AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 27 Bitcoin

graph/db: add gossip version parameter to FilterKnownChanIDs

Public commit record

What the developer wrote

Authored by Elle Mouton

78/100 · Adequate
graph/db: add gossip version parameter to FilterKnownChanIDs

Add an explicit lnwire.GossipVersion parameter to FilterKnownChanIDs
on the Store interface, SQLStore, KVStore, and ChannelGraph. Since
FilterKnownChanIDs is always called from a version-scoped ChanSeries
context, a single version parameter is cleaner than per-item version
reads. A convenience wrapper on VersionedGraph preserves the existing
ChanSeries call-site signature by threading c.v automatically.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
The short version

What changed, and why it matters

This commit refactors how a Lightning Network routing database method, FilterKnownChanIDs, receives the gossip protocol version. Previously the version was read from each individual channel record; now it is passed explicitly from the version-scoped wrapper. The change also adds a sanity check that zombie channels returned by the database match the expected gossip version, and updates tests to cover both v1 and v2 gossip. It is a defensive correctness improvement rather than a clear-cut fix for an active vulnerability.

Recommended action

Treat as a routine correctness/refactoring patch. Reviewers should verify that all call sites of FilterKnownChanIDs now use a VersionedGraph and that the explicit version matches the channel range/series context. No emergency action is indicated by the diff alone, but downstream callers should be checked for version mismatches.

Security signals we found

01

Defensive version-consistency check added for zombie channel records

02

SQL zombie lookup now uses the caller-supplied gossip version rather than per-item version field

03

KVStore now explicitly rejects unsupported gossip versions instead of silently using v1 behavior

04

Existing zombie-revival logic preserved; no new authorization or input-validation boundary introduced

05

No mention of CVE, security advisory, or independent researcher attribution in commit

Risk score

Why this scored 27/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 6/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.