AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 43 Bitcoin

Fix PaymentForwarded fields on restart claim

Public commit record

What the developer wrote

Authored by Valentine Wallace

60/100 · Adequate
Fix PaymentForwarded fields on restart claim

Previously, we were spuriously using the upstream channel's info when we
should've been using the downstream channel's.
✓ Descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
The short version

What changed, and why it matters

This commit fixes a bug in the Lightning Dev Kit where, after a node restarts, it was using the wrong payment channel's details when reconstructing forwarded payments. Specifically, it used the upstream (incoming) channel's information where it should have used the downstream (outgoing) channel's. This could cause incorrect data in PaymentForwarded events and potentially wrong decisions about whether the downstream channel is closed, but it does not appear to allow theft of funds or direct remote exploitation.

Recommended action

Review whether any deployed nodes logged or acted on incorrect PaymentForwarded fields or downstream-closed flags after restart; upgrade to include this fix. No immediate emergency response appears required because the bug is in accounting/event metadata rather than fund-custody logic.

Security signals we found

01

Incorrect channel metadata used in post-reload claim replay

02

PaymentForwarded event fields could be wrong after restart

03

Downstream closure detection used upstream counterparty lookup

04

user_channel_id was incorrectly None for reconstructed forwards

Risk score

Why this scored 43/100

Our methodology →
Potential impact 12/30
Exploitability 5/25
Stealth signal 8/15
Affected reach 7/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.