AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 30 Bitcoin

graph/db: update SQLStore to read and write v2 channels

Public commit record

What the developer wrote

Authored by Elle Mouton

78/100 · Adequate
graph/db: update SQLStore to read and write v2 channels

Extends the SQL store to support v2 (taproot) channel announcements:
- Add version validation in AddChannelEdge
- Store v2-specific fields: FundingPkScript, MerkleRootHash, Signature
- Update buildEdgeInfoWithBatchData to reconstruct v2 channels from DB
with optional bitcoin keys and funding script handling
- Add WithMerkleRootHash edge modifier for ChannelV2Fields
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
The short version

What changed, and why it matters

This commit extends LND's SQL graph database to store and retrieve a newer type of Lightning channel announcement (called 'v2' or 'taproot' channels). It adds support for new fields like funding scripts, Merkle root hashes, and a single signature, and it replaces hard-coded 'v1 only' checks with version-aware logic. There is no direct evidence in the commit that this fixes an active security bug; it reads as a feature-completion change to support a new protocol version.

Recommended action

Treat as a normal feature/compatability commit. Reviewers should verify that isKnownGossipVersion correctly enumerates only supported versions, that optional v2 fields are validated elsewhere before reaching the DB layer, and that the new signature/proof paths do not bypass existing auth-proof checks. No urgent security response is indicated by the diff alone.

Security signals we found

01

Input validation added: AddChannelEdge rejects unknown gossip versions before DB operations.

02

Version-specific handling replaces a hard-coded v1-only path, reducing the chance of version mismatch or data corruption when v2 announcements are received.

03

Optional fields are length-checked before conversion, which is defensive but not obviously fixing a known vulnerability.

04

No explicit security bug, CVE, or incident is described in the commit or supplied references.

Risk score

Why this scored 30/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 5/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.