AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 29 Bitcoin

Split DiscardFunding from SpliceFailed event

Public commit record

What the developer wrote

Authored by Jeffrey Czyz

78/100 · Adequate
Split DiscardFunding from SpliceFailed event

When a splice fails, users need to reclaim UTXOs they contributed to the
funding transaction. Previously, the contributed inputs and outputs were
included in the SpliceFailed event. This commit splits them into a
separate DiscardFunding event with a new FundingInfo::Contribution
variant, providing a consistent interface for UTXO cleanup across all
funding failure scenarios.

Changes:
- Add FundingInfo::Contribution variant to hold inputs/outputs for
DiscardFunding events
- Remove contributed_inputs/outputs fields from SpliceFailed event
- Add QuiescentError enum for better error handling in funding_contributed
- Emit DiscardFunding on all funding_contributed error paths
- Filter duplicate inputs/outputs when contribution overlaps existing
pending contribution
- Return Err(APIError) from funding_contributed on all error cases
- Add comprehensive test coverage for funding_contributed error paths

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
The short version

What changed, and why it matters

This commit is a defensive refactor of how a Lightning node library (LDK) tells wallet software to reclaim UTXOs after a splice or dual-funding attempt fails. It splits the cleanup signal out of the general 'splice failed' event into a dedicated 'DiscardFunding' event, and makes sure that signal is emitted on more error paths (wrong peer, unknown channel, duplicate contribution, channel shutting down, etc.). The change is primarily about preventing user funds from being accidentally left locked or double-spent by giving the wallet a clearer, more consistent reclaim signal. It is not a remote exploit fix; it is an API-hardening and reliability improvement.

Recommended action

Review downstream wallet/event-handler code that consumes Event::SpliceFailed. Update handlers to expect a separate Event::DiscardFunding for contributed inputs/outputs, and stop reading contributed_inputs/contributed_outputs from SpliceFailed. Verify that wallets act on DiscardFunding promptly to avoid leaving UTXOs reserved for abandoned funding transactions. No emergency deployment is indicated, but the event contract change is breaking for consumers of these events.

Security signals we found

01

New event type dedicated to UTXO reclaim after funding failure

02

Error paths now emit DiscardFunding instead of silently discarding contribution data

03

Duplicate/overlapping contributions filtered to avoid double-reclaim or reuse confusion

04

API now returns Err(APIError) on all funding_contributed failure cases

05

Serialization updated for new FundingInfo::Contribution variant and removed SpliceFailed fields

06

Extensive new tests cover missing peer, missing channel, duplicate contribution, active negotiation, shutdown, and unfunded-channel error paths

Risk score

Why this scored 29/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 6/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.