25.02: Egregious feerate spent to claim anchor output of already high-feerate commitment

[whitslack]

I had an HTLC hit its deadline, which forced my node to unilaterally close the channel:

2025-03-22T23:11:48.144Z UNUSUAL 03…4c-chan#255714: Peer permanent failure in CHANNELD_NORMAL: Offered HTLC 35773 SENT_ADD_ACK_REVOCATION cltv 888979 hit deadline (reason=protocol)
2025-03-22T23:11:48.144Z DEBUG   03…4c-channeld-chan#255714: Status closed, but not exited. Killing
2025-03-22T23:11:48.145Z INFO    03…4c-chan#255714: State changed from CHANNELD_NORMAL to AWAITING_UNILATERAL
2025-03-22T23:11:48.174Z DEBUG   03…4c-chan#255714: We have 3 anchor points to use
2025-03-22T23:11:48.175Z DEBUG   lightningd: Broadcasting txid 0d…ed
2025-03-22T23:11:48.175Z DEBUG   lightningd: sendrawtransaction: 02…20
2025-03-22T23:11:48.208Z DEBUG   plugin-bcli: sendrawtx exit 0 (bitcoin-cli -datadir=/var/lib/bitcoind -rpcclienttimeout=60 sendrawtransaction 02…20) 
2025-03-22T23:11:48.227Z DEBUG   03…4c-chan#255714: Worth fee 0sat for local commit tx to get 263913860msat in 889510 blocks at feerate 4853perkw
2025-03-22T23:11:48.230Z DEBUG   03…4c-chan#255714: Worth fee 0sat for local commit tx to get 125090514msat in 889307 blocks at feerate 4853perkw
2025-03-22T23:11:48.232Z DEBUG   03…4c-chan#255714: Worth fee 0sat for local commit tx to get 214094428msat in 889003 blocks at feerate 4853perkw
2025-03-22T23:11:48.235Z DEBUG   03…4c-chan#255714: Worth fee 15458sat for local commit tx to get 69663541msat in 888979 blocks at feerate 10891perkw
2025-03-22T23:11:48.235Z DEBUG   03…4c-chan#255714: Anchorspend for local commit tx fee 15458sat (w=714), commit_tx fee 10051sat (w=1628): package feerate 10891 perkw
2025-03-22T23:11:48.238Z INFO    03…4c-chan#255714: Creating anchor spend for local commit tx 09…f3: we're paying fee 15458sat
2025-03-22T23:11:48.238Z DEBUG   lightningd: Broadcasting txid 09…f3
2025-03-22T23:11:48.238Z DEBUG   lightningd: sendrawtransaction: 02…00
2025-03-22T23:11:48.359Z DEBUG   plugin-bcli: sendrawtx exit 0 (bitcoin-cli -datadir=/var/lib/bitcoind -rpcclienttimeout=60 sendrawtransaction 02…00 0) 

(The first sendrawtransaction is the commitment itself, and the second is my spend of my anchor output.)

At the time of the closing, the blockchain tip was at block height 888979, which was the CLTV expiration of the expired HTLC. The prevailing feerates at the time had been around 1-2 sat/vB, and the feerate of the commitment transaction (which was paid by the peer) was 24.7 sat/vB, meaning there was absolutely no need for CLN to CPFP the commitment by spending my anchor output with an 85.6 sat/vB feerate. (The effective feerate of the two-transaction package then became 43.4 sat/vB.)

CLN's bad CPFP logic needlessly turned what would have been a relatively inexpensive (for me) unilateral closure of a peer-funded channel into a $13 loss for me. (I had earned 245 sat from forwarding payments in/out through that channel by the time it was closed, and I spent 15,458 sat to CPFP the commitment that would have confirmed immediately even without my anchor spend. 😑)

[rustyrussell]

Thankyou for the excellent report!

Here's the breakdown:

1. We close because we're close to the deadline.
2. We want to unilaterally close, and we go "we have 1 block to do this!".
3. We asked bitcoind what estimatesmartfee 2 CONSERVATIVE was, and it said "10891 perkw". That's roughly 43.5 sat/vB.
4. We created an anchor to do exactly that.

So it's not the CPFP logic which is broken: that pretty much nailed it.

It's the second step: the outgoing ctlv is not the real deadline, it's the incoming cltv.

[whitslack]

@rustyrussell: Thank you for the analysis! Wouldn't you actually have the CLTV delta (perhaps minus 1 block) to claim the HTLCs rather than just 1 block? [Edit: I think that's equivalent to what you said about the incoming CLTV being the actual deadline.]