ksedgwic/clboss v0.16.3

v0.16.3: Tougher Than the Race

on GitHub

Point release fixing three reported security/robustness issues.
Upgrading is recommended for all CLBOSS operators.

• JitRebalancer fee-budget race (#323, reported by Moin): every
  incoming forward HTLC spawned a concurrent rebalance with no
  per-destination guard, so several in-flight HTLCs toward the same
  depleted channel launched that many full-size rebalances against a
  stale expenditure budget — fees paid on each, and the recorded
  overspend then blocked legitimate JIT rebalances for that channel.
  An in-flight guard now admits one rebalance per destination at a
  time.

• Auto-close force-closed offline peers (#324, reported by Moin;
  experimental, opt-in feature): close was issued with a 180-second
  unilateral timeout regardless of the peer's connection state, while
  one complaint source selects peers specifically for a low connect
  rate. Closes now wait for the peer to come online (polled every 10
  minutes) and fall back to a unilateral close at low feerates only
  after a persisted 3-day patience window.

• Reverse-swap claim corrupted sibling swaps (#325, reported by
  Vincenzo Palazzo): the UPDATE persisting a successful Boltz claim
  had no WHERE clause, so it stamped every in-flight swap row as
  claimed and blocked sibling swaps' claims. Present since 2020;
  affected funds were recoverable after the timelock, no theft path.
  The update is now scoped to the claimed swap.

Reported issues fixed since v0.16.0:

Thanks to the reporters. See CHANGELOG.md for details.