AI-generated analysisPublished automatically and not human-verified. Validated context appears in community notes below.
← Watch feed
Low 27 Bitcoin

Support async signing of interactive-tx initial commitment signatures

Public commit record

What the developer wrote

Authored by Wilmer Paulino

73/100 · Adequate
Support async signing of interactive-tx initial commitment signatures

This commit allows for an async signer to immediately return upon a call
to `EcdsaChannelSigner::sign_counterparty_commitment` for the initial
commitment signatures of an interactively funded transaction, such that
they can call back in via `ChannelManager::signer_unblocked` once the
signatures are ready. This is done for both splices and dual-funded
channels, though note that the latter still require more work to be
integrated. Since `tx_signatures` must be sent only after exchanging
`commitment_signed`, we make sure to hold them back if they're ready to
be sent until our `commitment_signed` is also ready.
✓ Specific, descriptive subject✓ Names a concrete action or component✓ Provides detailed explanatory context
The short version

What changed, and why it matters

This commit adds support for asynchronous (delayed) signing when opening or splicing Lightning channels that use the newer interactive-funding protocol. Previously, if a hardware or remote signer was not ready to produce the initial commitment signature, the code either did not support the delay or could accidentally send transaction signatures before the commitment signature was ready. The change holds back the transaction-signature message until the commitment signature is available, and adds a regression test for splicing. It is a protocol-correctness and robustness improvement rather than a fix for an active exploit.

Recommended action

Review as a normal correctness/robustness improvement. No urgent security response is indicated from the commit alone. Users relying on async signers for splicing or V2 channels should upgrade to obtain the ordering fix and test coverage. Continue monitoring for follow-up dual-funding integration work noted in the commit message.

Security signals we found

01

Protocol-ordering fix: prevents sending tx_signatures before commitment_signed is available

02

Async signer support extended to V2/interactive-tx funding and splices

03

Removal of TODO comment indicating previously unimplemented dual-funding async signing path

04

Added regression test for async splice initial commitment signature

05

Channel reestablishment retransmission made safe for pending async signer

Risk score

Why this scored 27/100

Our methodology →
Potential impact 5/30
Exploitability 3/25
Stealth signal 4/15
Affected reach 5/15
Confidence 7/10
Evidence quality 3/5
Human-validated context

Community notes

Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.

No validated notes yet.

The AI analysis stands alone for now. Submit a note if you can add evidence or important context.