Skip to content

multi: improve resolution lifecycle safety - #11054

Open
yyforyongyu wants to merge 14 commits into
lightningnetwork:masterfrom
yyforyongyu:contractcourt-resolution-safety
Open

multi: improve resolution lifecycle safety#11054
yyforyongyu wants to merge 14 commits into
lightningnetwork:masterfrom
yyforyongyu:contractcourt-resolution-safety

Conversation

@yyforyongyu

Copy link
Copy Markdown
Member

Summary

Improve safety across contract resolution lifecycles.

Change Description

  • Strengthen contract and sweep resolution state handling.
  • Add focused regression coverage for recovery paths.

@github-actions github-actions Bot added the severity-critical Requires expert review - security/consensus critical label Aug 10, 2026
@github-actions

Copy link
Copy Markdown

🔴 PR Severity: CRITICAL

gh pr view | 21 files | 1265 lines changed

🔴 Critical (10 files)
  • contractcourt/breach_arbitrator.go - breach handling / on-chain dispute resolution logic
  • contractcourt/commit_sweep_resolver.go - commitment output sweep resolution state machine
  • contractcourt/contract_resolver.go - core contract resolver interface/state
  • contractcourt/htlc_outgoing_contest_resolver.go - HTLC contest resolution logic
  • contractcourt/htlc_success_resolver.go - HTLC success resolution logic
  • contractcourt/htlc_timeout_resolver.go - HTLC timeout resolution logic (largest diff, 144 lines)
  • server.go - core server coordination
  • sweep/fee_bumper.go - fee-bumping for fund recovery sweeps
  • sweep/sweeper.go - output sweeping engine
  • sweep/test_utils.go - sweep package test scaffolding (non-_test.go, still counted)
🟠 High (1 file)
  • chainntnfs/spend.go - new spend-notification helper (new file)

Analysis

This PR touches multiple contractcourt/* resolvers (breach, commit-sweep, HTLC success/timeout/outgoing-contest) together with sweep/* (fee bumper, sweeper) and server.go. Each of these packages individually maps to CRITICAL (on-chain dispute resolution / fund recovery / core server coordination), and the change spans several of them at once, touching commitment/HTLC resolution state transitions and sweep fee-bumping logic — exactly the kind of cross-cutting, safety-sensitive change that needs expert review. Non-test/non-generated lines changed are ~684, which alone would trigger a one-level bump, but the base classification is already at the highest tier. The PR also adds substantial regression test coverage (*_test.go files, chainntnfs/spend_test.go) for the affected recovery paths, which is a good sign but does not reduce the review bar given the sensitivity of the production code touched.


To override, add a severity-override-{critical,high,medium,low} label.

@yyforyongyu
yyforyongyu force-pushed the contractcourt-resolution-safety branch from 34933ca to 7c564ec Compare August 11, 2026 12:02
@saubyk saubyk added this to v0.21 Aug 13, 2026
@saubyk saubyk moved this to In progress in v0.21 Aug 13, 2026
@saubyk saubyk added this to the v0.21.3 milestone Aug 13, 2026
Add an explicit transaction matching mode while preserving the filter
hint used by notifier backends. Keep requests indexed and clean up
registrations when setup cannot finish.
Add one validated policy for confirmation requirements and height
classification. Cover invalid depths and finality boundaries with
focused tests.
Validate spend candidates through confirmation notifications at every
configured depth. Preserve filter hints, inclusion details, causal
errors, and bounded cancellation.
Exercise replacement, reorg, shutdown, and validation transitions with
direct waiter calls and deterministic barriers. Verify matching inputs
and authoritative inclusion state.
Route shared resolver spend waits through the stable-spend API while
preserving existing one-confirmation behavior. Update legacy notifier
fixtures to model that policy explicitly.
Apply the configured spend finality policy to success-resolver
transitions through the shared resolver kit. Keep unrelated fixtures at
one confirmation.
Keep mempool observation active while requiring a stable block spend for
terminal timeout resolution. Add a standalone replacement regression
with direct resolver assertions.
Resolve outgoing contests only after the observed spend reaches the
configured finality policy. Keep resolver calls and terminal result
assertions visible in the regression.
Classify spends with the shared finality policy and reject invalid
publisher configuration. Preserve the last broadcast transaction when a
candidate cannot be accepted.
Delay monitored input delivery until the shared finality policy is met.
Extend notifier fixtures and cover removal followed by a stable
replacement.
Require stable spend results before advancing breach output recovery.
Preserve configured depth selection and verify removed candidates do not
alter persisted recovery state.
Give each breach spend attempt one cancellation and join path. Ensure
partial worker sets are released before shutdown or validation errors
return.
Retry transient breach spend registration failures with a bounded delay
while preserving terminal shutdown and validation errors. Cover
cancellation across consecutive attempts.
Document the contract resolution lifecycle hardening included in this
release.
@yyforyongyu
yyforyongyu force-pushed the contractcourt-resolution-safety branch from 7c564ec to 6e0fff8 Compare August 15, 2026 10:41
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

severity-critical Requires expert review - security/consensus critical

Projects

Status: In progress

Development

Successfully merging this pull request may close these issues.

2 participants