Reject splicing a channel with a splice inherited from a prior LDK version

A pending splice negotiated before an upgrade from a prior LDK version
(e.g. 0.2) returns without its feerate or our contribution: 0.2 persists
neither and drops the odd TLVs that carry them. splice_channel derives the
RBF feerate floor from the prior splice's feerate and assumed it was always
present via a debug assertion, so attempting to splice such a channel
tripped that assertion.

Return a clean error instead, refusing to splice a channel whose pending
splice lacks the metadata to reconstruct the prior request.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: jkczyz

lightning-tests/src/upgrade_downgrade_tests.rs

@@ -61,6 +61,7 @@ use lightning::ln::splicing_tests::*;
 use lightning::ln::types::ChannelId;
 use lightning::onion_message::packet::Packet;
 use lightning::sign::OutputSpender;
+use lightning::util::errors::APIError;
 use lightning::util::ser::{MaybeReadable, Writeable};
 use lightning::util::wallet_utils::WalletSourceSync;
 
@@ -1016,4 +1017,88 @@ fn upgrade_single_splice_from_0_2() {
 		assert_eq!(splice.candidates.len(), 1);
 		assert_eq!(splice.candidates[0].contribution, None);
 	}
+
+	// The splice cannot be RBF'd: 0.2 persisted no feerate, so splice_channel refuses it.
+	let node_id_1 = nodes[1].node.get_our_node_id();
+	let err = nodes[0].node.splice_channel(&channel_id, &node_id_1).unwrap_err();
+	let expected = format!(
+		"Channel {} has a pending splice from a prior LDK version and cannot be spliced again",
+		channel_id,
+	);
+	match err {
+		APIError::APIMisuseError { err } => assert_eq!(err, expected),
+		_ => panic!("unexpected error: {:?}", err),
+	}
+}
+
+#[test]
+fn splice_inherited_across_0_2_cannot_be_rbfed() {
+	// Negotiate a contributory splice on current, downgrade to LDK 0.2, then upgrade back. LDK 0.2
+	// persists neither our contribution nor the splice feerate and does not retain the odd TLVs that
+	// carry them, so the splice returns to current without either. `splice_channel` needs the prior
+	// feerate to derive the RBF floor, so it refuses such a channel with a clean error rather than
+	// operating on incomplete state (which would otherwise trip a debug assertion that a pending
+	// splice always has a known feerate).
+	let chan_id_bytes;
+	let (v3_mgr, v3_mon);
+	{
+		let chanmon_cfgs = create_chanmon_cfgs(2);
+		let node_cfgs = create_node_cfgs(2, &chanmon_cfgs);
+		let node_chanmgrs = create_node_chanmgrs(2, &node_cfgs, &[None, None]);
+		let nodes = create_network(2, &node_cfgs, &node_chanmgrs);
+		let (_, _, channel_id, _) =
+			create_announced_chan_between_nodes_with_value(&nodes, 0, 1, 100_000, 0);
+		chan_id_bytes = channel_id.0;
+
+		let added_value = Amount::from_sat(50_000);
+		provide_utxo_reserves(&nodes, 2, added_value * 2);
+		let contribution = do_initiate_splice_in(&nodes[0], &nodes[1], channel_id, added_value);
+		let (splice_tx, _) = splice_channel(&nodes[0], &nodes[1], channel_id, contribution);
+		mine_transaction(&nodes[0], &splice_tx);
+		mine_transaction(&nodes[1], &splice_tx);
+
+		v3_mgr = nodes[0].node.encode();
+		v3_mon = get_monitor!(nodes[0], channel_id).encode();
+	}
+
+	// Downgrade node 0 to LDK 0.2 and re-serialize there, stripping the contribution and feerate.
+	let (v2_mgr, v2_mon);
+	{
+		let mut chanmon_cfgs = lightning_0_2_utils::create_chanmon_cfgs(2);
+		chanmon_cfgs[0].keys_manager.disable_all_state_policy_checks = true;
+		chanmon_cfgs[1].keys_manager.disable_all_state_policy_checks = true;
+		let node_cfgs = lightning_0_2_utils::create_node_cfgs(2, &chanmon_cfgs);
+		let node_chanmgrs = lightning_0_2_utils::create_node_chanmgrs(2, &node_cfgs, &[None, None]);
+		let nodes = lightning_0_2_utils::create_network(2, &node_cfgs, &node_chanmgrs);
+		let mut config = lightning_0_2_utils::test_default_channel_config();
+		config.channel_handshake_config.negotiate_anchors_zero_fee_htlc_tx = true;
+		let mgr = lightning_0_2_utils::_reload_node(&nodes[0], config, &v3_mgr, &[&v3_mon[..]]);
+		assert_eq!(mgr.list_channels().len(), 1);
+		let v2_channel_id = lightning_0_2::ln::types::ChannelId(chan_id_bytes);
+		v2_mgr = mgr.encode();
+		v2_mon = get_monitor_0_2!(nodes[0], v2_channel_id).encode();
+	}
+
+	// Upgrade back to current and attempt to RBF the inherited splice.
+	let mut chanmon_cfgs = create_chanmon_cfgs(2);
+	chanmon_cfgs[0].keys_manager.disable_all_state_policy_checks = true;
+	chanmon_cfgs[1].keys_manager.disable_all_state_policy_checks = true;
+	let node_cfgs = create_node_cfgs(2, &chanmon_cfgs);
+	let (persister, chain_mon, new_node);
+	let node_chanmgrs = create_node_chanmgrs(2, &node_cfgs, &[None, None]);
+	let mut nodes = create_network(2, &node_cfgs, &node_chanmgrs);
+	let config = test_default_channel_config();
+	reload_node!(nodes[0], config, &v2_mgr, &[&v2_mon[..]], persister, chain_mon, new_node);
+
+	let channel_id = ChannelId(chan_id_bytes);
+	let node_id_1 = nodes[1].node.get_our_node_id();
+	let err = nodes[0].node.splice_channel(&channel_id, &node_id_1).unwrap_err();
+	let expected = format!(
+		"Channel {} has a pending splice from a prior LDK version and cannot be spliced again",
+		channel_id,
+	);
+	match err {
+		APIError::APIMisuseError { err } => assert_eq!(err, expected),
+		_ => panic!("unexpected error: {:?}", err),
+	}
 }

lightning/src/ln/channel.rs

@@ -12928,11 +12928,21 @@ where
 						.as_ref()
 						.map(|n| n.funding_feerate_sat_per_1000_weight())
 				});
-			debug_assert!(
-				prev_feerate.is_some(),
-				"pending_splice should have last_funding_feerate or funding_negotiation",
-			);
-			let min_rbf_feerate = prev_feerate.map(min_rbf_feerate);
+			let prev_feerate = match prev_feerate {
+				Some(prev_feerate) => prev_feerate,
+				None => {
+					// The feerate and our contribution are only persisted by LDK 0.3+, so their
+					// absence means this splice was last written by an older version (negotiated
+					// there, or round-tripped 0.3 -> 0.2 -> 0.3) and cannot be RBF'd.
+					return Err(APIError::APIMisuseError {
+						err: format!(
+							"Channel {} has a pending splice from a prior LDK version and cannot be spliced again",
+							self.context.channel_id(),
+						),
+					});
+				},
+			};
+			let min_rbf_feerate = Some(min_rbf_feerate(prev_feerate));
 			let prior = if pending_splice.last_funding_feerate_sat_per_1000_weight.is_some() {
 				pending_splice.latest_contribution().cloned()
 			} else {