LDK
← All projectsLightning Dev Kit

rust-lightning

Composable Rust libraries for building Lightning wallets, nodes, and services.

BitcoinCryptographic librariesLightning NetworkNormal
Repository coverage

1478 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

225security candidates208second-pass queue286AI analyses
63commits · 30 days
191commits · 60 days
647commits · 180 days
1475commits · 365 days
Backfill bands
Aug 5 → Feb 6819 seen18 candidatesComplete
Feb 6 → Jun 6468 seen16 candidatesComplete
Jun 6 → Jul 6128 seen8 candidatesComplete
Jul 6 → Aug 561 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

69/100 average clarity
352Strong · 80–100
782Adequate · 60–79
285Thin · 40–59
59Opaque · 0–39
3security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Elias Rohrer1531525567
Matt Corallo3564756173
Leo Nash1161334162
Jeffrey Czyz1774151068
Wilmer Paulino1493942069
Joost Jager1622424069
elnosh301315056
Valentine Wallace1351014069
shaavan2266069
Carla Kirk-Cohen6533069
benthecarman1833071
Duncan Dean833057
Analysis record

Published AI watches

Last scanned 57 minutes ago

Low 47 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Return `Err`s` instead of panicking on oversized messages

This commit changes how the Lightning networking code handles oversized encrypted messages. Previously, certain conditions would cause the program to crash with a panic. Now the code returns errors instead, which is a defensive improvement…

panic-to-error conversion for oversized message encryption/decryptiondenial-of-service hardening against oversized peer messagesdebug_assert retained to preserve test coverage of invariant violations
08f12bc7by Matt Corallo+68−313 files
Vendor flagged security relevance
Informational 15 AI analysisMessage 45 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Update crate repository links to forgejo

This commit simply updates the 'repository' web links in 15 package metadata files from GitHub to a self-hosted Forgejo instance. It does not change any program code, build logic, dependencies, or security behavior. There is no security is…

eb77676dby benthecarman+15−1515 files
No security note in commit
Moderate 54 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Retransmit splice_locked for 0-conf channels missing tx_signatures

This commit fixes a bug in the Lightning Dev Kit where, after a disconnection, a node could fail to retransmit a 'splice_locked' message to a peer that was still waiting for transaction signatures. Without this retransmission, the two peer…

Protocol state desynchronization between channel peers after reconnectionMissing retransmission of splice_locked for 0-conf splice channelsPotential channel unusability or stuck splice negotiation
5434015bby Wilmer Paulino+266−12 files
No security note in commit
Low 26 AI analysisMessage 90 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Include to_self_delay size in DelayedPaymentOutput weight calculation

This commit fixes a small accounting bug in how the Lightning wallet estimates the size (and therefore transaction fee) of a special Bitcoin transaction that sweeps funds back to the user after a channel closes. The old code always assumed…

debug assertion failure possible in development/testing buildstransaction weight/fee estimate overestimation up to 3 WUconstant replaced with per-descriptor length computation
e6652237by Matt Morehouse+97−83 files
No security note in commit
Informational 18 AI analysisMessage 65 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Correct docs on `ChannelSigner::get_per_commitment_point`

This commit only updates documentation comments for a Rust function called get_per_commitment_point. It removes an outdated warning that the method was non-asynchronous and that returning an error could cause a crash, and replaces it with …

Documentation-only changeRemoves outdated panic warningAdds retry/unblock guidance for signer errors
5057809bby Matt Corallo+6−31 file
No security note in commit
Informational 15 AI analysisMessage 63 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Require manual reviewer assignment

This commit changes the project's internal code-review workflow. It stops automatically assigning a human reviewer when a pull request is opened; instead, contributors must manually click a button to request a reviewer after first addressi…

9c1e5787by Joost Jager+21−232 files
No security note in commit
Moderate 60 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Handle missing splice tx_signatures on reestablish

This commit fixes a bug in LDK's Lightning channel reconnection logic after a splice (a way to resize a channel's on-chain funds). If one peer had already received the splice signatures but the other had not, and then they disconnected and…

Protocol-state inconsistency on reconnection after splice signature exchangePotential channel stall/force-close due to quiescence not being exited before commitment updateFuzzer-discovered edge case in Lightning splicing retransmission
f93a7f0cby Wilmer Paulino+600−975 files
No security note in commit
Informational 19 AI analysisMessage 68 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

offers: Allow disabling invoice response MPP

This commit adds a new option for Lightning invoice creators to explicitly tell payers not to use multi-path payments (MPP) when paying an invoice. It does not change any enforcement rules; it only changes what feature bits are advertised …

New API surface for feature advertisement controlExplicit documentation that the method does not enforce single-HTLC receipt, shifting enforcement responsibility to callersNo removal or weakening of existing validation logic
00aabf81by Elias Rohrer+9−01 file
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Change assign-reviewer authorized integration token to a bot acct

This commit swaps the ID number used by an automated workflow that randomly assigns code reviewers. The old number pointed to a real person's account, so the workflow's assignments appeared to come from that person. The new number points t…

f734d1ebby Matt Corallo+1−11 file
No security note in commit
Informational 15 AI analysisMessage 45 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Pin jobserver to 0.1.34 on pre-1.85 rustc

This commit adjusts the project's continuous integration (CI) test script to pin an older version of a build-time helper crate called `jobserver` when using older Rust compilers. It is a build compatibility fix, not a security patch, and d…

a4641403by Matt Corallo+3−01 file
No security note in commit
Informational 17 AI analysisMessage 50 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Bump esplora-client to 0.13 to switch from `reqwest` to `bitreq`

This commit updates a dependency used to talk to Esplora blockchain servers from version 0.12 to 0.13, switching the underlying HTTP library from reqwest to bitreq. It also removes two CI workarounds that pinned older versions of idna_adap…

Dependency version bump (esplora-client 0.12 -> 0.13)HTTP backend switch (reqwest -> bitreq) in a transitive dependencyRemoval of MSRV pins for idna_adapter and hyper-rustls
5cd499e0by Matt Corallo+1−72 files
No security note in commit
Informational 15 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Test cross-version serialization of pending splices

This commit only adds new test code. It exercises how a newer version of LDK exchanges saved channel data with the older LDK 0.2 release when a channel has a pending splice. There is no change to production logic, no bug fix, and no securi…

0beadb3bby Jeffrey Czyz+208−01 file
No security note in commit
Low 25 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Require `htlc_value_satoshis` in [pending] `HTLCUpdate`s

This commit removes the 'Option' wrapper from several HTLC amount fields, making them required instead of optional. It is a cleanup/refactoring change that simplifies the code by assuming the amount is always known. The commit message fram…

Removal of Option wrapper for financial amount fieldsSerialization format change from optional to required TLV fieldsLoss of backward compatibility with older serialized monitor/channel state
40957aadby Matt Corallo+24−284 files
No security note in commit
Informational 15 AI analysisMessage 78 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Use a builder for sign_interactive_funding_tx arguments

This commit is a code cleanup inside the project's test suite. It replaces a helper function with several hard-to-read positional arguments (like bare `false` and `None`) with a 'builder' pattern that names each option. This makes the test…

ed250c02by Jeffrey Czyz+116−861 file
No security note in commit
Low 25 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ln: persist the paid BOLT 12 invoice and build payer proofs

This commit is a feature addition, not a vulnerability fix. It extends rust-lightning's BOLT 12 payment support so that when a wallet pays a BOLT 12 invoice, the paid invoice is saved through retries and restarts and is later exposed in th…

New BOLT 12 payer proof feature: persists paid invoice across retries/restarts and exposes it in Event::PaymentSentPayer signing key re-derived from invoice payer metadata rather than storing extra key materialAdds end-to-end test for proof creation, verification, and bech32 round-trip
580c9bc8by Vincenzo Palazzo+226−284 files
No security note in commit
Informational 17 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

refactor(offers): extract payer key derivation helpers

This commit is a code cleanup (refactor) in the Lightning Dev Kit library. It moves existing payer key-derivation logic into shared helper functions so that future 'payer proof' features can reuse the same code. The change does not appear …

Refactor only: moves existing key derivation/verification logic into helpers without changing algorithmsAdds new public API `Bolt12Invoice::derive_payer_signing_keys` for payer proof key recoveryNo mention of vulnerability, bug, CVE, security fix, or exploit in commit title/message
2bd9266aby Vincenzo Palazzo+120−212 files
No security note in commit
Informational 15 AI analysisMessage 83 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Upload new fuzz corpus entries as a short-lived CI artifact

This commit changes a CI workflow for the rust-lightning project. It stops trying to push new fuzz test inputs directly to a corpus repository from automated test runs, and instead uploads them as a temporary artifact that a separate sched…

b9f55b6cby Matt Corallo+52−451 file
No security note in commit
Informational 15 AI analysisMessage 90 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ci: don't double-assign reviewers, support manual assignment runs

This is a routine update to the project's automated reviewer-assignment workflow. It prevents the bot from accidentally adding a second random reviewer when one is already assigned, and adds a manual trigger so maintainers can request an a…

24651a1aby Matt Corallo+73−91 file
No security note in commit
Informational 18 AI analysisMessage 55 · Thin
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Fix assign-reviewer's auth by setting the authorized integration audience

This is a one-line fix to a Forgejo workflow that assigns reviewers. The workflow requests a temporary identity token from the CI system so it can call another service. The change adds an explicit audience parameter to that token request, …

OIDC token audience now explicitly scopedCI workflow authentication hardeningNo change to application code or cryptographic logic
055d334dby Matt Corallo+1−11 file
No security note in commit
Low 25 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

ln: add trampoline mpp accumulation with rejection on completion

This commit adds partial support in the Lightning Dev Kit node software for receiving and temporarily holding multi-part trampoline payments, then deliberately rejects them once all parts arrive because full outbound forwarding is not yet …

New trampoline forward handling path accumulates MPP parts before rejectingDebug assertion guards first-HTLC failure in MPP mergeTODO comment flags possible MPP inconsistency in next_node_id across trampoline parts
1afd35e6by Carla Kirk-Cohen+240−112 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedFormat `tx_builder::get_available_balances`by Leo Nash · 121302e1 · Feb 24, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Leo Nash

Format `tx_builder::get_available_balances`

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
signing or wallet pathsecond-pass: opaque commit messagesecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is purely a code formatting and documentation cleanup of one internal function in the Lightning Dev Kit. It adds explanatory comments and rewraps long lines to match the project's style guide. No logic, calculations, or security behavior were changed.

AI review queuedCreate `ChannelConstraints` to hold parameters for balance calculationsby Leo Nash · 22b056ba · Feb 24, 2026 · 2 filesMessage 73 · AdequateInformational 15Details
Commit message · Leo Nash

Create `ChannelConstraints` to hold parameters for balance calculations

In an upcoming commit, we move `get_available_balances_for_scope` behind
`TxBuilder::get_channel_stats`, and pass channel parameters relevant to
balance calculations in `TxBuilder::get_channel_stats` via
`ChannelConstraints`.

There are no functional changes in this commit.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a pure internal code reorganization. It creates a new ChannelConstraints container and copies existing channel parameters into it so a future change can pass them more easily. The values used in balance calculations are identical to before; nothing about user funds, network behavior, or security rules changes.

Security candidateExtract contributed_{inputs|outputs} iteratorsby Jeffrey Czyz · a4f2ea27 · Feb 24, 2026 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Jeffrey Czyz

Extract contributed_{inputs|outputs} iterators

The following types have methods for returning contributed inputs and
outputs:
- FundingNegotiationContext
- InteractiveTxConstructor
- InteractiveTxSigningSession
- ConstructedTransaction

Having iterators for these can avoid allocations, which is useful for
filtering contributed input and outputs when producing DiscardFunding
events.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Informational 15/100

This commit is a straightforward internal code cleanup in the Lightning Dev Kit's transaction-building code. It replaces a few methods that always built full lists of contributed inputs and outputs with new iterator methods that let callers decide when to build those lists. There is no change to security logic, no bug fix, and no externally visible behavior change.

Security candidateClean up fuzz crate: use panic=abort, add stdin_fuzz support, remove dylibby Joost Jager · 69e2d8cf · Feb 23, 2026 · 75 filesMessage 95 · StrongInformational 15Details
Commit message · Joost Jager

Clean up fuzz crate: use panic=abort, add stdin_fuzz support, remove dylib

This commit makes three related changes to the fuzz infrastructure:

1. Set panic=abort on both dev and release profiles, and remove the
dylib crate type (keeping rlib and staticlib). The dylib crate type
was added in e28fd78e6 (2019) for a C-callable harness that was
never implemented. Removing dylib is what enables panic=abort,
since Rust forces panic=unwind on dylib crates. staticlib is
retained as it is compatible with panic=abort.

2. Add stdin_fuzz support: a new Stdout logger, updated target template
so that stdin_fuzz calls _test() with Stdout logging, and updated
README with usage instructions. This allows reproducing crashes via
piped input, useful for git bisect and AI-assisted debugging.

3. Update all fuzzer frontends (AFL, honggfuzz, libfuzzer, stdin_fuzz)
to call the _test() functions directly instead of going through the
_run() C wrappers.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
fuzzing or regression evidencesigning or wallet pathboot or update pathauthentication pathparser or protocol path
AI analysis · Informational 15/100

This commit is a routine cleanup of the project's fuzz-testing infrastructure. It changes how fuzz tests are compiled and run, adds a new way to feed test input via standard input, and removes an unused dynamic-library build mode. There is no indication it fixes or introduces a security vulnerability in the actual Lightning library code.

AI review queuedDelete `TxBuilder::subtract_non_htlc_outputs`by Leo Nash · 75d4a6bf · Feb 23, 2026 · 2 filesMessage 70 · AdequateInformational 12Details
Commit message · Leo Nash

Delete `TxBuilder::subtract_non_htlc_outputs`

We make temporary use of the raw
`tx_builder::saturating_sub_anchor_outputs` function in
`get_available_balances_for_scope`. This ok because we move most of
the `get_available_balances_for_scope` function to the
`TxBuilder::get_channel_stats` call in an upcoming commit.

Again, no functional change is introduced in this commit.

70/100 · AdequateMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 12/100

This commit is a straightforward internal code cleanup in the Lightning Dev Kit's Rust implementation. It removes a helper method called subtract_non_htlc_outputs from a trait and replaces its uses with direct calls to a similar helper function. The commit message explicitly states there is no functional change, and the diff shows the new helper behaves identically to the removed method. There is no indication this fixes or introduces a security issue.

AI review queuedDelete `TxBuilder::commit_tx_fee_sat`by Leo Nash · a4bf94a4 · Feb 23, 2026 · 2 filesMessage 58 · ThinLow 27Details
Commit message · Leo Nash

Delete `TxBuilder::commit_tx_fee_sat`

Move calls to `TxBuilder::commit_tx_fee_sat` in
`new_for_inbound_channel` and `new_for_outbound_channel` to
`ChannelContext::get_next_{*}_commitment_stats`, and set the parameters
such that the exact same behavior is maintained.

We also replace calls to `TxBuilder::commit_tx_fee_sat` in
`get_pending_htlc_stats`, `next_local_commit_tx_fee_msat`, and
`next_remote_commit_tx_fee_msat` with `chan_utils::commit_tx_fee_sat`.
All three functions get deleted in an upcoming commit, so we accept
this temporary use of the `chan_utils::commit_tx_fee_sat` function.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 27/100

This commit is a code cleanup in the Lightning Dev Kit's rust-lightning project. It removes a helper method called `commit_tx_fee_sat` from a transaction-building trait and moves the fee-checking logic into a more central place when opening channels. The goal is to keep the same behavior while simplifying the code. There is no direct evidence in the commit that this fixes a security vulnerability.

AI review queuedIntroduce `TxBuilder::get_channel_stats`by Leo Nash · 4760f868 · Feb 23, 2026 · 2 filesMessage 58 · ThinInformational 13Details
Commit message · Leo Nash

Introduce `TxBuilder::get_channel_stats`

This commit moves the previous `TxBuilder::get_next_commitment_stats`
method to a private function, and then calls this function in
`TxBuilder::get_channel_stats`.

Similar to the previous `TxBuilder::get_next_commitment_stats` method,
`TxBuilder::get_channel_stats` fails if any party cannot afford the
HTLCs outbound from said party, and the anchors if they are the funder.

Aside from the API changes on `TxBuilder`, there are no functional
changes in this commit.

58/100 · ThinMessage clarity
✓ Descriptive subject✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 13/100

This commit is a straightforward internal code reorganization in the Lightning Dev Kit's transaction-building code. It renames and restructures a method so that a new wrapper, `get_channel_stats`, returns the same underlying commitment statistics inside a new container struct. The commit message explicitly states there are no functional changes beyond the API rename, and the diff shows only mechanical renames and field-access adjustments (e.g., `stats.nondust_htlc_count` becomes `stats.commitment_stats.nondust_htlc_count`). There is no indication of a security fix, vulnerability, or behavior change.

Security candidateInclude MPP payment amount in `RecipientOnionFields`by Matt Corallo · abf258a6 · Feb 20, 2026 · 29 filesMessage 95 · StrongLow 36Details
Commit message · Matt Corallo

Include MPP payment amount in `RecipientOnionFields`

In some uses of LDK we need the ability to send HTLCs for only a
portion of some larger MPP payment. This allows payers to make
single payments which spend funds from multiple wallets, which may
be important for ecash wallets holding funds in multiple mints or
graduated wallets which hold funds across a trusted wallet and a
self-custodial wallet.

In order to allow for this, we need to separate the concept of the
payment amount from the onion MPP amount. Here we start this
process by adding a `total_mpp_amount_msat` field to
`RecipientOnionFields` (which is the appropriate place for a field
describing something in the recipient onion).

We currently always assert that it is equal to the existing fields,
but will relax this in the coming commit(s).

We also start including a payment preimage on probe attempts,
which appears to have been the intent of the code, but which did
not work correctly.

The bulk of the test updates were done by Claude.

95/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Mentions testing or verification
Why it was queued
signing or wallet pathboot or update path
AI analysis · Low 36/100

This commit is a preparatory refactor in LDK's payment-sending code. It adds a new `total_mpp_amount_msat` field to `RecipientOnionFields` so that, in future commits, a payer can send an HTLC that is only one part of a larger multi-part payment. For now the new field is always required and is asserted to match the existing payment amount, so behavior is unchanged. The commit also fixes a small related bug where probe payments were not including a payment preimage as intended. There is no immediate security vulnerability here; it is a feature-building change with a minor bug fix.

Security candidateValidate the `Router` is meeting MPP and max-fee limitations givenby Matt Corallo · c31a7bee · Feb 20, 2026 · 6 filesMessage 73 · AdequateLow 47Details
Commit message · Matt Corallo

Validate the `Router` is meeting MPP and max-fee limitations given

When `OutboundPayments` calls the provided `Router` to fetch a
`Route` it passes a `RouteParameters` with a specific max-fee. Here
we validate that the `Route` returned sticks to the limits
provided, and also that it meets the MPP rules of not having any
single MPP part which can be removed while still meeting the
desired payment amount.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
defensive validationboot or update path
AI analysis · Low 47/100

This commit adds safety checks inside the Lightning payment code to make sure the route finder (the 'Router') actually follows the rules it was given. Before sending a payment, the code now verifies that the chosen route does not exceed the user-set maximum fee, does not contain useless empty paths, and does not include unnecessary multi-path payment (MPP) parts. If the router misbehaves, the payment is abandoned instead of being sent. It is a defensive hardening change rather than a fix for a known active attack.

Security candidateReplace `get_closing_signed_broadcast!` macro with direct function callsby elnosh · 28388c40 · Feb 19, 2026 · 5 filesMessage 65 · AdequateInformational 15Details
Commit message · elnosh

Replace `get_closing_signed_broadcast!` macro with direct function calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathboot or update path
AI analysis · Informational 15/100

This commit is a straightforward code cleanup in the project's test suite. It replaces a Rust macro used only in tests with an equivalent regular function. There is no change to the actual Lightning node logic that runs in production, and no security-relevant behavior is altered.

Security candidateReplace `get_payment_preimage_hash!` macro with direct function callsby elnosh · e48478a7 · Feb 19, 2026 · 9 filesMessage 65 · AdequateInformational 15Details
Commit message · elnosh

Replace `get_payment_preimage_hash!` macro with direct function calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a straightforward code cleanup in the project's test suite. It removes a helper macro used only in tests and replaces it with direct calls to an existing function. There is no change to the actual Lightning node logic that runs in production, and nothing in the commit suggests a security fix.

Security candidateReplace `check_closed_broadcast!` macro with direct function callsby elnosh · 63f4f8f5 · Feb 19, 2026 · 13 filesMessage 65 · AdequateInformational 15Details
Commit message · elnosh

Replace `check_closed_broadcast!` macro with direct function calls

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

65/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
boot or update path
AI analysis · Informational 15/100

This commit is a straightforward code cleanup in the project's test suite. It replaces a Rust macro called `check_closed_broadcast!` with direct calls to an equivalent function. Macros are a shorthand in Rust; replacing them with normal function calls makes the test code easier to read and maintain but does not change what the tests actually do. There is no change to the live Lightning node software that users run, so this cannot affect real funds or network security.

Security candidateTime out incomplete MPP payments in chanmon_consistencyby Wilmer Paulino · 520dcbb2 · Feb 18, 2026 · 4 filesMessage 73 · AdequateLow 27Details
Commit message · Wilmer Paulino

Time out incomplete MPP payments in chanmon_consistency

This requires calling `timer_tick_occurred`. As a result, when
`timer_tick_occurred` is called, disabled/enabled updates and
`WarnAndDisconnect` events may be triggered.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
boot or update path
AI analysis · Low 27/100

This commit changes how a Lightning payment library runs its internal fuzz tests. It makes the test harness call the normal periodic timer function instead of a special stripped-down version, so incomplete multi-part payments time out properly during testing. The production code is mostly unchanged, but a few internal test-only helpers are now available under a new test-utilities feature flag. There is no direct evidence this fixes a real-world security bug; it appears to be a test-harness cleanup that makes fuzzing more realistic.

Security candidateDrive splices to completion in chanmon_consistencyby Wilmer Paulino · 3c09513b · Feb 18, 2026 · 1 fileMessage 85 · StrongInformational 12Details
Commit message · Wilmer Paulino

Drive splices to completion in chanmon_consistency

This commit adds support for locking splices. This required confirming
transactions, which this target previously didn't consider.

It also fixes a `serial_id` collision, due to its generation using
the first 4 bytes of `get_secure_random_bytes`, that was preventing
splices from negotiating up to the `tx_signatures` exchange.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing boundary
AI analysis · Informational 12/100

This commit updates a fuzzing test harness (chanmon_consistency) in the Lightning Dev Kit project. It adds the ability to simulate confirming splice transactions on a fake blockchain and fixes a serial ID collision in the test's random number generator. The changes are confined to test/fuzzing code and do not alter production Lightning logic.

Security candidateSupport async signing in chanmon_consistencyby Wilmer Paulino · ed520ae9 · Feb 18, 2026 · 2 filesMessage 68 · AdequateInformational 13Details
Commit message · Wilmer Paulino

Support async signing in chanmon_consistency

This commit adds new opcodes to enable/disable signer operations one by
one. Note that this only covers signer operations post-funding.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundarysigning or wallet path
AI analysis · Informational 13/100

This commit only changes test and fuzzing code. It adds new test controls that let developers temporarily disable or enable individual signer operations during fuzz testing, and it removes one unused signer-operation flag. There is no change to production Lightning code, so it does not create a real-world security vulnerability or fix one.

Security candidateFree holding cell upon tx_signatures exchangeby Wilmer Paulino · 3e8b0604 · Feb 17, 2026 · 2 filesMessage 68 · AdequateLow 44Details
Commit message · Wilmer Paulino

Free holding cell upon tx_signatures exchange

After cad88af, a few code paths that also lead to a quiescence exit were
not accounted for. This commit addresses the last remaining path where
we exit quiescence when we exchange `tx_signatures` with the
counterparty.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 44/100

This patch fixes a bug in the Lightning Dev Kit where, after a special quiet period called 'quiescence' used during splicing (modifying a channel's funds), some queued payment updates were not released when the quiet period ended via the 'tx_signatures' message exchange. The fix ensures those queued updates are freed and processed, preventing payment delays or stalls during splice operations.

AI review queuedRemove use of Deref with CoinSelectionSourceby Jeffrey Czyz · 2a238d76 · Feb 17, 2026 · 3 filesMessage 68 · AdequateInformational 17Details
Commit message · Jeffrey Czyz

Remove use of Deref with CoinSelectionSource

Instead of using Deref in APIs using CoinSelectionSource, implement
CoinSelectionSource for any Deref with a Target that implements
CoinSelectionSource.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 17/100

This commit is a code cleanup in the Lightning Dev Kit's Rust library. It changes how a wallet interface called CoinSelectionSource is used in function signatures. Instead of requiring that a wallet type be a pointer-like wrapper (Deref) around something that implements CoinSelectionSource, the commit makes CoinSelectionSource directly implementable for any pointer-like wrapper. This simplifies the API and removes an internal wrapper struct, but it does not fix a security bug or change runtime behavior in a way that would affect funds or network safety.

AI review queuedMake ConfirmedUtxo the primary typeby Jeffrey Czyz · 9a0a2497 · Feb 17, 2026 · 2 filesMessage 68 · AdequateInformational 15Details
Commit message · Jeffrey Czyz

Make ConfirmedUtxo the primary type

FundingTxInput was originally designed for channel funding but is now
used more broadly for coin selection and splicing. The name
ConfirmedUtxo better reflects its general-purpose nature as a confirmed
UTXO with previous transaction data. Make ConfirmedUtxo the real struct
in wallet_utils and alias FundingTxInput to it for backward
compatibility.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a pure code reorganization: it renames the internal primary type from FundingTxInput to ConfirmedUtxo and makes FundingTxInput a backward-compatible alias. No behavior, logic, or security properties change. It is not a security fix.

AI review queuedMove sync wallet utils to util::wallet_utilsby Jeffrey Czyz · 0ce6ba40 · Feb 17, 2026 · 11 filesMessage 68 · AdequateInformational 15Details
Commit message · Jeffrey Czyz

Move sync wallet utils to util::wallet_utils

Synchronous wallet utilities were coupled to bump_transaction::sync,
limiting their reusability for other features like channel funding and
splicing which need synchronous wallet operations. Consolidate all
wallet utilities in a single module for consistency and improved code
organization.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a straightforward code reorganization. It moves synchronous wallet helper code from one module (bump_transaction::sync) into a shared utility module (util::wallet_utils) so it can be reused by channel funding and splicing features. No security-relevant behavior is changed; only import paths and module locations are adjusted.

AI review queuedMove wallet utils to dedicated moduleby Jeffrey Czyz · 45db7c88 · Feb 17, 2026 · 9 filesMessage 68 · AdequateInformational 19Details
Commit message · Jeffrey Czyz

Move wallet utils to dedicated module

Wallet-related types were tightly coupled to bump_transaction, making
them less accessible for other use cases like channel funding and
splicing. Extract these utilities to a dedicated module for improved
code organization and reusability across the codebase.

Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit is a pure code reorganization: it moves wallet-related types and traits (for choosing which coins to spend in Bitcoin transactions) from one internal module to a new dedicated module. There are no functional changes, no bug fixes, and no security patches visible in the diff.

Security candidateUse CoinSelection::change_output when splicingby Jeffrey Czyz · 96b9e6af · Feb 17, 2026 · 7 filesMessage 68 · AdequateLow 32Details
Commit message · Jeffrey Czyz

Use CoinSelection::change_output when splicing

Now that CoinSelection is used to fund a splice funding transaction, use
that for determining of a change output should be used. Previously, the
initiator could either provide a change script upfront or let LDK
generate one using SignerProvider::get_destination_script.

Since older versions may have serialized a SpliceInstruction without a
change script while waiting on quiescence, LDK must still generate a
change output in this case.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing boundary
AI analysis · Low 32/100

This commit changes how Lightning Dev Kit handles 'change' money during Bitcoin channel splicing. Previously, the user could provide a change address or LDK would generate one itself. Now, the wallet's coin-selection logic decides whether a change output is needed and what it looks like. The commit keeps a fallback for older stored data that may not include a change script. It is a code-quality and consistency improvement rather than a clear security fix, though it reduces the chance of fee or change-output mistakes during splicing.

AI review queuedSplit splice initiation into two phasesby Jeffrey Czyz · 2fd33510 · Feb 17, 2026 · 11 filesMessage 68 · AdequateLow 28Details
Commit message · Jeffrey Czyz

Split splice initiation into two phases

Previously, splice_channel required callers to manually construct
funding inputs and pass them directly, making coin selection the
caller's responsibility. This made the API difficult to use and
prevented reuse of the existing CoinSelectionSource trait.

Introduce a two-phase API: splice_channel now returns a FundingTemplate
that callers use to build a FundingContribution via wallet-backed
splice methods (e.g., splice_in_sync, splice_out_sync), which handle
coin selection automatically. The completed contribution is then passed
to a new funding_contributed method to begin quiescence and negotiation.

This also renames SpliceContribution to FundingContribution and moves
fee estimation and input validation into the funding module, co-located
with the types they operate on.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 28/100

This commit refactors how Lightning channel 'splicing' is started. Instead of requiring the user to manually pick coins and hand them to the API, it splits the process into two steps: first the library returns a 'funding template', then the user's wallet automatically selects coins through a standard trait and the result is handed back. The change is mostly an API usability improvement and moves fee-estimation/validation code into a dedicated module. There is no direct evidence in the commit that it fixes a security vulnerability; it is a design/API change.

AI review queuedMake ClaimId optional in coin selectionby Jeffrey Czyz · 4cae129b · Feb 17, 2026 · 2 filesMessage 80 · StrongLow 27Details
Commit message · Jeffrey Czyz

Make ClaimId optional in coin selection

CoinSelectionSource is used for anchor bumping where a ClaimId is passed
in to avoid double spending other claims. To re-use this trait for
funding a splice, the ClaimId must be optional. And, if None, then any
locked UTXOs may be considered ineligible by an implementation.

80/100 · StrongMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 27/100

This commit changes how a wallet picks coins to spend when building Bitcoin transactions. Previously, every coin selection had to be tied to a specific 'claim ID' used to avoid accidentally spending the same coin twice across different claims. Now the claim ID is optional so the same code can be reused for a new feature called 'splicing.' When no claim ID is provided, the code is designed to treat the spend as unique and avoid double-spending locked coins. The change includes safety checks to skip the 'force conflicting spend' path when there is no claim ID.

AI review queuedUse FundingTxInput instead of Utxo in CoinSelectionby Jeffrey Czyz · fc3fa7ca · Feb 17, 2026 · 6 filesMessage 85 · StrongLow 27Details
Commit message · Jeffrey Czyz

Use FundingTxInput instead of Utxo in CoinSelection

In order to reuse CoinSelectionSource for splicing, the previous
transaction of each UTXO is needed. Update CoinSelection to use
FundingTxInput (renamed to ConfirmedUtxo) so that it is available.

This requires adding a method to WalletSource to look up a previous
transaction for a UTXO. Otherwise, Wallet's implementation of
CoinSelectionSource would need WalletSource to include the previous
transactions when listing confirmed UTXOs to select from. But this would
be inefficient since only some UTXOs are selected.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 27/100

This commit refactors how the Lightning Dev Kit (LDK) selects coins for on-chain Bitcoin transactions. It changes the internal data structure used during coin selection so that each selected coin now carries the full previous transaction that created it, not just the coin's own details. The main stated reason is to prepare for a future feature called 'splicing.' The commit also adds a new wallet method to look up those previous transactions on demand. There is no direct evidence in the commit that this fixes an active security bug, but it does touch code that handles real money (transaction fees and UTXOs) and changes a public wallet interface, so downstream implementers need to update their code.

AI review queuedMove FundingTxInput::sequence to Utxoby Jeffrey Czyz · c80afe9e · Feb 13, 2026 · 4 filesMessage 68 · AdequateInformational 19Details
Commit message · Jeffrey Czyz

Move FundingTxInput::sequence to Utxo

A forthcoming commit will change CoinSelection to include FundingTxInput
instead of Utxo, though the former will probably be renamed. This is so
CoinSelectionSource can be used when funding a splice. Further updating
WalletSource to use FundingTxInput is not desirable, however, as it
would result in looking up each confirmed UTXOs previous transaction
even if it is not selected. See Wallet's implementation of
CoinSelectionSource, which delegates to WalletSource for listing all
confirmed UTXOs.

This commit moves FundingTxInput::sequence to Utxo, and thus the
responsibility for setting it to WalletSource implementations. Doing so
will allow Wallet's CoinSelectionSource implementation to delegate
looking up previous transactions to WalletSource without having to
explicitly set the sequence on any FundingTxInput.

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 19/100

This commit is a straightforward internal code reorganization in the Lightning Dev Kit's Rust library. It moves the 'sequence' field (a Bitcoin transaction detail that controls things like replace-by-fee) from one internal data structure called FundingTxInput into another called Utxo. The change is preparation for future work on splicing (a way to resize a Lightning channel) and avoids unnecessary lookups of previous transactions. There is no indication this fixes a security vulnerability or introduces a new attack path.