Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.
Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.
This commit makes on-chain 'MonitorEvent' notifications durable and replay-safe. Previously, if a node crashed after a ChannelMonitor persisted a block update but before the ChannelManager processed the resulting event, the event could be …
Durability/atomicity fix for async persistence: prevents lost MonitorEvents across crashesNew ack-based event lifecycle with random event IDsArchival gating on unacknowledged events to avoid losing preimage/timeout information
This commit refactors how LDK nodes claim incoming Lightning payments. It replaces a separate 'claim with known custom TLVs' method with an options struct passed to the normal claim call, and fixes two edge cases in payment attribution dat…
API change: claim_funds now takes ClaimFundsOptions, consolidating TLV-known behavior into one pathFailure-packet length bound added to prevent oversized onion error messagesIncoming failure packet truncated at 32 KiB before processing
This change fixes a wallet bookkeeping problem in rust-lightning's built-in coin-selection wrappers. Previously, when a splice attempt failed or coin selection errored after picking UTXOs, those UTXOs stayed marked as 'reserved' in memory …
Resource exhaustion / denial-of-service via permanent in-memory UTXO reservationIncorrect state tracking in coin-selection wrapperNew API method required for correct lifecycle management (release_utxos)
This commit fixes a bug in the wallet's coin-selection code. When the wallet picked UTXOs to spend, it locked them immediately so they couldn't be reused. But if a later step—fetching the change address or the previous transaction—failed, …
Resource lock leak on error pathUTXO lock state inconsistency between selection and confirmationDenial-of-service/funds-unavailability risk from persistent UTXO locks
This commit rewrites how a Lightning wallet talks to Esplora block-explorer servers so that many status checks happen in parallel instead of one at a time. It is a performance/refactoring change. There is no direct evidence in the commit t…
Concurrency/timing change in transaction confirmation logicNew inconsistency check preserved when a previously-confirmed tx is reported unconfirmedAdded defensive error path for missing pre-fetched block status
This change stops the Electrum-based transaction sync client from downloading the very transaction that created an output it is watching. Previously, the client could request that transaction from Electrum, even though a transaction can ne…
Avoids unnecessary Electrum transaction.get requests for watched outputsReduces information disclosure to Electrum server about watched outpointsAdds regression test verifying request suppression
This change improves how the Lightning Dev Kit's Electrum and Esplora transaction-sync clients track watched Bitcoin transactions. Previously, the code ignored the script pubkey (the 'address' associated with a transaction) supplied when r…
Previously ignored `script_pubkey` argument in `register_tx` for transaction watchersElectrum script-history queries previously used an arbitrary transaction output, which could be OP_RETURN and therefore unindexed by some Electrum serversNew logic prefers caller-supplied script pubkey and falls back to non-OP_RETURN outputs
This commit changes how LDK stores pending event notifications. It adds serialization support for several event types that previously were not fully saved to disk, and introduces a helper method so the code can decide which events are wort…
Data-loss prevention: previously non-round-trippable event variants are now fully serialized, avoiding accidental event loss when users serialize Event queues themselvesState-consistency hardening: ChannelManager now explicitly skips events that describe non-surviving restart state, preventing replay of stale eventsDefensive assertion: debug builds assert that every persisted event round-trips to Some(event), catching serialization mismatches
This commit only adds documentation comments to two source files. It explains that certain funding-signing events can become stale if the underlying negotiation fails, and that callers may see specific harmless errors as a result. No code …
This commit fixes a design flaw in LDK's built-in wallet helper where coins selected for a splice-in (or other unclaimed funding) were permanently reserved in memory if the transaction was abandoned. Over repeated failed splices, all spend…
Denial-of-service via UTXO exhaustion from repeated failed splice negotiationsRisk of inability to broadcast fee-bumping/claim transactions due to lack of available UTXOsNew API surface (release_utxos) introduced to mitigate resource leak
This commit removes a fixed-version pin for the honggfuzz fuzzing tool in a continuous-integration script. The project now uses the current release of honggfuzz instead of an older pinned version. There is no change to the actual Lightning…
This commit changes the Rust toolchain used in the continuous integration (CI) fuzzing job from a fixed older version (1.75) to the latest stable release. It is purely a build/test infrastructure change to fix a dependency compatibility is…
This commit makes a previously internal helper function public so that outside developers can build dummy-hop tails for blinded payment paths without recreating the logic themselves. It is an API usability change, not a fix for a known sec…
No security-relevant behavior change in the diffAPI visibility broadened from crate-public to publicCLTV expiry overflow check already present and unchanged
This change adds a safety check in a Bitcoin Lightning Network library (LDK). Previously, if the software tried to verify a peer's commitment signature before it had learned the peer's channel parameters, it could crash with a panic. Now i…
Defensive check added on peer-driven code path to prevent panicMissing counterparty_parameters could previously cause panic during commitment transaction constructionChannel closure returned instead of panic
This commit only changes the wording of an error message sent to peers when a commitment transaction fails validation. It replaces the vague phrase 'Failed to validate our commitment' with the clearer 'Received commitment failed validation…
This commit moves the checks that validate a counterparty's signatures on the holder's commitment and HTLC transactions out of the general channel code and into the signer module (InMemorySigner). Previously, these signature checks were do…
Moved signature validation from channel state machine into signer moduleAdded new tests that corrupt signatures and verify rejectionChanged error message from 'Invalid commitment tx signature from peer' / 'Invalid funding_created signature from peer' to 'Failed to validate our commitment'
This change fixes a Lightning channel splicing bug: when two peers temporarily disconnect during a splice, any half-finished signature the other side already sent is now discarded. Before the fix, that stale signature could be reused after…
State-invalidation bug in multi-step protocol (splice negotiation)Stale cryptographic signature not cleared on disconnectPotential reuse of old commitment state after reconnect
This fix prevents a Lightning channel from being accidentally force-closed. During a splice (a way to resize a payment channel), one side's initial signature could be kept in memory after the peers disconnected. If the peers later reconnec…
State inconsistency: in-memory buffered message not cleared on disconnectDuplicate message processing after reconnectionForce-close consequence for active Lightning channel
This commit is a simple rename of a public function from `matches_invoice_signing_pubkey` to `key_can_sign_invoice`, plus matching updates to its documentation, callers, tests, and changelog. No behavior changed. It is not a security fix.
This commit is a simple rename of a function and its documentation from matches_invoice_signing_pubkey to key_can_sign_invoice. No logic, behavior, or security properties changed. It is a follow-up code-review naming cleanup.
Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.
Lower-priorityDrop the async-setting of the `P2PGossipSync` `utxo_verifier`by Matt Corallo · 15ddb316 · Dec 31, 2025 · 3 filesMessage 83 · StrongInformational 12Details
Commit message · Matt Corallo
Drop the async-setting of the `P2PGossipSync` `utxo_verifier`
Now that we do not rely on circular references for `P2PGossipSync` validation, we no longer need the hacky `P2PGossipSync::add_utxo_lookup` method to add the gossip validator after building the `P2PGossipSync` first. Thus, we remove it here, updating some tests that relied on it.
83/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
AI analysis · Informational 12/100
This commit is a routine internal cleanup in the Lightning Dev Kit's gossip message handling code. It removes a method that let users set a UTXO (unspent transaction output) lookup provider after the object was created, because the codebase no longer needs that late-setup workaround. The change only affects how the code is structured and how tests are set up; it does not fix a security bug or introduce a known vulnerability.
Lower-priorityMove to awaiting gossip validation in the background processorby Matt Corallo · ad78799b · Dec 31, 2025 · 3 filesMessage 81 · StrongLow 32Details
Commit message · Matt Corallo
Move to awaiting gossip validation in the background processor
`P2PGossipSync` is a rather poor design. It currently basically requires two circular `Arc` references, leaving `NetworkGraph`s to leak if LDK is un-loaded: * `P2PGossipSync` owns/holds a reference to the `GossipVerifier` and `GossipVerifier` holds an `Arc` to the `P2PGossipSync` and * `PeerManager` holds a reference to the `P2PGossipSync` (as the gossip message handler) which owns/holds a reference to the `GossipVerifier`, which has a `Deref` (likely an `Arc` in practice) to the `PeerManager`.
Instead, we should move towards the same design we have elsewhere - hold a `Notifier` and expose waiting on it to the background processor then poll for completion from there (in this case, as in others by checking for completion when handling `get_and_clear_pending_msg_events` calls).
After the last few commits of setup, here we finally switch to waking the background processor directly when we detect async gossip validation completion, allowing us to drop the circular references in `P2PGossipSync`/`GossipVerifier` entirely.
Fixes #3369
81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Low 32/100
This commit refactors how Lightning Dev Kit handles background verification of gossip data (the routing information nodes share). Previously, the gossip verifier, the gossip sync component, and the peer manager held circular references to each other, which could prevent memory from being freed when LDK was unloaded. The change replaces those circular references with a notification mechanism: the background processor now waits directly for a 'validation completed' signal. This is primarily a memory-leak and architectural cleanup, not a direct exploit fix, but it removes a design that could keep resources alive unexpectedly.
Lower-priorityPoll for resolved `UtxoFuture`s rather than resolving on the graphby Matt Corallo · 91a16c53 · Dec 31, 2025 · 4 filesMessage 73 · AdequateInformational 24Details
Commit message · Matt Corallo
Poll for resolved `UtxoFuture`s rather than resolving on the graph
`P2PGossipSync` is a rather poor design. It currently basically requires two circular `Arc` references, leaving `NetworkGraph`s to leak if LDK is un-loaded: * `P2PGossipSync` owns/holds a reference to the `GossipVerifier` and `GossipVerifier` holds an `Arc` to the `P2PGossipSync` and * `PeerManager` holds a reference to the `P2PGossipSync` (as the gossip message handler) which owns/holds a reference to the `GossipVerifier`, which has a `Deref` (likely an `Arc` in practice) to the `PeerManager`.
Instead, we should move towards the same design we have elsewhere - hold a `Notifier` and expose waiting on it to the background processor then poll for completion from there (in this case, as in others by checking for completion when handling `get_and_clear_pending_msg_events` calls).
Here we do the bulk of this work, moving `UtxoFuture` resolution to a simple function that signals the `Notifier` and stores the result. We then poll to convert the result into forwarded messages in `P2PGossipSync::get_and_clear_pending_message_events`. Note that we still rely on manual wakeups from the gossip validator, but that will be fixed in the next commit.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 24/100
This commit refactors how Lightning Dev Kit handles asynchronous checks of Bitcoin transaction outputs (UTXOs) used to validate gossip messages about the network graph. Previously, resolving these checks required direct circular references between components, which could cause memory leaks when LDK was unloaded. The new design uses a notification/polling pattern instead, making the code cleaner and avoiding leaked objects. It is a defensive architectural fix rather than a patch for an active exploit.
Lower-priorityPass a new `Notifier` through to `UtxoFuture`sby Matt Corallo · efaadf57 · Dec 31, 2025 · 4 filesMessage 80 · StrongInformational 19Details
Commit message · Matt Corallo
Pass a new `Notifier` through to `UtxoFuture`s
`P2PGossipSync` is a rather poor design. It currently basically requires two circular `Arc` references, leaving `NetworkGraph`s to leak if LDK is un-loaded: * `P2PGossipSync` owns/holds a reference to the `GossipVerifier` and `GossipVerifier` holds an `Arc` to the `P2PGossipSync` and * `PeerManager` holds a reference to the `P2PGossipSync` (as the gossip message handler) which owns/holds a reference to the `GossipVerifier`, which has a `Deref` (likely an `Arc` in practice) to the `PeerManager`.
Instead, we should move towards the same design we have elsewhere - hold a `Notifier` and expose waiting on it to the background processor then poll for completion from there (in this case, as in others by checking for completion when handling `get_and_clear_pending_msg_events` calls).
Here we take the first step towards this, adding a shared `Notifier` to `PendingChecks` and piping it through to `UtxoFuture`s so that they can be simply resolved and wake the background processor (once it waits on the new `Notifier`).
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 19/100
This commit is a small internal cleanup in the Lightning Dev Kit Rust library. It changes how background tasks are notified when an asynchronous UTXO (unspent transaction output) lookup finishes, so that circular references between gossip-sync objects can eventually be removed. There is no direct security vulnerability being fixed here; it is a design refactor that may help prevent memory leaks in the future.
Lower-prioritySimplify `Sleeper` init in sync `lightning-background-processor`by Matt Corallo · 5ff4051d · Dec 31, 2025 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo
Simplify `Sleeper` init in sync `lightning-background-processor`
Rather than `match`ing on on several optional objects (with another one to come in a future commit), build an iterator over the futures using the fact that an `Option` is an iterator.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
AI analysis · Informational 15/100
This commit is a straightforward internal code cleanup in the Lightning Dev Kit Rust library. It replaces several hand-written helper functions for waiting on 2, 3, or 4 background tasks with a single helper that accepts any number of tasks using Rust's standard iterator features. There is no indication this fixes a security bug or changes user-facing behavior.
Lower-priorityAutomatically archive resolved `ChannelMonitor`s in the BPby Matt Corallo · ded972b5 · Dec 16, 2025 · 1 fileMessage 81 · StrongLow 36Details
Commit message · Matt Corallo
Automatically archive resolved `ChannelMonitor`s in the BP
When we first added auto-archiving of resolved `ChannelMonitor`s, we wanted to be somewhat cautious of flipping it on by default as archiving a `ChannelMonitor` too soon would be a critical bug and, while we were confident in it, we weren't 100%. Since then its been used extensively in various LDK deployments, including `ldk-node`.
Given its now seen substantial use, and performs an important anti-DoS function, here we flip to calling it by default on a new timer in `lightning-background-processor`.
Fixes #218
81/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Links an issue, advisory, or supporting reference
AI analysis · Low 36/100
This change turns on automatic cleanup of old, resolved Lightning channel monitoring data by default in LDK's background processor. Previously this cleanup existed but was not enabled by default because archiving a monitor too early could risk losing funds. After broader real-world use, the developers now enable it automatically on a timer, which helps prevent denial-of-service/resource-exhaustion issues caused by keeping stale monitors around forever. The commit itself is a defensive hardening change, not an active vulnerability fix.
Lower-priorityUse more specific locked_handle_unfunded_close when possibleby Joost Jager · 42a993d5 · Dec 15, 2025 · 1 fileMessage 50 · ThinInformational 19Details
Commit message · Joost Jager
Use more specific locked_handle_unfunded_close when possible
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 19/100
This commit is a small internal cleanup in the Lightning Dev Kit's channel manager. It replaces calls to a more general force-close helper with a more specific helper meant for channels that have not yet been funded. The change removes duplicated parameters and makes the code clearer, but there is no direct evidence in the commit or supplied references that it fixes an active security vulnerability or changes externally observable behavior.
Make the names more descriptive and link shared documentation.
50/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides an explanatory body
AI analysis · Informational 15/100
This commit only renames several internal helper methods in the Lightning channel manager to make their purpose clearer (for example, 'convert_channel_err' becomes 'locked_handle_force_close'). No behavior changes, security fixes, or bug fixes are present in the diff.
AI review queuedInline format argsby Joost Jager · e50280cb · Dec 15, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager
Inline format args
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100
This commit is a minor code cleanup that changes how two error messages are formatted in Rust. It uses a newer, more concise syntax for embedding variables inside strings. There is no functional change and no security relevance.
Lower-priorityLDK Node Integration CI: Also patch LDK dependencies if `git`by Elias Rohrer · c7d1ba70 · Dec 12, 2025 · 1 fileMessage 73 · AdequateInformational 15Details
Commit message · Elias Rohrer
LDK Node Integration CI: Also patch LDK dependencies if `git`
By now, we switched our LDK Node `main` to a specific commit on LDK's `main`. Since we don't have the `crates.io` dependencies in the `Cargo.toml`, the patch command won't actually do anything but silently fail, i.e., *not* check the PR changes against the LDK Node main branch.
Here we fix this by also patching the git repository path.
73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
documentation-only discount
AI analysis · Informational 15/100
This is a routine fix to an internal GitHub Actions CI workflow. The change ensures that when testing pull requests against the LDK Node project, the local copy of rust-lightning is patched in correctly even when LDK Node depends on it via a Git URL rather than crates.io. It has no effect on shipped code or user-facing security.
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit simply moves a group of channel-closing helper methods to a different location within the same file. No code behavior was changed, so it has no security impact on its own.
Lower-priorityConvert send_channel_ready macro to methodby elnosh · 3247fad6 · Dec 11, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · elnosh
Convert send_channel_ready macro to method
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit is a simple code cleanup: it turns an internal macro (a reusable code snippet) into a regular Rust method. The actual behavior of the program does not change. There is no security fix or vulnerability here.
Lower-priorityAllow clippy's new assertions-on-constants lintby Matt Corallo · 6ff720b9 · Dec 11, 2025 · 1 fileMessage 60 · AdequateInformational 15Details
Commit message · Matt Corallo
Allow clippy's new assertions-on-constants lint
This is really dumb, `assert!(cfg!(fuzzing))` is a perfectly reasonable thing to write!
60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
fuzzing or regression evidence
AI analysis · Informational 15/100
This commit only adds one line to a shell script used in continuous integration. It tells the Clippy code-analysis tool to ignore a newly introduced lint about assertions on constant values. The change does not modify any actual Rust source code, runtime behavior, or security-sensitive logic.
AI review queuedRustfmt touched methodsby Joost Jager · d436cbf5 · Dec 11, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager
Rustfmt touched methods
28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100
This commit is purely a code-formatting cleanup. It uses rustfmt to rewrap long function signatures, break up long macro invocations, and adjust indentation in a single Rust source file. No logic, behavior, or security properties of the code were changed.
Lower-priorityRemove rustfmt::skip from touched methodsby Joost Jager · 7fe270b0 · Dec 11, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Joost Jager
Remove rustfmt::skip from touched methods
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit simply removes formatting-suppression annotations from several Rust methods. It does not change any executable code, logic, or security behavior. It is a code-style cleanup with no security relevance.
Lower-priorityConvert macro to convert_channel_err methodby Joost Jager · ee426703 · Dec 11, 2025 · 1 fileMessage 45 · ThinInformational 12Details
Commit message · Joost Jager
Convert macro to convert_channel_err method
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 12/100
This commit is a straightforward internal code cleanup: it turns a Rust macro named convert_channel_err into a regular method on the ChannelManager struct. The logic inside the conversion stays the same, and all call sites are updated to use the new method. There is no change to user-facing behavior, network protocol handling, or security-sensitive checks.
Lower-priorityConvert macro to convert_channel_err_funded methodby Joost Jager · 36cfb13a · Dec 11, 2025 · 1 fileMessage 50 · ThinInformational 12Details
Commit message · Joost Jager
Convert macro to convert_channel_err_funded method
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 12/100
This commit is a straightforward code cleanup: it turns a small Rust macro used only for funded-channel error handling into a regular method. The behavior appears unchanged; the same internal function is called with the same arguments. There is no indication this fixes or introduces a security issue.
Lower-priorityReplace macro with direct call to convert_unfunded_channel_err_internalby Joost Jager · ec112c47 · Dec 11, 2025 · 1 fileMessage 50 · ThinInformational 15Details
Commit message · Joost Jager
Replace macro with direct call to convert_unfunded_channel_err_internal
50/100 · ThinMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This is a small internal code cleanup in the Lightning Dev Kit's Rust implementation. It removes a rarely-used macro branch and replaces two calls with direct function calls. There is no visible security change: the same function runs, with the same arguments, in the same order. The commit message and diff give no indication of a bug fix or security issue.
Lower-priorityConvert macro to convert_channel_err_coop methodby Joost Jager · 87e01ffd · Dec 11, 2025 · 1 fileMessage 45 · ThinInformational 15Details
Commit message · Joost Jager
Convert macro to convert_channel_err_coop method
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 15/100
This commit is a straightforward code cleanup: it turns a small macro used only for cooperative channel closures into a regular Rust method. No behavior changes, no security fixes, and no bug fixes are visible in the diff.
Lower-priorityConvert convert_funded_channel_err fns to methodsby Joost Jager · 004ceef4 · Dec 11, 2025 · 1 fileMessage 45 · ThinInformational 14Details
Commit message · Joost Jager
Convert convert_funded_channel_err fns to methods
45/100 · ThinMessage clarity
✓ Descriptive subject✓ Names a concrete action or component! No meaningful explanatory body
AI analysis · Informational 14/100
This commit is a simple code cleanup: it turns two standalone helper functions into methods attached to the ChannelManager struct. The actual logic inside the functions is copied almost verbatim, with only mechanical changes like replacing `cm.get_cm()` and `cm.logger` with `self.logger`, and `cm.short_to_chan_info` with `self.short_to_chan_info`. There is no change to behavior, no bug fix, and no security improvement or regression visible in the diff.
Lower-priorityTest 0.2 -> 0.3 reload with with forward htlcs presentby Valentine Wallace · a24dcffa · Dec 10, 2025 · 2 filesMessage 95 · StrongInformational 12Details
Commit message · Valentine Wallace
Test 0.2 -> 0.3 reload with with forward htlcs present
We have an overarching goal of (mostly) getting rid of ChannelManager persistence and rebuilding the ChannelManager's state from existing ChannelMonitors, due to issues when the two structs are out-of-sync on restart. The main issue that can arise is channel force closure.
In the previous commit we started this process by rebuilding ChannelManager::decode_update_add_htlcs, forward_htlcs, and pending_intercepted_htlcs from the Channel data, which will soon be included in the ChannelMonitors as part of a different series of PRs.
Here we test that HTLC forwards that were originally received on 0.2 can still be successfully forwarded using the new reload + legacy handling code that will be merged for 0.3.
95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Informational 12/100
This commit adds new automated tests to make sure that payment forwarding state created by an older version (0.2) of the Lightning Dev Kit library still works correctly after upgrading to the upcoming 0.3 version. It does not change production code and is not a security fix or vulnerability.
Lower-priorityGather to-decode HTLC fwds from channels on manager readby Valentine Wallace · 64de9891 · Dec 10, 2025 · 2 filesMessage 85 · StrongInformational 23Details
Commit message · Valentine Wallace
Gather to-decode HTLC fwds from channels on manager read
We have an overarching goal of (mostly) getting rid of ChannelManager persistence and rebuilding the ChannelManager's state from existing ChannelMonitors, due to issues when the two structs are out-of-sync on restart. The main issue that can arise is channel force closure.
Here we start this process by rebuilding ChannelManager::decode_update_add_htlcs from the Channels, which will soon be included in the ChannelMonitors as part of a different series of PRs.
The newly built map is not yet used but will be in the next commit.
85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 23/100
This commit is a preparatory internal refactoring in the Lightning Dev Kit's rust-lightning code. It changes how the ChannelManager reconstructs a list of pending forwarded payments when it is loaded from disk, gathering the data from individual channels instead of relying on a previously stored map. The new reconstructed map is created but not yet used in this commit; a follow-up commit will start using it. There is no direct security vulnerability introduced here, but the change is part of a larger effort to avoid dangerous inconsistencies between two key data structures (ChannelManager and ChannelMonitor) that could lead to forced channel closures if they get out of sync.
Rebuild manager forwarded htlcs maps from Channels
We have an overarching goal of (mostly) getting rid of ChannelManager persistence and rebuilding the ChannelManager's state from existing ChannelMonitors, due to issues when the two structs are out-of-sync on restart. The main issue that can arise is channel force closure.
Here we start this process by rebuilding ChannelManager::decode_update_add_htlcs, forward_htlcs, and pending_intercepted_htlcs from Channel data, which will soon be included in the ChannelMonitors as part of a different series of PRs.
We also fix the reload_node test util to use the node's pre-reload config after restart. The previous behavior was a bit surprising and led to one of this commit's tests failing.
95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
AI analysis · Low 42/100
This commit changes how a Lightning node rebuilds its internal list of in-flight forwarded payments when it restarts. The goal is to eventually stop requiring a separate snapshot of the ChannelManager, instead reconstructing state from the more-reliable ChannelMonitor. The patch adds logic to avoid duplicate HTLC entries when both old and new reconstruction sources are present, and fixes a test helper so reload tests use the node's actual configuration. It is a forward-looking infrastructure change with safety implications if the deduplication logic is wrong, but it does not appear to introduce a remotely exploitable vulnerability.
We have an overarching goal of (mostly) getting rid of ChannelManager persistence and rebuilding the ChannelManager's state from existing ChannelMonitors, due to issues when the two structs are out-of-sync on restart. The main issue that can arise is channel force closure.
As part of this, we plan to store at least parts of Channels in ChannelMonitors, and that Channel data will be used in rebuilding the manager.
Once we store update_adds in Channels, we can use them on restart when reconstructing ChannelManager maps such as forward_htlcs and pending_intercepted_htlcs. Upcoming commits will start doing this reconstruction.
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Low 31/100
This commit changes how the Lightning Dev Kit stores information about incoming payment commitments inside a channel. It keeps a copy of the original 'update_add' message alongside committed inbound HTLCs so that, after a restart, the node can rebuild its internal payment-forwarding maps from Channel and ChannelMonitor data rather than relying on the separate ChannelManager persistence. The change is framed by the authors as a reliability improvement to avoid force-closure when ChannelManager and ChannelMonitor get out of sync on restart. It is not a direct security patch and does not appear to fix an active exploit, but it touches consensus-adjacent state and serialization, so mistakes here could affect funds safety.
We have an overarching goal of (mostly) getting rid of ChannelManager persistence and rebuilding the ChannelManager's state from existing ChannelMonitors, due to issues when the two structs are out-of-sync on restart. The main issue that can arise is channel force closure.
As part of rebuilding ChannelManager forward HTLCs maps, we will also add a fix that will regenerate HTLCIntercepted events for HTLC intercepts that are present but have no corresponding event in the queue. That fix will use this new method.
80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
AI analysis · Informational 12/100
This commit is a small internal code cleanup in the Lightning Dev Kit's channel manager. It pulls out duplicated code for creating an 'HTLC intercepted' event into a shared helper function. The change does not fix a security bug and does not alter user-facing behavior; it is preparation for a future reliability improvement around restarting the channel manager without losing track of intercepted payments.