Validate negative funding contributions in `splice_init` and `splice_ack` messages #4011

tankyleo · 2025-08-14T01:21:41Z

From BOLT 2:

- If `funding_contribution_satoshis` is negative and its absolute value
  is greater than the sending node's current channel balance:
  - MUST send a `warning` and close the connection or send an `error`
    and fail the channel.

We allow the remote to be below the new reserve as long as their
funding contribution is not negative; we don't care whether they were
above or below the previous funding reserve.

ldk-reviews-bot · 2025-08-14T01:21:43Z

👋 I see @valentinewallace was un-assigned.
If you'd like another reviewer assignment, please click here.

codecov · 2025-08-14T01:31:40Z

Codecov Report

❌ Patch coverage is 8.33333% with 11 lines in your changes missing coverage. Please review.
✅ Project coverage is 88.76%. Comparing base (1c36624) to head (d0023e3).
⚠️ Report is 8 commits behind head on main.

Files with missing lines	Patch %	Lines
lightning/src/sign/tx_builder.rs	8.33%	11 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4011      +/-   ##
==========================================
- Coverage   88.78%   88.76%   -0.03%     
==========================================
  Files         176      176              
  Lines      128139   128533     +394     
  Branches   128139   128533     +394     
==========================================
+ Hits       113768   114087     +319     
- Misses      11803    11859      +56     
- Partials     2568     2587      +19

Flag	Coverage Δ
fuzzing	`21.86% <8.33%> (-0.05%)`	⬇️
tests	`88.59% <8.33%> (-0.03%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

ldk-reviews-bot · 2025-08-16T01:25:45Z

🔔 1st Reminder

Hey @wpaulino! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

ldk-reviews-bot · 2025-08-18T01:26:28Z

🔔 2nd Reminder

Hey @wpaulino! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

tankyleo · 2025-08-19T18:02:47Z

On hold until splice-out PR gets in.

ldk-reviews-bot · 2025-08-20T01:27:13Z

🔔 3rd Reminder

Hey @wpaulino! This PR has been waiting for your review.
Please take a look when you have a chance. If you're unable to review, please let us know so we can find another reviewer.

As much as possible, we want to only mutate state once we are done with input validation. This also removes complaints when helper functions during validation take a `&self`.

As in `splice_init`, this helps clearly delineate `splice_ack` message validation from the subsequent state mutations. This is a code-move.

We will validate the reserve requirements on the new `FundingScope` in `validate_splice_contribution`.

`NextCommitmentStats` provides the commitment transaction fee as a separate value to assist with applying a multiplier on it in `can_accept_incoming_htlc`. Nonetheless in most cases, we want the balances to include the commitment transaction fee, so here we add a helper that gives us these balances.

This applies to both `splice_init` and `splice_ack` messages. From BOLT 2: ``` - If `funding_contribution_satoshis` is negative and its absolute value is greater than the sending node's current channel balance: - MUST send a `warning` and close the connection or send an `error` and fail the channel. ``` We allow the remote to be below the new reserve as long as their funding contribution is not negative; we don't care whether they were above or below the previous funding reserve.

wpaulino · 2025-08-26T22:39:10Z

lightning/src/ln/channel.rs

@@ -11095,7 +11095,7 @@ where
 		})
 	}

-	/// Handle splice_ack
+	/// See also [`validate_splice_ack`]


Nit: just remove the comment

wpaulino · 2025-08-26T22:44:44Z

lightning/src/sign/tx_builder.rs

+impl NextCommitmentStats {
+	pub(crate) fn get_balances_including_fee_msat(&self) -> (Option<u64>, Option<u64>) {
+		let holder_balance_incl_fee_msat = if self.is_outbound_from_holder {
+			self.holder_balance_before_fee_msat


Does this already have the anchor outputs value subtracted?

wpaulino · 2025-08-26T22:50:13Z

lightning/src/sign/tx_builder.rs

+		let counterparty_balance_incl_fee_msat = if self.is_outbound_from_holder {
+			self.counterparty_balance_before_fee_msat
+		} else {
+			self.counterparty_balance_before_fee_msat
+				.and_then(|balance| balance.checked_sub(self.commit_tx_fee_sat * 1000))
+		};


Suggested change

let counterparty_balance_incl_fee_msat = if self.is_outbound_from_holder {

self.counterparty_balance_before_fee_msat

} else {

self.counterparty_balance_before_fee_msat

.and_then(|balance| balance.checked_sub(self.commit_tx_fee_sat * 1000))

};

let counterparty_balance_incl_fee_msat =

self.counterparty_balance_before_fee_msat.and_then(|balance| {

if self.is_outbound_from_holder {

balance

} else {

balance.checked_sub(self.commit_tx_fee_sat * 1000)

}

});

The two branches of the if statement here don't return the same type - will take another look later

wpaulino · 2025-08-26T23:25:07Z

lightning/src/ln/channel.rs

+		// This *should* have no effect because no HTLC updates should be pending, but even if it does,
+		// the result may be a failed negotiation (and not a force-close), so we choose to include them.
+		let include_remote_unknown_htlcs = true;
+		let addl_nondust_htlc_count = 0;


Wouldn't we want to make sure the new commitment is able to handle a new non-dust HTLC being added?

Ah yes thank you ! How about just 1 additional HTLC here ? This parameter increases the commitment transaction fee we get back.

wpaulino · 2025-08-26T23:28:41Z

lightning/src/ln/channel.rs

-
-		// TODO(splicing): Pre-check for reserve requirement
-		// (Note: It should also be checked later at tx_complete)
+		if their_funding_contribution.is_negative() {


There's also the case where we make a positive contribution and the counterparty does too, but a much larger one, bringing the reserve high enough that even after our contribution we still are not able to meet it.

From my reading of the spec, seems a party should only complain in cases where the counterparty's funding contribution is negative.

Did we want to be stricter than the spec here ?

wpaulino · 2025-08-26T23:31:41Z

lightning/src/ln/channel.rs

+		let validate_stats = |stats: NextCommitmentStats| {
+			let (_, remote_balance_incl_fee_msat) = stats.get_balances_including_fee_msat();
+			let splice_remote_balance_msat = remote_balance_incl_fee_msat
+				.ok_or(ChannelError::Warn(format!("Remote balance does not cover the sum of HTLCs, anchors, and commitment transaction fee")))?;


Error needs to be WarnAndDisconnect

wpaulino · 2025-08-26T23:34:30Z

lightning/src/ln/channel.rs

+
+		// Reserve check on local commitment transaction
+
+		let splice_local_commitment_stats = self.context.get_next_local_commitment_stats(


The "next" naming is odd here because we're actually building an alternative version of the current commitment transaction

Agreed :) If a squint a little, the "next" commitment transaction will have different to_local, to_remote balances, that's the one we are validating here. As far as I see at this point, this "alternative" commitment transaction is the one we will sign "next" ?

This is from 3921 feel free to take a look.

ldk-reviews-bot · 2025-08-26T23:35:08Z

👋 The first review has been submitted!

Do you think this PR is ready for a second reviewer? If so, click here to assign a second reviewer.

tankyleo changed the title ~~Validate negative funding contributions in splice_ack and splice_init messages~~ Validate negative funding contributions in splice_init and splice_ack messages Aug 14, 2025

tankyleo force-pushed the splice-reserve-check branch from 6d6b07c to 93965c6 Compare August 14, 2025 01:24

tankyleo requested a review from wpaulino August 14, 2025 01:25

tankyleo added this to Weekly Goals Aug 14, 2025

tankyleo self-assigned this Aug 14, 2025

wpaulino mentioned this pull request Aug 18, 2025

Add splice-out support #3979

Merged

tankyleo removed the request for review from wpaulino August 20, 2025 01:37

tankyleo marked this pull request as draft August 20, 2025 01:38

jkczyz mentioned this pull request Aug 21, 2025

Dual-funded channels and Splicing Project Tracking #1621

Open

7 tasks

tankyleo added 6 commits August 26, 2025 19:12

Finish validation in splice_ack before taking a &mut self

e5ce891

As much as possible, we want to only mutate state once we are done with input validation. This also removes complaints when helper functions during validation take a `&self`.

Add validate_splice_ack helper function

6327ad1

As in `splice_init`, this helps clearly delineate `splice_ack` message validation from the subsequent state mutations. This is a code-move.

Make for_splice infallible

70347d3

Let validate_splice_contribution construct the new FundingScope

e63b416

We will validate the reserve requirements on the new `FundingScope` in `validate_splice_contribution`.

tankyleo force-pushed the splice-reserve-check branch from 93965c6 to d0023e3 Compare August 26, 2025 22:14

tankyleo marked this pull request as ready for review August 26, 2025 22:14

ldk-reviews-bot requested a review from valentinewallace August 26, 2025 22:15

tankyleo requested review from wpaulino and removed request for valentinewallace August 26, 2025 22:15

wpaulino reviewed Aug 26, 2025

View reviewed changes


		// Reserve check on local commitment transaction

		let splice_local_commitment_stats = self.context.get_next_local_commitment_stats(

Validate negative funding contributions in splice_init and splice_ack messages #4011

Are you sure you want to change the base?

Validate negative funding contributions in splice_init and splice_ack messages #4011

Conversation

tankyleo commented Aug 14, 2025

Uh oh!

ldk-reviews-bot commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Aug 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

ldk-reviews-bot commented Aug 16, 2025

Uh oh!

ldk-reviews-bot commented Aug 18, 2025

Uh oh!

tankyleo commented Aug 19, 2025

Uh oh!

ldk-reviews-bot commented Aug 20, 2025

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

ldk-reviews-bot commented Aug 26, 2025

Uh oh!

Uh oh!

Validate negative funding contributions in `splice_init` and `splice_ack` messages #4011

Validate negative funding contributions in `splice_init` and `splice_ack` messages #4011

ldk-reviews-bot commented Aug 14, 2025 •

edited

Loading

codecov bot commented Aug 14, 2025 •

edited

Loading