splice: Track if splice sigs are sent
What the developer wrote
Authored by Dusty Daemon
splice: Track if splice sigs are sent
Use the new i_sent_sigs field to track if we’ve sent our peer our user sigs.
What changed, and why it matters
This commit adds tracking for whether a node has sent its own splice signatures during a channel-splicing negotiation. It also changes the logic so that the node updates its internal 'inflight' funding record when it either receives the peer's signature or sends its own. The change appears to fix a state-tracking gap that could cause a splice to stall or leave the channel in an inconsistent state, but the commit message does not frame it as a security fix and no exploit is directly evident from the diff alone.
Treat as a low-to-moderate reliability/state-consistency fix. Review the splice state machine to confirm no double-update or replay issues are introduced by the broadened condition. If this commit is part of a larger fix series, evaluate it in context. No immediate emergency response is warranted based solely on this diff.
Security signals we found
State-machine change in splice signature handling
New boolean tracking field used to record local signature transmission
Condition broadened from recv_signature to recv_signature || send_signature
No explicit security framing or CVE reference in commit
Evidence from the diff
In channeld/channeld.c, resume_splice_negotiation() now records inflight->i_sent_sigs = send_signature before deciding who signs first. The subsequent update to core is now triggered by recv_signature || send_signature rather than only recv_signature. This ensures the inflight state is persisted/validated when this node is the one that produced signatures, not only when it receives the peer’s signatures. The change is small and defensive; it likely prevents a case where a locally signed splice is not propagated to core, potentially causing state desynchronization or a stuck splice.
Changed components
channeld/channeld.cresume_splice_negotiation()splice/inflight signature stateInspect captured patch +2 / −1
diff --git a/channeld/channeld.c b/channeld/channeld.c
index 1f8efded..eb201588 100644
--- a/channeld/channeld.c
+++ b/channeld/channeld.c
@@ -3627,6 +3627,7 @@ static void resume_splice_negotiation(struct peer *peer,
psbt_txid(tmpctx, current_psbt, &final_txid, NULL);
+ inflight->i_sent_sigs = send_signature;
if (do_i_sign_first(peer, current_psbt, our_role,
inflight->force_sign_first)
&& send_signature) {
@@ -3827,7 +3828,7 @@ static void resume_splice_negotiation(struct peer *peer,
wit_stack);
}
- if (recv_signature) {
+ if (recv_signature || send_signature) {
/* We let core validate our peer's signatures are correct. */
msg = towire_channeld_update_inflight(NULL, current_psbt, NULL,
NULL,
Why this scored 42/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.