askrene: regression test that triggers assertion
What the developer wrote
Authored by Lagrang3
askrene: regression test that triggers assertion
cln-askrene: plugins/askrene/mcf.c:474: combine_cost_function: Assertion `fcost != INFINITE' failed.
cln-askrene: FATAL SIGNAL 6 (version v25.12-131-gb15f386-modded)
0x55703f242fd1 send_backtrace
common/daemon.c:38
0x55703f24305b crashdump
common/daemon.c:83
0x7f548b421def ???
./signal/../sysdeps/unix/sysv/linux/x86_64/libc_sigaction.c:0
0x7f548b47695c __pthread_kill_implementation
./nptl/pthread_kill.c:44
0x7f548b421cc1 __GI_raise
../sysdeps/posix/raise.c:26
0x7f548b40a4ab __GI_abort
./stdlib/abort.c:73
0x7f548b40a41f __assert_fail_base
./assert/assert.c:118
0x55703f234491 combine_cost_function
plugins/askrene/mcf.c:474
0x55703f2358b6 single_path_flow
plugins/askrene/mcf.c:1213
0x55703f235fa2 linear_routes
plugins/askrene/mcf.c:1411
0x55703f236804 single_path_routes
plugins/askrene/mcf.c:1656
0x55703f22edad do_getroutes
plugins/askrene/askrene.c:689
0x55703f22f269 json_getroutes
plugins/askrene/askrene.c:910
0x55703f2411a7 ld_command_handle
plugins/libplugin.c:2155
0x55703f2413b1 ld_read_json
plugins/libplugin.c:2231
0x55703f271a4d next_plan
ccan/ccan/io/io.c:60
0x55703f271ed8 do_plan
ccan/ccan/io/io.c:422
0x55703f271f91 io_ready
ccan/ccan/io/io.c:439
0x55703f27391b io_loop
ccan/ccan/io/poll.c:470
0x55703f2417fd plugin_main
plugins/libplugin.c:2429
0x55703f22f753 main
plugins/askrene/askrene.c:1452
0x7f548b40bca7 __libc_start_call_main
../sysdeps/nptl/libc_start_call_main.h:58
0x7f548b40bd64 __libc_start_main_impl
../csu/libc-start.c:360
0x55703f22baa0 ???
_start+0x20:0
0xffffffffffffffff ???
???:0
Changelog-None
Signed-off-by: Lagrang3 <lagrang3@protonmail.com>
What changed, and why it matters
This commit adds a skipped regression test that demonstrates a crash in Core Lightning's routing plugin (askrene). When a user-defined channel has an unusually high routing fee, the plugin's single-path solver hits an internal assertion and aborts. The test is currently disabled with @unittest.skip, so it documents the bug rather than fixing it. A remote user who can call the getroutes RPC with crafted layer parameters could likely trigger the plugin to crash, causing a denial of service.
Treat as a known crash bug / denial-of-service issue. The skipped test should be enabled only after fixing combine_cost_function to handle INFINITE cost without aborting. Review fee-cost arithmetic for overflow or unbounded growth, and ensure the solver returns a clean 'excessive cost' error instead of aborting the plugin. Consider restricting creation of channels with fee rates that can produce INFINITE costs, or clamping computed costs.
Security signals we found
Assertion failure leading to plugin abort (SIGABRT)
Crash reachable through JSON-RPC getroutes
Denial-of-service vector in routing plugin
Regression test supplied but skipped, indicating known unfixed bug
Evidence from the diff
The commit adds test_excessive_fee_cost in tests/test_askrene.py. It creates an askrene layer with a synthetic channel whose fee_proportional_millionths is 100000 (10%) and then calls getroutes for half a bitcoin with maxfee_msat=1000. The commit message shows this triggers an assertion failure in plugins/askrene/mcf.c:474 (combine_cost_function: Assertion `fcost != INFINITE’ failed.), which aborts the cln-askrene plugin. The test is marked @unittest.skip, so it is a reproducer, not a fix. The crash path is single_path_flow -> linear_routes -> single_path_routes -> do_getroutes -> json_getroutes, reachable via RPC.
Changed components
plugins/askrene/mcf.cplugins/askrene/askrene.ccln-askrene plugingetroutes RPC handlerInspect captured patch +36 / −0
diff --git a/tests/test_askrene.py b/tests/test_askrene.py
index 613cfa1b..f9b3e6ae 100644
--- a/tests/test_askrene.py
+++ b/tests/test_askrene.py
@@ -1959,3 +1959,39 @@ def test_splice_dying_channel(node_factory, bitcoind):
wait_for(lambda: [c['active'] for c in l3.rpc.listchannels()['channels']] == [True] * 6)
routes = l3.rpc.getroutes(l1.info['id'], l2.info['id'], '200001sat', [], 100000, 6)['routes']
assert set([only_one(r['path'])['short_channel_id_dir'] for r in routes]) == set([pre_splice_scidd, post_splice_scidd])
+
+
+@unittest.skip
+def test_excessive_fee_cost(node_factory):
+ """Produce a arc with very large fee cost that triggers an assertion in
+ askrene's single path solver."""
+ l1 = node_factory.get_node()
+ node1 = "020000000000000000000000000000000000000000000000000000000000000001"
+ one_btc = 100000000000
+ l1.rpc.askrene_create_layer("mylayer")
+ l1.rpc.askrene_create_channel(
+ layer="mylayer",
+ source=l1.info["id"],
+ destination=node1,
+ short_channel_id="0x0x0",
+ capacity_msat=one_btc,
+ )
+ l1.rpc.askrene_update_channel(
+ layer="mylayer",
+ short_channel_id_dir="0x0x0/1",
+ enabled=True,
+ htlc_minimum_msat=0,
+ htlc_maximum_msat=one_btc,
+ fee_base_msat=0,
+ fee_proportional_millionths=100000, # 10%
+ cltv_expiry_delta=18,
+ )
+ with pytest.raises(RpcError, match=r"Could not find route without excessive cost"):
+ l1.rpc.getroutes(
+ source=l1.info["id"],
+ destination=node1,
+ amount_msat=one_btc // 2,
+ layers=["mylayer", "auto.no_mpp_support"],
+ maxfee_msat=1000,
+ final_cltv=5,
+ )
Why this scored 58/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.