Remove expectance of interactive-tx commitment_signed during reestablish
What the developer wrote
Authored by Wilmer Paulino
Remove expectance of interactive-tx commitment_signed during reestablish
The use of `expecting_peer_commitment_signed` was being used as a way to
signal that we must disconnect if the message is not sent in a timely
manner. This isn't necessary, as we're already quiescent within this
flow, and can disconnect via that signal instead.
What changed, and why it matters
This commit removes a small piece of bookkeeping in the Lightning channel code that tracked whether a peer's commitment signature was still expected during a channel re-establishment. The change says this extra signal is unnecessary because the protocol is already in a quiet 'quiescent' state that can be used to disconnect if needed. It is a cleanup, but it touches code that decides when to disconnect from a peer, which is security-sensitive in Lightning because disconnects affect funds availability and potential force-close behavior.
Treat as a normal code-review item. Verify that removing the expecting_peer_commitment_signed flag does not weaken liveness guarantees or allow a stale peer to remain connected longer than intended during reestablishment. Review related tests for interactive-tx reestablish and quiescence timeouts. No immediate security response is indicated by the available evidence.
Security signals we found
Change affects state tracking for commitment_signed receipt during channel reestablish
Change removes a disconnect-expectancy signal in interactive-tx flow
Commit message frames change as cleanup, not as a security fix
No explicit vulnerability description or advisory references present
Evidence from the diff
In rust-lightning’s channel.rs, the reestablishment logic for interactive-tx channels previously set self.context.expecting_peer_commitment_signed = true when the peer had not yet sent commitment_signed. This flag was used as a liveness/disconnect signal. The patch removes that assignment, relying instead on the existing quiescence mechanism to trigger disconnects. The diff is four lines removed and no lines added. There is no explicit security framing in the commit message, and no references to CVEs, advisories, or researchers.
Changed components
lightning/src/ln/channel.rsinteractive-tx channel reestablishment logicexpecting_peer_commitment_signed state flagInspect captured patch +0 / −4
diff --git a/lightning/src/ln/channel.rs b/lightning/src/ln/channel.rs
index ab9c964..ef8b8a4 100644
--- a/lightning/src/ln/channel.rs
+++ b/lightning/src/ln/channel.rs
@@ -10645,10 +10645,6 @@ where
)));
}
- if !session.has_received_commitment_signed() {
- self.context.expecting_peer_commitment_signed = true;
- }
-
if !session.has_holder_witnesses() {
log_debug!(logger, "Waiting for funding transaction signatures to be provided");
} else {
Why this scored 45/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.