LDK
← All projectsLightning Dev Kit

rust-lightning

Composable Rust libraries for building Lightning wallets, nodes, and services.

BitcoinCryptographic librariesLightning NetworkNormal
Repository coverage

1497 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

225security candidates209second-pass queue1462AI analyses
75commits · 30 days
208commits · 60 days
663commits · 180 days
1491commits · 365 days
Backfill bands
Aug 5 → Feb 6819 seen18 candidatesComplete
Feb 6 → Jun 6468 seen16 candidatesComplete
Jun 6 → Jul 6128 seen8 candidatesComplete
Jul 6 → Aug 561 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

69/100 average clarity
359Strong · 80–100
790Adequate · 60–79
288Thin · 40–59
60Opaque · 0–39
3security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Elias Rohrer15315153667
Matt Corallo35847349473
Jeffrey Czyz17741177168
Wilmer Paulino14939144169
Leo Nash11613116162
Valentine Wallace13710135169
Vincenzo Palazzo10210184
Joost Jager16224162069
elnosh301330056
shaavan22622069
Carla Kirk-Cohen78365068
benthecarman18318071
Analysis record

Published AI watches

Last scanned 23 minutes ago

Low 32 AI analysisMessage 91 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Only fetch TXIDs instead of entire block during gossip verification' (#4846)

This commit changes how the Lightning Dev Kit's block-sync module verifies Lightning network gossip announcements. Instead of downloading entire Bitcoin blocks (which can be large), it now downloads only the list of transaction IDs for a b…

API surface change in UtxoSource traitReduced data exposure: no longer fetches full blocks for gossip verificationNew JSON parsing for txid lists and TxOut values
ebe7a447by Matt Corallo+275−1025 files
No security note in commit
Low 35 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Allow filtered block rescans at the current tip' (#4847)

This commit changes how the Lightning Dev Kit (LDK) node software handles receiving the same block twice through its filtered-block interface. Previously, calling filtered_block_connected with the current tip again would trigger an asserti…

Assertion relaxation in block connection pathPotential denial-of-service vector removed: previously a malicious or buggy filter provider could crash the node by replaying the current tipNew test coverage for same-block filtered rescan
54ddbd0bby Matt Corallo+177−486 files
No security note in commit
Informational 15 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Add test framework coverage of `Listen` block connection replays

This commit only adds a new test mode to the project's internal testing framework. It lets developers simulate a specific way blocks are delivered to the Lightning node (a 'replay' through the Listen interface) so that behavior is covered …

bf6ad23eby Matt Corallo+18−32 files
No security note in commit
Informational 15 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Update functional test block connection to detect block replays

This commit changes only internal test helper code in the Lightning Dev Kit repository. It makes the functional test framework smarter about 'block replays'—situations where the same block is fed to a test node more than once—so the fake b…

No production code modifiedNo cryptographic, consensus, or networking changesCommit message frames change as test-framework correctness, not security
477facb4by Matt Corallo+41−333 files
No security note in commit
Moderate 66 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Correct HTLC confusion on unrevoked counterparty commitment txs

This patch fixes a bug in the Lightning Dev Kit where the software could confuse HTLCs (payment contracts) on live, unrevoked counterparty commitment transactions with ones from old, revoked transactions. Previously, it relied only on whet…

Incorrect revocation state detection for counterparty commitment transactionsHTLC direction not previously checked when matching against pending HTLCsPromotion of debug assertions to full assertions for HTLC claim path consistency
f06a08a6by Matt Corallo+26−192 files
Vendor flagged security relevance
Low 47 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Return `Err`s` instead of panicking on oversized messages

This commit changes how the Lightning networking code handles oversized encrypted messages. Previously, certain conditions would cause the program to crash with a panic. Now the code returns errors instead, which is a defensive improvement…

panic-to-error conversion for oversized message encryption/decryptiondenial-of-service hardening against oversized peer messagesdebug_assert retained to preserve test coverage of invariant violations
08f12bc7by Matt Corallo+68−313 files
Vendor flagged security relevance
Moderate 62 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Avoid panicking when attempting to send an oversized message

This commit fixes a crash bug in the Lightning Dev Kit's peer message handling. Previously, if a message grew too large to be sent over the encrypted peer connection, the code would panic (abruptly terminate the whole program). The patch m…

Replaces a `.expect()` panic path with a fallible `Result` in peer message encryptionAdds graceful peer disconnection when a critical message cannot be sentIncludes a regression test for oversized-message handling
c5fdc3bfby Matt Corallo+148−901 file
Vendor flagged security relevance
High 74 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Avoid oversized relayed failure messages

This patch fixes a crash bug in the Lightning Dev Kit's handling of HTLC failure messages. A downstream peer could send a maximally-sized failure message without attribution data. When the node added its own attribution data while relaying…

Denial-of-service via remote-triggered panic in message encryptionOversized message exceeding Noise/Lightning wire framing limitMissing length validation before adding attribution data during relay
6b1dfb1aby Matt Corallo+64−191 file
Vendor flagged security relevance
Moderate 64 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Reject attempts to advance one-hop blinded forward paths

This commit fixes a denial-of-service bug in rust-lightning where a maliciously crafted one-hop blinded reply path could cause the node to panic when it tried to respond. The fix rejects paths with too few hops before advancing them, and a…

Denial-of-service vector via malformed blinded pathPanic in onion construction due to zero-hop pathUntrusted reply path input validation gap
969a40cfby Matt Corallo+49−14 files
Vendor flagged security relevance
High 72 AI analysisMessage 96 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

lightning-types: replace Zl/Zp separators in `PrintableString`

This commit fixes a log-forgery risk in a Rust Lightning library helper called PrintableString. That helper is meant to make untrusted text safe to print by replacing dangerous characters with a placeholder. It already caught most control …

log injection / log forgery via U+2028/U+2029 line separatorsincomplete input sanitisation in PrintableStringpeer-controlled strings (node alias, BOLT 12 description/issuer/payer_note, peer_msg) as attack surface
75defa9cby Vincenzo Palazzo+63−83 files
Vendor flagged security relevance
Moderate 69 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Apply the unfunded channel peer limit to all unaccepted channels

This commit fixes a rate-limiting bug in the Lightning Dev Kit (LDK) that let a single peer bypass the cap on how many different peers can have unfunded (not-yet-funded) channels open. Previously, if a peer sent multiple channel requests q…

Denial-of-service resource exhaustion via rapid inbound channel open requestsLogic error in rate-limiting conditionRegression test added for the bypass scenario
56a4ee43by Matt Corallo+87−62 files
Vendor flagged security relevance
Moderate 60 AI analysisMessage 88 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Allow filtered block rescans at the current tip

This commit fixes a bug where replaying the current blockchain block through a normal listener callback could crash two core Lightning components (ChannelManager and OutputSweeper) with a panic. The fix recognizes a same-block replay as a …

panic in chain listener callbacksame-block replay/rescan mishandlingassertion failure on valid chain input
686f9860by Elias Rohrer+118−123 files
Vendor flagged security relevance
Moderate 57 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Avoid panic when reorged claims cannot merge

This commit fixes a crash bug in the Lightning Dev Kit's on-chain transaction handler. During a deep blockchain reorganization, a previously settled HTLC claim could be 'resurrected' at a block height where it could no longer be combined w…

Assertion/panic in reorg handling pathDeep blockchain reorg as trigger conditionHTLC claim resurrection after reorg
f1dc8487by Matt Corallo+219−52 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 45 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Update crate repository links to forgejo

This commit simply updates the 'repository' web links in 15 package metadata files from GitHub to a self-hosted Forgejo instance. It does not change any program code, build logic, dependencies, or security behavior. There is no security is…

eb77676dby benthecarman+15−1515 files
No security note in commit
Low 45 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Account for message type prefix len in prevtx length enforcement

This commit fixes a small but real accounting bug in how rust-lightning checks whether a previous transaction (prevtx) attached to a funding input will make the resulting Lightning wire message too large. The code previously compared the m…

Off-by-constant length check in protocol message size enforcementPotential acceptance of a prevtx that produces an oversized Lightning wire messageDenial-of-service / protocol-interop risk from peer message rejection
d29e1415by Wilmer Paulino+21−41 file
No security note in commit
Moderate 54 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Retransmit splice_locked for 0-conf channels missing tx_signatures

This commit fixes a bug in the Lightning Dev Kit where, after a disconnection, a node could fail to retransmit a 'splice_locked' message to a peer that was still waiting for transaction signatures. Without this retransmission, the two peer…

Protocol state desynchronization between channel peers after reconnectionMissing retransmission of splice_locked for 0-conf splice channelsPotential channel unusability or stuck splice negotiation
5434015bby Wilmer Paulino+266−12 files
No security note in commit
Low 37 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

bolt12: add pay_for_bolt12_invoice for externally-sourced invoices

This commit adds a new API, pay_for_bolt12_invoice, that lets users pay a BOLT 12 invoice even if LDK did not originally request it. It is intended for advanced use cases like multi-sender payments and replaces an older, more restrictive A…

New API removes internal invoice-origin verification, shifting trust boundary to callerDocumentation explicitly warns caller to verify invoice via Bolt12Invoice::verify_using_metadata and to ensure unique payment_id to avoid duplicate paymentsInput validation added for zero amount, overpay, and partial-amount-without-MPP
5b80fe9cby Alkamal01+550−156 files
No security note in commit
Low 26 AI analysisMessage 90 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Include to_self_delay size in DelayedPaymentOutput weight calculation

This commit fixes a small accounting bug in how the Lightning wallet estimates the size (and therefore transaction fee) of a special Bitcoin transaction that sweeps funds back to the user after a channel closes. The old code always assumed…

debug assertion failure possible in development/testing buildstransaction weight/fee estimate overestimation up to 3 WUconstant replaced with per-descriptor length computation
e6652237by Matt Morehouse+97−83 files
No security note in commit
Informational 18 AI analysisMessage 65 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Correct docs on `ChannelSigner::get_per_commitment_point`

This commit only updates documentation comments for a Rust function called get_per_commitment_point. It removes an outdated warning that the method was non-asynchronous and that returning an error could cause a crash, and replaces it with …

Documentation-only changeRemoves outdated panic warningAdds retry/unblock guidance for signer errors
5057809bby Matt Corallo+6−31 file
No security note in commit
Informational 17 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

fuzz: allow empty-channel force close with in-flight payments

This commit changes a fuzz-testing harness, not the production Lightning node code. It loosens a test rule so the fuzzer can simulate force-closing a channel that has no pending payments of its own, even if other channels in the test still…

Fuzz harness behavior change onlyNo modifications to production consensus, cryptography, or networking codeNo privilege boundary crossed
dbb12502by Joost Jager+32−71 file
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

Lower-priorityInline `locked_close_channel` in the new `convert_*_channel_err`by Matt Corallo · b6974a02 · Nov 17, 2025 · 1 fileMessage 73 · AdequateInformational 14Details
Commit message · Matt Corallo

Inline `locked_close_channel` in the new `convert_*_channel_err`

Now that `convert_channel_err` is primarily in two functions,
`locked_close_channel` is just a dumb macro that has two forms,
each only called once. Instead, drop it and inline its contents
into `convert_*_channel_err`.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 14/100

This commit is a straightforward code cleanup: it removes a small internal macro and copies its contents directly into the two functions that used it. There is no change in behavior, no bug fix, and no security-relevant change. It is purely a refactoring to make the code easier to read and maintain.

Lower-priorityFunctionize the UNFUNDED case in `convert_channel_err`by Matt Corallo · 0b0b56ba · Nov 17, 2025 · 1 fileMessage 73 · AdequateInformational 14Details
Commit message · Matt Corallo

Functionize the UNFUNDED case in `convert_channel_err`

`convert_channel_err` is used extensively in `channelmanager.rs`
(often indirectly via `try_channel_entry`) and generates nontrivial
code (especially once you include `locked_close_channel`). Here we
take the `UNFUNDED` case of it and move them to an internal
function reducing the generated code size.

On the same machine as described three commits ago, this further
reduces build times from the previous commit by about another
second.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 14/100

This commit is a pure code cleanup: it extracts the handling of unfunded channels from a large macro into a small internal function. There is no change to user-visible behavior, no bug fix, and no security relevance.

Lower-priorityFunctionize the FUNDED cases in `convert_channel_err`by Matt Corallo · 252a75a5 · Nov 17, 2025 · 1 fileMessage 73 · AdequateInformational 13Details
Commit message · Matt Corallo

Functionize the FUNDED cases in `convert_channel_err`

`convert_channel_err` is used extensively in `channelmanager.rs`
(often indirectly via `try_channel_entry`) and generates nontrivial
code (especially once you include `locked_close_channel`). Here we
take the `FUNDED` cases of it and move them to an internal function
reducing the generated code size.

On the same machine as described two commits ago, this further
reduces build times by about another second.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 13/100

This commit is a code cleanup that moves some repeated logic into a new helper function. It does not change what the program does; it only reorganizes how the code is structured to make builds slightly faster. There is no indication of a security fix.

Lower-priorityFormat `convert_*_channel_err` code moved out of macroby Matt Corallo · 7cea2e93 · Nov 17, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Matt Corallo

Format `convert_*_channel_err` code moved out of macro

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is purely a code formatting and minor refactoring change. It splits a few long single-line expressions into multiple shorter lines and introduces temporary variables for readability. There is no functional change, no bug fix, and no security relevance.

Lower-priorityMove `ChannelError`-handling logic down in `channelmanager.rs`by Matt Corallo · 2a650256 · Nov 17, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Move `ChannelError`-handling logic down in `channelmanager.rs`

In the next commit we'll functionize some of the
`ChannelError`-handling logic, requiring it have access to
`handle_new_monitor_update_locked_actions_handled_by_caller!` which
thus needs to be defined above it.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100

This commit is a pure code reorganization: it moves several large blocks of macro definitions lower in the same file so that a later commit can reuse them more easily. No behavior, logic, or security properties of the code change.

Lower-priorityFormat the code moved in the previous commitby Matt Corallo · 4e4e34e3 · Nov 17, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Matt Corallo

Format the code moved in the previous commit

45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup of a macro and a few nearby functions in the Lightning channel manager. It renames local variables for brevity, wraps long argument lists, and shortens a couple of log/debug strings. There is no functional change and no security relevance.

Lower-priorityMove unlocked part of `handle_monitor_update_completion` into an fnby Matt Corallo · 639e2bae · Nov 17, 2025 · 1 fileMessage 83 · StrongInformational 14Details
Commit message · Matt Corallo

Move unlocked part of `handle_monitor_update_completion` into an fn

The `handle_monitor_update_completion` macro is called from a
number of places in `channelmanager.rs` and dumps quite a bit of
code into each callsite. Here we take the unlocked half of
`handle_monitor_update_completion` and move it into a function in
`ChannelManager`.

As a result, building the `lightning` crate tests after a
single-line `println` change in `channelmanager.rs` was reduced by
around a full second (out of ~28.5 originally) on my machine using
rustc 1.85.0. Memory usage of the `expand_crate` step went from
+554MB to +548MB in the same test.

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 14/100

This commit is a straightforward code cleanup: it takes a large block of code that was duplicated inside a macro and moves it into a regular function. The behavior is unchanged; the change only reduces compile time and memory usage slightly. There is no security fix or vulnerability here.

Lower-priorityLog structured peer id, channel id and payment hashby Joost Jager · 053933b5 · Nov 17, 2025 · 1 fileMessage 83 · StrongInformational 15Details
Commit message · Joost Jager

Log structured peer id, channel id and payment hash

Since most log messages no longer include the channel ID in their text,
this commit updates the test logger to output the structured channel ID
instead. The ID is truncated for readability. Similarly peer id and
payment hash are logged.

Co-authored-by: Matt Corallo <git@bluematt.me>

83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit only changes how log messages are formatted. It makes peer IDs, channel IDs, and payment hashes appear more clearly in log output so developers and operators can more easily trace what a log entry refers to. There is no security vulnerability or behavior change to the Lightning protocol itself.

Security candidateRemove redundant channel ID loggingby Joost Jager · 65f7f7f3 · Nov 17, 2025 · 10 filesMessage 78 · AdequateInformational 15Details
Commit message · Joost Jager

Remove redundant channel ID logging

Previously, log messages often included the channel ID both in the
message text and in the structured `channel_id` field. This led to
redundant information and made it difficult to quickly identify which
log lines pertain to a given channel, as the ID could appear in
different positions or sometimes not at all.

This change removes the channel ID from the message in all cases where
it is already present in the structured field. A test run was used to
verify that the structured field always appeared in these log calls.
Some exceptions remain—for example, calls where the structured field
contains a temporary channel ID and the message contains the final ID
were left unchanged.

78/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a straightforward cleanup of log messages. It removes duplicate channel IDs from the text of log lines when the same ID is already attached as a structured field. There is no change to program logic, network behavior, cryptography, or access control. It only affects what developers and operators see in logs, making them more consistent and easier to read.

Lower-priorityUnify test logger outputby Joost Jager · 30715f58 · Nov 14, 2025 · 5 filesMessage 53 · ThinInformational 15Details
Commit message · Joost Jager

Unify test logger output

Now that we have Display implemented on Record, the various
test logger implementations can make use of that.

53/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a minor code cleanup in test-only logging code. It replaces several hand-written log formatting blocks with a single shared Display implementation for log records. There is no functional change to production code and no security relevance.

Lower-priorityAlign log levelsby Joost Jager · 3fc5090a · Nov 14, 2025 · 1 fileMessage 43 · ThinInformational 15Details
Commit message · Joost Jager

Align log levels

Makes sure that 4 and 5 character log levels line up.

43/100 · ThinMessage clarity
✓ Subject identifies a change✓ Provides an explanatory body
AI analysis · Informational 15/100

This commit is a cosmetic formatting change to log output. It pads log level names (like 'INFO' or 'DEBUG') so that 4-letter and 5-letter levels line up visually in log files. There is no security relevance.

Lower-priorityImplement Display for Recordby Joost Jager · 621f9097 · Nov 14, 2025 · 3 filesMessage 60 · AdequateInformational 15Details
Commit message · Joost Jager

Implement Display for Record

As a preparatory step for unifying test log output.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit adds a standard way to print log records and updates test code to use it. It is a code cleanup/refactoring change with no security relevance.

Security candidateRemove `check_closed_event` macroby elnosh · 3ec3492b · Nov 13, 2025 · 24 filesMessage 50 · ThinInformational 15Details
Commit message · elnosh

Remove `check_closed_event` macro

Replace calls to `check_closed_event` macro
to the identically-named function.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100

This commit is a pure code cleanup: it removes a Rust macro used in tests and replaces every call to that macro with an equivalent function call. The behavior of the tests remains the same; no production code or security logic was changed.

Security candidateCleanup: Remove redundant (hmac, nonce) from codebaseby shaavan · b18ccb35 · Nov 13, 2025 · 11 filesMessage 78 · AdequateLow 34Details
Commit message · shaavan

Cleanup: Remove redundant (hmac, nonce) from codebase

Now that we have introduced an alternate mechanism for authentication
in the codebase, we can safely remove the now redundant (hmac, nonce)
fields from the Payment ReceiveTlvs's while maintaining the security
of the onion messages.

78/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
Why it was queued
access controlsigning or wallet path
AI analysis · Low 34/100

This commit removes an older, now-redundant HMAC/nonce authentication mechanism from LDK's blinded payment paths. The code had already introduced a newer 'ReceiveAuthKey' way to authenticate the same data, so the old (hmac, nonce) fields are being stripped out to simplify the codebase. The change is described by the project as a cleanup, not a security fix, and the diff shows the old verification checks being replaced by reliance on the newer mechanism. There is no direct evidence in the commit of an exploitable vulnerability, but removing a redundant authentication layer is a normal hardening step.

Lower-priorityIntroduce ReceiveAuthKey-based verification in Blinded Payment Pathsby shaavan · b1e884b6 · Nov 13, 2025 · 11 filesMessage 91 · StrongLow 35Details
Commit message · shaavan

Introduce ReceiveAuthKey-based verification in Blinded Payment Paths

Extends the work started in
[PR#3917](https://github.com/lightningdevkit/rust-lightning/pull/3917)
by adding ReceiveAuthKey-based verification for Blinded Payment Paths.

This reduces space previously taken by individual ReceiveTlvs and
aligns the verification logic with that used for Blinded Message Paths.

91/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification✓ Links an issue, advisory, or supporting reference
Why it was queued
defensive validation
AI analysis · Low 35/100

This commit changes how hidden (blinded) Lightning payment paths are created and checked. It adds a new 'receive authentication key' used when encrypting the final hop's details, and it makes the receiving node verify that the final hop was encrypted with that key. This is a defensive hardening change that reduces the data sent in payment paths and makes the verification logic consistent with another similar feature (blinded message paths).

Lower-priorityPipe channel node information through to `forward_broadcast_msg`by Matt Corallo · 1d516e61 · Nov 12, 2025 · 6 filesMessage 73 · AdequateLow 29Details
Commit message · Matt Corallo

Pipe channel node information through to `forward_broadcast_msg`

Sadly, the lightning gossip protocol operates by always flooding
peers with all the latest gossip they receive. For nodes with many
peers, this can result in lots of duplicative gossip as they
receive every message from every peer. As a results, some lightning
implementations disable gossip with new peers after some threshold.
This should mostly work as these peers expect to receive the latest
gossip from their many other peers.

However, in some cases an LDK node may wish to open public
channels but only has a single connection to the bulk of the rest
of the network - with one such peer which requests that it not
receive any gossip. In that case, LDK would dutifully never send
any gossip to its only connection to the outside world. We would
still send gossip for channels with that peer as it would be sent
as unicast gossip, but if we then open another connection to
another peer which doesn't have any connection to the outside world
any information on that channel wouldn't propagate.

We've seen this setup on some LSPs, where they have a public node
and then an LSP which only connects through that public node, but
expects to open public channels to its LSP clients.

In the next commit we'll start forwarding such gossip to all peers
by ignoring peer gossip limitations about all of our own channels.
Here we do the final prep work, passing the two sides of each
channel back from `handle_channel_update` calls and into
`forward_broadcast_msg`.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 29/100

This commit is preparatory plumbing for a future fix. It changes how Lightning gossip messages are internally forwarded so that the peer handler knows which two nodes are on each side of a channel. The commit itself does not change any forwarding rules, but the next commit is expected to use this information to ensure a node always forwards gossip about its own public channels, even to peers that have asked to stop receiving gossip. That addresses a real-world routing problem where LSPs could become isolated from the wider network, but it is not a direct security vulnerability and does not introduce one.

Lower-priorityAlways forward gossip for all our channels to all our peersby Matt Corallo · 587e6fc6 · Nov 12, 2025 · 1 fileMessage 73 · AdequateLow 36Details
Commit message · Matt Corallo

Always forward gossip for all our channels to all our peers

Sadly, the lightning gossip protocol operates by always flooding
peers with all the latest gossip they receive. For nodes with many
peers, this can result in lots of duplicative gossip as they
receive every message from every peer. As a results, some lightning
implementations disable gossip with new peers after some threshold.
This should mostly work as these peers expect to receive the latest
gossip from their many other peers.

However, in some cases an LDK node may wish to open public
channels but only has a single connection to the bulk of the rest
of the network - with one such peer which requests that it not
receive any gossip. In that case, LDK would dutifully never send
any gossip to its only connection to the outside world. We would
still send gossip for channels with that peer as it would be sent
as unicast gossip, but if we then open another connection to
another peer which doesn't have any connection to the outside world
any information on that channel wouldn't propagate.

We've seen this setup on some LSPs, where they have a public node
and then an LSP which only connects through that public node, but
expects to open public channels to its LSP clients.

Here we finally forward all gossip that is about either side of any
of our channels to all our peers, irrespective of their requested
gossip filtering.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Low 36/100

This commit fixes a Lightning network gossip propagation bug. Some peers ask nodes not to send them gossip updates. Previously, LDK honored that request too strictly: if a node had only one connection to the rest of the network and that connection asked for no gossip, information about the node's own public channels would not spread to other peers. The change ensures that gossip about channels the node itself participates in is always forwarded to all peers, even those that normally filter out gossip. This improves network visibility of the node's own channels but does not create a direct way to steal funds or crash the node.

Lower-priorityInclude both `node_id`s in `BroadcastChannelUpdate`by Matt Corallo · 0e8d7759 · Nov 12, 2025 · 10 filesMessage 73 · AdequateInformational 22Details
Commit message · Matt Corallo

Include both `node_id`s in `BroadcastChannelUpdate`

Sadly, the lightning gossip protocol operates by always flooding
peers with all the latest gossip they receive. For nodes with many
peers, this can result in lots of duplicative gossip as they
receive every message from every peer. As a results, some lightning
implementations disable gossip with new peers after some threshold.
This should mostly work as these peers expect to receive the latest
gossip from their many other peers.

However, in some cases an LDK node may wish to open public
channels but only has a single connection to the bulk of the rest
of the network - with one such peer which requests that it not
receive any gossip. In that case, LDK would dutifully never send
any gossip to its only connection to the outside world. We would
still send gossip for channels with that peer as it would be sent
as unicast gossip, but if we then open another connection to
another peer which doesn't have any connection to the outside world
any information on that channel wouldn't propagate.

We've seen this setup on some LSPs, where they have a public node
and then an LSP which only connects through that public node, but
expects to open public channels to its LSP clients.

In a coming commit we'll start forwarding such gossip to all peers
by ignoring peer gossip limitations about all of our own channels.
While other gossip has the `node_id`s of both sides of the channel
explicitly in the message, `ChannelUpdate`s do not, so here we add
the `node_id`s to `BroadcastChannelUpdate` giving us the
information we need when we go to broadcast updates.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 22/100

This commit is a preparatory refactor for a future Lightning Dev Kit change. It adds the two node IDs of a channel to the internal `BroadcastChannelUpdate` message event, but does not yet change any actual gossip-sending behavior. The goal is to later allow LDK to forward gossip about its own public channels even to peers that normally ask not to receive gossip. As it stands, this commit only carries extra metadata and updates call sites; it does not by itself fix or break security.

Lower-priorityln/test: add test vectors for v3 channelsby Carla Kirk-Cohen · c9bd30aa · Nov 12, 2025 · 2 filesMessage 55 · ThinInformational 15Details
Commit message · Carla Kirk-Cohen

ln/test: add test vectors for v3 channels

55/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit only adds new test code. It introduces test vectors for a new Lightning channel type (v3 / zero-fee anchor commitments) and a small helper function for converting hex strings to payment hashes in test utilities. There is no change to production code, no bug fix, and no security patch.

Lower-priorityln: pass preimage into test_commitment_commonby Carla Kirk-Cohen · 4bf71d99 · Nov 12, 2025 · 1 fileMessage 70 · AdequateInformational 15Details
Commit message · Carla Kirk-Cohen

ln: pass preimage into test_commitment_common

In v3 test vectors, we're using real preimages so won't be able to
use the workaround here.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100

This commit only changes test code. It updates a Lightning channel test helper so that test vectors explicitly provide payment preimages instead of the helper guessing them from a hardcoded loop. There is no change to production code and no security risk to users.

Lower-priorityln/test: test_channel_common zero fee commitment anchor handlingby Carla Kirk-Cohen · 0c604dd0 · Nov 12, 2025 · 1 fileMessage 60 · AdequateInformational 13Details
Commit message · Carla Kirk-Cohen

ln/test: test_channel_common zero fee commitment anchor handling

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 13/100

This commit only changes a test file inside the Lightning Dev Kit codebase. It updates how a test macro calculates signature types and output indexes for different channel feature combinations. There is no change to production code, no bug fix, and no security-relevant behavior change.

Lower-priorityln/refactor: remove rustfmt skip from outbound_commitment_testby Carla Kirk-Cohen · 845aa04f · Nov 12, 2025 · 2 filesMessage 50 · ThinInformational 15Details
Commit message · Carla Kirk-Cohen

ln/refactor: remove rustfmt skip from outbound_commitment_test

50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a pure code cleanup in the project's test files. It removes markers that told the automatic formatter (rustfmt) to skip certain test code, then reformats that code and moves a few small helper functions to a shared test utilities file. There is no change to the actual Lightning protocol logic, wallet behavior, or any code that runs in production.

Lower-priorityln/refactor: move hex test helpers from blinded payments to test_utilsby Carla Kirk-Cohen · 9cfd18c3 · Nov 12, 2025 · 2 filesMessage 60 · AdequateInformational 15Details
Commit message · Carla Kirk-Cohen

ln/refactor: move hex test helpers from blinded payments to test_utils

60/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Mentions testing or verification! No meaningful explanatory body
AI analysis · Informational 15/100

This commit is a simple code cleanup: it moves three small helper functions used only in tests from one test file into a shared test utility file. There is no change to production code, no security fix, and no behavior change.

Lower-priorityln/test: move commitment check macro out of outbound testby Carla Kirk-Cohen · 2b92b083 · Nov 12, 2025 · 1 fileMessage 75 · AdequateInformational 15Details
Commit message · Carla Kirk-Cohen

ln/test: move commitment check macro out of outbound test

To be used in the commits that follow for zero fee commitment test
vectors.

75/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
AI analysis · Informational 15/100

This commit is a pure test-code refactoring. It moves a large macro used to check commitment transactions from inside one specific test function to a shared location so it can be reused by upcoming tests. No production code, user behavior, or security logic is changed.

Security candidateRemove `get_htlc_update_msgs` macroby elnosh · 6514200b · Nov 12, 2025 · 21 filesMessage 50 · ThinInformational 15Details
Commit message · elnosh

Remove `get_htlc_update_msgs` macro

Replace calls to `get_htlc_update_msgs` macro
to the identically-named function.

50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100

This commit is a straightforward internal cleanup in the rust-lightning test code. It removes a helper macro called `get_htlc_update_msgs!` and replaces every use of it with an already-existing function of the same name. There is no change to production code, user-facing behavior, or security logic.