Prevent HTLC double-forwards, prune forwarded onions #4303

valentinewallace · 2026-01-06T22:02:32Z

Fixes two bugs where we would otherwise double-forward an HTLC
Prunes inbound HTLC onions once they are irrevocably forwarded (#4227 Followups #4280)
Prepares for LDK 0.5 where we can stop persisting legacy ChannelManager forward maps and fully reconstruct them from Channel data. See the follow-up tagged 0.5: (0.5) Deprecate legacy pending HTLC ChannelManager persistence #4359

Closes #4280, partially addresses #4286

~~Based on #4289~~

Reconstruct pending HTLC set from Channels in prod based on the serialized manager version Fix double-forward, prefer legacy forward maps #4289 (comment)
Fix double-forward if outbound HTLC is in holding cell (#4227 Followups #4280 (comment))

ldk-reviews-bot · 2026-01-06T22:02:35Z

👋 Thanks for assigning @joostjager as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

codecov · 2026-01-06T23:43:32Z

Codecov Report

❌ Patch coverage is 76.17188% with 61 lines in your changes missing coverage. Please review.
✅ Project coverage is 86.08%. Comparing base (114f6b5) to head (fce5071).
⚠️ Report is 16 commits behind head on main.

Files with missing lines	Patch %	Lines
lightning/src/ln/channelmanager.rs	67.09%	45 Missing and 6 partials ⚠️
lightning/src/ln/channel.rs	92.68%	5 Missing and 1 partial ⚠️
lightning/src/util/ser.rs	40.00%	0 Missing and 3 partials ⚠️
lightning/src/ln/functional_test_utils.rs	92.85%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4303      +/-   ##
==========================================
- Coverage   86.10%   86.08%   -0.02%     
==========================================
  Files         156      156              
  Lines      102610   102815     +205     
  Branches   102610   102815     +205     
==========================================
+ Hits        88354    88511     +157     
- Misses      11762    11807      +45     
- Partials     2494     2497       +3

Flag	Coverage Δ
tests	`86.08% <76.17%> (-0.02%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

lightning/src/ln/channel.rs

valentinewallace · 2026-01-14T17:19:52Z

Pushed a rebase on main due to #4289 landing

We recently added support for reconstructing ChannelManager::decode_update_add_htlcs on startup, using data present in the Channels. However, we failed to prune HTLCs from this rebuilt map if a given inbound HTLC was already forwarded to the outbound edge and in the outbound holding cell. Here we fix this bug that would have caused us to double-forward inbound HTLC forwards, which fortunately never shipped. Co-Authored-By: Claude Opus 4.5 <[email protected]>

We recently added support for reconstructing ChannelManager::decode_update_add_htlcs on startup, using data present in the Channels. However, we failed to prune HTLCs from this rebuilt map if a given HTLC was already forwarded+removed from the outbound edge and resolved in the inbound edge's holding cell. Here we fix this bug that would have caused us to double-forward inbound HTLC forwards, which fortunately was not shipped. Co-Authored-By: Claude Opus 4.5 <[email protected]>

In 0.3+, we are taking steps to remove the requirement of regularly persisting the ChannelManager and instead rebuild the set of HTLC forwards (and the manager generally) from Channel{Monitor} data. We previously merged support for reconstructing the ChannelManager::decode_update_add_htlcs map from channel data, using a new HTLC onion field that will be present for inbound HTLCs received on 0.3+ only. However, we now want to add support for pruning this field once it's no longer needed so it doesn't get persisted every time the manager gets persisted. At the same time, in a future LDK version we need to detect whether the field was ever present to begin with to prevent upgrading with legacy HTLCs present. We accomplish both by converting the plain update_add option that was previously serialized to an enum that indicates whether the HTLC is from 0.2- versus 0.3+-with-onion-pruned. Actual pruning of the new update_add field is added in the next commit.

We store inbound committed HTLCs' onions in Channels for use in reconstructing the pending HTLC set on ChannelManager read. If an HTLC has been irrevocably forwarded to the outbound edge, we no longer need to persist the inbound edge's onion and can prune it here.

In the last commit, we added support for pruning an inbound HTLC's persisted onion once the HTLC has been irrevocably forwarded to the outbound edge. Here, we add a check on startup that those inbound HTLCs were actually handled. Specifically, we check that the inbound HTLC is either (a) currently present in the outbound edge or (b) was removed via claim. If neither of those are true, we infer that the HTLC was removed from the outbound edge via fail and fail the inbound HTLC backwards. Tests for this code are added in a follow-up PR that will be merged in 0.5. We can't test this code right now because of reconstruct_manager_from_monitors logic is needed, and whether it runs during tests is chosen randomly.

In 0.3+, we are taking steps to remove the requirement of regularly persisting the ChannelManager and instead rebuild the set of HTLC forwards (and the manager generally) from Channel{Monitor} data. We previously merged support for reconstructing the ChannelManager::decode_update_add_htlcs map from channel data, using a new HTLC onion field that will be present for inbound HTLCs received on 0.3+ only. The plan is that in upcoming LDK versions, the manager will reconstruct this map and the other forward/claimable/pending HTLC maps will automatically repopulate themselves on the next call to process_pending_htlc_forwards. As such, once we're in a future version that reconstructs the pending HTLC set, we can stop persisting the legacy ChannelManager maps such as forward_htlcs, pending_intercepted_htlcs since they will never be used. For 0.3 to be compatible with this future version, in this commit we detect that the manager was last written on a version of LDK that doesn't persist the legacy maps. In that case, we don't try to read the old forwards map and run the new reconstruction logic only.

joostjager · 2026-01-29T18:22:22Z

Haven't reviewed yet, but the following question came up: in the previous pr and in this pr, double-forward bugs are fixed. Couldn't the fuzzer detect this?

joostjager

The logic in this PR is quite complex, with multiple interacting state machines (inbound HTLC state, outbound HTLC state, holding cells, monitor updates) that need to stay consistent across restarts. The fact that multiple double-forward bugs were discovered during development suggests the state space is large enough that targeted unit tests may not provide sufficient coverage.

I keep wondering if the existing fuzzer can exercise these restart scenarios with in-flight HTLCs at various stages. The current strategy of adding a specific regression test might be too reactive?

joostjager · 2026-01-30T10:20:02Z

lightning/src/ln/channel.rs

+	WithOnion { update_add_htlc: msgs::UpdateAddHTLC },
+	/// This inbound HTLC is a forward that was irrevocably committed to the outbound edge, allowing
+	/// its onion to be pruned and no longer persisted.
+	Forwarded {


I think this commit could've been split in two. First introducing the enum with WithOnion and Legacy, and then adding Forwarded

It would introduce a lot of intermediary changes in the channel.rs tests, where InboundHTLCStates are created. I'd like to use ::Forwarded for them by the end of the PR since the ::Legacy variant is removed in the 0.5 PR. Do you still want this?

joostjager · 2026-01-30T10:26:46Z

lightning/src/ln/channel.rs

 /// Useful for reconstructing the pending HTLC set on startup.
-#[derive(Debug)]
-enum InboundUpdateAdd {
+#[derive(Debug, Clone)]


Tests for this code are added in a follow-up PR that will be merged in 0.5. We
can't test this code right now because of reconstruct_manager_from_monitors
logic is needed, and whether it runs during tests is chosen randomly.

We talked about this before, but reading this again, I keep wondering if you can't add a deterministic control lever for reconstruct_manager_from_monitors so that you can already test the code without waiting for 0.5?

ACK on a cfg flag?

joostjager · 2026-01-30T10:28:02Z

lightning/src/ln/channelmanager.rs

+//
+// If 0.3 or 0.4 reads this manager version, it knows that the legacy maps were not written and
+// acts accordingly.
+const RECONSTRUCT_HTLCS_FROM_CHANS_VERSION: u8 = 2;


Didn't you want to make this version 10, to be able to insert other upgrades in between?

joostjager · 2026-01-30T10:31:37Z

lightning/src/ln/channel.rs

+		// We don't want to return an HTLC as needing processing if it already has a resolution that's
+		// pending in the holding cell.
+		let htlc_resolution_in_holding_cell = |id: u64| -> bool {
+			self.context.holding_cell_htlc_updates.iter().any(|holding_cell_htlc| {


The htlc_resolution_in_holding_cell closure iterates the holding cell for each HTLC. Is it worth putting it in a set?

I don't think it's worth an allocation, given the per-channel htlc limits, but no preference here.

joostjager · 2026-01-30T10:36:55Z

lightning/src/ln/channel.rs

+	Forwarded {
+		/// Useful if we need to fail or claim this HTLC backwards after restart, if it's missing in the
+		/// outbound edge.
+		hop_data: HTLCPreviousHopData,


I think there is some data in here that is redundant with InboundHTLCOutput. Not sure if we care

I'm not sure either. @TheBlueMatt any opinion? This is the simplest way so I might save the dedup for followup.

Hmm, yea, would still be quite nice to reduce size here but its alright to do it in a followup (just has to happen in 0.3!)

joostjager · 2026-01-30T10:38:18Z

lightning/src/ln/channelmanager.rs

+					mem::take(&mut already_forwarded_htlcs).drain(..)
+				{
+					if hash != payment_hash {
+						already_forwarded_htlcs.push((hash, hop_data, outbound_amt_msat));


Is there a different way to do this other than drain and push back again? Maybe filter or retain or something?

I tried retain at first, but with filter/retain we can't take-by-value and have to clone the hop_data 🤔

joostjager · 2026-01-30T10:40:07Z

lightning/src/ln/channel.rs

+	pub(super) fn prune_inbound_htlc_onion(
+		&mut self, htlc_id: u64, hop_data: HTLCPreviousHopData, outbound_amt_msat: u64,
+	) {
+		for htlc in self.context.pending_inbound_htlcs.iter_mut() {


Log or assert if not found?

joostjager · 2026-01-30T10:41:07Z

lightning/src/ln/channelmanager.rs

+		if (decode_update_add_htlcs_legacy.is_some() || pending_intercepted_htlcs_legacy.is_some())
+			&& ver >= RECONSTRUCT_HTLCS_FROM_CHANS_VERSION
+		{
+			return Err(DecodeError::InvalidValue);


Maybe log this specific case too?

TheBlueMatt · 2026-01-30T21:14:15Z

lightning/src/ln/channel.rs

 	pub failed_htlcs: Vec<(HTLCSource, PaymentHash, HTLCFailReason)>,
 	pub finalized_claimed_htlcs: Vec<(HTLCSource, Option<AttributionData>)>,
+	// Inbound update_adds that are now irrevocably committed to this channel and are ready for the
+	// onion to be processed in order to forward or receive the HTLC.


docs not comments, also above and below.

TheBlueMatt · 2026-01-30T21:35:52Z

lightning/src/ln/channelmanager.rs

 					let peer_state = &mut *peer_state_lock;
 					is_channel_closed = !peer_state.channel_by_id.contains_key(channel_id);
+					if reconstruct_manager_from_monitors {
+						if let Some(chan) = peer_state.channel_by_id.get(channel_id) {


Rather than adding additional logic to examine the holding cell explicitly, I think we should fix the bug by addressing the original underlying confusion - HTLCs for channels still open are "owned" by the channel, not the monitor. Looking at the monitor results in us missing some HTLCs. IMO the code here would be a good bit cleaner if we only looked at monitors for closed channels and for open channels only looked at the channel (which would need a method to list all HTLCs, including the holding cell ones).

TheBlueMatt · 2026-01-30T21:55:18Z

lightning/src/ln/channel.rs

 		let mut pending_update_adds = Vec::new();
 		mem::swap(&mut pending_update_adds, &mut self.context.monitor_pending_update_adds);
+		let committed_outbound_htlc_sources = self.context.pending_outbound_htlcs.iter().filter_map(|htlc| {
+			if let &OutboundHTLCState::Committed = &htlc.state {


Doesn't this mean we're constantly calling back into the previous channel to remove the onion as long as the HTLC is pending? We should probably filter this at least somewhat. Luckily I think its as simple as changing this to checking for LocalAnnounced not Committed. The docs for that say "Added by us and included in a commitment_signed (if we were AwaitingRemoteRevoke when we created it we would have put it in the holding cell instead)." ie finishing all pending monitor updates implies that we've included the HTLC in the monitor (and are now sending the commitment_signed).

TheBlueMatt · 2026-01-30T21:55:57Z

lightning/src/ln/channel.rs

+	Forwarded {
+		/// Useful if we need to fail or claim this HTLC backwards after restart, if it's missing in the
+		/// outbound edge.
+		hop_data: HTLCPreviousHopData,


Hmm, yea, would still be quite nice to reduce size here but its alright to do it in a followup (just has to happen in 0.3!)

valentinewallace added this to the 0.3 milestone Jan 6, 2026

valentinewallace mentioned this pull request Jan 6, 2026

Reconstruct ChannelManager forwarded HTLCs maps from Channels #4227

Merged

3 tasks

valentinewallace force-pushed the 2025-12-reconstruct-fwds-followup-2 branch from 01aa4c0 to 4012864 Compare January 7, 2026 21:50

valentinewallace self-assigned this Jan 8, 2026

valentinewallace added this to Weekly Goals Jan 8, 2026

valentinewallace added the weekly goal Someone wants to land this this week label Jan 8, 2026

valentinewallace force-pushed the 2025-12-reconstruct-fwds-followup-2 branch from 4012864 to e2ea1ed Compare January 8, 2026 21:16

valentinewallace marked this pull request as ready for review January 8, 2026 21:16

ldk-reviews-bot requested a review from wpaulino January 8, 2026 21:16

valentinewallace removed the request for review from wpaulino January 8, 2026 21:16

TheBlueMatt reviewed Jan 11, 2026

View reviewed changes

lightning/src/ln/channel.rs Show resolved Hide resolved

valentinewallace force-pushed the 2025-12-reconstruct-fwds-followup-2 branch from e2ea1ed to c40741b Compare January 14, 2026 17:19

valentinewallace mentioned this pull request Jan 15, 2026

Stale ChannelManager causes channel force-closures #4286

Open

16 tasks

valentinewallace and others added 3 commits January 29, 2026 11:05

Trivial: document some fields on MonitorRestoreUpdates

25d40c8

valentinewallace force-pushed the 2025-12-reconstruct-fwds-followup-2 branch from c40741b to 3f0f811 Compare January 29, 2026 16:09

valentinewallace changed the title ~~Follow-ups to #4227 (Part 2)~~ Prevent HTLC double-forwards, prune forwarded onions Jan 29, 2026

valentinewallace added 4 commits January 29, 2026 11:26

valentinewallace force-pushed the 2025-12-reconstruct-fwds-followup-2 branch from 3f0f811 to fce5071 Compare January 29, 2026 16:27

valentinewallace requested review from TheBlueMatt and joostjager January 29, 2026 16:28

valentinewallace mentioned this pull request Jan 29, 2026

Split ChannelManager::read into two stages #4332

Open

valentinewallace mentioned this pull request Jan 29, 2026

(0.5) Deprecate legacy pending HTLC ChannelManager persistence #4359

Draft

3 tasks

joostjager reviewed Jan 30, 2026

View reviewed changes

TheBlueMatt reviewed Jan 30, 2026

View reviewed changes

Prevent HTLC double-forwards, prune forwarded onions #4303

Are you sure you want to change the base?

Prevent HTLC double-forwards, prune forwarded onions #4303

Conversation

valentinewallace commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

ldk-reviews-bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

codecov bot commented Jan 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

Uh oh!

valentinewallace commented Jan 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

joostjager commented Jan 29, 2026

Uh oh!

joostjager left a comment

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

valentinewallace commented Jan 6, 2026 •

edited

Loading

ldk-reviews-bot commented Jan 6, 2026 •

edited

Loading

codecov bot commented Jan 6, 2026 •

edited

Loading

valentinewallace commented Jan 14, 2026 •

edited

Loading