AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 24 Bitcoin

Poll for resolved `UtxoFuture`s rather than resolving on the graph

Public commit record

What the developer wrote

Authored by Matt Corallo

73/100 · Adequate
Poll for resolved `UtxoFuture`s rather than resolving on the graph

`P2PGossipSync` is a rather poor design. It currently basically
requires two circular `Arc` references, leaving `NetworkGraph`s to
leak if LDK is un-loaded:
* `P2PGossipSync` owns/holds a reference to the
`GossipVerifier` and `GossipVerifier` holds an `Arc` to the
`P2PGossipSync` and
* `PeerManager` holds a reference to the `P2PGossipSync` (as the
gossip message handler) which owns/holds a reference to the
`GossipVerifier`, which has a `Deref` (likely an `Arc` in
practice) to the `PeerManager`.

Instead, we should move towards the same design we have elsewhere -
hold a `Notifier` and expose waiting on it to the background
processor then poll for completion from there (in this case, as in
others by checking for completion when handling
`get_and_clear_pending_msg_events` calls).

Here we do the bulk of this work, moving `UtxoFuture` resolution
to a simple function that signals the `Notifier` and stores the
result. We then poll to convert the result into forwarded messages
in `P2PGossipSync::get_and_clear_pending_message_events`. Note that
we still rely on manual wakeups from the gossip validator, but that
will be fixed in the next commit.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit refactors how Lightning Dev Kit handles asynchronous checks of Bitcoin transaction outputs (UTXOs) used to validate gossip messages about the network graph. Previously, resolving these checks required direct circular references between components, which could cause memory leaks when LDK was unloaded. The new design uses a notification/polling pattern instead, making the code cleaner and avoiding leaked objects. It is a defensive architectural fix rather than a patch for an active exploit.

Recommended action

Treat as a routine hardening/refactoring commit. No immediate security response required, but downstream users should update to avoid the memory-leak-prone circular-reference design. Review follow-up commit mentioned in message for removal of manual wakeups.

Security signals we found

01

Eliminates circular Arc references between P2PGossipSync, GossipVerifier, and PeerManager

02

Prevents NetworkGraph memory leaks on LDK unload

03

Refactors async UTXO validation from push/callback to poll/notify pattern

04

Removes public resolve_without_forwarding and parameterized resolve APIs in favor of simpler resolve

05

Adds process_completed_checks polling in get_and_clear_pending_msg_events

Risk score

Why this scored 24/100

Our methodology →
Potential impact 5/30
Exploitability 2/25
Stealth signal 3/15
Affected reach 4/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.