AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Informational 20 Bitcoin

Expose the outgoing HTLC's CLTV expiry in `Event::HTLCIntercepted`

Public commit record

What the developer wrote

Authored by Matt Corallo

73/100 · Adequate
Expose the outgoing HTLC's CLTV expiry in `Event::HTLCIntercepted`

In the previous commit our interception documentation noted that in
some cases devs may wish to validate the CLTV expiry of HTLCs
before forwarding. Here we enable that by exposing the next-hop's
CLTV value in `Event::HTLCIntercepted`
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds a new piece of information—the outgoing HTLC's CLTV expiry block height—to the Event::HTLCIntercepted event in the Lightning Dev Kit. This lets developers who intercept payments inspect when the forwarded HTLC would time out, so they can validate it before forwarding. It is a feature/API enhancement, not a fix for an active vulnerability.

Recommended action

No immediate security action required. This is an API enhancement. Developers using HTLC interception should consider validating outgoing_htlc_expiry_block_height before forwarding, as now enabled by this change.

Security signals we found

01

Adds defensive visibility into HTLC timeout parameters for intercepting nodes

02

Backward-compatible TLV serialization of new optional field

03

No logic change to forwarding, validation, or channel state machine

04

Commit message references prior documentation about CLTV validation

Risk score

Why this scored 20/100

Our methodology →
Potential impact 2/30
Exploitability 1/25
Stealth signal 1/15
Affected reach 3/15
Confidence 9/10
Evidence quality 4/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.