lightningd: cancel watching original funding when we switch to the new one via splice.
What the developer wrote
Authored by Rusty Russell
lightningd: cancel watching original funding when we switch to the new one via splice.
This happens if the channel is *not* announcable yet. Then we hit the assertion
in funding_depth_cb that the txid is the same as the current funding.txid.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
Changelog-EXPERIMENTAL: fixed crash when we splice a channel which hasn't been announced yet.
What changed, and why it matters
This commit fixes a crash in Core Lightning that can happen when a user splices a channel that hasn't been publicly announced yet. Splicing is an experimental feature that changes a channel's funding transaction. The bug caused the program to hit an internal consistency check (assertion) because it was still monitoring the old funding transaction after switching to the new one. The commit only adds test stub functions and does not show the actual fix code, so we can only infer the intended change from the commit message.
Obtain the full commit or the actual production code change to verify that the stale txwatch is properly canceled when switching funding during splice. Treat this as a reliability/DoS issue until the real fix is reviewed. If running experimental splicing, ensure this patch (or the complete version) is applied.
Security signals we found
Assertion/crash in funding_depth_cb due to stale funding tx watch
Splicing on non-announcable channels triggers inconsistency
Changelog-EXPERIMENTAL labels this as a crash fix
Only test stubs are visible in the diff; production fix is not shown
Evidence from the diff
The commit message states that when a non-announcable channel is spliced, the original funding transaction watch is not canceled, leading to an assertion failure in funding_depth_cb because the watched txid no longer matches channel->funding.txid. The diff itself only adds generated test stubs for find_txwatch_ in two unit test files (run-invoice-select-inchan.c and run-wallet.c), presumably so tests compile after the real code change. The actual production code change is not present in the supplied diff, so classification relies heavily on the commit message.
Changed components
lightningd channel funding watch logicsplicing code path for non-announcable channelswallet/test/run-wallet.clightningd/test/run-invoice-select-inchan.cInspect captured patch +20 / −0
diff --git a/lightningd/test/run-invoice-select-inchan.c b/lightningd/test/run-invoice-select-inchan.c
index d41bf546..0b42cb1c 100644
--- a/lightningd/test/run-invoice-select-inchan.c
+++ b/lightningd/test/run-invoice-select-inchan.c
@@ -257,6 +257,16 @@ struct channel *find_channel_by_id(const struct peer *peer UNNEEDED,
struct plugin *find_plugin_for_command(struct lightningd *ld UNNEEDED,
const char *cmd_name UNNEEDED)
{ fprintf(stderr, "find_plugin_for_command called!\n"); abort(); }
+/* Generated stub for find_txwatch_ */
+struct txwatch *find_txwatch_(struct chain_topology *topo UNNEEDED,
+ const struct bitcoin_txid *txid UNNEEDED,
+ enum watch_result (*cb)(struct lightningd *ld UNNEEDED,
+ const struct bitcoin_txid * UNNEEDED,
+ const struct bitcoin_tx * UNNEEDED,
+ unsigned int depth UNNEEDED,
+ void *arg) UNNEEDED,
+ void *arg UNNEEDED)
+{ fprintf(stderr, "find_txwatch_ called!\n"); abort(); }
/* Generated stub for fixup_htlcs_out */
void fixup_htlcs_out(struct lightningd *ld UNNEEDED)
{ fprintf(stderr, "fixup_htlcs_out called!\n"); abort(); }
diff --git a/wallet/test/run-wallet.c b/wallet/test/run-wallet.c
index 0cef1f6c..b2e82957 100644
--- a/wallet/test/run-wallet.c
+++ b/wallet/test/run-wallet.c
@@ -256,6 +256,16 @@ void fatal(const char *fmt UNNEEDED, ...)
/* Generated stub for fatal_vfmt */
void fatal_vfmt(const char *fmt UNNEEDED, va_list ap UNNEEDED)
{ fprintf(stderr, "fatal_vfmt called!\n"); abort(); }
+/* Generated stub for find_txwatch_ */
+struct txwatch *find_txwatch_(struct chain_topology *topo UNNEEDED,
+ const struct bitcoin_txid *txid UNNEEDED,
+ enum watch_result (*cb)(struct lightningd *ld UNNEEDED,
+ const struct bitcoin_txid * UNNEEDED,
+ const struct bitcoin_tx * UNNEEDED,
+ unsigned int depth UNNEEDED,
+ void *arg) UNNEEDED,
+ void *arg UNNEEDED)
+{ fprintf(stderr, "find_txwatch_ called!\n"); abort(); }
/* Generated stub for force_peer_disconnect */
void force_peer_disconnect(struct lightningd *ld UNNEEDED,
const struct peer *peer UNNEEDED,
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.