Splice: select confirmed UTXOs + prevent double spend

src/event.rs

@@ -1761,29 +1761,53 @@ where
 				counterparty_node_id,
 				unsigned_transaction,
 				..
-			} => match self.wallet.sign_owned_inputs(unsigned_transaction) {
-				Ok(partially_signed_tx) => {
-					match self.channel_manager.funding_transaction_signed(
-						&channel_id,
-						&counterparty_node_id,
-						partially_signed_tx,
-					) {
-						Ok(()) => {
-							log_info!(
-								self.logger,
-								"Signed funding transaction for channel {} with counterparty {}",
-								channel_id,
-								counterparty_node_id
-							);
-						},
-						Err(e) => {
-							// TODO(splicing): Abort splice once supported in LDK 0.3
-							debug_assert!(false, "Failed signing funding transaction: {:?}", e);
-							log_error!(self.logger, "Failed signing funding transaction: {:?}", e);
-						},
-					}
-				},
-				Err(()) => log_error!(self.logger, "Failed signing funding transaction"),
+			} => {
+				// Keep a copy of the unsigned tx: signing consumes it, but a sign failure still
+				// needs the tx to identify and free the coins this splice reserved.
+				let reserved_tx = unsigned_transaction.clone();
+				match self.wallet.sign_owned_inputs(unsigned_transaction) {
+					Ok(partially_signed_tx) => {
+						let funding_tx = partially_signed_tx.clone();
+						match self.channel_manager.funding_transaction_signed(
+							&channel_id,
+							&counterparty_node_id,
+							partially_signed_tx,
+						) {
+							Ok(()) => {
+								if let Err(e) = self.wallet.finalize_splice(funding_tx) {
+									// The signed tx will be broadcast by LDK but the spend was not
+									// persisted; a restart would see these coins spendable again.
+									log_error!(
+										self.logger,
+										"Failed to record splice funding spend for channel {}: {:?}",
+										channel_id,
+										e
+									);
+								}
+								log_info!(
+									self.logger,
+									"Signed funding transaction for channel {} with counterparty {}",
+									channel_id,
+									counterparty_node_id
+								);
+							},
+							Err(e) => {
+								// TODO(splicing): Abort splice once supported in LDK 0.3
+								self.wallet.abort_splice(&reserved_tx);
+								debug_assert!(false, "Failed signing funding transaction: {:?}", e);
+								log_error!(
+									self.logger,
+									"Failed signing funding transaction: {:?}",
+									e
+								);
+							},
+						}
+					},
+					Err(()) => {
+						self.wallet.abort_splice(&reserved_tx);
+						log_error!(self.logger, "Failed signing funding transaction");
+					},
+				}
 			},
 			LdkEvent::SplicePending {
 				channel_id,

src/lib.rs

@@ -1338,7 +1338,7 @@ impl Node {
 
 			let fee_rate = self.fee_estimator.estimate_fee_rate(ConfirmationTarget::ChannelFunding);
 
-			let inputs = self
+			let (inputs, reserved_outpoints) = self
 				.wallet
 				.select_confirmed_utxos(vec![shared_input], &[shared_output], fee_rate)
 				.map_err(|()| {
@@ -1365,30 +1365,22 @@ impl Node {
 				},
 			};
 
-			self.channel_manager
-				.splice_channel(
-					&channel_details.channel_id,
-					&counterparty_node_id,
-					contribution,
-					funding_feerate_per_kw,
-					None,
-				)
-				.map_err(|e| {
+			match self.channel_manager.splice_channel(
+				&channel_details.channel_id,
+				&counterparty_node_id,
+				contribution,
+				funding_feerate_per_kw,
+				None,
+			) {
+				// Coins stay reserved until the deferred signing step frees them.
+				Ok(()) => Ok(()),
+				Err(e) => {
 					log_error!(self.logger, "Failed to splice channel: {:?}", e);
-					let tx = bitcoin::Transaction {
-						version: bitcoin::transaction::Version::TWO,
-						lock_time: bitcoin::absolute::LockTime::ZERO,
-						input: vec![],
-						output: vec![bitcoin::TxOut {
-							value: Amount::ZERO,
-							script_pubkey: change_address.script_pubkey(),
-						}],
-					};
-					match self.wallet.cancel_tx(&tx) {
-						Ok(()) => Error::ChannelSplicingFailed,
-						Err(e) => e,
-					}
-				})
+					// The splice never reached LDK; free the reserved coins now.
+					self.wallet.release_reserved_utxos(&reserved_outpoints);
+					Err(Error::ChannelSplicingFailed)
+				},
+			}
 		} else {
 			log_error!(
 				self.logger,

src/liquidity.rs

@@ -2066,9 +2066,9 @@ where
 		let fee_rate =
 			self.fee_estimator.estimate_fee_rate(ConfirmationTarget::ChannelFunding);
 
-		let inputs = self
+		let (inputs, reserved_outpoints) = self
 			.wallet
-			.select_utxos(vec![shared_input], &[shared_output], fee_rate)
+			.select_confirmed_utxos(vec![shared_input], &[shared_output], fee_rate)
 			.map_err(|()| APIError::APIMisuseError {
 				err: "Insufficient confirmed UTXOs for splice".to_string(),
 			})?;
@@ -2092,28 +2092,21 @@ where
 			},
 		};
 
-		self.channel_manager
-			.splice_channel(
-				&channel_id,
-				&counterparty_node_id,
-				contribution,
-				funding_feerate_per_kw,
-				None,
-			)
-			.map_err(|e| {
-				// Cancel change address reservation on failure
-				let tx = bitcoin::Transaction {
-					version: bitcoin::transaction::Version::TWO,
-					lock_time: bitcoin::absolute::LockTime::ZERO,
-					input: vec![],
-					output: vec![bitcoin::TxOut {
-						value: Amount::ZERO,
-						script_pubkey: change_address.script_pubkey(),
-					}],
-				};
-				let _ = self.wallet.cancel_tx(&tx);
-				e
-			})
+		match self.channel_manager.splice_channel(
+			&channel_id,
+			&counterparty_node_id,
+			contribution,
+			funding_feerate_per_kw,
+			None,
+		) {
+			// Coins stay reserved until the deferred signing step frees them.
+			Ok(()) => Ok(()),
+			Err(e) => {
+				// The splice never reached LDK; free the reserved coins now.
+				self.wallet.release_reserved_utxos(&reserved_outpoints);
+				Err(e)
+			},
+		}
 	}
 
 	/// Open a channel for LSPS4. Extracted from the OpenChannel event handler