AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 36 Bitcoin

Remove automatic channel acceptance

Public commit record

What the developer wrote

Authored by elnosh

58/100 · Thin
Remove automatic channel acceptance

Removes the `manually_accept_inbound_channels` config
option. In upcoming commit we will default to anchor
channels which requires users checking if they have
enough onchain funds to cover fees in case of a force
close. Hence, we move to always require users to
manually accept inbound channels.
✓ Descriptive subject✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit removes the automatic acceptance of incoming Lightning channels in the LDK library. Previously, users could set a flag to automatically accept inbound channel requests. Now, every inbound channel request must be explicitly approved by the user through an OpenChannelRequest event. This is a deliberate design change to ensure users verify they have enough on-chain funds to cover fees, especially with upcoming anchor channel defaults. It is not a fix for an active vulnerability, but it prevents accidental or unsafe channel acceptance.

Recommended action

Review downstream applications using LDK to ensure they handle `Event::OpenChannelRequest` and call `accept_inbound_channel` (or reject) for every inbound channel. Update configuration code that sets `manually_accept_inbound_channels`, as the field no longer exists. Consider this a breaking API/behavior change rather than an emergency patch.

Security signals we found

01

Removal of automatic inbound channel acceptance path

02

Mandatory manual approval via Event::OpenChannelRequest

03

Preparation for anchor channels default, requiring on-chain fee reserve awareness

04

Prevents accidental acceptance of zero-conf or anchor channels without user review

05

No CVE, advisory, or exploit code present in commit or references

Risk score

Why this scored 36/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 4/15
Affected reach 7/15
Confidence 8/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.