Skip to content

Fix wallet UTXO reuse for funding transactions and onchain spends - #1037

Open
tnull wants to merge 3 commits into
lightningdevkit:mainfrom
tnull:2026-08-fix-wallet-utxo-reuse
Open

Fix wallet UTXO reuse for funding transactions and onchain spends#1037
tnull wants to merge 3 commits into
lightningdevkit:mainfrom
tnull:2026-08-fix-wallet-utxo-reuse

Conversation

@tnull

@tnull tnull commented Aug 10, 2026

Copy link
Copy Markdown
Collaborator

Fixes #41.

For the longest time BDK didn't offer any UTXO locking mechanisms and only considered transactions canonical once seen in the mempool during syncing. This always left a gap between the time of transaction signing/broadcast and the time of sync during which the wallet could double-spend itself. Since bdk_wallet v3.0 they finally offer UTXO locking APIs which we finally use here to close this gap for funding transactions and onchain spends.

Note: We intentionally leave splicing transactions out-of-scope of this PR because with #962 and #930 there are related PRs inflight. Depending on the order these land, this PR or they need to be updated to marry the two approaches. (cc @jkczyz)

@tnull tnull added this to the 0.8 milestone Aug 10, 2026
@tnull
tnull requested a review from wpaulino August 10, 2026 12:41
@ldk-reviews-bot

ldk-reviews-bot commented Aug 10, 2026

Copy link
Copy Markdown

👋 Thanks for assigning @jkczyz as a reviewer!
I'll wait for their review and will help manage the review process.
Once they submit their review, I'll check if a second reviewer would be helpful.

@tnull
tnull force-pushed the 2026-08-fix-wallet-utxo-reuse branch from 5385ef8 to 2932580 Compare August 10, 2026 14:03
@tnull
tnull marked this pull request as draft August 10, 2026 14:12
@tnull

tnull commented Aug 10, 2026

Copy link
Copy Markdown
Collaborator Author

Drafting this for now as it might make sense to wait for #962 to land first, and then rebase this.

@tnull
tnull force-pushed the 2026-08-fix-wallet-utxo-reuse branch from 2932580 to 61b7adf Compare August 12, 2026 09:51
@tnull
tnull marked this pull request as ready for review August 12, 2026 09:52
@tnull

tnull commented Aug 12, 2026

Copy link
Copy Markdown
Collaborator Author

Rebased to resolve minor conflicts. Should be good for review now that #962 landed.

@wpaulino @jkczyz Do you think we should also cover UTXO locking for splices in this PR, or would that be the concern of #930?

@jkczyz

jkczyz commented Aug 12, 2026

Copy link
Copy Markdown
Contributor

Rebased to resolve minor conflicts. Should be good for review now that #962 landed.

@wpaulino @jkczyz Do you think we should also cover UTXO locking for splices in this PR, or would that be the concern of #930?

I'd say either here or in a dedicated PR. It can be done independent of #930, which is already pretty big. That touches SpliceNegotiationFailed handling, but for unlocking we only need to touch DiscardFunding handling. The bigger change is using our own CoinSelectionSource for locking rather than relying on LdkWallet, IIUC.

tnull added 3 commits August 13, 2026 11:02
Record wallet transactions before broadcast and reserve funding inputs
until their transactions are durable. This prevents concurrent
operations from selecting the same inputs. Dropped transactions remain
recoverable through the existing rebroadcast path.

Co-Authored-By: HAL 9000
Locally inserted transactions can be newer than Bitcoin Core's latest
mempool timestamp. Reporting that stale timestamp for an eviction makes
BDK ignore it and leaves the transaction's inputs unavailable.

Use the later of the local observation time and Bitcoin Core's mempool
time. This makes local transactions evictable without regressing nodes
whose Bitcoin Core clock is ahead of the application clock.

Co-Authored-By: HAL 9000
Reserve wallet inputs as soon as splice coin selection returns so
concurrent wallet operations cannot reuse them before the funding
transaction reaches the wallet. Release discarded contributions so
failed or superseded splice rounds do not strand funds.

Co-Authored-By: HAL 9000
@tnull
tnull force-pushed the 2026-08-fix-wallet-utxo-reuse branch from 61b7adf to 4e7409c Compare August 13, 2026 10:46
@tnull

tnull commented Aug 13, 2026

Copy link
Copy Markdown
Collaborator Author

Rebased to resolve minor conflicts. Should be good for review now that #962 landed.
@wpaulino @jkczyz Do you think we should also cover UTXO locking for splices in this PR, or would that be the concern of #930?

I'd say either here or in a dedicated PR. It can be done independent of #930, which is already pretty big. That touches SpliceNegotiationFailed handling, but for unlocking we only need to touch DiscardFunding handling. The bigger change is using our own CoinSelectionSource for locking rather than relying on LdkWallet, IIUC.

Now added a commit here, let me know what you think

@tnull
tnull requested a review from jkczyz August 13, 2026 10:49
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Don't double-spend ourselves on sequential channel opens

3 participants