Check channel is live while handling counterparty tx_init_rbf
What the developer wrote
Authored by Wilmer Paulino
Check channel is live while handling counterparty tx_init_rbf
This mirrors what we do for counterparty `splice_init` messages, making
sure we don't accept RBFs once a channel has requested shutdown.
What changed, and why it matters
This commit adds a safety check in the Lightning Dev Kit's code that handles a message called tx_init_rbf, which is used to propose bumping the fee on a channel's on-chain transaction. Before this change, the code did not verify that the channel was still 'live' (active and not shutting down). The fix rejects RBF requests once a channel has requested shutdown, matching an existing safeguard already in place for splice_init messages. The change prevents a counterparty from initiating fee-bump negotiations after shutdown has begun, which could otherwise lead to protocol confusion or inconsistent channel state.
Review whether other interactive-tx message handlers (e.g., tx_add_input, tx_add_output, tx_complete, tx_signatures) also need is_live() checks, and confirm that shutdown transitions correctly mark the channel as not live. Consider adding regression tests for RBF during shutdown.
Security signals we found
Missing state validation in protocol message handler
Shutdown/RBF state machine inconsistency
Peer-triggered error path (WarnAndDisconnect)
Mirrors existing splice_init safeguard pattern
Evidence from the diff
In lightning/src/ln/channel.rs, validate_tx_init_rbf() now checks self.context.is_live() before proceeding. If the channel is not live, it returns ChannelError::WarnAndDisconnect with the message ‘RBF requested on a channel that is not live’. This mirrors the guard already present in the splice_init handler. The patch is small (+5 lines) and defensive, closing a gap where a peer could send tx_init_rbf during or after a shutdown request.
Changed components
lightning/src/ln/channel.rsvalidate_tx_init_rbf()tx_init_rbf message handlingInspect captured patch +5 / −0
diff --git a/lightning/src/ln/channel.rs b/lightning/src/ln/channel.rs
index 7f5c4f2..6f50d52 100644
--- a/lightning/src/ln/channel.rs
+++ b/lightning/src/ln/channel.rs
@@ -13397,6 +13397,11 @@ where
fn validate_tx_init_rbf<F: FeeEstimator>(
&self, msg: &msgs::TxInitRbf, fee_estimator: &LowerBoundedFeeEstimator<F>,
) -> Result<(ChannelPublicKeys, PublicKey), ChannelError> {
+ if !self.context.is_live() {
+ return Err(ChannelError::WarnAndDisconnect(
+ "RBF requested on a channel that is not live".to_owned(),
+ ));
+ }
if !self.context.channel_state.is_quiescent() {
return Err(ChannelError::WarnAndDisconnect("Quiescence needed for RBF".to_owned()));
}
Why this scored 44/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.