AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 26 Bitcoin

graph/db: version reject cache for policies

Public commit record

What the developer wrote

Authored by Elle Mouton

68/100 · Adequate
graph/db: version reject cache for policies

Make the reject cache version-aware so v1 and v2 policy state can be
cached independently per channel ID. Add helpers to store v1 timestamps
or v2 block heights and thread the versioned cache key through KV/SQL
store cache accesses.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit reworks an in-memory cache in LND's channel graph database so that it can separately store metadata for two different gossip protocol versions (v1 and v2). The change is mostly a correctness/performance improvement to avoid cache collisions between versions, but it also fixes places where the SQL backend was not invalidating or updating the cache with the correct version key. There is no direct evidence in the commit message or diff that this is a security fix, and no CVE or advisory is referenced.

Recommended action

Treat as a correctness/maintenance patch. Review whether any remaining hard-coded GossipVersion1 cache accesses in KVStore or SQLStore can be reached with v2 channel data; if so, further cache key versioning may be needed. No urgent security action is indicated by the supplied materials.

Security signals we found

01

Cache key collision between protocol versions could cause stale or mixed metadata to be returned

02

SQLStore cache invalidation now uses the edge's actual gossip version instead of an implicit v1 default

03

No explicit security framing, CVE, or advisory is present in the commit or supplied references

Risk score

Why this scored 26/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 5/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.