Add ability to buy reservations for instant outs from server - #883
Open
sputn1ck wants to merge 9 commits into
Open
Add ability to buy reservations for instant outs from server#883sputn1ck wants to merge 9 commits into
sputn1ck wants to merge 9 commits into
Conversation
sputn1ck
marked this pull request as ready for review
February 3, 2025 16:36
sputn1ck
force-pushed
the
buy_reservations
branch
from
February 3, 2025 16:38
b610e67 to
8ae455d
Compare
sputn1ck
force-pushed
the
buy_reservations
branch
from
March 24, 2025 16:07
8ae455d to
cc9b823
Compare
sputn1ck
force-pushed
the
buy_reservations
branch
2 times, most recently
from
April 8, 2025 07:41
9d3f8f7 to
c8bd673
Compare
sputn1ck
force-pushed
the
buy_reservations
branch
3 times, most recently
from
April 17, 2025 09:49
a9b6c87 to
16fd7ed
Compare
sputn1ck
force-pushed
the
buy_reservations
branch
from
April 17, 2025 14:56
16fd7ed to
114dac6
Compare
hieblmi
added a commit
to hieblmi/loop
that referenced
this pull request
Aug 11, 2026
SendPaymentAndPollAccepted and BuildHtlc both run after PollPaymentAcceptedAction has called LockReservation on every reservation backing the swap. Their OnRecover transitions pointed directly to Failed, whose action is fsm.NoOpAction -- so on daemon restart while in either state, the FSM moved to Failed without ever unlocking the reservations. The local store kept them in the Locked state until on-chain expiry (typically tens of hours later), making them unusable for any subsequent swap. For users who pay for reservations (PR lightninglabs#883's invoice-requested flow) that is a direct material loss. Add an intermediate UnlockReservationsOnRecover state whose action calls handleErrorAndUnlockReservations and then routes to Failed via the normal OnError edge. SendPaymentAndPollAccepted.OnRecover and BuildHtlc.OnRecover now point at this state instead of Failed directly. Init.OnRecover -> Failed is left alone because at that point the InstantOut row has not yet been persisted and no reservation locks have been taken; there is nothing to clean up. Post-PushPreimage states (PushPreimage.OnRecover -> PushPreimage, etc.) are also left alone since they self-loop on recovery rather than terminate. The cleanup helper itself still derives its context from the caller's context (see existing handleErrorAndUnlockReservations); fixing that context-cancel hazard is a separate change.
hieblmi
added a commit
to hieblmi/loop
that referenced
this pull request
Aug 11, 2026
When loopd is started without --experimental the swap client server's reservationManager and instantOutManager are nil. ListReservations already returns codes.Unimplemented in that case; the rest of the instant-out / reservation RPC family didn't, and would dereference a nil pointer. Affected handlers (all of which now return the same Unimplemented status): - ReservationRequest (new in PR lightninglabs#883) - ReservationQuote (new in PR lightninglabs#883) - InstantOut - InstantOutQuote - ListInstantOuts Without this fix an authenticated caller can crash the daemon by invoking any of these RPCs against a non-experimental loopd. With default localhost binding the attack surface is small, but loop is also commonly fronted by lit / LSP wrappers that expose RPCs to other internal services, so a single packet is enough for a remote DoS.
hieblmi
added a commit
to hieblmi/loop
that referenced
this pull request
Aug 11, 2026
SendPaymentAndPollAccepted and BuildHtlc both run after PollPaymentAcceptedAction has called LockReservation on every reservation backing the swap. Their OnRecover transitions pointed directly to Failed, whose action is fsm.NoOpAction -- so on daemon restart while in either state, the FSM moved to Failed without ever unlocking the reservations. The local store kept them in the Locked state until on-chain expiry (typically tens of hours later), making them unusable for any subsequent swap. For users who pay for reservations (PR lightninglabs#883's invoice-requested flow) that is a direct material loss. Add an intermediate UnlockReservationsOnRecover state whose action calls handleErrorAndUnlockReservations and then routes to Failed via the normal OnError edge. SendPaymentAndPollAccepted.OnRecover and BuildHtlc.OnRecover now point at this state instead of Failed directly. Init.OnRecover -> Failed is left alone because at that point the InstantOut row has not yet been persisted and no reservation locks have been taken; there is nothing to clean up. Post-PushPreimage states (PushPreimage.OnRecover -> PushPreimage, etc.) are also left alone since they self-loop on recovery rather than terminate. The cleanup helper itself still derives its context from the caller's context (see existing handleErrorAndUnlockReservations); fixing that context-cancel hazard is a separate change.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This pull request introduces several new features and improvements related to reservation management and state handling. The most significant changes include adding a new reservation command, updating the reservation state machine to support client-initiated reservations, and enhancing error handling and timeout configurations.
New Features:
cmd/loop/reservations.go. [1] [2] [3]instantout/reservation/actions.goandinstantout/reservation/fsm.go. [1] [2] [3] [4] [5] [6] [7] [8] [9] [10]Enhancements:
cmd/loop/main.go.instantout/reservation/actions.go. [1] [2] [3]Testing and Mocking:
instantout/reservation/actions_test.go. [1] [2] [3]Code Refactoring:
instantout/reservation/manager.go. [1] [2] [3] [4]These changes improve the flexibility and robustness of the reservation system, allowing for better error handling and support for both server-initiated and client-initiated reservations.