LL
← All projectsLightning Labs

LND

Go implementation of a complete Lightning Network node.

BitcoinLightning NetworkNormal
Repository coverage

1386 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

141security candidates194second-pass queue1285AI analyses
73commits · 30 days
173commits · 60 days
596commits · 180 days
1234commits · 365 days
Backfill bands
Aug 5 → Feb 6405 seen5 candidatesComplete
Feb 6 → Jun 6665 seen28 candidatesComplete
Jun 6 → Jul 689 seen4 candidatesComplete
Jul 6 → Aug 569 seen0 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

67/100 average clarity
318Strong · 80–100
646Adequate · 60–79
391Thin · 40–59
31Opaque · 0–39
1security candidate with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Olaoluwa Osuntokun20942204474
Elle Mouton26832268167
ziggie44416413165
Yong28513171
LNBiG111173
Jared Tobin909171
bitromortac531051069
yyforyongyu83861068
Erick Cestari26726070
Andras Banki-Horvath11311072
Gijs van Dam33230073
ziggieXXX2026070
Analysis record

Published AI watches

Last scanned 59 minutes ago

Moderate 62 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11212 from ziggie1984/disable-legacy-channels

This change stops LND from opening new Lightning channels using the old 'legacy' commitment format. The legacy format makes it harder to recover funds if something goes wrong, because the money owed to you is tied to a secret key that chan…

Prevents opening new channels with the legacy commitment type, whose tweaked to_remote output complicates data-loss recoveryCloses a negotiation path where an empty channel_type TLV bypassed feature checks and forced a legacy channelAdds explicit RPC and wire rejection with a dedicated error code
112cb5f3by ziggieXXX+265−4716 files
Vendor flagged security relevance
Moderate 56 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11223 from gijswijs/legacy-dust-retribution-fix

This update fixes a bug in how LND handles old-style punishment transactions when a channel partner tries to cheat. Previously, tiny (dust) HTLCs were left as blank placeholder entries in the punishment data, which could cause the node to …

nil-pointer dereference risk in breach retribution pathlegacy revocation log handling inconsistency with modern formatdefensive hardening added for trimmed/dust HTLCs
500ca51fby ziggieXXX+168−146 files
No security note in commit
Moderate 62 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11190 from Roasbeef/zpay32-reject-duplicate-payment-hashes

This change tightens how LND reads Lightning invoices (BOLT 11). Previously, if an invoice contained more than one payment hash field, LND would silently keep the first one and ignore the rest. Now it rejects the invoice entirely. The rele…

Behavior change from 'use first duplicate field' to 'reject duplicate fields'New error type ErrDuplicatePaymentHash returned on duplicate payment hash fieldsMalformed/unsupported-length duplicate payment hash now treated as duplicate and rejected
86306f89by Yong+147−106 files
No security note in commit
Moderate 62 AI analysisMessage 98 · Strong
LL Lightning LabsLND BitcoinLightning Network

zpay32: reject duplicate payment hash fields

This change tightens how LND reads Lightning invoices. Previously, if an invoice contained more than one payment hash field, LND would silently keep the first valid one and ignore the rest. Now it rejects such invoices outright. This preve…

Behavioral change from silent first-field acceptance to explicit rejection of duplicate payment hash fieldsPrevents invoice parsing from depending on field ordering when multiple payment hashes are presentCovers malformed first field + valid second field, closing a potential bypass
e2f27063by Olaoluwa Osuntokun+147−106 files
Vendor flagged security relevance
Moderate 53 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11132 from yyforyongyu/task-11129-pong

This change fixes how LND answers network 'ping' messages from other Lightning nodes. Previously, LND would sometimes silently ignore valid pings to limit reply traffic, which violates the Lightning protocol (BOLT 1) and could make a peer …

Protocol compliance fix: BOLT 1 requires a Pong for every valid PingRemoved silent suppression of Pong replies that could cause peer timeout/misbehaviorUnified rate limiting now accounts for amplification bandwidth, not just ping count
d3d1f1d0by Olaoluwa Osuntokun+274−1715 files
Vendor flagged security relevance
Low 33 AI analysisMessage 90 · Strong
LL Lightning LabsLND BitcoinLightning Network

itest: stop creating legacy channels

This commit updates LND's integration tests to stop using an obsolete 'legacy' channel type and adds a test confirming that LND now rejects that legacy type. The commit message says the real fix is elsewhere in the same pull request: previ…

Deprecated commitment format (legacy) is now rejected by RPCTest added to verify legacy channel type is refusedUnused legacy node configuration flag removed
03d8b09dby ziggie+24−85 files
No security note in commit
Moderate 60 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11198 from gijswijs/amp-setlocal-reconstruction-fix

This change fixes a bug in LND's handling of AMP (Atomic Multi-Path) payments. Previously, if one partial payment set failed to reconstruct its secret preimage, the entire invoice was canceled, including unrelated partial payment sets from…

Denial-of-service against reusable static AMP invoices by causing unrelated accepted HTLC sets to be canceledIncorrect invoice state transition from set-local failure to global invoice cancellationAvailability impact on multi-payer AMP invoice scenarios
88959aecby Olaoluwa Osuntokun+155−44 files
Vendor flagged security relevance
Low 29 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11200 from ziggie1984/build-go-1.27.1

This commit updates the Go programming language version used to build LND from 1.25.13/1.26.6 to 1.26.8 (language version) and 1.27.1 (toolchain). It also regenerates many automatically generated RPC files and adjusts linter settings. The …

Go version bump may indirectly address unlisted runtime/standard-library security fixesLarge regenerated protobuf files suggest dependency/toolchain refresh rather than logic changeLinter configuration expanded to suppress new checks, consistent with a toolchain upgrade
ef4820e5by Olaoluwa Osuntokun+4932−412670 files
No security note in commit
Informational 15 AI analysisMessage 92 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: adopt focused golangci-lint v2.13 checks

This commit is a routine build-maintenance change. It updates the project's Go linter configuration to a newer version and fixes the resulting style warnings: a WebSocket header spelling and several documentation comments that didn't start…

bada7ea3by ziggie+27−1911 files
No security note in commit
Informational 15 AI analysisMessage 68 · Adequate
LL Lightning LabsLND BitcoinLightning Network

lnrpc: regenerate protos with Go 1.27

This commit is a housekeeping change that regenerates automatically generated RPC binding files using a newer Go compiler version. The only differences are in code comments (doc-comment formatting), not in actual program logic or API behav…

dd523108by ziggie+4501−369826 files
No security note in commit
Informational 20 AI analysisMessage 100 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: fix Go 1.27 compatibility

This commit is a routine build-and-test maintenance patch to make the LND codebase compile and pass tests with the upcoming Go 1.27 release. It upgrades the project's custom linter tool, refreshes many indirect tool dependencies, adjusts o…

No production code changesNo vulnerability fix or CVE reference presentDependency-only refresh in tools module (development tooling)
6b54a387by ziggie+365−3706 files
No security note in commit
Informational 15 AI analysisMessage 80 · Strong
LL Lightning LabsLND BitcoinLightning Network

build: bump Go language and toolchain versions

This commit is a routine maintenance update that changes which version of the Go programming language is used to build the lnd project. It does not change any application logic, fix a bug, or address a security vulnerability. The project i…

b1f9ca66by ziggie+39−3930 files
No security note in commit
Moderate 60 AI analysisMessage 83 · Strong
LL Lightning LabsLND BitcoinLightning Network

invoices: cancel only the failing AMP set on reconstruction failure

This commit fixes a bug in LND's invoice handling for reusable AMP (Atomic Multi-Path) invoices. Previously, if one payment set failed to reconstruct its preimage, the entire invoice was canceled, even though other valid payment sets on th…

Denial-of-service-like availability impact: a malicious or buggy payer could cause a whole reusable AMP invoice to be canceled, blocking legitimate concurrent payersSet-local failure incorrectly escalated to invoice-global cancellationRegression test added for concurrent-set survival after reconstruction failure
d74ab6faby Gijs van Dam+141−42 files
No security note in commit
Low 34 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11061 from bitromortac/2604-bolt12-1f

This commit adds the missing cryptographic signature layer for BOLT 12 offers in LND. It builds a Merkle tree from the message fields, signs that tree with a BIP-340 Schnorr signature, and now rejects invoice requests and invoices whose si…

Adds BIP-340 Schnorr signature verification for BOLT 12 invoice_request and invoice messagesMerkle tree commits to canonical re-encoded TLV records; non-minimal feature/amount encodings now rejected to preserve byte-exactnessSignature TLV type 240 and reserved range 240-1000 excluded from the signed Merkle root
1049d301by Yong+2076−7815 files
Vendor flagged security relevance
Low 35 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11125 from bhandras/codex/reorg-aware-output-lock-20260825

This commit adds a new optional wallet feature to LND that lets users lock UTXOs until the transaction spending them reaches a chosen confirmation depth, instead of relying on a wall-clock timeout. It is a feature addition with safety chec…

New RPC fields release_after_spend_confs and confirmed_spend_height added to LeaseOutput and FundPsbtCustom lock ID enforced as required for confirmation-controlled FundPsbt leases; all-zero and reserved internal IDs rejectedCapability check (ResolveOutputLeaser) prevents silent downgrade to time-only lease when confirmation control is requested
80dde144by Yong+1293−10021 files
No security note in commit
Informational 19 AI analysisMessage 58 · Thin
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10812 from ziggie1984/chanstate-kv-store-move

This commit is a large internal code reorganization for the LND Lightning node. It moves channel state storage logic from the `channeldb` package into a new `chanstate` package, while keeping the same database keys, serialization formats, …

Large refactoring with no change to cryptographic or consensus-critical logicCodec serialization moved verbatim to new package; wire format unchangedDatabase bucket keys and TLV record types preserved
62b0a073by Olaoluwa Osuntokun+3923−310924 files
No security note in commit
Low 25 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #10804 from GeorgeTsagk/close-immediately-itest-lnd-7c38

This change fixes a data-handling bug in LND's channel-opening code. When opening a Lightning channel using an optional 'auxiliary funding controller' (used for custom channel types such as Taproot Assets), the funding manager was previous…

Data-correctness fix in funding handshake: negotiated channel configs now exposed to auxiliary funding controllerAuxiliary funding controller receives incomplete channel state before patch, complete state after patchNo explicit security claim, CVE, or advisory referenced in commit or supplied materials
1e127653by Olaoluwa Osuntokun+291−254 files
No security note in commit
Moderate 60 AI analysisMessage 88 · Strong
LL Lightning LabsLND BitcoinLightning Network

bolt12: verify invoice_request and invoice signatures on read

This change makes LND's BOLT 12 invoice and invoice-request reader actually check that the digital signature is valid, instead of only checking that a signature field exists. Before, an attacker could craft or modify a BOLT 12 message and …

Missing cryptographic verification on parsed BOLT 12 messages replaced with BIP-340 Schnorr signature verificationReader accepted any 64-byte placeholder signature before the patchNew negative tests verify rejection of wrong-signer and tampered Merkle-root fields
aa8bd19fby bitromortac+272−723 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 78 · Adequate
LL Lightning LabsLND BitcoinLightning Network

itest: cover confirmation-controlled leases

This commit only adds a new integration test for an existing feature called confirmation-controlled leases. It does not change production code, so it cannot introduce a security vulnerability or fix one directly. The test exercises how lon…

a1ab4e92by Andras Banki-Horvath+152−02 files
No security note in commit
Moderate 68 AI analysisMessage 73 · Adequate
LL Lightning LabsLND BitcoinLightning Network

Merge pull request #11122 from gijswijs/websocket-proxy-hardening

This update fixes two security-related bugs in LND's REST WebSocket proxy. First, a specially crafted WebSocket protocol header could crash the proxy (a panic). Second, the proxy previously had no limit on how large an incoming WebSocket m…

panic fix in request header parsingunbounded incoming WebSocket message read now cappedincorrect header value assignment possible before fix
c662f853by Yong+227−104 files
Vendor flagged security relevance
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedmulti: fix linter issuesby Olaoluwa Osuntokun · 65d04f34 · Apr 13, 2026 · 26 filesMessage 28 · OpaqueInformational 15Details
Commit message · Olaoluwa Osuntokun

multi: fix linter issues

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is purely a code cleanup patch titled 'fix linter issues'. It reformats long lines, adds whitespace, replaces if-else chains with switch statements, and adds linter suppression comments. There are no functional changes to how the software behaves, and nothing in the commit message or diff indicates a security fix.

Security candidatelnwallet: regenerate test vectors with BIP-340 HTLC signaturesby Olaoluwa Osuntokun · 1866770f · Apr 13, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Olaoluwa Osuntokun

lnwallet: regenerate test vectors with BIP-340 HTLC signatures

Regenerate the test vector JSON with HTLC second-level transaction
signatures that use BIP-340 standard nonce derivation (zero auxrand)
instead of RFC6979. This makes the HTLC signatures reproducible across
different Schnorr implementations. The commitment transaction MuSig2
signatures are unchanged.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
signing boundaryfuzzing or regression evidencesigning or wallet path
AI analysis · Informational 15/100

This commit only updates test data in a single JSON file. It changes the example signatures used in automated tests so they are generated with a standard BIP-340 nonce method instead of an older RFC6979 method. No production wallet code, protocol logic, or user-facing behavior is changed. There is no security vulnerability here.

AI review queuedmulti: fix linter issuesby Olaoluwa Osuntokun · 890636a1 · Apr 13, 2026 · 6 filesMessage 51 · ThinInformational 15Details
Commit message · Olaoluwa Osuntokun

multi: fix linter issues

Fix gci (extra blank lines) and ll (line length > 80 chars) issues
across contractcourt, input, and watchtower packages.

51/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is purely a code cleanup: it removes extra blank lines, shortens lines that were too long, and adds linter suppression comments where needed. There are no functional changes to the program's behavior, so it does not fix or introduce any security issue.

AI review queuedlnwallet: add support for local nonces map in revoke_and_ackby Olaoluwa Osuntokun · 55ab4b03 · Apr 13, 2026 · 2 filesMessage 65 · AdequateLow 34Details
Commit message · Olaoluwa Osuntokun

lnwallet: add support for local nonces map in revoke_and_ack

We only ever set a single nonce, but we'll check both fields to make
sure that at least one of them is set.

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Low 34/100

This commit updates the LND Lightning wallet so that RevokeAndAck messages can carry a new map of nonces keyed by funding transaction ID, while still accepting the older single-nonce field. It is a backwards-compatibility and protocol-extension change for Taproot channels, not a fix for an active bug or exploit. The code now validates that at least one nonce field is present and that any map entry matches the channel's funding transaction.

Lower-priorityitest+input: add production taproot channel integration testsby Olaoluwa Osuntokun · d15b9616 · Apr 13, 2026 · 4 filesMessage 83 · StrongInformational 15Details
Commit message · Olaoluwa Osuntokun

itest+input: add production taproot channel integration tests

This commit adds comprehensive integration test coverage for production
taproot channels to validate end-to-end functionality in realistic scenarios.
The tests verify that production taproot channels can be successfully opened,
operated, and closed using the finalized taproot specification with optimized
scripts and feature bits 80/81.

The integration tests cover channel opening with the SIMPLE_TAPROOT_FINAL
commitment type, ensuring that the complete channel lifecycle works correctly
with production taproot features. Test utilities have been enhanced to support
production taproot channel creation and validation, providing the necessary
infrastructure for comprehensive testing scenarios.

Additional unit tests have been added to the input package to validate size
calculations and witness generation for production taproot witness types.
These tests ensure that the new Final witness types produce correctly sized
witnesses and transactions, maintaining the expected efficiency benefits of
the optimized script structure.

The test coverage helps ensure that production taproot channels operate
correctly across all system components while maintaining compatibility with
existing channel types and providing confidence in the production readiness
of the implementation.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validation
AI analysis · Informational 15/100

This commit only adds new automated tests and test helpers for a new Lightning channel type called SIMPLE_TAPROOT_FINAL. It does not change any production code that handles real user funds or network messages. The tests verify that the new channel type can be opened, reconnected, confirmed, and closed correctly, and that its Bitcoin scripts are smaller than the older staging versions. There is no security fix or vulnerability here.

Lower-priorityfunding: add production taproot channel negotiation supportby Olaoluwa Osuntokun · 27ae0cb5 · Apr 13, 2026 · 3 filesMessage 83 · StrongInformational 19Details
Commit message · Olaoluwa Osuntokun

funding: add production taproot channel negotiation support

This commit extends the funding manager's commitment type negotiation logic
to handle production taproot channels. The negotiation system now recognizes
and properly processes requests for channels using the final taproot
specification with feature bits 80/81 and optimized script structures.

The commitment type negotiation has been enhanced to distinguish between
staging and production taproot variants during the channel opening process.
When a production taproot channel is requested, the negotiation logic ensures
that both parties support the necessary feature bits and applies the
appropriate channel type configuration including the TaprootFinalBit flag.

Comprehensive test coverage has been added to validate the negotiation
behavior for production taproot channels, ensuring that the funding process
correctly handles feature bit validation, commitment type mapping, and error
conditions. The tests verify that production taproot channels are only
established when both peers indicate support for the finalized taproot
features.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
defensive validation
AI analysis · Informational 19/100

This commit adds support for negotiating a new, finalized version of Taproot payment channels in the Lightning Network Daemon (LND). It is a feature addition that lets two LND nodes agree to use the production-ready Taproot channel format when both sides advertise the new feature bits. The change also includes tests and fixes a small consistency check in existing tests. There is no direct evidence in the commit that this fixes an active security vulnerability.

Lower-prioritylnwire: add local_nonces field to revoke_and_ackby Olaoluwa Osuntokun · 09acceda · Apr 13, 2026 · 2 filesMessage 45 · ThinInformational 11Details
Commit message · Olaoluwa Osuntokun

lnwire: add local_nonces field to revoke_and_ack

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 11/100

This commit adds a new optional data field called local_nonces to a Lightning network control message (revoke_and_ack). It is part of the protocol plumbing for a feature called splice nonce coordination. There is no indication in the commit that this fixes a security bug; it appears to be a feature addition or protocol update.

Lower-priorityinput: thread script options through taproot HTLC functionsby Olaoluwa Osuntokun · 60b3d2c9 · Apr 13, 2026 · 2 filesMessage 73 · AdequateInformational 19Details
Commit message · Olaoluwa Osuntokun

input: thread script options through taproot HTLC functions

This commit extends the taproot HTLC script generation functions to accept
TaprootScriptOpt parameters, enabling callers to specify whether production
or staging script variants should be generated. The SenderHTLCScriptTaproot
and ReceiverHTLCScriptTaproot functions now accept a variadic opts parameter
that is forwarded to the underlying script tree construction.

This change provides the necessary infrastructure for the wallet and contract
resolution systems to generate the appropriate script trees based on channel
type. Production taproot channels can now pass the WithProdScripts() option
to generate optimized scripts using OP_CHECKSIGVERIFY, while staging channels
continue to use the existing development script structure.

The modification maintains backward compatibility by making the opts parameter
variadic with sensible defaults. Existing callers that do not specify options
will continue to generate staging scripts as before, ensuring no disruption
to current functionality while enabling future production script support.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 19/100

This commit is a plumbing change for Lightning Network's taproot HTLC script generation. It adds optional parameters so callers can choose between 'staging' (development) and 'production' script variants. By default, existing callers continue using staging scripts, so behavior is unchanged. There is no direct security fix or vulnerability here; it is infrastructure preparation for a future production feature.

AI review queueditest: extend relevant itests to cover taproot chans finalby Olaoluwa Osuntokun · 5bbfdc62 · Apr 13, 2026 · 9 filesMessage 50 · ThinInformational 19Details
Commit message · Olaoluwa Osuntokun

itest: extend relevant itests to cover taproot chans final

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit only adds and updates integration tests for a new Lightning channel type called 'simple taproot final'. It does not change the actual production code that handles money or network messages, so it does not introduce or fix a security vulnerability by itself. It is test-only work that exercises existing channel features such as opening, force-closing, payments, backups, and revocations under the new channel type.

AI review queuedlnrpc/walletrpc: add witness types for taproot chans finalby Olaoluwa Osuntokun · d86b8400 · Apr 13, 2026 · 4 filesMessage 50 · ThinInformational 19Details
Commit message · Olaoluwa Osuntokun

lnrpc/walletrpc: add witness types for taproot chans final

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit adds new witness type labels for Taproot Lightning channels to LND's wallet RPC. It is essentially a protocol/API bookkeeping change: it exposes new enum values so the wallet RPC can report or handle additional Taproot channel sweep types. There is no direct evidence in the diff of a security vulnerability being fixed; it appears to be a feature or completeness update for production Taproot channels.

Lower-prioritywatchtower: prepare infrastructure for production taproot supportby Olaoluwa Osuntokun · 597af82f · Apr 13, 2026 · 1 fileMessage 85 · StrongInformational 15Details
Commit message · Olaoluwa Osuntokun

watchtower: prepare infrastructure for production taproot support

This commit adds preparatory infrastructure and TODO markers in the watchtower
justice kit generation for future production taproot channel support. The
changes establish placeholders for channel type detection and script option
selection that will be needed when watchtowers begin handling breach scenarios
for production taproot channels.

The current implementation includes commented code structures that demonstrate
the intended approach for integrating production script options into the
justice transaction generation process. When channel type information becomes
available in the BreachRetribution structure, these placeholders can be
activated to ensure that watchtowers generate justice transactions using the
appropriate script optimization level.

This preparatory work ensures that the watchtower system has a clear path
toward production taproot support while maintaining current functionality
for staging taproot and legacy channels. The TODO comments provide explicit
guidance for future development when watchtower breach handling for production
taproot channels is implemented.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 15/100

This commit is purely preparatory: it adds placeholder variables and TODO comments in LND's watchtower code to make future taproot channel support easier. No live behavior changes; it explicitly defaults to existing 'staging' scripts and leaves the new production script option commented out. There is no security issue in this patch itself.

Lower-prioritylnrpc+rpcserver: add production taproot commitment type to RPC interfaceby Olaoluwa Osuntokun · 4ee8bd58 · Apr 13, 2026 · 4 filesMessage 73 · AdequateInformational 20Details
Commit message · Olaoluwa Osuntokun

lnrpc+rpcserver: add production taproot commitment type to RPC interface

This commit extends the Lightning RPC interface to support production taproot
channels by adding a new SIMPLE_TAPROOT_FINAL commitment type. This allows
external clients to explicitly request channels that use the finalized taproot
specification with optimized script structures and feature bits 80/81.

The RPC server has been updated to properly handle the new commitment type
during channel opening operations, mapping the SIMPLE_TAPROOT_FINAL type to
the appropriate internal channel type flags including both SimpleTaprootFeatureBit
and TaprootFinalBit. This ensures that channels opened through the RPC interface
are properly configured with production taproot capabilities.

The existing SIMPLE_TAPROOT commitment type has been clarified in its
documentation to indicate that it represents the staging version using
development scripts, providing clear distinction between the two taproot
variants available to RPC clients. The protobuf definitions and generated
code have been updated accordingly to support this new functionality.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 20/100

This commit adds a new 'production' taproot channel option to LND's remote-control API. It is a feature addition, not a fix for an active security bug. The change lets external apps request a finalized taproot channel type and ensures the server sets the correct protocol flags. There is no direct evidence in the commit of a vulnerability being patched.

AI review queuedlnwallet: integrate production script options in commitment generationby Olaoluwa Osuntokun · 2e0343cc · Apr 13, 2026 · 3 filesMessage 85 · StrongLow 30Details
Commit message · Olaoluwa Osuntokun

lnwallet: integrate production script options in commitment generation

This commit updates the wallet's commitment transaction generation logic to
use appropriate script options based on the channel type. The commitment
builder now determines whether a channel uses production taproot scripts
and passes the WithProdScripts() option accordingly to HTLC script generation
functions.

The changes affect three key areas of the wallet: channel state management,
commitment transaction construction, and funding reservation handling. Each
area now properly detects production taproot channels using the IsTaprootFinal()
method and applies the correct script generation options to ensure consistency
with the channel's script optimization level.

This integration ensures that production taproot channels generate commitment
transactions with optimized script trees using OP_CHECKSIGVERIFY, while
maintaining full compatibility with staging taproot and legacy channel types.
The script option selection is applied consistently across all commitment
transaction scenarios including local commits, remote commits, and HTLC
processing.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 30/100

This commit adds support for a new 'production' version of taproot Lightning channels. It makes sure the wallet picks the correct, optimized Bitcoin scripts when building commitment transactions for this new channel type, while keeping older staging taproot and legacy channels unchanged. There is no direct evidence in the commit that this fixes an active security vulnerability; it reads more like feature completion for a new channel type.

Lower-prioritycontractcourt: implement production taproot witness selectionby Olaoluwa Osuntokun · 269d2c38 · Apr 13, 2026 · 1 fileMessage 73 · AdequateLow 32Details
Commit message · Olaoluwa Osuntokun

contractcourt: implement production taproot witness selection

This commit implements the core logic for selecting appropriate witness types
based on channel type in the contract resolution system. The commit sweep
resolver, HTLC timeout resolver, and HTLC success resolver have been updated
to use production taproot witness types when handling final taproot channels.

For each resolver, the witness type selection follows a consistent three-way
pattern: production taproot channels use Final witness types, staging taproot
channels use the existing taproot witness types, and legacy channels continue
to use their established witness types. This ensures that each channel type
uses the appropriate script structure and witness generation logic.

The HTLC success resolver required the addition of a new production input
constructor to properly handle direct HTLC sweeps on remote commitments with
production taproot channels. The HTLC timeout resolver was updated to handle
both second-level timeout transactions and direct timeout sweeps with the
correct production witness types.

These changes ensure that production taproot channels benefit from the
optimized script structure using OP_CHECKSIGVERIFY while maintaining full
backward compatibility with staging taproot and legacy channel types.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 32/100

This commit updates part of LND's on-chain dispute-resolution code so that a new 'final' taproot channel type uses its own dedicated witness types when spending commitment outputs. It is a feature-completion change that adds the correct script/witness selection for production taproot channels while keeping older channel types on their existing paths. There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be correctness and compatibility work for a new channel type.

Lower-priorityinput: add production taproot witness types for final channelsby Olaoluwa Osuntokun · fc2e01a3 · Apr 13, 2026 · 3 filesMessage 73 · AdequateLow 28Details
Commit message · Olaoluwa Osuntokun

input: add production taproot witness types for final channels

This commit introduces seven new witness types specifically designed for
production taproot channels that use the final optimized script structure.
These witness types correspond to the existing staging taproot witness types
but are intended for channels using the finalized taproot specification with
optimized scripts that employ OP_CHECKSIGVERIFY instead of OP_CHECKSIG + OP_DROP.

The new witness types cover all taproot channel operations including local and
remote commitment spends, second-level HTLC transactions, direct HTLC sweeps,
and revocation scenarios. Each production witness type follows the established
naming convention by appending "Final" to distinguish them from their staging
counterparts.

The witness generation logic for these new types mirrors the existing taproot
implementation but will be used when the channel type indicates a production
taproot channel rather than a staging one. This ensures that the correct
script tree structure and witness format is used for each channel type.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 28/100

This commit adds new witness types and size constants for production taproot channels in LND. It is a feature-completion change that mirrors existing staging taproot logic but uses slightly optimized scripts (OP_CHECKSIGVERIFY instead of OP_CHECKSIG + OP_DROP). There is no direct evidence in the commit that this fixes an active security vulnerability; it appears to be part of maturing taproot channel support.

Lower-prioritycontractcourt: integrate production taproot support in nurseryby Olaoluwa Osuntokun · f9a85986 · Apr 13, 2026 · 9 filesMessage 73 · AdequateLow 33Details
Commit message · Olaoluwa Osuntokun

contractcourt: integrate production taproot support in nursery

This commit completes the production taproot integration by updating the
UTXO nursery to properly handle production taproot channels. The nursery
is responsible for incubating time-locked outputs from commitment transactions
and must use the correct witness types for successful sweeping operations.

The witness type selection logic has been updated in three key areas within
the IncubateOutputs function: incoming HTLC resolution handling, outgoing
HTLC resolution handling, and baby output creation through makeBabyOutput.
Each location now uses a consistent three-way selection pattern that chooses
production taproot witness types for final channels, staging types for
development channels, and legacy types for traditional channels.

A new helper method isProdTaprootResolution has been added to determine
production taproot channels by examining the presence of a ResolutionBlob,
which indicates auxiliary channel information used by production taproot
implementations. The makeBabyOutput function has been converted to a method
to access this helper function.

The NurseryReport function has been updated to include all new Final witness
types in its switch statements, ensuring that production taproot outputs are
properly categorized and reported. This maintains consistency in the nursery's
reporting system while supporting the new witness types.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 33/100

This commit finishes adding support for a new kind of Bitcoin taproot channel in LND's 'UTXO nursery' — the component that looks after time-locked funds after a channel is force-closed. It makes sure the nursery picks the correct transaction-signature format (called a witness type) for production taproot channels, instead of accidentally using the older or staging taproot formats. The change is mostly about completing a feature and preventing sweep failures for the new channel type, not about fixing an obvious exploitable bug.

Lower-prioritycontractcourt: add channel type support to HTLC resolversby Olaoluwa Osuntokun · 6b0c3f5c · Apr 13, 2026 · 5 filesMessage 73 · AdequateLow 32Details
Commit message · Olaoluwa Osuntokun

contractcourt: add channel type support to HTLC resolvers

This commit extends all HTLC contract resolvers to accept and store channel
type information, which is essential for determining whether to use staging
or production taproot witness types during contract resolution. Each resolver
constructor now accepts a channeldb.ChannelType parameter and stores it as
a field within the resolver struct.

The channel arbitrator has been updated to extract channel type information
from the channel state and pass it to all resolver constructors. This ensures
that each resolver has the necessary context to make appropriate decisions
about script generation and witness type selection based on the specific
channel type being resolved.

Helper methods isTaprootFinal() have been added to each resolver to provide
a clean interface for determining when production taproot witness types
should be used. This lays the groundwork for the resolvers to properly
handle both staging and production taproot channels with the correct
script optimizations.

The changes maintain backward compatibility with existing channel types
while providing the infrastructure needed for production taproot channel
support throughout the contract resolution system.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 32/100

This commit prepares LND's on-chain contract-resolution code to distinguish between experimental 'staging' taproot channels and the new 'final' production taproot channels. It passes the channel type into HTLC resolvers and adds helper checks so the correct Bitcoin witness script is chosen when a channel is force-closed. The change itself is infrastructure: it does not fix an active bug, but it prevents a class of future failures where a production taproot channel could be resolved using the wrong script type.

Security candidateinput: add production taproot HTLC succeed input constructorby Olaoluwa Osuntokun · 0720abca · Apr 13, 2026 · 1 fileMessage 78 · AdequateInformational 17Details
Commit message · Olaoluwa Osuntokun

input: add production taproot HTLC succeed input constructor

This commit adds MakeTaprootHtlcSucceedInputFinal, a new input constructor
specifically for creating HTLC success inputs that use production taproot
witness types. This function parallels the existing MakeTaprootHtlcSucceedInput
but creates inputs with the TaprootHtlcAcceptedRemoteSuccessFinal witness type
instead of the staging variant.

The new constructor follows the same pattern and signature as its staging
counterpart, ensuring consistency in the input creation API. This allows
contract resolvers to create the appropriate input type based on whether
they are handling a staging or production taproot channel, ensuring that
the correct witness generation logic is applied during transaction creation.

This addition provides the necessary infrastructure for production taproot
channels to properly construct inputs for sweeping HTLC outputs on remote
commitment transactions with the optimized script structure.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
signing boundary
AI analysis · Informational 17/100

This commit adds a new helper function in LND for creating a specific kind of Bitcoin transaction input used when claiming a Lightning HTLC (a payment locked by a hash/time condition) on a production taproot channel. It mirrors an existing staging-channel helper but uses the final/production witness type. There is no direct evidence in the commit of a security vulnerability; it appears to be infrastructure for an upcoming or recently enabled feature.

Lower-prioritychanneldb: add production taproot channel type supportby Olaoluwa Osuntokun · 749a8e45 · Apr 13, 2026 · 1 fileMessage 85 · StrongInformational 19Details
Commit message · Olaoluwa Osuntokun

channeldb: add production taproot channel type support

This commit introduces the infrastructure necessary to distinguish between
staging and production taproot channels in the channel database. A new
TaprootFinalBit flag is added to the ChannelType enumeration to identify
channels that use the final taproot specification with optimized scripts.

The IsTaprootFinal() method provides a clean interface for determining when
a channel uses production taproot scripts versus the staging implementation.
Production taproot channels are characterized by their use of feature bits
80/81 and optimized script structures that employ OP_CHECKSIGVERIFY for
improved efficiency and reduced transaction sizes.

This channel type distinction is essential for the contract resolution system
to select appropriate witness types and script generation options. The bit
must be set alongside SimpleTaprootFeatureBit to ensure proper channel type
validation and backwards compatibility with existing taproot implementations.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 19/100

This commit adds a new database flag and helper method so LND can tell apart experimental 'staging' taproot channels from the finalized 'production' version. It is a small infrastructure change (11 lines) and does not, by itself, change how funds are secured or how transactions are validated. It simply prepares the code to recognize a new channel variant.

Lower-priorityfeature: add taproot final to feature bit managerby Olaoluwa Osuntokun · 8ce6327c · Apr 11, 2026 · 3 filesMessage 45 · ThinInformational 19Details
Commit message · Olaoluwa Osuntokun

feature: add taproot final to feature bit manager

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 19/100

This commit adds a new advertised protocol feature flag for final/fully-released Taproot channels in LND. It tells other nodes that this LND node supports the finalized version of simple Taproot channels, and it wires up the same dependencies and on/off switch as the earlier 'staging' version. There is no direct security bug in the diff; it is a feature-enablement change.

Lower-prioritybuild: update to actor v0.0.6by Olaoluwa Osuntokun · 48e3a2f9 · Apr 11, 2026 · 2 filesMessage 57 · ThinInformational 15Details
Commit message · Olaoluwa Osuntokun

build: update to actor v0.0.6

57/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Uses a recognizable type or scope! No meaningful explanatory body
AI analysis · Informational 15/100

This commit simply updates a Go module dependency called 'actor' from version 0.0.5 to 0.0.6 and removes a temporary local override. It is a routine build/maintenance change with no visible security implications in the diff itself.

Lower-prioritydiscovery/test: assert ProcessSyncTransition error in sync transition testby Gijs van Dam · cc375a66 · Apr 11, 2026 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Gijs van Dam

discovery/test: assert ProcessSyncTransition error in sync transition test

TestGossipSyncerSyncTransitions calls ProcessSyncTransition but
discards its return value. If the function ever regresses and returns
an error on the happy path, the test would silently pass. Assert
that the returned error is nil.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds a missing error check inside a unit test. It does not change any production code, so it cannot introduce or fix a security vulnerability in the running software. It simply makes the test fail loudly if the function being tested ever starts returning an unexpected error.

Lower-prioritymulti/test: add unit tests for gossip result helpers and context bridgeby Olaoluwa Osuntokun · 532a7032 · Apr 11, 2026 · 5 filesMessage 83 · StrongInformational 15Details
Commit message · Olaoluwa Osuntokun

multi/test: add unit tests for gossip result helpers and context bridge

In this commit, we add test coverage for the new helper functions
introduced as part of the chan error -> Future[error] migration.

discovery/gossip_result_test.go covers AwaitGossipResult (success,
error propagation, and context cancellation) and the idempotency of
completeGossipResult (a second call must never block or overwrite the
first result).

lnutils/context_test.go covers ContextFromQuit, verifying that closing
the quit channel cancels the derived context and that calling cancel()
allows the internal goroutine to exit cleanly without leaking.

actor/future_test.go removes a stale doc comment that was left over
from a prior edit pass.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only adds and updates unit tests. It does not change any production code, so it cannot introduce a security vulnerability or fix one directly. The tests verify that helper functions behave correctly when futures complete, contexts cancel, or goroutines shut down. A test comment that previously described a 'Network Isolation Attack' regression was removed, but the actual regression test remains and the production behavior it exercises was already in place before this commit.

Lower-prioritydiscovery: add gossip result helpers wrapping actor.Future[error]by Olaoluwa Osuntokun · fc348602 · Apr 11, 2026 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Olaoluwa Osuntokun

discovery: add gossip result helpers wrapping actor.Future[error]

In this commit, we add gossip_result.go with three thin wrappers that
form the internal vocabulary for the chan error -> Future[error]
migration.

completeGossipResult(p Promise[error], err error) resolves a gossip
processing promise. A nil error signals success; non-nil signals the
specific gossip failure. Calling it more than once is safe since the
underlying Promise.Complete uses sync.Once, making any repeat call a
no-op. This idempotency is the core property that makes the pattern
safe for deferred message re-processing.

AwaitGossipResult(ctx, f Future[error]) error is the public-facing
counterpart: it blocks until the future resolves or the context is
cancelled, returning whichever error applies. Callers outside the
discovery package (funding, server) use this.

awaitGossipResult is a package-internal alias for AwaitGossipResult,
avoiding the need to qualify the symbol inside the package.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit adds a small helper file in the discovery package that wraps a generic 'future/promise' concurrency pattern for gossip message processing. It does not change behavior, fix a bug, or alter security controls. There is no security issue visible in the diff.

Security candidateactor: add CompleteWith and AwaitFuture generic package-level helpersby Olaoluwa Osuntokun · 4e0992fa · Apr 11, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Olaoluwa Osuntokun

actor: add CompleteWith and AwaitFuture generic package-level helpers

In this commit, we add two package-level generic helpers to the actor
module as part of the broader chan error -> Future[error] migration in
the discovery package.

CompleteWith[T](p Promise[T], val T) is a one-liner convenience wrapper
over p.Complete(fn.Ok(val)). It lets callers complete a promise with a
plain value without constructing an fn.Result inline, which cuts noise
at every completion site.

AwaitFuture[T](ctx, f Future[T]) (T, error) provides the symmetric
receive side: it blocks until the future resolves or the context is
cancelled and returns the value and any context error unpacked from
the fn.Result, matching the (val, err) convention callers expect.

Both functions are deliberately thin (no policy, no timeout, no new
state) so they compose freely with higher-level helpers built on top,
e.g. discovery.AwaitGossipResult.

go.mod is updated to pin the actor module via a local replace directive
so the rest of the lnd module picks up these additions without waiting
for a tagged release.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
access control
AI analysis · Informational 15/100

This commit adds two small helper functions to an internal actor package and updates the Go module file to use the local copy of that package. There is no security-relevant change; it is purely a code cleanup and convenience addition for future development work.