Reject `splice_init`s when we aren't quiescent
What the developer wrote
Authored by Matt Corallo
Reject `splice_init`s when we aren't quiescent
What changed, and why it matters
This commit adds a safety check in the Lightning Dev Kit's channel code to refuse splice-in operations unless the channel is in a quiet, stable state called 'quiescent.' Before this change, the code apparently allowed splice initiation even when the channel was busy with other activity. The patch prevents potential protocol confusion or unsafe splice handling by disconnecting the peer with a warning if a splice is requested at the wrong time.
Treat as a protocol-hardening fix. Review whether other splice-related message handlers (splice_ack, splice_locked, tx_add_input, etc.) also enforce quiescence and other required preconditions consistently. Consider adding regression tests for splice_init during non-quiescent states.
Security signals we found
Missing state-guard check in protocol message handler
Enforcement of quiescence precondition for splice operations
Use of WarnAndDisconnect to reject invalid peer request
Evidence from the diff
In lightning/src/ln/channel.rs, the splice_init handler now checks self.context.channel_state.is_quiescent() before processing a splice_init message. If the channel is not quiescent, it returns ChannelError::WarnAndDisconnect(‘Quiescence needed to splice’). This enforces the BOLT protocol requirement that splicing must occur only when the channel is quiescent, blocking splice attempts during pending updates, commitments, or other non-quiet states.
Changed components
lightning/src/ln/channel.rssplice_init message handlerchannel state machineInspect captured patch +4 / −0
diff --git a/lightning/src/ln/channel.rs b/lightning/src/ln/channel.rs
index 47eea77..1b0fdf0 100644
--- a/lightning/src/ln/channel.rs
+++ b/lightning/src/ln/channel.rs
@@ -11110,6 +11110,10 @@ where
ES::Target: EntropySource,
L::Target: Logger,
{
+ if !self.context.channel_state.is_quiescent() {
+ return Err(ChannelError::WarnAndDisconnect("Quiescence needed to splice".to_owned()));
+ }
+
let our_funding_contribution = SignedAmount::from_sat(our_funding_contribution_satoshis);
let splice_funding = self.validate_splice_init(msg, our_funding_contribution)?;
Why this scored 50/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.