AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 27 Bitcoin

pytest: test that opening a channel below our own minimum fails *gracefully*.

Public commit record

What the developer wrote

Authored by Rusty Russell

75/100 · Adequate
pytest: test that opening a channel below our own minimum fails *gracefully*.

At the moment it fails after the *peer* responds.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body✓ Mentions testing or verification
The short version

What changed, and why it matters

This commit adds a test that reveals a bug in how Core Lightning handles channel openings that are below a user's own configured minimum. Currently the node lets the user try to open the channel and only fails after the remote peer gets involved, which is impolite and could leak information or cause unnecessary peer disconnects. The test is marked as expected to fail (xfail), meaning the bug exists but is not yet fixed by this commit.

Recommended action

Treat this as a low-priority bug report rather than an active vulnerability. The maintainers should move the `min-capacity-sat` validation earlier in the `fundchannel` flow so the RPC fails locally without contacting the peer. Reviewers may want to confirm whether the peer-visible WIRE_ERROR could be used to fingerprint node policy or trigger unnecessary disconnects.

Security signals we found

01

Local policy enforcement bypassed until peer interaction occurs

02

Potential peer-visible error leakage before local validation

03

Test-only commit, no runtime fix applied

04

Expected-fail test documents a bug rather than patching it

Risk score

Why this scored 27/100

Our methodology →
Potential impact 6/30
Exploitability 4/25
Stealth signal 3/15
Affected reach 5/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.