Point release fixing three reported security/robustness issues.
Upgrading is recommended for all CLBOSS operators.
-
JitRebalancer fee-budget race (#323, reported by Moin): every
incoming forward HTLC spawned a concurrent rebalance with no
per-destination guard, so several in-flight HTLCs toward the same
depleted channel launched that many full-size rebalances against a
stale expenditure budget — fees paid on each, and the recorded
overspend then blocked legitimate JIT rebalances for that channel.
An in-flight guard now admits one rebalance per destination at a
time. -
Auto-close force-closed offline peers (#324, reported by Moin;
experimental, opt-in feature):closewas issued with a 180-second
unilateral timeout regardless of the peer's connection state, while
one complaint source selects peers specifically for a low connect
rate. Closes now wait for the peer to come online (polled every 10
minutes) and fall back to a unilateral close at low feerates only
after a persisted 3-day patience window. -
Reverse-swap claim corrupted sibling swaps (#325, reported by
Vincenzo Palazzo): the UPDATE persisting a successful Boltz claim
had no WHERE clause, so it stamped every in-flight swap row as
claimed and blocked sibling swaps' claims. Present since 2020;
affected funds were recoverable after the timelock, no theft path.
The update is now scoped to the claimed swap.
Reported issues fixed since v0.16.0:
| Issue | Reported by | Fixed in | Summary |
|---|---|---|---|
| #321 | s373nZ | v0.16.1 | CLN v25.05+ compat: channel_state_changed / newaddr crashes |
| #322 | (internal) | v0.16.2 | FundsMover self-payment claim did not verify the incoming HTLC amount (theft vector) |
| #323 | Moin | v0.16.3 | JitRebalancer concurrent rebalances read a stale fee budget |
| #324 | Moin | v0.16.3 | auto-close force-closed offline peers with a 3-minute timeout |
| #325 | Vincenzo Palazzo | v0.16.3 | reverse-swap claim UPDATE unscoped, corrupting sibling swaps |
Thanks to the reporters. See CHANGELOG.md for details.