AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 32 Bitcoin

sendpsbt: update channel psbts if this is a channel PSBT.

Public commit record

What the developer wrote

Authored by Rusty Russell

65/100 · Adequate
sendpsbt: update channel psbts if this is a channel PSBT.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides an explanatory body
The short version

What changed, and why it matters

This change makes the sendpsbt RPC command smarter: if the transaction being sent matches a PSBT that was promised for a new or spliced Lightning channel, the node now saves the final signed version with that channel so it can re-send it after a restart. It also updates the saved channel PSBT during splice signing. This is a reliability improvement for channel funding and splicing, not a fix for an obvious exploit.

Recommended action

Review whether psbt_equivalent is sufficiently precise to avoid associating an unrelated PSBT with a channel, and ensure the replacement cannot be triggered by a malicious or accidental RPC caller. Consider adding tests for the new association behavior and for splice restart retransmission.

Security signals we found

01

PSBT equivalence comparison ignores signatures and most PSBT fields, comparing only inputs/outputs

02

Channel funding PSBT is overwritten when an equivalent PSBT is sent via sendpsbt

03

Splice signing path now persists updated funding PSBT

04

No input validation or authorization checks beyond existing RPC access

Risk score

Why this scored 32/100

Our methodology →
Potential impact 8/30
Exploitability 5/25
Stealth signal 4/15
Affected reach 6/15
Confidence 6/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.