AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Moderate 57 Bitcoin

sweep: account for aux extra budget when filtering inputs

Public commit record

What the developer wrote

Authored by Jared Tobin

73/100 · Adequate
sweep: account for aux extra budget when filtering inputs

The BudgetAggregator filters out inputs whose budget cannot cover the
min relay fee or their requested starting fee rate. For inputs that
carry a resolution blob (custom channel outputs), the aux sweeper
contributes a sizable extra budget to any input set they join, but the
filter only considered the input's own budget, which for asset outputs
is tiny (their value is carried off-chain).

The filter is mostly harmless with default parameters, but the
starting fee rate of an input is ratcheted whenever a sweep attempt
fails, including failures that have nothing to do with fees: e.g. when
a concurrent sweep transaction spends the wallet UTXO that was backing
this input's set (the sweeper currently doesn't lease selected wallet
UTXOs, so concurrent input sets can pick the same one). One such
collision is enough to push the required starting fee above a small
asset input's own budget, after which the input is filtered out of
every future input set and the sweep is silently stranded forever.

Account for the aux extra budget in the filter, mirroring how the
budget input set itself accounts for it when deciding whether wallet
inputs are needed. Inputs without a resolution blob (the only kind
that exists without an aux sweeper) are unaffected.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes a bug in LND's transaction sweeping logic that could permanently strand certain custom-channel (asset) outputs. The sweeper's budget filter was ignoring extra funds contributed by an optional 'aux sweeper' helper, so it would reject inputs whose own on-chain budget looked too small even though a separate budget pool was available to pay their fees. After a single unrelated sweep failure, the required fee estimate could rise enough that the input was silently dropped forever and never swept. The fix adds the aux contribution to the filter's budget check and falls back safely if the aux helper is temporarily unavailable.

Recommended action

Apply the patch. Operators running LND with custom channels / aux sweepers should upgrade to avoid stranding of asset outputs. Monitor logs for 'Skipped input' and aux-sweeper errors after upgrade to confirm the fix is active.

Security signals we found

01

Denial-of-service / fund stranding: custom-channel outputs could be silently excluded from all future sweeps

02

Fee-ratchet interaction: non-fee failures (wallet UTXO collisions) could raise startingFeeRate and trigger the filter

03

Missing budget accounting: filter did not mirror set-construction logic that already used aux extra budget

04

Silent failure mode: filtered inputs are logged but never retried, leading to permanent stranding

05

Defense-in-depth fix: lookup errors fall back to zero extra budget rather than dropping the input

Risk score

Why this scored 57/100

Our methodology →
Potential impact 18/30
Exploitability 8/25
Stealth signal 12/15
Affected reach 7/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.