AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 33 Bitcoin

Checkpoint deferred ChannelManager with AwaitingSignatures splice

Public commit record

What the developer wrote

Authored by Wilmer Paulino

83/100 · Strong
Checkpoint deferred ChannelManager with AwaitingSignatures splice

We don't currently checkpoint our signing session prior to sending
`commitment_signed`. The fuzzer has shown that it's possible that we
commit to a splice candidate and reload with an outdated manager prior
to the signing session existing. If the counterparty commits to the
splice back, and is expecting to resume, we'll end up aborting
erroneously leading to a force close. We defer the real fix for now and
instead prevent the fuzzer from running into this case.

Fixes fuzz payload:

7f0200000000004211a10081bd4a191f1119401f001118100f1810411f00111810101b10401f00111810101810411f00111810101810401f00111fb170b170ff
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context✓ Mentions testing or verification
The short version

What changed, and why it matters

This commit is a temporary workaround in a fuzz-testing harness for the Lightning Dev Kit. It forces a save of the channel manager before restarting a test node when a specific in-progress splice state exists. The underlying issue is that the signing session for a splice isn't checkpointed before sending a commitment message, so if the node restarts at the wrong moment, it can reload stale state and force-close a channel unnecessarily. The commit does not fix the root cause; it only prevents the fuzzer from hitting the case.

Recommended action

Treat this as a known bug marker rather than a completed fix. The project should implement proper checkpointing of the signing session before sending `commitment_signed` for splices, then remove this fuzzer workaround and add a regression test.

Security signals we found

01

State persistence gap between commitment and signing session

02

Potential force-close after reload due to stale ChannelManager state

03

Splice candidate in AwaitingSignatures status

04

Deferred persistence path affected

05

FIXME comment indicating incomplete fix

Risk score

Why this scored 33/100

Our methodology →
Potential impact 8/30
Exploitability 4/25
Stealth signal 5/15
Affected reach 6/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.