routing: increase MinCLTVDelta from 18 to 24 blocks
What the developer wrote
Authored by Olaoluwa Osuntokun
routing: increase MinCLTVDelta from 18 to 24 blocks
This increases the minimum CLTV delta allowed for invoice creation to
provide more headroom above DefaultFinalCltvRejectDelta (19 blocks).
The previous value of 18 was below the reject threshold, which could
allow users to create invoices with CLTV deltas that would be rejected
when receiving payments.
What changed, and why it matters
This commit tightens a safety setting in LND, the Lightning Network Daemon. It raises the minimum allowed CLTV delta—the time buffer built into Lightning invoices—from 18 to 24 blocks. The old minimum of 18 was below LND's own 19-block rejection threshold, so users could create invoices that other nodes would refuse to pay. The change prevents that mismatch but is a policy adjustment, not a fix for a code vulnerability that lets an attacker steal funds directly.
Treat as a low-risk hardening/policy fix. Operators and integrators should note the new minimum and ensure any tooling or documentation that references the old 18-block floor is updated. No emergency deployment is warranted, but including it in the next maintenance release is reasonable.
Security signals we found
Safety threshold raised to stay above internal reject delta
Prevents creation of invoices that would be rejected by default routing policy
No cryptographic weakness or memory-safety bug present in diff
Change is a single constant update with no new validation logic
Evidence from the diff
The patch changes the constant MinCLTVDelta in routing/router.go from 18 to 24. The commit message explains that 18 was below DefaultFinalCltvRejectDelta (19 blocks), allowing user-created invoices with CLTV deltas that would be rejected by payers. Raising the floor to 24 gives headroom above the reject threshold. This is a configuration/policy guard, not a cryptographic or protocol exploit fix. It reduces the chance of stuck or rejected payments caused by user-selected low deltas.
Changed components
routing/router.goInvoice CLTV delta validationDefault routing policy parametersInspect captured patch +2 / −2
diff --git a/routing/router.go b/routing/router.go
index 3c35b7c..19df5b9 100644
--- a/routing/router.go
+++ b/routing/router.go
@@ -54,8 +54,8 @@ const (
// creating incompatibilities during the upgrade process. For some time
// LND has used an explicit default final CLTV delta of 40 blocks for
// bitcoin, though we now clamp the lower end of this
- // range for user-chosen deltas to 18 blocks to be conservative.
- MinCLTVDelta = 18
+ // range for user-chosen deltas to 24 blocks to be conservative.
+ MinCLTVDelta = 24
// MaxCLTVDelta is the maximum CLTV value accepted by LND for all
// timelock deltas.
Why this scored 33/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.