Don't retransmit tx_signatures pending monitor update
What the developer wrote
Authored by Jeffrey Czyz
Don't retransmit tx_signatures pending monitor update
The ChannelMonitor must be successfully persisted before transmitting
any messages.
What changed, and why it matters
This commit fixes a timing issue in the Lightning Dev Kit where a node could send transaction signatures to its peer before its own local safety record (the ChannelMonitor) had been saved. Sending signatures too early could, in edge cases, leave the node in a vulnerable or inconsistent state if something crashed or went wrong before the save completed. The fix simply waits to send signatures until the monitor update is finished.
Review related message-sending paths for similar missing monitor-persistence guards; add regression tests covering monitor-update-in-progress scenarios during signature retransmission; consider backporting to maintained release branches.
Security signals we found
Order-of-operations fix ensuring critical state persistence precedes signature transmission
Prevents potential inconsistent state between sent signatures and local ChannelMonitor
Missing guard condition added to retransmission path
Evidence from the diff
In lightning/src/ln/channel.rs, the code that decides whether to retransmit holder funding transaction signatures now checks self.context.channel_state.is_monitor_update_in_progress(). If a monitor update is still pending, it returns None and logs a wait message, deferring signature transmission until persistence succeeds. This aligns signature retransmission with the existing requirement that ChannelMonitor must be persisted before transmitting messages.
Changed components
lightning/src/ln/channel.rsChannel funding signature retransmission logicChannelMonitor persistence coordinationInspect captured patch +3 / −0
diff --git a/lightning/src/ln/channel.rs b/lightning/src/ln/channel.rs
index 2b3280e..0d54e4b 100644
--- a/lightning/src/ln/channel.rs
+++ b/lightning/src/ln/channel.rs
@@ -9289,6 +9289,9 @@ where
if session.holder_tx_signatures().is_none() {
log_debug!(logger, "Waiting for funding transaction signatures to be provided");
None
+ } else if self.context.channel_state.is_monitor_update_in_progress() {
+ log_debug!(logger, "Waiting for monitor update before providing funding transaction signatures");
+ None
} else {
session.holder_tx_signatures().clone()
}
Why this scored 60/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.