AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 44 Bitcoin

Fix output filtering in into_unique_contributions

Public commit record

What the developer wrote

Authored by Jeffrey Czyz

68/100 · Adequate
Fix output filtering in into_unique_contributions

Filter outputs by script_pubkey rather than full TxOut equality. Outputs
reusing the same address as a prior round are still considered committed
even if the value differs (e.g., different change amounts across RBF
rounds with different feerates).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit fixes a bug in how the Lightning Dev Kit filters duplicate transaction outputs when multiple funding or splicing attempts overlap. Previously, it treated two outputs as duplicates only if both the amount and the destination address matched exactly. The fix now treats outputs as duplicates if only the destination address matches, even if the amounts differ. This prevents a user from accidentally losing control of funds when a second splicing attempt reuses a change address with a different amount, such as after a fee-bump (RBF).

Recommended action

Review whether the script_pubkey-only filtering could inadvertently suppress legitimate outputs in any edge cases, and confirm that wallet change-address reuse across splicing rounds is handled safely. Consider whether additional tests are needed for multi-party or adversarial scenarios.

Security signals we found

01

Change in output-deduplication semantics from full TxOut equality to script_pubkey-only equality

02

Test updates demonstrate the intended behavior: same-script outputs filtered, different-script outputs retained

03

Commit message describes the change as a fix for output filtering in funding/splicing contributions

04

Scenario involves overlapping funding contributions and DiscardFunding event handling

05

No explicit security framing or CVE reference in commit or supplied materials

Risk score

Why this scored 44/100

Our methodology →
Potential impact 12/30
Exploitability 8/25
Stealth signal 7/15
Affected reach 8/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.