ACINQ / eclair

A scala implementation of the Lightning Network.
Apache License 2.0
1.24k stars 266 forks source link

Don't send `splice_locked` before `tx_signatures` #2741

Closed t-bast closed 1 year ago

t-bast commented 1 year ago

When reconnecting in the middle of signing a splice, we must ensure that splice_locked is sent after tx_signatures. Otherwise when using 0-conf we may retransmit splice_locked before tx_signatures, which our peer will ignore because they don't have a corresponding fully signed commitment.

This may eventually lead to a mismatch where one side thinks that the splice has been locked and the other doesn't, so one side will send more signatures which results in a force-close.

It should never happen though, because we only send splice_locked once the transaction has been published (zero-conf) or confirmed. Once that happened, we will never retransmit tx_signatures (because we run into that condition), so we'll never mix tx_signatures and splice_locked. But it is more future-proof to make that change, in case we later change our behavior to re-send tx_signatures even if the transaction was already published or confirmed.