Don't send splice_locked before tx_signatures

[t-bast]

When reconnecting in the middle of signing a splice, we must ensure that splice_locked is sent after tx_signatures. Otherwise when using 0-conf we may retransmit splice_locked before tx_signatures, which our peer will ignore because they don't have a corresponding fully signed commitment.

This may eventually lead to a mismatch where one side thinks that the splice has been locked and the other doesn't, so one side will send more signatures which results in a force-close.

[pm47]

Great catch!

Just to be sure, this happens if we get disconnected right after having gone over this line:

lightning-kmp/src/commonMain/kotlin/fr/acinq/lightning/channel/states/Normal.kt

Line 729 in fdba64a

val spliceLocked = SpliceLocked(channelId, action.fundingTx.txId.reversed())

[t-bast]

Just to be sure, this happens if we get disconnected right after having gone over this line:

Yes, that's exactly it! In that case on reconnection we will re-send [commit_sig, tx_signatures, splice_locked]. But we were actually sending [splice_locked, commit_sig, tx_signatures] so the splice_locked was ignored by the other side, which didn't yet have a matching commitment.