Add note for alternative_funding_confirmed assertion in promote_funding
What the developer wrote
Authored by Wilmer Paulino
Add note for alternative_funding_confirmed assertion in promote_funding
What changed, and why it matters
This commit adds a code comment explaining why a consistency check in the Lightning channel monitoring logic uses a debug-only assertion instead of a runtime panic. The change itself is only a comment; it does not alter program behavior. It documents a rare reorganization scenario where the monitor might not yet have seen an alternative funding transaction that got locked in. There is no direct security fix here, but it clarifies an existing defensive coding choice.
No immediate action required. Treat as documentation-only commit. If reviewing related code, verify that the reorg handling around alternative funding confirmation is sound and that the debug assertion is sufficient for test coverage.
Security signals we found
Comment references reorg-related consistency edge case in channel funding logic
Existing debug-only assertion instead of runtime assertion indicates prior defensive design decision
No executable code change; no patch of a vulnerability
Evidence from the diff
In lightning/src/chain/channelmonitor.rs, within ChannelMonitorImpl::promote_funding, a comment was added above an existing debug_assert_eq!(alternative_funding_txid, new_funding_txid). The comment explains that in rare reorg cases, a potential funding transaction may have been locked in without the ChannelMonitor having observed it, so a runtime assertion is intentionally avoided. The diff changes no executable code.
Changed components
lightning/src/chain/channelmonitor.rsChannelMonitorImpl::promote_fundingInspect captured patch +3 / −0
diff --git a/lightning/src/chain/channelmonitor.rs b/lightning/src/chain/channelmonitor.rs
index c7011af..92d39f0 100644
--- a/lightning/src/chain/channelmonitor.rs
+++ b/lightning/src/chain/channelmonitor.rs
@@ -3851,6 +3851,9 @@ impl<Signer: EcdsaChannelSigner> ChannelMonitorImpl<Signer> {
self.outputs_to_watch.remove(&funding.funding_txid());
}
if let Some((alternative_funding_txid, _)) = self.alternative_funding_confirmed.take() {
+ // In exceedingly rare cases, it's possible there was a reorg that caused a potential funding to
+ // be locked in that this `ChannelMonitor` has not yet seen. Thus, we avoid a runtime assertion
+ // and only assert in debug mode.
debug_assert_eq!(alternative_funding_txid, new_funding_txid);
}
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.