AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 23 Bitcoin

splice script: Implement dynamic wallet & fee

Public commit record

What the developer wrote

Authored by Dusty Daemon

80/100 · Strong
splice script: Implement dynamic wallet & fee

Implementing dynamic wallet amounts and the ability for the wallet to pay fee.

Because wallets increase the fee paying for the fee (due to inputs increasing transaction size), this process must be inherently recursive.

Adding to the complication is that wallets may take a percentage of total funds in the splice before accomodating the fee.

Finally, any percentage based receiver or contributor of funds may also be responsible for the fee.

Supporting all this means we need to build a solver that can be executed repeatidly, solving what can be solved on each pass. Some answers inherently require answers from prior passes.

`calc_in_ppm_and_fee` is the workhorse that handles this recursive problem.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This commit rewrites the fee and wallet-funding arithmetic for Core Lightning's experimental 'splice script' feature. It introduces a multi-pass solver so that wallet inputs, percentage-based contributions, and on-chain fees can be reconciled when users splice funds into or out of a Lightning channel. The change is large and touches delicate monetary calculations, but it is framed by the author as a feature implementation, not a security fix. There is no disclosed vulnerability or incident tied to this commit.

Recommended action

Treat this as a high-risk feature change rather than a confirmed vulnerability. Reviewers should audit the new multi-pass solver for off-by-one satoshi errors, rounding inconsistencies, and state-machine bugs (especially the SPLICE_CMD_PENDING transitions), and run the project's splice-script test suite against it. No immediate patch or mitigation is indicated by the supplied materials.

Security signals we found

01

Large rewrite of financial/fee arithmetic in an experimental feature

02

Recursive solver for wallet funding and fee attribution

03

Percentage-based (ppm) amount calculations with rounding handling

04

Dust-limit check added for wallet outputs

05

No explicit security fix language or CVE reference in commit

06

No external advisory or incident disclosure supplied

Risk score

Why this scored 23/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 5/15
Confidence 4/10
Evidence quality 2/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.