ElementsProject / ElementsProject/lightning
Failure to reject absurdly high channel reserves
- Dominant language
- C
- Stars
- 3.1k
- Forks
- 1k
- Avg merge
- 4d 10h
- Merged PRs (30d)
- 13
Description
BOLT 2 has one [required](https://github.com/lightning/bolts/blob/152897261850d93c4f4597f39cf22d7d22d6ede6/02-peer-protocol.md?plain=1#L872) and one [suggested](https://github.com/lightning/bolts/blob/152897261850d93c4f4597f39cf22d7d22d6ede6/02-peer-protocol.md?plain=1#L853) check that provide an upper limit on the channel reserve imposed by the counterparty:
1. ```
The receiving node MUST fail the channel if:
- both `to_local` and `to_remote` amounts for the initial commitment transaction are less than or equal to `channel_reserve_satoshis`
```
2. ```
The receiving node MAY fail the channel if:
- it considers `channel_reserve_satoshis` too large.
```
CLN implements neither.
### Impact
CLN will accept a channel reserve larger than its own initial balance, leaving it unable to send anything on the channel until the funder chooses to push more funds to it. For example, CLN accepts the following channel parameters:
```
funding_satoshis = 100_000
push_msat = 20_000_000
feerate_per_kw = 500
channel_reserve_satoshis = 87_000
channel_type = anchors
```
The balances on the initial commitment transaction after fees are:
```
to_local (funder) = 78_778 sat
to_remote (CLN) = 20_000 sat
```
Both sides are below the reserve, so CLN cannot spend until it has received a further sats, and the funder is under no obligation to ever send it. CLN's balance is still recoverable on-chain by closing the channel.
One thing to note is that CLN does impose the aggregate reserve check on the funding amount: https://github.com/ElementsProject/lightning/blob/c1551c557cc524e2241f9cbae7d3895b1b0b627c/openingd/common.c#L126-L144 This rejects cases where aggregate reserve/fee exceeds the channel capacity, but misses cases where the capacity covers the fee and reserve, yet after pushing some amount to the peer, both balances fall below the reserve.
### Suggested fix
Add a check for requirement 1 above, as mandated by the spec.
Also add a cap on the channel reserve imposed by the counterparty. For reference, [LND](https://github.com/lightningnetwork/lnd/blob/90ea05d5a7f9239ede8eb4e2f36d9a66c39e67d5/lnwallet/reservation.go#L972-L978) caps at 20% of capacity and [Eclair](https://github.com/ACINQ/eclair/blob/0c4ddc4d3b98417f98033c31faa942732e48abb2/eclair-core/src/main/resources/reference.conf#L137) caps at 5%.
### Discovery
The missing specification check was detected while fuzzing with [smite](https://github.com/lnfuzz/smite).
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.