splice: Fix cross-channel splices
What the developer wrote
Authored by Dusty Daemon
splice: Fix cross-channel splices
When doing a cross channel splice, inputs move from having no SIGHASH to having SIGHASH_ALL assigned.
This causes psbt_get_changeset to flag the input as having changed, as the sighash value is compared.
This causes the second channel splice to `tx_remove_input` the input as it doesn’t match anymore, breaking the splice.
We fix this by removing the sighash value from input comparisions.
What changed, and why it matters
This commit fixes a bug in Core Lightning's splicing feature where a transaction input could be incorrectly removed during a 'cross-channel splice' because the software compared a newly-added signature hash flag. The fix tells the comparison logic to ignore the signature-hash value so the input is not treated as changed and wrongly dropped. It is a functional bug fix rather than an obvious security vulnerability, but it could cause a splice to fail or funds to be handled incorrectly.
Treat as a bug fix with low-to-moderate operational risk. Review whether failed or partially-executed splices could leave channels in an inconsistent state, and consider adding regression tests for cross-channel splice input matching.
Security signals we found
Functional bug in multi-channel transaction construction
Incorrect input removal could disrupt splice protocol flow
Normalization of comparison field to prevent false-positive change detection
Evidence from the diff
In common/psbt_open.c’s linearize_input, the code now calls wally_psbt_input_set_sighash(&psbt->inputs[0], 0) before comparing PSBT inputs. During cross-channel splices, an input transitions from having no SIGHASH to SIGHASH_ALL. Without this change, psbt_get_changeset sees the sighash difference as an input change and the second splice calls tx_remove_input, breaking the splice. The patch normalizes the sighash field to zero during input comparison so it is not part of the diff.
Changed components
common/psbt_open.csplicing / cross-channel splice logicPSBT input comparison (psbt_get_changeset)Inspect captured patch +1 / −0
diff --git a/common/psbt_open.c b/common/psbt_open.c
index c2bf855..d589322 100644
--- a/common/psbt_open.c
+++ b/common/psbt_open.c
@@ -82,6 +82,7 @@ static const u8 *linearize_input(const tal_t *ctx,
wally_psbt_input_set_witness_script(&psbt->inputs[0], NULL, 0);
wally_psbt_input_set_redeem_script(&psbt->inputs[0], NULL, 0);
wally_psbt_input_set_taproot_signature(&psbt->inputs[0], NULL, 0);
+ wally_psbt_input_set_sighash(&psbt->inputs[0], 0);
psbt->inputs[0].taproot_leaf_hashes.num_items = 0;
psbt->inputs[0].taproot_leaf_paths.num_items = 0;
psbt->inputs[0].keypaths.num_items = 0;
Why this scored 41/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.