AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 30 Bitcoin

Don't scan the blockchain for spent external channels (#3226)

Public commit record

What the developer wrote

Authored by Bastien Teinturier

93/100 · Strong
Don't scan the blockchain for spent external channels (#3226)

When an external channel is spent, we don't immediately remove it from
our network graph in case the spending transaction is a splice (see
https://github.com/lightning/bolts/pull/1270 for more details).

A side-effect of this change, introduced in #2936, is that when we
start watching a channel after receiving its `channel_announcement`,
we will scan the blockchain if it is actually already spent. This can
be expensive if peers send us `channel_announcement`s for channels
that have been spent a long time ago since `bitcoind` doesn't provide
an index for spending transactions. It is also misleading, because if
we give up after scanning X blocks of the blockchain, we will create
a log line saying that funds are at risk: they're never at risk since
those are not our channels.

This commit fixes this issue by only checking whether the channel is
already spent by a confirmed transaction or not when setting the watch
(which is an inexpensive and efficient RPC call to `bitcoind`), without
scanning the blockchain to find the spending transaction. If it is
already spent, we immediately remove it from our network graph, even
if the spending transaction was actually a splice. This is fine, since
that channel will be re-added to our graph whenever we receive the
`channel_announcement` for the splice. In the worst case, we will simply
not route through an actually available channels for a few blocks while
its splice transaction is confirming.

Co-authored-by: pm47 <pm.padiou@gmail.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode✓ Links an issue, advisory, or supporting reference
The short version

What changed, and why it matters

This commit fixes a performance and usability bug in the Eclair Lightning node. When the node learned about an old public channel that had already been closed, it would wastefully scan the entire Bitcoin blockchain looking for the closing transaction, which could be very slow and produced scary 'funds at risk' log messages even though no user funds were actually in danger. The fix makes the node simply check whether the channel output is already gone and, if so, remove the channel from its routing map without hunting for the closing transaction.

Recommended action

No immediate security action required; this is a defensive hardening/performance fix. Operators should upgrade to avoid unnecessary bitcoind load and false-positive risk alerts. Reviewers may want to confirm that isTransactionOutputSpent correctly distinguishes mempool-spent vs confirmed-spent, since the new path only triggers on confirmed spends.

Security signals we found

01

Avoids expensive blockchain rescan triggered by untrusted public channel_announcement messages

02

Eliminates misleading 'funds are at risk' log lines for external channels where no funds are at risk

03

Changes WatchExternalChannelSpentTriggered to carry Option[Transaction] rather than Transaction

04

Adds Kamon metrics for active watches and watched UTXOs

05

Immediate pruning of already-spent external channels could briefly affect routing during splice confirmation window

Risk score

Why this scored 30/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 6/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.