AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 28 Bitcoin

Change FundingInfo::Contribution to expose contributed output scripts

Public commit record

What the developer wrote

Authored by Wilmer Paulino

85/100 · Strong
Change FundingInfo::Contribution to expose contributed output scripts

Exposing the amounts for each output isn't very helpful because it's
possible that they vary across over multiple splice candidates due to
RBF. This commit changes `FundingInfo::Contribution` and several of the
helpers used to derive it to be based on output scripts instead.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Explains rationale or failure mode
The short version

What changed, and why it matters

This commit refactors how a Lightning node reports which transaction outputs a user is contributing during channel funding or splicing. Instead of sharing full output details (including amounts), it now shares only the output scripts (addresses). The stated reason is that amounts can change across RBF (fee-bump) attempts, so scripts are a more stable identifier. The change also fixes filtering logic so duplicate outputs are correctly recognized by their script, preventing a user's own change output from being incorrectly reported as a new contribution in later rounds.

Recommended action

Treat as a normal code-quality and API-clarity patch. Reviewers should verify that downstream consumers of `FundingInfo::Contribution` no longer need output amounts, and that the new script-only deduplication correctly handles all edge cases where two distinct outputs share the same script (e.g., reused addresses). No immediate security response is indicated by the supplied materials.

Security signals we found

01

Change in public API data type from full transaction outputs to scripts only

02

Fix to output deduplication logic that previously failed to filter the change output by script

03

Refactoring of RBF/splicing contribution tracking to use stable identifiers (scripts) rather than amounts

04

No explicit security claim in commit message or diff

Risk score

Why this scored 28/100

Our methodology →
Potential impact 5/30
Exploitability 5/25
Stealth signal 5/15
Affected reach 5/15
Confidence 5/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.