LDK
← All projectsLightning Dev Kit

rust-lightning

Composable Rust libraries for building Lightning wallets, nodes, and services.

BitcoinCryptographic librariesLightning NetworkNormal
Repository coverage

1655 commits in the local evidence base

Every captured commit receives deterministic security triage and a separate communication-quality score. Security candidates and broader second-pass signals receive full-patch Ollama analysis.

249security candidates223second-pass queue1517AI analyses
88commits · 30 days
195commits · 60 days
565commits · 180 days
1307commits · 365 days
Backfill bands
Aug 5 → Feb 6819 seen18 candidatesComplete
Feb 6 → Jun 6468 seen16 candidatesComplete
Jun 6 → Jul 6128 seen8 candidatesComplete
Jul 6 → Aug 561 seen3 candidatesComplete
Commit communication

Does the history explain itself?

Message quality measures whether a commit identifies its scope, purpose, rationale, testing, and supporting references. It does not change the security-severity score.

70/100 average clarity
470Strong · 80–100
830Adequate · 60–79
293Thin · 40–59
62Opaque · 0–39
3security candidates with opaque commit messaging
Read the scoring rubric →
Developer activity

Who is changing the project?

Public Git author strings; identities are not independently verified.

DeveloperCommitsCandidatesAnalyzedHigh riskMessage avg.
Elias Rohrer15315153667
Matt Corallo43452370574
Jeffrey Czyz19545182169
Wilmer Paulino15945155169
Leo Nash11613116162
Valentine Wallace14010135169
Vincenzo Palazzo11311183
Joost Jager16224162069
elnosh371331057
auto-pr-bot2478087
shaavan22622069
Carla Kirk-Cohen78366068
Analysis record

Published AI watches

Last scanned 41 minutes ago

Informational 19 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'tx-sync: Parallelize esplora status queries' (#4913)

This commit rewrites how a Lightning wallet talks to Esplora block-explorer servers so that many status checks happen in parallel instead of one at a time. It is a performance/refactoring change. There is no direct evidence in the commit t…

Concurrency/timing change in transaction confirmation logicNew inconsistency check preserved when a previously-confirmed tx is reported unconfirmedAdded defensive error path for missing pre-fetched block status
c303f515by Matt Corallo+140−371 file
No security note in commit
Low 30 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Skip Electrum creator transaction downloads' (#4992)

This change stops the Electrum-based transaction sync client from downloading the very transaction that created an output it is watching. Previously, the client could request that transaction from Electrum, even though a transaction can ne…

Avoids unnecessary Electrum transaction.get requests for watched outputsReduces information disclosure to Electrum server about watched outpointsAdds regression test verifying request suppression
c36e50cbby Matt Corallo+142−02 files
No security note in commit
Low 44 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Use preferred sPK of watched txn in electrum, not rand ones' (#4867)

This change improves how the Lightning Dev Kit's Electrum and Esplora transaction-sync clients track watched Bitcoin transactions. Previously, the code ignored the script pubkey (the 'address' associated with a transaction) supplied when r…

Previously ignored `script_pubkey` argument in `register_tx` for transaction watchersElectrum script-history queries previously used an arbitrary transaction output, which could be OP_RETURN and therefore unindexed by some Electrum serversNew logic prefers caller-supplied script pubkey and falls back to non-OP_RETURN outputs
bfe5ca89by tnull+52−243 files
No security note in commit
Low 33 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Serialize transient Event variants; move persist decision into ChannelManager' (#4791)

This commit changes how LDK stores pending event notifications. It adds serialization support for several event types that previously were not fully saved to disk, and introduces a helper method so the code can decide which events are wort…

Data-loss prevention: previously non-round-trippable event variants are now fully serialized, avoiding accidental event loss when users serialize Event queues themselvesState-consistency hardening: ChannelManager now explicitly skips events that describe non-surviving restart state, preventing replay of stale eventsDefensive assertion: debug builds assert that every persisted event round-trips to Some(event), catching serialization mismatches
a0d4632eby Matt Corallo+694−818 files
No security note in commit
Informational 15 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Document that funding signing events can go stale' (#4960)

This commit only adds documentation comments to two source files. It explains that certain funding-signing events can become stale if the underlying negotiation fails, and that callers may see specific harmless errors as a result. No code …

26eecf2dby Matt Corallo+15−02 files
No security note in commit
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Drop the honggfuzz version pin from the CI fuzz job

This commit removes a fixed-version pin for the honggfuzz fuzzing tool in a continuous-integration script. The project now uses the current release of honggfuzz instead of an older pinned version. There is no change to the actual Lightning…

4a1635efby auto-pr-bot+1−51 file
No security note in commit
Informational 15 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Run the CI fuzz job on the stable toolchain

This commit changes the Rust toolchain used in the continuous integration (CI) fuzzing job from a fixed older version (1.75) to the latest stable release. It is purely a build/test infrastructure change to fix a dependency compatibility is…

21c4ed2bby auto-pr-bot+3−32 files
No security note in commit
Informational 19 AI analysisMessage 91 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Expose the dummy-hop tail constructor publicly

This commit makes a previously internal helper function public so that outside developers can build dummy-hop tails for blinded payment paths without recreating the logic themselves. It is an API usability change, not a fix for a known sec…

No security-relevant behavior change in the diffAPI visibility broadened from crate-public to publicCLTV expiry overflow check already present and unchanged
c5443353by auto-pr-bot+14−71 file
No security note in commit
Moderate 54 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Fail commitment sig verification without counterparty params

This change adds a safety check in a Bitcoin Lightning Network library (LDK). Previously, if the software tried to verify a peer's commitment signature before it had learned the peer's channel parameters, it could crash with a panic. Now i…

Defensive check added on peer-driven code path to prevent panicMissing counterparty_parameters could previously cause panic during commitment transaction constructionChannel closure returned instead of panic
de7ecc2fby auto-pr-bot+24−01 file
Vendor flagged security relevance
Informational 15 AI analysisMessage 100 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Clarify the commitment validation failure message

This commit only changes the wording of an error message sent to peers when a commitment transaction fails validation. It replaces the vague phrase 'Failed to validate our commitment' with the clearer 'Received commitment failed validation…

3284a006by auto-pr-bot+11−114 files
No security note in commit
Moderate 61 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Move holder commit sig checks to `InMemorySigner`' (#4885)

This commit moves the checks that validate a counterparty's signatures on the holder's commitment and HTLC transactions out of the general channel code and into the signer module (InMemorySigner). Previously, these signature checks were do…

Moved signature validation from channel state machine into signer moduleAdded new tests that corrupt signatures and verify rejectionChanged error message from 'Invalid commitment tx signature from peer' / 'Invalid funding_created signature from peer' to 'Failed to validate our commitment'
83f5ba55by Matt Corallo+626−31024 files
No security note in commit
Low 42 AI analysisMessage 86 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'Drop stale splice signature on disconnect' (#4954)

This change fixes a Lightning channel splicing bug: when two peers temporarily disconnect during a splice, any half-finished signature the other side already sent is now discarded. Before the fix, that stale signature could be reused after…

State-invalidation bug in multi-step protocol (splice negotiation)Stale cryptographic signature not cleared on disconnectPotential reuse of old commitment state after reconnect
c9a77251by Matt Corallo+22−12 files
No security note in commit
Moderate 58 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Drop stale splice signature on disconnect

This fix prevents a Lightning channel from being accidentally force-closed. During a splice (a way to resize a payment channel), one side's initial signature could be kept in memory after the peers disconnected. If the peers later reconnec…

State inconsistency: in-memory buffered message not cleared on disconnectDuplicate message processing after reconnectionForce-close consequence for active Lightning channel
71405b4bby Wilmer Paulino+22−12 files
Vendor flagged security relevance
Informational 20 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'offers: rename matches_invoice_signing_pubkey to key_can_sign_invoice' (#4942)

This commit is a simple rename of a public function from `matches_invoice_signing_pubkey` to `key_can_sign_invoice`, plus matching updates to its documentation, callers, tests, and changelog. No behavior changed. It is not a security fix.

a476cf92by Matt Corallo+13−133 files
No security note in commit
Informational 15 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

offers: rename matches_invoice_signing_pubkey to key_can_sign_invoice

This commit is a simple rename of a function and its documentation from matches_invoice_signing_pubkey to key_can_sign_invoice. No logic, behavior, or security properties changed. It is a follow-up code-review naming cleanup.

388187caby Vincenzo Palazzo+13−133 files
No security note in commit
Informational 18 AI analysisMessage 81 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Merge PR 'offers: add Offer::permits_invoice_signed_by' (#4884)

This commit adds a new public helper method, Offer::matches_invoice_signed_by (later renamed matches_invoice_signing_pubkey), that lets callers check whether an invoice signing key belongs to the recipient named by a BOLT 12 offer. It also…

Refactors existing BOLT 12 invoice-signing-pubkey validation into a reusable helperAdds public API to bind an invoice signing key to an offer recipientAdds unit tests for issuer-id vs. path-last-hop matching behavior
016af8f9by Matt Corallo+81−135 files
No security note in commit
Low 29 AI analysisMessage 85 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Support retired TLV fields in object-constructing macros

This commit is a feature enhancement for LDK's internal serialization macros. It allows developers to mark old protocol fields as 'retired' (reserved but no longer used) in more places, so those type numbers cannot be accidentally reused. …

TLV type-number reservation mechanism extended to more macro-generated code pathsPrevents accidental reuse of retired protocol field type numbersAvoids UnknownRequiredFeature decode failures for obsolete even-type fields
6d7c2bdaby Jeffrey Czyz+120−222 files
No security note in commit
Informational 17 AI analysisMessage 91 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Replace splice failure wire tests with a 0.2 downgrade test

This commit is a test-only cleanup in the Lightning Dev Kit (LDK) Rust codebase. It removes low-level byte-level tests for splice failure events and replaces them with a single cross-version test that actually loads a 0.2 node with seriali…

Cross-version serialization compatibility test addedRemoval of byte-level tests that could not detect real 0.2 mismatchesNo production code changes
80f2b44fby auto-pr-bot+95−2663 files
No security note in commit
Low 28 AI analysisMessage 98 · Strong
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Document duplicate HTLC handling on revoked commitments

This commit only adds a code comment explaining an existing quirk: if a revoked old channel transaction contains two identical-looking payment forwards and the other side claims both, the software may only claim one upstream while letting …

Behavioral quirk in revoked-commitment HTLC resolution documentedDuplicate (payment_hash, amount) HTLCs can map to the same upstream sourcePotential missed upstream preimage claim on second identical HTLC
c5bd8b11by auto-pr-bot+19−01 file
Vendor flagged security relevance
Moderate 60 AI analysisMessage 73 · Adequate
LDK Lightning Dev Kitrust-lightning BitcoinCryptographic librariesLightning Network

Abort active splice RBF when prior candidate confirms

This commit fixes a state-handling bug in Lightning Dev Kit's splicing feature. When a user tries to speed up or replace a pending splice (an 'RBF' attempt) and the older splice transaction unexpectedly gets confirmed on-chain, the softwar…

State-conflict handling between confirmed splice candidate and active RBF negotiationStructured abort propagation through chain-event pathConditional abort based on holder signature progress to avoid unsafe cancellation
7587d2cdby Wilmer Paulino+623−424 files
No security note in commit
Repository ledger

Explore captured commits

Expand any commit for its author, full message, clarity score, changed files, triage signals, analysis, and source link.

AI review queuedResolve legacy TLV fields during ChannelManagerData deserializationby Joost Jager · d2c55dd2 · Feb 2, 2026 · 1 fileMessage 73 · AdequateLow 28Details
Commit message · Joost Jager

Resolve legacy TLV fields during ChannelManagerData deserialization

Move the resolution of legacy/compatibility TLV fields from
from_channel_manager_data (stage 2) into ChannelManagerData::read
(stage 1). This keeps ChannelManagerData minimal by consolidating
mutually exclusive fields into their final form during deserialization:

- pending_outbound_payments: Merge TLV 3, TLV 1 (no_retry), and
non-TLV compat fields into a single HashMap
- in_flight_monitor_updates: Convert legacy TLV 10 (keyed by OutPoint)
to TLV 17 format (keyed by ChannelId)
- pending_events: Apply events_override (TLV 8) if present

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Low 28/100

This commit is an internal code cleanup in the Lightning Dev Kit's channel manager. It moves the handling of old data formats (legacy TLV fields) from a later initialization stage into the deserialization stage, so the data structure is normalized earlier. There is no direct evidence this fixes an active security vulnerability; it appears to be a maintainability and correctness refactor to prevent inconsistencies when loading older persisted data.

AI review queuedSplit ChannelManager::read into two stagesby Joost Jager · 3deecd4a · Feb 2, 2026 · 1 fileMessage 68 · AdequateInformational 12Details
Commit message · Joost Jager

Split ChannelManager::read into two stages

Introduce ChannelManagerData<SP> as an intermediate DTO that holds all
deserialized data from a ChannelManager before validation. This splits
the read implementation into:

1. Stage 1: Pure deserialization into ChannelManagerData
2. Stage 2: Validation and reconstruction using the DTO

The existing validation and reconstruction logic remains unchanged;
only the deserialization portion was extracted into the DTO's
ReadableArgs implementation.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 12/100

This commit is a pure internal code reorganization. It splits the loading of a Lightning node's ChannelManager into two steps: first reading raw data into a temporary data holder, then validating and building the actual ChannelManager. No security behavior appears to change; it is a refactoring to make the code easier to maintain and test.

AI review queuedUnwrap TLV fields with initialized defaults in ChannelManagerDataby Joost Jager · fe6fd648 · Feb 2, 2026 · 1 fileMessage 73 · AdequateInformational 18Details
Commit message · Joost Jager

Unwrap TLV fields with initialized defaults in ChannelManagerData

For TLV fields that are initialized with Some(...) before reading and
thus always have a value after deserialization, remove the Option
wrapper from ChannelManagerData and unwrap when constructing it.

This applies to pending_claiming_payments and
monitor_update_blocked_actions_per_peer.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 18/100

This is a small internal cleanup in the Lightning Dev Kit's Rust code. It removes unnecessary 'Option' wrappers from two data fields that are always set during deserialization, replacing later `.unwrap()` calls with direct use. The change does not introduce a new security vulnerability; it is a refactoring that makes the code clearer and slightly reduces panic risk by moving the unwrapping to a point where the value is guaranteed to exist.

AI review queuedDrop Deref indirection for SignerProviderby Valentine Wallace · 9432adbc · Jan 30, 2026 · 9 filesMessage 68 · AdequateInformational 13Details
Commit message · Valentine Wallace

Drop Deref indirection for SignerProvider

Reduces generics and verbosity across the codebase, should provide equivalent
behavior.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 13/100

This commit is a straightforward internal code cleanup in the Lightning Dev Kit's Rust library. It removes an unnecessary layer of pointer-like indirection (the Deref trait) around the SignerProvider type used throughout channel and monitor code. The change simplifies type signatures and reduces boilerplate but does not alter what the code actually does or how it protects funds.

AI review queuedDrop Deref indirection for OutputSpenderby Valentine Wallace · 644ca0c6 · Jan 30, 2026 · 3 filesMessage 68 · AdequateInformational 15Details
Commit message · Valentine Wallace

Drop Deref indirection for OutputSpender

Reduces generics and verbosity across the codebase, should provide equivalent
behavior.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This is a routine Rust code cleanup change. It removes the requirement that an OutputSpender must be wrapped in a Deref pointer (like Arc or reference), and instead makes OutputSpender work directly through a blanket implementation. The commit message says it reduces generics and verbosity while keeping the same behavior. There is no security fix here.

AI review queuedDrop Deref indirection for Loggerby Valentine Wallace · ac8074e5 · Jan 30, 2026 · 30 filesMessage 68 · AdequateInformational 18Details
Commit message · Valentine Wallace

Drop Deref indirection for Logger

Reduces generics and verbosity across the codebase, should provide equivalent
behavior.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: unusually broad changesecond-pass: security-sensitive path
AI analysis · Informational 18/100

This is a large but straightforward internal refactoring of the Rust Lightning code. It removes an extra layer of pointer indirection (the Deref trait) from how the Logger type is passed around, replacing it with direct Logger trait bounds. The commit message says the goal is to reduce generics and verbosity while keeping the same behavior. There is no change to cryptographic logic, network protocol handling, or security-sensitive operations.

AI review queuedDrop Deref indirection for BroadcasterInterfaceby Valentine Wallace · aa9feace · Jan 30, 2026 · 14 filesMessage 68 · AdequateInformational 18Details
Commit message · Valentine Wallace

Drop Deref indirection for BroadcasterInterface

Reduces generics and verbosity across the codebase, should
provide equivalent behavior.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

68/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 18/100

This commit is a large but straightforward internal code cleanup in the Lightning Dev Kit Rust library. It removes an extra layer of pointer-like generic wrapping (the `Deref` indirection) around the transaction-broadcasting interface and instead uses the trait directly. The commit message says the goal is to reduce generics and verbosity while keeping the same behavior. There is no indication this fixes a security bug or changes runtime behavior in a way that introduces a vulnerability.

AI review queuedFix race condition in async `UtxoFuture` resolutionby Elias Rohrer · 114f6b56 · Jan 29, 2026 · 1 fileMessage 73 · AdequateLow 43Details
Commit message · Elias Rohrer

Fix race condition in async `UtxoFuture` resolution

Previously, we refactored the `GossipVerifier` to not require holding a
circular reference. As part of this, we moved to a model where the
`UtxoFuture`s are now polled by the background processor which checks
for completion through `get_and_clear_pending_msg_events`.

However, as part of this refactor we introduced race-condition: as we
only held `Weak` references in `PendingChecksContext` and the
`UtxoFuture` was directly dropped by the `GossipVerifier` after calling
`resolve`, the actual data was dropped with the future and gone when the
background processor attempted to retrieve and apply it via
`check_resolved_futures`.

Here, we fix this issue by simply holding on to the `state` `Arc`s in a
separate `pending_states` `Vec` that is only pruned in
`check_resolved_futures`, ensuring any completed results are collected
first.

Signed-off-by: Elias Rohrer <dev@tnull.de>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
second-pass: broader security terminology
AI analysis · Low 43/100

This commit fixes a race condition in how the Lightning Dev Kit processes background checks on channel announcements (UTXO lookups). Previously, the result of a completed check could be thrown away before another part of the system could collect it, meaning valid gossip messages might be silently lost and not applied to the network graph. The fix keeps the result alive until it is explicitly collected.

AI review queued`ElectrumSyncClient`: Skip unconfirmed `get_history` entriesby Elias Rohrer · cc1eb168 · Jan 23, 2026 · 1 fileMessage 73 · AdequateLow 49Details
Commit message · Elias Rohrer

`ElectrumSyncClient`: Skip unconfirmed `get_history` entries

Electrum's `blockchain.scripthash.get_history` will return the
*confirmed* history for any scripthash, but will then also append any
matching entries from the mempool, with respective `height` fields set
to 0 or -1 (depending on whether all inputs are confirmed or not).

Unfortunately we previously only included a filter for confirmed
`get_history` entries in the watched output case, and forgot to add such
a check also when checking for watched transactions. This would have us
treat the entry as confirmed, then failing on the `get_merkle` step
which of course couldn't prove block inclusion. Here we simply fix this
omission and skip entries that are still unconfirmed (e.g., unconfirmed
funding transactions from 0conf channels).

Signed-off-by: Elias Rohrer <dev@tnull.de>

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Low 49/100

This patch fixes a bug in rust-lightning's Electrum-based transaction sync. When checking whether watched transactions were confirmed, the code previously treated unconfirmed mempool entries from Electrum's get_history as if they were already confirmed. It would then try to fetch a Merkle proof of block inclusion, which cannot exist for an unconfirmed transaction, causing a failure. The fix skips any history entry whose height is 0 or -1 (unconfirmed) in the watched-transaction path, matching what was already done for watched outputs. A debug assertion was also replaced with a proper error log and return if a server returns duplicate history entries.

AI review queuedrustfmt: format priv_short_conf_testsby Thrishalmadasu · b0883ba5 · Jan 23, 2026 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · Thrishalmadasu

rustfmt: format priv_short_conf_tests

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only reformats a test file using rustfmt. It changes whitespace and line breaks but does not alter any actual code logic, behavior, or security-sensitive functionality. There is no security impact.

AI review queuedUse Amount in calculate_change_output_valueby Jeffrey Czyz · 76e73a4f · Jan 16, 2026 · 2 filesMessage 35 · OpaqueLow 26Details
Commit message · Jeffrey Czyz

Use Amount in calculate_change_output_value

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Low 26/100

This commit refactors a Bitcoin transaction fee and change-calculation routine to use the strongly-typed Amount type instead of raw u64 satoshi values. The main functional change is that input/output totals now use checked_add/checked_sub, which prevents silent overflow/underflow wraparound when summing large amounts. It also tightens one subtraction so an unexpected negative value panics instead of silently wrapping. This is a defensive hardening change rather than a fix for a known exploitable bug.

AI review queuedAdd an option to deserialize monitors in parallel in async loadby Matt Corallo · 18f7a8f5 · Jan 8, 2026 · 1 fileMessage 85 · StrongInformational 15Details
Commit message · Matt Corallo

Add an option to deserialize monitors in parallel in async load

`MonitorUpdatingPersister::read_all_channel_monitors_with_updates`
was made to do the IO operations in parallel in a previous commit,
however in practice this doesn't provide material parallelism for
large routing nodes. Because deserializing `ChannelMonitor`s is the
bulk of the work (when IO operations are sufficiently fast), we end
up blocked in single-threaded work nearly the entire time.

Here, we add an alternative option - a new
`read_all_channel_monitors_with_updates_parallel` method which uses
the `FutureSpawner` to cause the deserialization operations to
proceed in parallel.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 15/100

This commit adds a new optional method that lets a Lightning node read its saved channel monitors in parallel, including the CPU-heavy step of turning stored data back into usable objects. It is a performance improvement, not a security fix. The existing single-threaded method remains available and unchanged in behavior.

AI review queuedRustfmt channel methodsby Joost Jager · 8ae40eed · Jan 8, 2026 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager

Rustfmt channel methods

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup. It removes `#[rustfmt::skip]` annotations from three methods in the Lightning channel code and lets rustfmt reformat the function signatures, calls, and log statements across multiple lines. No logic, behavior, or security checks were changed.

AI review queuedAdd logger to monitor_updating_pausedby Joost Jager · cafbd568 · Jan 8, 2026 · 2 filesMessage 35 · OpaqueInformational 14Details
Commit message · Joost Jager

Add logger to monitor_updating_paused

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 14/100

This commit only adds a logging parameter to an internal helper function and its callers. It does not change program logic, state handling, or security behavior. The change is purely for better observability when channel monitor updates are paused.

AI review queuedInline format argsby Joost Jager · e50280cb · Dec 15, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager

Inline format args

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is a minor code cleanup that changes how two error messages are formatted in Rust. It uses a newer, more concise syntax for embedding variables inside strings. There is no functional change and no security relevance.

AI review queuedRustfmt touched methodsby Joost Jager · d436cbf5 · Dec 11, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager

Rustfmt touched methods

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup. It uses rustfmt to rewrap long function signatures, break up long macro invocations, and adjust indentation in a single Rust source file. No logic, behavior, or security properties of the code were changed.

AI review queuedAdd docs to `commitment_signed_dance_return_raa`by elnosh · e5528ead · Dec 9, 2025 · 1 fileMessage 35 · OpaqueInformational 15Details
Commit message · elnosh

Add docs to `commitment_signed_dance_return_raa`

35/100 · OpaqueMessage clarity
✓ Descriptive subject! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit only adds explanatory documentation comments to an existing internal test helper function. No code behavior was changed, so it cannot introduce or fix a security issue on its own.

AI review queuedMake `AttributionData` actually pub since its used in the public APIby Matt Corallo · bd578235 · Dec 9, 2025 · 5 filesMessage 85 · StrongInformational 19Details
Commit message · Matt Corallo

Make `AttributionData` actually pub since its used in the public API

`AttributionData` is a part of the public `UpdateFulfillHTLC` and
`UpdateFailHTLC` messages, but its not actually `pub`. Yet again
re-exports bite us and leave us with a broken public API - we
ended up accidentally sealing `AttributionData`.

Instead, here, we just make `onion_utils` `pub` so that we avoid
making the same mistake in the future.

Note that this still leaves us with arather useless public
`AttributionData` API - it can't be created, updated, or decoded,
it can only be serialized and deserialized, but at least it exists.

85/100 · StrongMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
Why it was queued
second-pass: broader security terminology
AI analysis · Informational 19/100

This commit fixes a Rust library API visibility problem. A data type called AttributionData was supposed to be publicly usable because it appears in public Lightning protocol messages, but it was accidentally kept internal due to how Rust re-exports work. The change makes the containing module public so users can actually reference the type. It is a usability/API completeness fix, not a security vulnerability fix.

AI review queuedUpdate crate version numbers post v0.2 releaseby Elias Rohrer · 29d97a2a · Dec 5, 2025 · 10 filesMessage 60 · AdequateInformational 15Details
Commit message · Elias Rohrer

Update crate version numbers post v0.2 release

We bump the `+git` version numbers, fixing the SemVer checks.

60/100 · AdequateMessage clarity
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit only updates version numbers in package configuration files after a software release. It changes references from version 0.2.0 to 0.3.0 across several related crates and bumps the main crate's version label from 0.2.0+git to 0.3.0+git. There are no code changes, no security fixes, and no behavior changes.

AI review queuedRustfmt handle_monitor_update_completion_actionsby Joost Jager · f312c24f · Dec 3, 2025 · 1 fileMessage 25 · OpaqueInformational 15Details
Commit message · Joost Jager

Rustfmt handle_monitor_update_completion_actions

25/100 · OpaqueMessage clarity
✓ Descriptive subject! Too few words to establish purpose! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup. It removes a #[rustfmt::skip] annotation and lets Rust's automatic formatter reformat one function in the Lightning channel manager. No logic, behavior, or security properties of the code are changed.

AI review queuedRustfmt channel methodsby Joost Jager · 8116e0b8 · Nov 26, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager

Rustfmt channel methods

Clean up changes in previous commits.

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely a code formatting cleanup. It removes manual rustfmt skip annotations and lets rustfmt reformat several match statements and function signatures in the Lightning channel code. There are no logic changes, no security fixes, and no behavior differences.

AI review queuedSupport async fetching of commitment point during channel reestablishby Wilmer Paulino · 1f7b2490 · Nov 18, 2025 · 3 filesMessage 73 · AdequateLow 42Details
Commit message · Wilmer Paulino

Support async fetching of commitment point during channel reestablish

`HolderCommitmentPoint` currently tracks the current and next point used
on counterparty commitments, which are unrevoked. When we reestablish a
channel, the counterparty sends us the commitment height, along with the
corresponding secret, for the state they believe to be the latest. We
compare said secret to the derived point we fetch from the signer to
know if the peer is being honest.

Since the protocol does not allow peers (assuming no data loss) to be
behind the current state by more than one update, we can cache the two
latest revoked commitment points alongside `HolderCommitmentPoint`, such
that we no longer need to reach the signer asynchronously when handling
`channel_reestablish` messages throughout the happy path. By doing so,
we avoid complexity in needing to pause the state machine (which may
also result in needing to stash any update messages from the
counterparty) while the signer response is pending.

The only remaining case left to handle is when the counterparty presents
a `channel_reestablish` with a state later than what we know. This can
only result in two terminal cases: either they provided a valid
commitment secret proving we are behind and we need to panic, or they
lied and we force close the channel. This is the only case we choose to
handle asynchronously as it's relatively trivial to handle.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: broader security terminologysecond-pass: security-sensitive path
AI analysis · Low 42/100

This commit improves how the Lightning node handles reconnections after a network interruption. Previously, when re-establishing a channel, the node sometimes had to ask an external signer for a cryptographic proof point and could not proceed until the signer responded. The change keeps the two most recent revoked proof points cached locally so the common case no longer needs to wait for the signer. It only defers to the signer asynchronously in the rare 'stale state' case, where the peer claims our node is behind. That stale case either proves data loss (causing a protective panic) or proves the peer is lying (causing a force-close). The commit is a defensive hardening/feature change, not a fix for an active exploit.

AI review queuedRustfmt modified fnsby Joost Jager · a6812c8e · Nov 18, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager

Rustfmt modified fns

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This commit is purely a code-formatting cleanup. It removes `#[rustfmt::skip]` annotations from a few functions in the Lightning channel manager and lets rustfmt reformat the code. No logic, behavior, or security properties of the program change.

AI review queuedInline error variableby Joost Jager · f63066ef · Nov 18, 2025 · 1 fileMessage 28 · OpaqueInformational 15Details
Commit message · Joost Jager

Inline error variable

28/100 · OpaqueMessage clarity
✓ Subject identifies a change! No meaningful explanatory body
Why it was queued
second-pass: opaque commit message
AI analysis · Informational 15/100

This is a trivial code cleanup: a developer removed a temporary variable that held an error message and instead put the message text directly into the logging call. The program's behavior, error messages, and security posture are unchanged.

AI review queuedTrivially replace `Box::pin` with `pin!` in a few placesby Matt Corallo · 21052847 · Nov 10, 2025 · 6 filesMessage 73 · AdequateInformational 15Details
Commit message · Matt Corallo

Trivially replace `Box::pin` with `pin!` in a few places

Now that our MSRV is above 1.68 we can use the `pin!` macro to
avoid having to `Box` various futures, avoiding some allocations,
especially in `lightning-net-tokio`, which happens in a tight loop.

73/100 · AdequateMessage clarity
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
Why it was queued
signing or wallet pathsecond-pass: security-sensitive path
AI analysis · Informational 15/100

This commit is a routine code cleanup that swaps one Rust standard-library mechanism for pinning futures (`Box::pin`) with a newer, allocation-free equivalent (`pin!`). It removes heap allocations in a few internal loops and sync wrappers, but does not change program logic, trust boundaries, or behavior. There is no security relevance.