AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 29 Bitcoin

graph/db: version MarkEdgeLive

Public commit record

What the developer wrote

Authored by Elle Mouton

68/100 · Adequate
graph/db: version MarkEdgeLive

Add a gossip version parameter to MarkEdgeLive throughout the stack:

- Store interface and KVStore/SQLStore implementations now take
lnwire.GossipVersion; KVStore rejects non-v1 with
ErrVersionNotSupportedForKVDB, SQLStore uses the version in the
DeleteZombieChannel query and cache invalidation.
- ChannelGraph.MarkEdgeLive passes the version through to both the
store call and the FetchChanInfos cache repopulation.
- FilterKnownChanIDs uses GossipVersion1 explicitly for its internal
MarkEdgeLive call; this site will be properly versioned when
FilterKnownChanIDs itself is versioned.
- graph.ChannelGraphSource interface and Builder.MarkEdgeLive updated
accordingly.
- Discovery gossiper and test mock updated to pass GossipVersion1 at
their (v1-only) call sites.
✓ Descriptive subject✓ Provides detailed explanatory context✓ Mentions testing or verification
The short version

What changed, and why it matters

This commit changes how LND tracks whether a Lightning channel is 'alive' versus a 'zombie' by adding a gossip-version parameter throughout the code. It is a plumbing/refactoring change to prepare for multiple gossip versions. It does not by itself fix a known exploit, but it tightens version handling: the older KV database backend now explicitly rejects non-version-1 gossip, and the newer SQL backend now uses the supplied version when deleting zombie records and clearing its cache. The most concrete security-relevant effect is preventing version confusion between the database and cache layers, which could otherwise leave stale or mismatched channel state.

Recommended action

Treat as a hardening/refactoring commit rather than an urgent security patch. Review related follow-up commits to confirm that FilterKnownChanIDs is also properly versioned and that all future gossip-version call sites supply the correct version. Continue normal testing, especially around zombie channel resurrection and cache consistency across backends.

Security signals we found

01

Adds explicit version validation in KVStore MarkEdgeLive (rejects non-v1)

02

Adds explicit version validation in SQLStore MarkEdgeLive (rejects unknown versions)

03

SQL zombie deletion and cache invalidation now use the passed gossip version instead of a hard-coded GossipVersion1

04

Graph cache repopulation now uses the same gossip version as the store call

05

No direct vulnerability description, CVE, or security advisory present in commit or references

Risk score

Why this scored 29/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 6/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.