AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 35 Bitcoin

Support splice shared input signing

Public commit record

What the developer wrote

Authored by Wilmer Paulino

68/100 · Adequate
Support splice shared input signing

This commit tracks all data related to the shared input of a splice,
such that a valid witness can be formed upon the splice transaction
finalization.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds support for correctly signing a special kind of Bitcoin transaction input used in Lightning channel 'splicing,' where both parties continue to share an existing funding output while adding or removing funds. Before this change, the code did not know how to build a valid witness (the cryptographic proof that unlocks the shared input) for that shared input. The patch tracks the shared input's position, the order in which the two parties' signatures must appear, and the script that unlocks the funds, then assembles the final transaction witness when both signatures are available. It also adds a small safety check that the transaction ID the caller signed matches the unsigned transaction, to detect malleation.

Recommended action

Review as part of normal feature/security hardening. The anti-malleation and shared-input validation are positive defensive changes. If this commit is being backported, ensure the splicing feature flag and dependent message serialization changes are included as a set. No immediate incident response is indicated by the diff alone.

Security signals we found

01

Adds anti-malleation check: funding_txid_signed must match unsigned_tx.compute_txid() before accepting holder witnesses

02

Adds shared-input signature presence/absence validation in received_tx_signatures

03

Adds duplicate-call protection in provide_holder_witnesses (holder_tx_signatures already provided)

04

Correctly orders 2-of-2 multisig signatures based on holder_sig_first to prevent producing invalid witnesses

05

Tracks shared input index explicitly rather than inferring it from serial_id, reducing risk of applying signatures to the wrong input

Risk score

Why this scored 35/100

Our methodology →
Potential impact 8/30
Exploitability 6/25
Stealth signal 5/15
Affected reach 7/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.