Skip to content

HTLC timeout transaction sweep is never run due to integer underflow #7305

Description

@cdecker

Issue and Steps to Reproduce

We (Greenlight) got a number of reports of missing sweeps of HTLC timeout transactions, due to a potential integer underflow issue. The symptoms are as follows:

  1. The node correctly recognizes an HTLC it has added to the channel as requiring a sweep
2024-04-08T21:13:56+02:00 {} stdout: DEBUG   0264a62a4307d701c04a46994ce5f5323b1ca28c80c66b73c631dbcb0990d6e835-onchaind-chan#1: Telling lightningd about OUR_HTLC_TIMEOUT_TX to resolve OUR_UNILATERAL/OUR_HTLC after block 835914 (-65 more blocks)
2024-04-08T21:13:57+02:00 {} stdout: DEBUG   0264a62a4307d701c04a46994ce5f5323b1ca28c80c66b73c631dbcb0990d6e835-onchaind-chan#1: Tracking output 463972904772472b38fa1cc907e5143a5af1a008cb373179c22f4d824d72e11f:4: OUR_UNILATERAL/DELAYED_OUTPUT_TO_US
  1. The next time the HTLC timeout transaction is mentioned it is in this log here
2024-04-08T21:13:57+02:00 {} stdout: DEBUG   0264a62a4307d701c04a46994ce5f5323b1ca28c80c66b73c631dbcb0990d6e835-onchaind-chan#1: billboard: 6 outputs unresolved: in 4294967232 blocks will spend OUR_HTLC (463972904772472b38fa1cc907e5143a5af1a008cb373179c22f4d824d72e11f:2) using OUR_HTLC_TIMEOUT_TX
  1. Notice that the timeout in blocks all of the sudden is (1 - 65) % UINT32_MAX, which is very suspicious.

My intuition is that this is an underflow in the u32 used to plan the execution of the transaction.

getinfo output

Server started with public key 02e5f238372e62540a421b9777f6efd9ea7ae78edb299a0dac74376ce27c5f6e49, alias STRANGEGOPHER-v23.08gl1

Yes, this has some small changes to the way UTXOs are tracked in the DB, but other than that it does not have any modification from the CLN in this repository.

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type::BugAn error, flaw, or fault that produces an incorrect or unexpected result

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions