AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 30 Bitcoin

Add `unannounced_channel_max_inbound_htlc_value_in_flight_percentage`

Public commit record

What the developer wrote

Authored by Leo Nash

53/100 · Thin
Add `unannounced_channel_max_inbound_htlc_value_in_flight_percentage`

Users can now configure two different max percentages for the channel
value that can be allocated to inbound HTLCs, one for announced
channels, and another for unannounced channels.

We also bump the default maximums to 25% for announced channels, and
100% for unannounced channels, to bring them closer to what people would
expect.
✓ Specific, descriptive subject✓ Provides detailed explanatory context! Too few words to establish purpose
The short version

What changed, and why it matters

This commit is a feature change, not a security bug fix. It splits one setting into two: the maximum share of a channel's value that can be tied up in incoming payments (HTLCs). Announced channels now default to 25% and unannounced (private) channels default to 100%. The change also updates many tests to keep their old behavior by explicitly setting the previous 10% default. There is no direct vulnerability in the diff, but the higher defaults slightly increase funds-at-risk if a node goes offline while many HTLCs are pending.

Recommended action

Review whether the new 100% default for unannounced channels matches your risk model; explicitly configure lower limits if you operate private channels and want to limit offline-exposure risk. No immediate patch or incident response is required.

Security signals we found

01

Configuration change that increases default inbound HTLC exposure limits

02

No input validation bypass or unsafe arithmetic introduced

03

Legacy serialization path maintained for backward compatibility

04

No attribution of a security report in commit or vendor material

Risk score

Why this scored 30/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 2/15
Affected reach 8/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.