splice-script: channel id corner case
What the developer wrote
Authored by Dusty Daemon
splice-script: channel id corner case
On the rare chance a channel id starts with 02 or 03 we need to check of it’s referring to a channel before parsing it node id, instead of after.
What changed, and why it matters
This commit fixes a rare parsing bug in Core Lightning's splice script feature. When a user typed a channel identifier that happened to start with the same characters as a node public key (02 or 03), the software would first try to interpret it as a node ID and reject it before ever checking whether it was actually a valid channel ID. The fix simply reorders those checks so channel ID lookup happens first. The practical effect is mostly that a few unusual channel IDs can now be used correctly in splice commands; it is not a typical security vulnerability.
Treat as a minor functional bug fix rather than a security issue. Include in normal release notes if splice scripts are user-facing. No urgent patching required absent additional context showing exploitable consequences.
Security signals we found
Input misclassification bug in script parser
Rare corner case based on identifier prefix
No buffer overflow, use-after-free, or cryptographic flaw visible
Change is a pure reordering of existing validation checks
Evidence from the diff
In common/splice_script.c, type_data() parses string tokens in splice scripts. Previously, when a token began with ‘02’ or ‘03’ it was classified as a potential node_id, and node_id_from_hexstr() was called immediately, returning INVALID_NODEID on failure before autocomplete_chan_id() could test whether the token matched an existing channel. The patch moves the node_id_from_hexstr() validation into an else branch after autocomplete_chan_id() succeeds or fails. This prevents misclassification of channel IDs whose textual representation starts with 02/03. No cryptographic, network, or consensus code is changed.
Changed components
common/splice_script.csplice script parser / type_data()channel ID autocomplete logicInspect captured patch +6 / −6
diff --git a/common/splice_script.c b/common/splice_script.c
index 0affda6e..b5af2a74 100644
--- a/common/splice_script.c
+++ b/common/splice_script.c
@@ -1110,12 +1110,6 @@ static struct splice_script_error *type_data(const tal_t *ctx,
input[i]->type = TOK_NODEID;
input[i]->node_id = tal(input[i],
struct node_id);
- if (!node_id_from_hexstr(input[i]->str,
- strlen(input[i]->str),
- input[i]->node_id))
- return new_error(ctx, INVALID_NODEID,
- input[i],
- "type_data");
/* Rare corner case where channel begins with
* prefix of 02 or 03 */
if (autocomplete_chan_id(input[i], channels,
@@ -1133,6 +1127,12 @@ static struct splice_script_error *type_data(const tal_t *ctx,
"type_data");
input[i]->type = TOK_CHANID;
input[i]->node_id = tal_free(input[i]->node_id);
+ } else if (!node_id_from_hexstr(input[i]->str,
+ strlen(input[i]->str),
+ input[i]->node_id)) {
+ return new_error(ctx, INVALID_NODEID,
+ input[i],
+ "type_data");
}
} else if (is_bitcoin_address(input[i]->str)) {
input[i]->type = TOK_BTCADDR;
Why this scored 23/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.