Check for preimage before failing back missing HTLCs#1233
Merged
t-bast merged 1 commit intoMar 11, 2025
Conversation
t-bast
reviewed
Mar 5, 2025
t-bast
left a comment
t-bast
left a comment
Collaborator
There was a problem hiding this comment.
Thanks, this is much better!
When an outstanding HTLC is missing from a confirmed commitment, the current recommendation is to fail it back immediately (or after a reorg-safety delay). But if a preimage is available for the HTLC, failing it back is at best going to cause an error (if the HTLC has already been fulfilled upstream) and at worst going to cause loss of funds (if the HTLC has *not* already been fulfilled upstream). Instead, the spec should clearly indicate that upstream HTLCs should be fulfilled when possible and only failed back if a preimage is not available.
morehouse
force-pushed
the
check_preimage_before_failback
branch
from
5dcc39e to
ac35563
Compare
t-bast
approved these changes
Mar 5, 2025
Collaborator
|
@rustyrussell @TheBlueMatt anything to add here? From Morehouse's report, looks like y'all fixed a similar bug in the past. |
Collaborator
|
I went back and checked and it looks like the bug we fixed a while back that @morehouse pointed to was in fact a different but vaguely related bug (marking an outbound, not forwarded, payment as paid and then allowing it to revert to unpaid on restart). I'm not entirely convinced that this spec change would save bugs (and people definitely should be thinking deeper than just blindly implementing the spec!), but certainly don't have any issues with this change. |
19 tasks
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
5 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
When an outstanding HTLC is missing from a confirmed commitment, the current recommendation is to fail it back immediately (or after a reorg-safety delay). But if a preimage is available for the HTLC, failing it back is at best going to cause an error (if the HTLC has already been fulfilled upstream) and at worst going to cause loss of funds (if the HTLC has not already been fulfilled upstream).
Instead, the spec should clearly indicate that upstream HTLCs should be fulfilled when possible and only failed back if a preimage is not available.
Motivated by https://morehouse.github.io/lightning/lnd-excessive-failback-exploit/.