AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 44 Bitcoin

Clear pending signer state when aborting splice RBF

Public commit record

What the developer wrote

Authored by Wilmer Paulino

78/100 · Adequate
Clear pending signer state when aborting splice RBF

If an asynchronous signer blocks the initial commitment signature for an
RBF, aborting the `AwaitingSignatures` negotiation discards its signing
session but previously left `signer_pending_funding` set. A later
`signer_unblocked` callback would then retry signing funding state which
no longer exists.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Names security-relevant behavior explicitly
The short version

What changed, and why it matters

This commit fixes a state-cleanup bug in Lightning Dev Kit's splice RBF (fee-bump) flow. When a user aborts a splice while waiting for an asynchronous hardware signer, the code now properly clears an internal 'signer still has pending funding work' flag. Before the fix, that flag could remain set, causing a later 'signer is ready' callback to try to continue signing a funding transaction that no longer exists. The patch is small and defensive; the main risk is a confused internal state leading to unexpected retries or errors, not direct theft of funds.

Recommended action

Apply the patch. Review other splice/RBF abort paths for similar stale pending-signer flags. Consider whether `signer_unblocked` should guard against missing signing sessions more defensively.

Security signals we found

01

State inconsistency between signing session and pending-signer flag

02

Asynchronous signer unblock callback retrying stale funding state

03

Regression test demonstrates abort-then-unblock behavior

04

No explicit security advisory or CVE referenced in commit

Risk score

Why this scored 44/100

Our methodology →
Potential impact 12/30
Exploitability 8/25
Stealth signal 6/15
Affected reach 7/15
Confidence 7/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.