AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Moderate 66 Bitcoin

Don't track refused monitor updates as pending

Public commit record

What the developer wrote

Authored by Valentine Wallace

68/100 · Adequate
Don't track refused monitor updates as pending

When a monitor update is rejected by the monitor (e.g. a stale commitment
update applied after funding spend), it's possible that that update modified
the monitor's state. Therefore, the ChainMonitor will respond by persisting the
entire monitor and not persisting the individual rejected update.

However, prior to this patch, if the above whole-monitor-persist returned
InProgress, the monitor would erroneously track the rejected monitor update as
pending-persist, even though that update was never handed to the persister in
the first place, so implementations would never know to call
channel_monitor_updated with the rejected update's ID.

This dangling pending update can then block emission of
MonitorEvent::Completed, blocking ChannelManager's completion actions (e.g.
PaymentClaimed) until restart. In the case of payment forwards, if this bug
blocked the resumption of another channel, it could lead to an HTLC timing out
and a force close.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
✓ Descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This patch fixes a bookkeeping bug in rust-lightning's ChainMonitor. When a monitor update is rejected (for example, because the channel funding has already been spent), the code may persist the entire monitor instead of the individual update. If that full-monitor save was still in progress, the system incorrectly recorded the rejected update as 'pending completion.' Because the rejected update was never actually handed to the persister, it would never complete, leaving a dangling pending entry. That could stall important channel events, and in payment-forwarding scenarios could contribute to an HTLC timeout and a forced channel closure.

Recommended action

Apply the patch. Ensure downstream users upgrade to a version containing this fix, especially nodes that route payments. Monitor for any stuck pending monitor updates and restart-affected nodes if symptoms appear before patching.

Security signals we found

01

State inconsistency: rejected monitor update tracked as pending-persist despite never being persisted individually

02

Denial-of-service-like effect: completion actions blocked until restart

03

Force-close risk: stalled forwarding channel can lead to HTLC timeout and force close

04

Bug is in chain-monitor update persistence path, a critical consensus-adjacent area

Risk score

Why this scored 66/100

Our methodology →
Potential impact 22/30
Exploitability 12/25
Stealth signal 10/15
Affected reach 10/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.