lightningd: don't rebroadcast withheld channels' funding_psbt on restart.
What the developer wrote
Authored by Rusty Russell
lightningd: don't rebroadcast withheld channels' funding_psbt on restart.
Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
What changed, and why it matters
This change stops Core Lightning from re-announcing the funding transaction for channels that are marked as 'withheld' when the node restarts. A withheld channel is one whose funding transaction should not be broadcast yet (for example, because it is waiting for a peer or some other condition). Re-broadcasting it could leak the channel's existence or funding details prematurely, or cause the transaction to be mined before the protocol is ready. The fix is a one-line guard that skips these channels during restart rebroadcast.
Apply the patch. Review whether any other restart-time rebroadcast paths (e.g., for RBF, splice, or dual-funded opens) also need to respect the withheld flag. Consider adding a regression test that verifies a withheld channel's funding PSBT is not re-broadcast after restart.
Security signals we found
Premature broadcast of a funding transaction
Leakage of channel funding details before protocol readiness
Violation of the 'withheld' channel invariant on restart
Small, targeted patch in channel opening/restart logic
Evidence from the diff
In resend_opening_transactions(), the loop that re-sends funding PSBTs on startup now also skips channels where channel->withheld is true. Previously, only channel_state_uncommitted, missing funding_psbt, and depth checks were performed. The withheld flag indicates the funding transaction should not be broadcast; omitting this check meant a restart could cause lightningd to broadcast the funding PSBT contrary to protocol intent. This is a confidentiality/availability issue rather than a direct funds-loss bug.
Changed components
lightningd/peer_control.cresend_opening_transactions()channel opening / funding broadcast pathInspect captured patch +1 / −1
diff --git a/lightningd/peer_control.c b/lightningd/peer_control.c
index a4aac0e..ebc8cfa 100644
--- a/lightningd/peer_control.c
+++ b/lightningd/peer_control.c
@@ -513,7 +513,7 @@ void resend_opening_transactions(struct lightningd *ld)
struct wally_tx *wtx;
if (channel_state_uncommitted(channel->state))
continue;
- if (!channel->funding_psbt)
+ if (!channel->funding_psbt || channel->withheld)
continue;
if (channel->depth != 0)
continue;
Why this scored 46/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.