wallet: exclude immature coinbase outputs from fee rescue selection
What the developer wrote
Authored by cdecker
wallet: exclude immature coinbase outputs from fee rescue selection
wallet_utxo_boost() selects wallet-funded inputs for anchor and HTLC fee
rescue transactions, but unlike ordinary coin selection it never applied
the coinbase-maturity check. An immature coinbase could therefore be the
sole rescue input, producing a consensus-invalid transaction that Bitcoin
Core rejects as a premature coinbase spend.
Apply the same utxo_is_immature() filter used by deep_enough()/ordinary
selection. Since both call sites pass the live blockheight and rebuild on
reorg/RBF, maturity is revalidated at construction and after reorgs.
This makes test_anchorspend_ignores_immature_coinbase pass, so its xfail
marker is dropped.
Changelog-Fixed: Wallet: anchor and HTLC fee rescue no longer select immature coinbase outputs, which produced a transaction bitcoind rejects
(cherry picked from commit 5e79baacc1c900c29acfae852f6233095872e309)
What changed, and why it matters
This fix prevents Core Lightning from trying to use freshly created bitcoins (immature coinbase rewards) as emergency funds for fee-bump transactions. Such a transaction would be invalid under Bitcoin's rules and would be rejected by the network, potentially leaving a channel unable to quickly bump fees during congestion. The patch adds the same maturity check already used for normal spending.
Apply the patch. Ensure all coin-selection paths for fee-bump/rescue transactions share the same maturity/CSV checks. Consider adding a regression test for HTLC rescue specifically if not already covered.
Security signals we found
Consensus-invalid transaction generation prevented
Fee rescue / CPFP failure mode mitigated
Coinbase maturity check added to coin selection
Test xfail removed: test_anchorspend_ignores_immature_coinbase now passes
Evidence from the diff
wallet_utxo_boost() selects wallet UTXOs for anchor/HTLC fee-rescue (CPFP-like) transactions. Previously it checked CSV timelocks but not coinbase maturity. An immature coinbase UTXO could be selected as the sole rescue input, producing a transaction that violates the 100-block coinbase maturity consensus rule and is rejected by bitcoind. The patch adds utxo_is_immature() filtering, matching deep_enough()/ordinary coin selection. Maturity is revalidated at construction and after reorgs/RBF rebuilds.
Changed components
wallet/wallet.cwallet_utxo_boost()anchor output fee rescueHTLC fee rescuetests/test_closing.pyInspect captured patch +5 / −1
### tests/test_closing.py
@@ -4878,7 +4878,6 @@ def test_anchorspend_using_to_remote(node_factory, bitcoind, anchors):
bitcoind.generate_block(1, wait_for_mempool=2)
-@pytest.mark.xfail(strict=True)
@unittest.skipIf(TEST_NETWORK != 'regtest', 'elementsd anchors not supported')
def test_anchorspend_ignores_immature_coinbase(node_factory, bitcoind, executor):
"""Fee rescue must not select an immature coinbase: spending one is
### wallet/wallet.c
@@ -631,6 +631,11 @@ struct utxo **wallet_utxo_boost(const tal_t *ctx,
if (utxo_is_csv_locked(utxo, blockheight))
continue;
+ /* Don't add immature coinbase outputs: spending them is
+ * consensus-invalid. */
+ if (utxo_is_immature(utxo, blockheight))
+ continue;
+
/* UTXOs must be sane amounts */
if (!amount_sat_add(&new_excess_sats,
excess_sats, utxo->amount))Why this scored 60/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.