Skip to content

Drive splices to completion in chanmon_consistency#4411

Merged
TheBlueMatt merged 7 commits intolightningdevkit:mainfrom
wpaulino:splice-fuzzing-fixes
Feb 18, 2026
Merged

Drive splices to completion in chanmon_consistency#4411
TheBlueMatt merged 7 commits intolightningdevkit:mainfrom
wpaulino:splice-fuzzing-fixes

Conversation

@wpaulino
Copy link
Contributor

There were two bugs preventing splices from negotiating up to the
`tx_signatures` exchange:

1. A `serial_id` collision because its generation used the first 4 bytes
   of `get_secure_random_bytes`.
2. Opcodes 0xa2 and 0xa3 used the wrong vout for the input to splice in.

This commit fixes both, while also adding support for locking splices.
This required confirming transactions, which this target previously
didn't consider.

This PR also includes support for fuzzing async signing (though not during initial channel open) and a few miscellaneous fixes as a result of #4367.

After running the fuzzer for a bit with these changes, a few bugs were discovered that will be addressed separately.

@wpaulino wpaulino added this to the 0.3 milestone Feb 12, 2026
@wpaulino wpaulino requested a review from TheBlueMatt February 12, 2026 00:54
@wpaulino wpaulino self-assigned this Feb 12, 2026
@ldk-reviews-bot
Copy link

ldk-reviews-bot commented Feb 12, 2026

👋 Thanks for assigning @TheBlueMatt as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

Copy link
Collaborator

@TheBlueMatt TheBlueMatt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

otherwise lgtm

@ldk-reviews-bot
Copy link

👋 The first review has been submitted!

Do you think this PR is ready for a second reviewer? If so, click here to assign a second reviewer.

@codecov
Copy link

codecov bot commented Feb 12, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 85.89%. Comparing base (d09f1d2) to head (ff39dff).
⚠️ Report is 11 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #4411      +/-   ##
==========================================
- Coverage   85.91%   85.89%   -0.02%     
==========================================
  Files         156      156              
  Lines      103958   103933      -25     
  Branches   103958   103933      -25     
==========================================
- Hits        89317    89277      -40     
- Misses      12122    12137      +15     
  Partials     2519     2519              
Flag Coverage Δ
tests 85.89% <ø> (-0.02%) ⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@wpaulino wpaulino force-pushed the splice-fuzzing-fixes branch 2 times, most recently from f6403f8 to a10750d Compare February 17, 2026 17:29
@wpaulino wpaulino requested a review from TheBlueMatt February 17, 2026 17:29
Copy link
Collaborator

@TheBlueMatt TheBlueMatt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Needs rebase.

This commit adds new opcodes to enable/disable signer operations one by
one. Note that this only covers signer operations post-funding.
This commit adds support for locking splices. This required confirming
transactions, which this target previously didn't consider.

It also fixes a `serial_id` collision, due to its generation using
the first 4 bytes of `get_secure_random_bytes`, that was preventing
splices from negotiating up to the `tx_signatures` exchange.
The `short_channel_id` is no longer guaranteed to be stable with
splicing now that the fuzzer can actually lock splices.
Even though we don't explicitly send probes, because probes are detected
based on hashing the payment hash+preimage, it's rather trivial for the
fuzzer to build payments that accidentally end up looking like probes.
@wpaulino wpaulino force-pushed the splice-fuzzing-fixes branch from a10750d to 0c8b9f3 Compare February 18, 2026 18:34
This requires calling `timer_tick_occurred`. As a result, when
`timer_tick_occurred` is called, disabled/enabled updates and
`WarnAndDisconnect` events may be triggered.
This regressed at some point, making the logs harder to parse on a
failed test run.
@wpaulino wpaulino force-pushed the splice-fuzzing-fixes branch from 0c8b9f3 to ff39dff Compare February 18, 2026 18:44
Copy link
Collaborator

@TheBlueMatt TheBlueMatt left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

thanks one comment for a followup, if you want.

keys_manager_a.enable_op_for_all_signers(SignerOp::GetPerCommitmentPoint);
nodes[0].signer_unblocked(None);
},
0xc7 => {
Copy link
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Wait, can we split the signer-enable bit for node B by the peer? That way we can have its channels with node A and node B in different states which may be useful.

@TheBlueMatt TheBlueMatt merged commit d627ce1 into lightningdevkit:main Feb 18, 2026
16 of 17 checks passed
@wpaulino wpaulino deleted the splice-fuzzing-fixes branch February 18, 2026 22:58
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

Status: Done

Development

Successfully merging this pull request may close these issues.

3 participants

Comments