Disclosure: LND Excessive Failback Exploit

[ariard]

This is hard to follow because it looks like you’re confusing downstream and upstream in several of your paragraphs…I think I got the gist of it though, but I don’t see how it applies to the change you’re referring to.

We do no use downstream or upstream as terminology in BOLT5, so lightning channels are always both directionals at all time, unless you unset the chan for forwarding (e.g with announce_for_forwarding=false in rust-lightning).

For the matter of present analysis, the fact that you can have offerered and received HTLCs pending is an element to consider (e.g a node can inflate the feerate cost of a commitment tx). However, in the present example, yes all the HTLCs are supposed to flow from Mallory to Mallet, so I’m correcting that in the initial post.

@t-bast

The BOLTs change only says that the preimage must be relayed upstream as soon as it’s obtained downstream. At that point we only specify that nodes should correctly extract preimages from downstream and send update_fulfill_htlc upstream. This doesn’t change the requirements of whether the node should force-close upstream (if its update_fulfill_htlc is not acked) or not.

Note as I was pointing out to Morehouse above before the fixes, the problem is antecedent to the BOLTs’s change. The fixes by indicating that the “MUST fulfill the corresponding incoming HTLC” as soon as the preimage is known, without waiting for a final revoke_and_ack of the peer or a local or remote commitment transaction that has reached reasonable depth in the chain.