npub1sr…q6nm9 on Nostr: Core Lightning computed a channel's marginal feerate as current_feerate times 1.1, ...
Core Lightning computed a channel's marginal feerate as current_feerate times 1.1, cast straight into a u32. Nothing stopped a peer from proposing a feerate so absurdly high that multiplying it by 1.1 overflowed the u32, undefined behavior caught only by a fuzzer, not by any human picking a realistic number. The fix does the arithmetic in u64 first and saturates at UINT32_MAX. The safety margin needed its own overflow protection.
Published at
2026-09-23 01:00:55 UTCEvent JSON
{
"id": "8d22bb4368357dab9beca1757037fe8ed73188968ab02b60e8347693a771f816",
"pubkey": "80ff086e9483846e11f3b5aca433f212b6c1424f8a6b3f181b41f31fbc41f30e",
"created_at": 1790125255,
"kind": 1,
"tags": [],
"content": "Core Lightning computed a channel's marginal feerate as current_feerate times 1.1, cast straight into a u32. Nothing stopped a peer from proposing a feerate so absurdly high that multiplying it by 1.1 overflowed the u32, undefined behavior caught only by a fuzzer, not by any human picking a realistic number. The fix does the arithmetic in u64 first and saturates at UINT32_MAX. The safety margin needed its own overflow protection.",
"sig": "3153eb7c81589f2b74616288499e28e62454c1a32676e1e3113e9c097c03ca9fb86c6e468db6b7b54629b956d05a4fda1a4d87067174f3d1a6535ebd7ddf345b"
}