AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 28 Bitcoin

graph/db: version disabled channel IDs

Public commit record

What the developer wrote

Authored by Elle Mouton

68/100 · Adequate
graph/db: version disabled channel IDs

Add a gossip version parameter to DisabledChannelIDs in the Store
interface and both implementations. Add a new version-filtered SQL
query and update the builder caller.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit extends the Lightning Network Daemon's channel graph database so it can separately list disabled channels for the older gossip protocol version (v1) and the newer one (v2). Previously the disabled-channel lookup only handled v1. The change is a feature completion / correctness fix: without it, a node running with v2 gossip could either get wrong disabled-channel data or fail to prune stale channels. There is no direct evidence in the commit that this was a security vulnerability, but an incorrect disabled-channel list could affect routing and channel pruning behavior.

Recommended action

Treat as a correctness/feature patch rather than an urgent security fix. Review whether the new V2 disabled query semantics (any disable bit set, HAVING COUNT(*) > 1) match the intended protocol definition of a disabled channel, and verify that callers other than pruneZombieChans pass the correct gossip version. Continue monitoring for related follow-up fixes or disclosures.

Security signals we found

01

Previously unversioned disabled-channel query could mix or ignore v2 disabled state

02

New SQL query uses COALESCE(cp.disable_flags, 0) != 0, which treats any set disable bit as disabled rather than requiring both directions disabled

03

V2 gossip disabled semantics differ from v1 (bit vector vs single boolean)

04

Zombie pruning depends on accurate disabled-channel data; incorrect data could prune or retain channels improperly

05

No explicit security framing, CVE, or attribution in commit

Risk score

Why this scored 28/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 6/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.