watchtower: prepare infrastructure for production taproot support
What the developer wrote
Authored by Olaoluwa Osuntokun
watchtower: prepare infrastructure for production taproot support
This commit adds preparatory infrastructure and TODO markers in the watchtower
justice kit generation for future production taproot channel support. The
changes establish placeholders for channel type detection and script option
selection that will be needed when watchtowers begin handling breach scenarios
for production taproot channels.
The current implementation includes commented code structures that demonstrate
the intended approach for integrating production script options into the
justice transaction generation process. When channel type information becomes
available in the BreachRetribution structure, these placeholders can be
activated to ensure that watchtowers generate justice transactions using the
appropriate script optimization level.
This preparatory work ensures that the watchtower system has a clear path
toward production taproot support while maintaining current functionality
for staging taproot and legacy channels. The TODO comments provide explicit
guidance for future development when watchtower breach handling for production
taproot channels is implemented.
What changed, and why it matters
This commit is purely preparatory: it adds placeholder variables and TODO comments in LND's watchtower code to make future taproot channel support easier. No live behavior changes; it explicitly defaults to existing 'staging' scripts and leaves the new production script option commented out. There is no security issue in this patch itself.
No security action required. Treat as normal feature-prep refactoring. Monitor future commits that activate the commented TODO logic to ensure production script selection is gated correctly on channel type.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The change modifies watchtower/blob/justice_kit.go to pass an empty scriptOpts slice into input.NewLocalCommitScriptTree, input.TaprootLocalCommitRevokeScript, and input.NewRemoteCommitScriptTree. The commented-out logic that would select input.WithProdScripts() is not active because channel type information is not yet available in BreachRetribution. The functional effect is identical to the prior code (no production script opt is applied).
Changed components
watchtower/blob/justice_kit.goInspect captured patch +25 / −3
diff --git a/watchtower/blob/justice_kit.go b/watchtower/blob/justice_kit.go
index 9dc1af6..61dcbe3 100644
--- a/watchtower/blob/justice_kit.go
+++ b/watchtower/blob/justice_kit.go
@@ -310,9 +310,17 @@ func newTaprootJusticeKit(sweepScript []byte,
// TODO(roasbeef): aux leaf tower updates needed
+ // TODO: Add channel type info to BreachRetribution to determine
+ // whether to use production scripts for final taproot channels.
+ // For now, we default to staging scripts.
+ var scriptOpts []input.TaprootScriptOpt
+ // if chanType.IsTaprootFinal() {
+ // scriptOpts = append(scriptOpts, input.WithProdScripts())
+ // }
+
tree, err := input.NewLocalCommitScriptTree(
breachInfo.RemoteDelay, keyRing.ToLocalKey,
- keyRing.RevocationKey, fn.None[txscript.TapLeaf](),
+ keyRing.RevocationKey, fn.None[txscript.TapLeaf](), scriptOpts...,
)
if err != nil {
return nil, err
@@ -352,8 +360,15 @@ func (t *taprootJusticeKit) ToLocalOutputSpendInfo() (*txscript.PkScript,
return nil, nil, err
}
+ // TODO: Add channel type info to determine whether to use production
+ // scripts for final taproot channels. For now, we default to staging scripts.
+ var scriptOpts []input.TaprootScriptOpt
+ // if chanType.IsTaprootFinal() {
+ // scriptOpts = append(scriptOpts, input.WithProdScripts())
+ // }
+
revokeScript, err := input.TaprootLocalCommitRevokeScript(
- localDelayedPubKey, revocationPubKey,
+ localDelayedPubKey, revocationPubKey, scriptOpts...,
)
if err != nil {
return nil, nil, err
@@ -419,8 +434,15 @@ func (t *taprootJusticeKit) ToRemoteOutputSpendInfo() (*txscript.PkScript,
return nil, nil, 0, err
}
+ // TODO: Add channel type info to determine whether to use production
+ // scripts for final taproot channels. For now, we default to staging scripts.
+ var scriptOpts []input.TaprootScriptOpt
+ // if chanType.IsTaprootFinal() {
+ // scriptOpts = append(scriptOpts, input.WithProdScripts())
+ // }
+
scriptTree, err := input.NewRemoteCommitScriptTree(
- toRemotePk, fn.None[txscript.TapLeaf](),
+ toRemotePk, fn.None[txscript.TapLeaf](), scriptOpts...,
)
if err != nil {
return nil, nil, 0, err
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.