rust-lightning

This commit is a straightforward internal code cleanup in the Lightning Dev Kit's transaction-building code. It replaces a few methods that always built full lists of contributed inputs and outputs with new iterator methods that let callers decide when to build those lists. There is no change to security logic, no bug fix, and no externally visible behavior change.

This commit is a routine cleanup of the project's fuzz-testing infrastructure. It changes how fuzz tests are compiled and run, adds a new way to feed test input via standard input, and removes an unused dynamic-library build mode. There is no indication it fixes or introduces a security vulnerability in the actual Lightning library code.

This commit is a preparatory refactor in LDK's payment-sending code. It adds a new `total_mpp_amount_msat` field to `RecipientOnionFields` so that, in future commits, a payer can send an HTLC that is only one part of a larger multi-part payment. For now the new field is always required and is asserted to match the existing payment amount, so behavior is unchanged. The commit also fixes a small related bug where probe payments were not including a payment preimage as intended. There is no immediate security vulnerability here; it is a feature-building change with a minor bug fix.

This commit adds safety checks inside the Lightning payment code to make sure the route finder (the 'Router') actually follows the rules it was given. Before sending a payment, the code now verifies that the chosen route does not exceed the user-set maximum fee, does not contain useless empty paths, and does not include unnecessary multi-path payment (MPP) parts. If the router misbehaves, the payment is abandoned instead of being sent. It is a defensive hardening change rather than a fix for a known active attack.

This commit is a straightforward code cleanup in the project's test suite. It replaces a Rust macro used only in tests with an equivalent regular function. There is no change to the actual Lightning node logic that runs in production, and no security-relevant behavior is altered.

This commit is a straightforward code cleanup in the project's test suite. It removes a helper macro used only in tests and replaces it with direct calls to an existing function. There is no change to the actual Lightning node logic that runs in production, and nothing in the commit suggests a security fix.

This commit is a straightforward code cleanup in the project's test suite. It replaces a Rust macro called `check_closed_broadcast!` with direct calls to an equivalent function. Macros are a shorthand in Rust; replacing them with normal function calls makes the test code easier to read and maintain but does not change what the tests actually do. There is no change to the live Lightning node software that users run, so this cannot affect real funds or network security.

This commit changes how a Lightning payment library runs its internal fuzz tests. It makes the test harness call the normal periodic timer function instead of a special stripped-down version, so incomplete multi-part payments time out properly during testing. The production code is mostly unchanged, but a few internal test-only helpers are now available under a new test-utilities feature flag. There is no direct evidence this fixes a real-world security bug; it appears to be a test-harness cleanup that makes fuzzing more realistic.

This commit updates a fuzzing test harness (chanmon_consistency) in the Lightning Dev Kit project. It adds the ability to simulate confirming splice transactions on a fake blockchain and fixes a serial ID collision in the test's random number generator. The changes are confined to test/fuzzing code and do not alter production Lightning logic.

This commit only changes test and fuzzing code. It adds new test controls that let developers temporarily disable or enable individual signer operations during fuzz testing, and it removes one unused signer-operation flag. There is no change to production Lightning code, so it does not create a real-world security vulnerability or fix one.

This patch fixes a bug in the Lightning Dev Kit where, after a special quiet period called 'quiescence' used during splicing (modifying a channel's funds), some queued payment updates were not released when the quiet period ended via the 'tx_signatures' message exchange. The fix ensures those queued updates are freed and processed, preventing payment delays or stalls during splice operations.

This commit changes how Lightning Dev Kit handles 'change' money during Bitcoin channel splicing. Previously, the user could provide a change address or LDK would generate one itself. Now, the wallet's coin-selection logic decides whether a change output is needed and what it looks like. The commit keeps a fallback for older stored data that may not include a change script. It is a code-quality and consistency improvement rather than a clear security fix, though it reduces the chance of fee or change-output mistakes during splicing.

This commit is a new regression test, not a fix. It verifies that a forwarding Lightning node can still claim two parts of a multi-path payment backwards after restarting, even if the node's temporary 'holding cell' state was lost during the crash. The test infrastructure was updated so the test can observe messages released from the holding cell during protocol exchanges. There is no production code change here.

This commit fixes a bug where a forwarding Lightning node, after restarting mid-payment, could emit a 'PaymentForwarded' event that was missing the identifier (next_user_channel_id) of the next channel the payment went through. The fix ensures the identifier is correctly looked up from the still-open channel state during startup. It is a data-correctness bug, not a direct loss-of-funds vulnerability, but it could break downstream accounting or automation that relies on this field.

This commit is purely a code-formatting cleanup. It removes a manual 'do not format' marker from one function and lets the Rustfmt tool reformat the code. No logic, behavior, or security properties of the software were changed.

This commit prepares the Lightning Dev Kit (LDK) to support a new 'phantom node' feature for BOLT 12 offers. It changes how encrypted control data in blinded payment paths and onion messages is authenticated: instead of checking one extra node-specific key, it now checks two keys (the existing node-specific key and a new shared phantom-node key). The commit itself does not enable the actual phantom-node building logic yet, but it adds the cryptographic plumbing so that future versions can authenticate blinded paths from any participant in a phantom-node setup while still keeping normal onion messages tied to a specific node.

This commit adds a seventh cryptographic key to an existing key-expansion routine. The new key is intended for a future feature where multiple nodes can share a 'phantom' blinded payment path. The change itself only extends the HKDF output and stores the extra key; it does not introduce a vulnerability or fix one.

This is a minor code cleanup change inside test helper macros. It replaces short internal names like `_reload_node` with fully qualified paths such as `$crate::ln::functional_test_utils::_reload_node`. This only affects how test macros resolve symbols when reused in other test crates; it does not change runtime behavior, user-facing APIs, or any security-sensitive logic.

This commit is a small, internal refactoring of a Rust serialization macro used in the Lightning Dev Kit. It adds an optional read-time callback to the 'legacy' type-length-value (TLV) field variant so future code can validate or reject decoded legacy values. All existing usage sites pass a no-op callback that always succeeds, so the change does not alter current behavior. It is a defensive/extensibility improvement, not a fix for an active security bug.

This is a fix inside a single test function. The test had a tight loop that repeatedly checked for events without ever pausing, which could monopolize a lock and prevent another thread in the same test from making progress. The change adds a brief yield so the other thread can run. It only affects test code, not production code, and has no security impact on real users.

This commit is a routine API and data-model enhancement. It adds an optional 'counterparty_node_id' field to the internal record that tracks spendable Lightning outputs, and threads that value through the sweeper methods. The field is optional and backward-compatible, so older stored records still load. There is no indication this fixes a security bug or introduces a vulnerability.

This commit is a simple code cleanup in the project's test utilities. It moves a small helper function that reads the latest monitor update ID from one test file into a shared test helper struct, so other tests can call it more cleanly. There is no change to production code, no security fix, and no behavior change.

This commit is a pure test-code refactoring. It renames the default test channel configuration because anchor channels became the production default, and updates many tests to explicitly use a new 'legacy' configuration where they previously relied on the old default. There is no change to production code, no bug fix, and no security-relevant behavior change.

This commit removes the automatic acceptance of incoming Lightning channels in the LDK library. Previously, users could set a flag to automatically accept inbound channel requests. Now, every inbound channel request must be explicitly approved by the user through an OpenChannelRequest event. This is a deliberate design change to ensure users verify they have enough on-chain funds to cover fees, especially with upcoming anchor channel defaults. It is not a fix for an active vulnerability, but it prevents accidental or unsafe channel acceptance.

This commit adds support for asynchronous (delayed) signing when opening or splicing Lightning channels that use the newer interactive-funding protocol. Previously, if a hardware or remote signer was not ready to produce the initial commitment signature, the code either did not support the delay or could accidentally send transaction signatures before the commitment signature was ready. The change holds back the transaction-signature message until the commitment signature is available, and adds a regression test for splicing. It is a protocol-correctness and robustness improvement rather than a fix for an active exploit.