splice script: Turn “wallet -> *” into “wallet -> 100%”
What the developer wrote
Authored by Dusty Daemon
splice script: Turn “wallet -> *” into “wallet -> 100%”
Treat the `*` as if it were `100%` for wallets.
100% is a special case that means “100% of needed funds” not “100% of wallet funds.” since taking out all of the wallet’s inputs is wasteful.
What changed, and why it matters
This commit fixes how the Core Lightning splicing tool interprets a wallet wildcard ('*'). Previously, the '*' value was stored as a special maximum number (UINT32_MAX) and could behave differently than intended. The change forces '*' to mean 'contribute 100% of the funds needed' rather than potentially being misread as a literal huge percentage. This prevents a splice request from accidentally trying to allocate an impossibly large share of funds, which could cause the splice to fail or behave unexpectedly.
Review related splice parser and state machine code to ensure no other sentinel values are interpreted literally. Add regression tests covering '*' and '100%' wallet contribution paths. Consider validating out_ppm bounds earlier in input parsing.
Security signals we found
Input normalization of a sentinel/wildcard value
Prevention of misinterpretation of UINT32_MAX as a literal ppm value
Avoids potential crash or incorrect transaction construction during splice execution
Evidence from the diff
In plugins/spender/splice.c, execute_splice now normalizes action->out_ppm when it equals UINT32_MAX (the internal encoding for the user-supplied ‘*’ wildcard) to 1000000 ppm (i.e., 100%). The comment notes that UINT32_MAX currently means 100%, but may mean something else later, so the code explicitly maps it now. This ensures the wallet contributes 100% of needed funds, not 100% of all wallet funds, avoiding pathological fund allocation.
Changed components
plugins/spender/splice.cCore Lightning splice/spend pathwallet contribution logic in splicingInspect captured patch +5 / −0
diff --git a/plugins/spender/splice.c b/plugins/spender/splice.c
index 66cec21b..d52d731b 100644
--- a/plugins/spender/splice.c
+++ b/plugins/spender/splice.c
@@ -1141,6 +1141,11 @@ static struct command_result *execute_splice(struct command *cmd,
state = splice_cmd->states[i];
char *bitcoin_address;
+ /* Today UINT32_MAX just means 100%. In the future it might mean
+ * something different. */
+ if (action->out_ppm == UINT32_MAX)
+ action->out_ppm = 1000000;
+
/* Load (only one) feerate if user provided one */
if (action->feerate_per_kw) {
if (splice_cmd->feerate_per_kw)
Why this scored 35/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.