You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Currently, during ChannelAnnouncement, the funding TX is fetched [using get_transaction](https://github.com/nervosnetwork/fiber/blob/develop/crates/fiber-lib/src/ckb/client.rs#L220C4-L227C6).
This approach only checks that the Funding Outpoint was Committed. But a Committed Outpoint does not guarantee availability of the Cell.
bolajahmad
changed the title
use get_live_cell from ckbClient to determine cell liveness
Ignore spent funding cell(s) in channel gossip message
Jun 24, 2026
Result: No reportable security findings in the intended change.
Reviewed range: 3c25bcf16200e5d641dcd9b79f086f391e976172..8562d79ca726099fc2cb0295f10e197241a37196
Validation:
Existing broad tests were not run locally; CI is expected to cover them.
Targeted build validation: cargo check -p fnn --features sqlite fails because crates/fiber-lib/src/fiber/gossip.rs calls is_funding_outpoint_live(...), but that function is not defined in this PR.
cargo check -p fnn --features rocksdb could not reach the PR code in this local environment because RocksDB binding generation failed on a missing local Clang header (stdbool.h).
Notes:
The added live-cell gate is security-positive in intent, but the helper implementation needs to be added (or the call updated) before this can be buildable and fully validated.
I think we can use this new field to improve the existing live cell checking code.
If I understand correctly and based on the fixes I made, the new block_hash field in the response has the same effect as checking if the cell is Some. If anything,I wonder if it's also okay to push this change and follow up with another commit to upgrade to new v5.1.0. If I'm missing something, please let me know!
@bolajahmad we added block_hash to the rpc get_live_cell in ckb 0.208 ( nervosnetwork/ckb#5269 )
I think we can use this new field to improve the existing live cell checking code.
If I understand correctly and based on the fixes I made, the new block_hash field in the response has the same effect as checking if the cell is Some. If anything,I wonder if it's also okay to push this change and follow up with another commit to upgrade to new v5.1.0. If I'm missing something, please let me know!
lgtm 👍
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Closes #530
Description
Currently, during
ChannelAnnouncement, the funding TX is fetched[using get_transaction](https://github.com/nervosnetwork/fiber/blob/develop/crates/fiber-lib/src/ckb/client.rs#L220C4-L227C6).This approach only checks that the
Funding Outpointwas Committed. But a Committed Outpoint does not guarantee availability of the Cell.This PR adds that layer of security.
Tests
cargo fmt --all -- --checkcargo clippy -p fnn --features rocksdb --all-targets -- -D warningsgit diff --cached --check