DB version key
619913bfby Elle Mouton+111−104 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-prioritydocs: update release notes for gossip v2 graph preparationby Elle Mouton · a39f94eb · Feb 13, 2026 · 1 fileMessage 77 · AdequateInformational 15Details
Commit message · Elle Mouton

docs: update release notes for gossip v2 graph preparation

Add reference to the PR implementing v2 channel support in the graph
database layer.

77/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope✓ Provides an explanatory body
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates the release notes document. It adds a hyperlink to an already-merged pull request about preparing the graph database for a new gossip protocol version. No program code was changed, so it cannot by itself introduce or fix a security issue.

Lower-prioritymulti: add DeleteChannelEdges to VersionedGraphby Elle Mouton · b3cf9a80 · Feb 13, 2026 · 5 filesMessage 68 · AdequateLow 26Details
Commit message · Elle Mouton

multi: add DeleteChannelEdges to VersionedGraph

Add version-aware DeleteChannelEdges method to VersionedGraph and
update call sites in graph builder, rpcserver, and server to use
versioned graphs. This ensures channel deletion operations are
properly scoped to the correct gossip version.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 26/100

This commit refactors how LND deletes channel edges from the network graph so that deletions go through a new version-aware wrapper. The change is mostly a code cleanup to support multiple gossip graph versions, but it includes a TODO noting that one RPC path still only supports v1 channel deletions. There is no direct evidence in the commit of an exploitable security bug.

Lower-prioritygraph/db: add version parameter to FetchChannelEdgesByID/Outpointby Elle Mouton · d88fa011 · Feb 13, 2026 · 4 filesMessage 73 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: add version parameter to FetchChannelEdgesByID/Outpoint

Make channel edge fetching version-aware by adding gossip version
parameter to FetchChannelEdgesByID and FetchChannelEdgesByOutpoint.
Add corresponding methods to VersionedGraph. V2 policy building is
marked as TODO.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a routine internal refactoring to prepare the LND channel graph database for future support of multiple gossip protocol versions. It adds a version parameter to two edge-lookup functions and makes the SQL store use that parameter instead of a hardcoded version. There is no security bug being fixed here and no behavior that would let an attacker do anything harmful.

Lower-prioritygraph/db: add version parameter to IsZombieEdgeby Elle Mouton · 03050a58 · Feb 13, 2026 · 5 filesMessage 78 · AdequateInformational 19Details
Commit message · Elle Mouton

graph/db: add version parameter to IsZombieEdge

Make IsZombieEdge version-aware and add corresponding method to
VersionedGraph. Convert TestEdgeInsertionDeletion to versioned test
using the createEdge helper for both v1 and v2 channel testing.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 19/100

This commit extends the channel graph database so that zombie-edge lookups know which gossip protocol version (v1 or v2) they are dealing with. Previously the code only checked v1 zombie records; now it can check the matching version. It is a correctness/refactoring change rather than a fix for an active vulnerability, but it removes a version-confusion bug class that could cause routing or channel-state mistakes in a multi-version Lightning network.

Security candidatesqldb/sqlc: add AddV2ChannelProof queryby Elle Mouton · 315f5ed7 · Feb 13, 2026 · 3 filesMessage 73 · AdequateInformational 15Details
Commit message · Elle Mouton

sqldb/sqlc: add AddV2ChannelProof query

Add SQL query to update the signature column for v2 channel auth proofs.
Unlike v1 which requires four separate signatures, v2 channels use a
single aggregated signature.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit adds a new database query to support v2 Lightning channel proofs. It simply updates a single signature column for v2 channels, whereas the older v1 proof format required four separate signatures. There is no security issue visible in the change itself.

Security candidategraph/db: treat empty channel signatures as missingby Elle Mouton · 6328c4d8 · Feb 13, 2026 · 5 filesMessage 100 · StrongModerate 51Details
Commit message · Elle Mouton

graph/db: treat empty channel signatures as missing

This commit improves handling of missing channel signatures in the
database:

- Return nil from auth proof accessors instead of empty slices so that
missing signatures are stored as NULL in SQL.
- Update public channel checks to require signature length > 0, which
properly handles existing empty bytea values in the database.
- Add regression test covering empty v1 and v2 channel signatures to
prevent future issues.

100/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryfuzzing or regression evidenceauthentication path
AI analysis · Moderate 51/100

This commit fixes a bug in LND's Lightning Network graph database where empty channel signatures were being treated as valid proof that a channel was publicly announced. Because the code previously treated empty byte slices the same as real signatures, a node connected only by such a 'channel' could incorrectly be considered public. The fix makes the database store empty signatures as NULL and changes all public-channel checks to require a signature length greater than zero. The commit message frames this as a correctness improvement and adds regression tests, but does not label it a security vulnerability.

Security candidategraph/db: support v2 channel proofs in AddEdgeProofby Elle Mouton · 99d622ca · Feb 13, 2026 · 2 filesMessage 78 · AdequateLow 32Details
Commit message · Elle Mouton

graph/db: support v2 channel proofs in AddEdgeProof

Update AddEdgeProof to handle both v1 (four separate signatures) and
v2 (single aggregated signature) channel authentication proofs using
the appropriate SQL queries.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundaryaccess control
AI analysis · Low 32/100

This commit extends a database function in the LND Lightning node so it can store both old-style (v1) and new-style (v2) channel authentication proofs. Previously, the code only accepted v1 proofs and would reject v2 proofs with an error. The change is a feature completion / bug fix for the new gossip protocol support, not a fix for an active security vulnerability. It adds the matching SQL query and tests for both versions.

Security candidategraph/db: add version parameter to IsPublicNodeby Elle Mouton · 971c0f6e · Feb 13, 2026 · 6 filesMessage 78 · AdequateInformational 24Details
Commit message · Elle Mouton

graph/db: add version parameter to IsPublicNode

Make IsPublicNode version-aware by routing to the appropriate SQL
query based on gossip version. V1 and v2 have different criteria for
determining node publicity (v1 requires four signatures, v2 requires
one). Convert TestNodeIsPublic to versioned test for both protocols.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundary
AI analysis · Informational 24/100

This commit updates how LND decides whether a Lightning node is 'public' so that the decision respects the network's gossip protocol version. In the older v1 protocol, a node needed four signatures to be considered public; in the newer v2 protocol, one signature is enough. Previously the code always used the v1 rule, which could misclassify v2 nodes as private. The change is a correctness fix rather than an obvious remote-exploitable vulnerability, but misclassified publicity could affect routing, channel selection, or policy decisions.

Security candidatesqldb/sqlc: add IsPublicV2Node queryby Elle Mouton · a99604c7 · Feb 13, 2026 · 3 filesMessage 73 · AdequateInformational 3Details
Commit message · Elle Mouton

sqldb/sqlc: add IsPublicV2Node query

Add SQL query to determine if a node has public v2 channels. Unlike
v1 which requires all four individual signatures, v2 channels are
considered public when the single aggregated signature is present.

73/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 3/100

This commit adds a new database query helper that checks whether a Lightning node has any 'version 2' public channels. It is purely additive and does not change any existing behavior or fix a known bug. There is no indication in the commit that this is a security patch.

Lower-prioritydocs: update release notesby Elle Mouton · 25bbb390 · Feb 13, 2026 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Elle Mouton

docs: update release notes

Update the Database section to reference both PRs that prepare the
graph DB for gossip v2 support:
- PR 10339: node handling
- PR 10379: channel handling (this PR)

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Uses a recognizable type or scope✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
AI analysis · Informational 15/100

This commit only updates the release notes documentation. It adds a second pull request link to an existing note about preparing the graph database for a future protocol feature (gossip v2). No code, logic, or configuration changes are present in the diff.

Lower-prioritygraph/db: refactor TestNodeIsPublic to use require assertionsby Elle Mouton · 86732fae · Feb 13, 2026 · 1 fileMessage 75 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: refactor TestNodeIsPublic to use require assertions

Replace verbose t.Fatal patterns with concise require assertions
following the project's testing guidelines.

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a pure test-code cleanup. It replaces verbose error-checking patterns in a single unit test with shorter, equivalent assertion helpers. There is no change to production code, no change to behavior, and no security relevance.

Lower-prioritygraph/db: add v2 channel announcement fields to ChannelEdgeInfoby Elle Mouton · 6842252b · Feb 13, 2026 · 2 filesMessage 73 · AdequateInformational 12Details
Commit message · Elle Mouton

graph/db: add v2 channel announcement fields to ChannelEdgeInfo

This commit extends ChannelEdgeInfo to support v2 (taproot) channel
announcements by adding:
- MerkleRootHash for the optional Merkle tree commitment
- ExtraSignedFields for additional signed TLV fields
- ChannelV2Fields struct to encapsulate v2-specific optional fields
- NewV2Channel constructor for creating v2 channel edges
- FundingPKScript handling for MuSig2 key aggregation with optional
taproot tweaks

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 12/100

This commit adds new data fields and code to support version 2 (Taproot) Lightning channels in LND's graph database. It does not fix a bug or close a security hole; it is a feature addition that lets the software understand and store newer channel announcement formats, including optional Merkle tree commitments and MuSig2 aggregated public keys. There is no indication in the commit or supplied references that this change addresses a security vulnerability.

Security candidatemulti: update models.ChannelAuthProof with v2 fieldby Elle Mouton · 7a260ee1 · Feb 13, 2026 · 11 filesMessage 78 · AdequateLow 32Details
Commit message · Elle Mouton

multi: update models.ChannelAuthProof with v2 field

Also update it to more closely match the persisted version which has the
v1 and v2 only fields as optional.

Refactor ChannelAuthProof to support both v1 and v2 channel
announcements:

- Add Version field to distinguish v1 from v2 proofs
- Wrap v1-specific fields (NodeSig1/2, BitcoinSig1/2) in fn.Option
since v2 doesn't use them
- Add optional Signature field for v2's single schnorr signature
- Add constructor functions NewV1ChannelAuthProof and
NewV2ChannelAuthProof to enforce correct initialization
- Add getter methods (NodeSig1(), BitcoinSig1(), etc.) that safely
unwrap options, returning empty slices when not present

The IsEmpty() check is updated to handle both versions correctly.
Both stores validate v1-only for now.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundarydefensive validationauthentication path
AI analysis · Low 32/100

This commit refactors how Lightning Network channel authentication proofs are represented in the lnd codebase. It adds support for a future v2 channel announcement format (using a single Schnorr signature) while keeping v1 (four ECDSA signatures) as the only currently supported version. The change is structural and preparatory; it does not appear to fix an active security bug, nor does it introduce obvious new vulnerabilities. Both database stores explicitly reject v2 proofs for now.

Lower-prioritymulti: add ToChannelAnnouncement helper on ChannelEdgeInfoby Elle Mouton · 830b9db6 · Feb 13, 2026 · 5 filesMessage 85 · StrongInformational 18Details
Commit message · Elle Mouton

multi: add ToChannelAnnouncement helper on ChannelEdgeInfo

So that we have one place that converts from our `models` struct to the
`lnwire.ChannelAnnouncement` struct.

The commit also refactors netann.CreateChanAnnouncement to only take a
ChannelEdgeInfo and get the proof from there instead of needing the
proof to be passed in separately.

Add ToChannelAnnouncement() method to ChannelEdgeInfo that converts
the model struct to a lnwire.ChannelAnnouncement1 message. This:

- Centralizes the conversion logic in one place instead of scattered
across multiple call sites
- Validates that AuthProof is present (can't create announcement
without proof)
- Currently only supports v1 channels, returning error for v2

Refactor netann.CreateChanAnnouncement to use this helper and remove
the separate chanProof parameter since proof is now accessed from
within ChannelEdgeInfo. This improves encapsulation and reduces
parameter count.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
defensive validation
AI analysis · Informational 18/100

This commit is a code cleanup: it moves the logic that builds a Lightning network channel announcement message into a single helper method on the channel data object. It also makes an existing function use that helper instead of duplicating the conversion code. There is no direct security fix here, but centralizing the logic reduces the chance of future bugs where different code paths build announcements differently. The helper also adds a small safety check that refuses to build an announcement if required proof data is missing.

Lower-prioritygraph/db: add FundingPKScript method on ChannelEdgeInfoby Elle Mouton · 06a669bc · Feb 13, 2026 · 4 filesMessage 73 · AdequateInformational 13Details
Commit message · Elle Mouton

graph/db: add FundingPKScript method on ChannelEdgeInfo

Add FundingPKScript() method that returns the funding output's
pkScript for the channel. The implementation is version-aware:

- V1: generates a 2-of-2 multisig P2WSH script from the two bitcoin
keys
- V2: will use taproot script (to be implemented)

This encapsulates the script generation logic and makes it clear
which bitcoin keys are being used. Replaces direct calls to
genMultiSigP2WSH with the cleaner method call.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 13/100

This commit is a routine code cleanup in LND's channel graph database. It moves the logic for generating a Bitcoin funding script into a dedicated method on a data structure, replacing a few direct helper function calls. There is no security fix or vulnerability here.

Lower-prioritygraph/db: add version parameter to DeleteChannelEdgesby Elle Mouton · a73189cc · Feb 13, 2026 · 5 filesMessage 73 · AdequateLow 27Details
Commit message · Elle Mouton

graph/db: add version parameter to DeleteChannelEdges

Thread the gossip version through DeleteChannelEdges to enable
version-aware channel deletion. The KVStore rejects non-v1 versions
while SQLStore properly passes the version to the underlying queries.
This prepares for v2 channel zombie handling (strict zombie pruning
for v2 is marked as TODO).

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 27/100

This commit changes how LND deletes Lightning channel records from its graph database. It adds a 'version' parameter so the code can distinguish between older (v1) and newer (v2) channel announcement formats. Right now it mostly hard-codes v1 and explicitly rejects or errors on v2 in some paths, so it is a preparatory/refactoring change rather than a finished security fix. There is no evidence in the commit that this resolves an active vulnerability or that it was released as a security patch.

Security candidategraph/db: update SQLStore to read and write v2 channelsby Elle Mouton · fa24d336 · Feb 13, 2026 · 2 filesMessage 78 · AdequateLow 30Details
Commit message · Elle Mouton

graph/db: update SQLStore to read and write v2 channels

Extends the SQL store to support v2 (taproot) channel announcements:
- Add version validation in AddChannelEdge
- Store v2-specific fields: FundingPkScript, MerkleRootHash, Signature
- Update buildEdgeInfoWithBatchData to reconstruct v2 channels from DB
with optional bitcoin keys and funding script handling
- Add WithMerkleRootHash edge modifier for ChannelV2Fields

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Low 30/100

This commit extends LND's SQL graph database to store and retrieve a newer type of Lightning channel announcement (called 'v2' or 'taproot' channels). It adds support for new fields like funding scripts, Merkle root hashes, and a single signature, and it replaces hard-coded 'v1 only' checks with version-aware logic. There is no direct evidence in the commit that this fixes an active security bug; it reads as a feature-completion change to support a new protocol version.

Lower-prioritygraph/db: make some ChannelEdgeInfo fields optionalby Elle Mouton · 44f41714 · Feb 13, 2026 · 4 filesMessage 73 · AdequateInformational 20Details
Commit message · Elle Mouton

graph/db: make some ChannelEdgeInfo fields optional

Since not all will be required for V2 channels.

Wrap BitcoinKey1Bytes and BitcoinKey2Bytes in fn.Option since these
fields are only required for v1 channel announcements. V2 channels may
or may not have bitcoin keys present in their announcement.

NewV1Channel constructor wraps the bitcoin keys with fn.Some().
All access sites updated to unwrap the options, using UnwrapOr for
non-critical paths and UnwrapOrErr where the keys must be present
(e.g., KV serialization, ToChannelAnnouncement).

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 20/100

This commit changes how Lightning Network channel announcement data is stored so that two public-key fields (BitcoinKey1Bytes and BitcoinKey2Bytes) are now optional rather than always required. This is preparation for a newer channel-announcement format (V2) where those keys may not be present. The change itself is a data-model refactor, not a fix for an active bug or vulnerability. It adds explicit error handling when those keys are unexpectedly missing in places that still require them, which is a defensive improvement.

Security candidategraph/db: add version parameter to createEdge test helperby Elle Mouton · 6bb3bdc8 · Feb 13, 2026 · 1 fileMessage 88 · StrongInformational 15Details
Commit message · Elle Mouton

graph/db: add version parameter to createEdge test helper

Extend the createEdge test helper to accept a gossip version, enabling
creation of both v1 and v2 test channels. V2 channels include the
appropriate auth proof (single signature), merkle root hash, and
funding script fields.

88/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit only changes test code. It extends a helper function used in unit tests so it can create both old-style (v1) and new-style (v2) fake Lightning channels for testing. No production code is modified, so it cannot directly affect real users or funds.

Lower-prioritymulti: add and use V1 constructor for models.ChannelEdgeInfoby Elle Mouton · ba6222b5 · Feb 13, 2026 · 18 filesMessage 83 · StrongLow 27Details
Commit message · Elle Mouton

multi: add and use V1 constructor for models.ChannelEdgeInfo

This makes it clear what fields must/can be set for a V1 channel.

Introduce NewV1Channel constructor to create v1 channel edges with
proper initialization and validation. The constructor:

- Takes required fields (chanID, chainHash, node keys) as parameters
- Takes v1-specific fields (bitcoin keys, extra opaque data) via
ChannelV1Fields struct
- Accepts optional fields (capacity, channel point, features, proof)
via functional options (WithCapacity, WithChannelPoint, etc.)
- Validates that if an AuthProof is provided, its version matches the
channel version

This makes it clear which fields are required vs optional for v1
channels and prevents incorrectly initialized channel edges. All
tests and production code updated to use the constructor.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validation
AI analysis · Low 27/100

This commit is a code-quality and safety refactor for LND's Lightning channel graph data structures. It introduces a single, controlled constructor for creating V1 channel records, replacing many places where fields were set by hand. The change makes it harder to accidentally create an invalid or inconsistent channel record, and adds a check that any attached proof matches the channel version. It is not an obvious security fix for an active vulnerability, but it reduces the risk of future bugs in how the network graph is built and validated.

Lower-prioritygraph/db: use route.Vertex for channel keysby Elle Mouton · 34f74c71 · Feb 13, 2026 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: use route.Vertex for channel keys

Replace [33]byte with route.Vertex for NodeKey1Bytes, NodeKey2Bytes,
BitcoinKey1Bytes, and BitcoinKey2Bytes in ChannelEdgeInfo. Since
route.Vertex is defined as [33]byte, this change is functionally
equivalent but provides better type safety and consistency with the
rest of the routing subsystem.

OtherNodeKeyBytes is also updated to return route.Vertex.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup in LND's channel graph database. It swaps one Go data type for another equivalent one (route.Vertex, which is defined as exactly the same 33-byte array) when storing public keys in channel records. There is no functional change, no bug fix, and no security-relevant behavior change.

AI review queuedmulti: add version to models.ChannelEdgeInfoby Elle Mouton · 4480352d · Feb 13, 2026 · 18 filesMessage 68 · AdequateInformational 19Details
Commit message · Elle Mouton

multi: add version to models.ChannelEdgeInfo

And set it to V1 version everywhere.

Add a Version field to ChannelEdgeInfo to distinguish between v1 and
v2 channel announcements. Set it to GossipVersion1 for all existing
channels.

Both KV and SQL stores now validate that only v1 channels are
currently supported, returning an error for v2 channels. The KV store
automatically sets version to v1 when deserializing (since all
persisted channels in KV format are v1).

This versioning is essential for handling the different field
requirements and validation logic between v1 and v2 channels.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
defensive validationsecond-pass: broader security terminology
AI analysis · Informational 19/100

This commit adds a version field to Lightning Network channel records and makes the code reject version 2 channels for now. It is a forward-looking structural change, not a fix for an active security bug. The new validation prevents the node from accidentally storing or relaying channel announcements it does not yet understand, which reduces the risk of future misbehavior but does not by itself stop any known current attack.

Security candidategraph/db: remove unused sig field from ChannelEdgePolicyby Elle Mouton · 6fda2e8d · Feb 13, 2026 · 2 filesMessage 78 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: remove unused sig field from ChannelEdgePolicy

Remove the cached parsed signature field and its lazy getter method
from ChannelEdgePolicy. This field was unused throughout the codebase
and the signature is already stored as raw bytes in SigBytes.

The SetSigBytes method is updated to remove the cache invalidation
logic.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit removes an unused internal cache field that stored a parsed cryptographic signature alongside the raw signature bytes. It is a straightforward code cleanup with no security-relevant behavior change: callers still access the raw signature bytes, and the only consumer is updated to set the field directly instead of through a helper method.

Security candidatesqldb/sqlc: update graph CreateChannel query for v2by Elle Mouton · ec46480a · Feb 13, 2026 · 2 filesMessage 78 · AdequateInformational 15Details
Commit message · Elle Mouton

sqldb/sqlc: update graph CreateChannel query for v2

Add three new optional fields to the CreateChannel SQL query to
support v2 channel announcements:
- signature: single schnorr signature (replaces four ECDSA sigs)
- funding_pk_script: the funding output script
- merkle_root_hash: for taproot channels

These fields are NULL for v1 channels and populated for v2 channels.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit updates a database query used to store Lightning Network channel announcements. It adds three new optional fields needed for newer 'v2' channel types (a single Schnorr signature, the funding output script, and a Merkle root hash). For older 'v1' channels these fields are left empty/NULL. There is no security fix or vulnerability here; it is a straightforward schema/query update to support a new channel format.

Lower-prioritygraph/db: add helper variable for testsby Elle Mouton · d8337be9 · Feb 13, 2026 · 3 filesMessage 70 · AdequateInformational 15Details
Commit message · Elle Mouton

graph/db: add helper variable for tests

Add an isSQLDB variable that will let us quickly check in tests if the
backing DB is KVStore or SQLStore.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a test-only helper variable (isSQLDB) to three test setup files. It does not change any production code, network behavior, or security-sensitive logic. There is no security issue here.