AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 26 Bitcoin

Split InteractiveTxConstructor::new into outbound/inbound variants

Public commit record

What the developer wrote

Authored by Jeffrey Czyz

73/100 · Adequate
Split InteractiveTxConstructor::new into outbound/inbound variants

Replace the single public InteractiveTxConstructor::new() with separate
new_for_outbound() and new_for_inbound() constructors. This moves the
initiator's first message preparation out of the core constructor,
making it infallible and removing is_initiator from the args struct.

Callers no longer need to handle constructor errors, which avoids having
to generate SpliceFailed/DiscardFunding events after the QuiescentAction
has already been consumed during splice_init/splice_ack handling.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit refactors how an internal transaction-construction object is created in the Lightning Dev Kit. It splits one constructor into two separate ones for the party that starts the process versus the party that responds. The main practical effect is that callers no longer have to handle an error right after they have already committed to starting a splice, which avoids a tricky cleanup situation where they might otherwise have to emit a failure event after consuming internal state. It is a defensive code-quality change rather than a fix for a known active exploit.

Recommended action

Review as a defensive hardening/refactoring change. Ensure the invariant relied on by new_for_outbound (initiator always has shared funding output and therefore a first message) holds in all production paths, including future splicing variants. No immediate security patch or incident response is indicated by the diff alone.

Security signals we found

01

Eliminates error path after QuiescentAction has already been consumed

02

Removes public fallible constructor in favor of role-specific infallible constructors

03

Adds debug_assert to document invariant that outbound first message cannot fail

04

Prevents need to emit SpliceFailed/DiscardFunding events from constructor failure path

Risk score

Why this scored 26/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 5/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.