Fix #6021: Do not transition channel state to CLOSED if tx is unconfirmed.

electrum/lnchannel.py

@@ -70,9 +70,9 @@ class channel_states(IntEnum):
                         #  - Non-funding node: has sent the funding_signed message.
     FUNDED          = 2 # Funding tx was mined (requires min_depth and tx verification)
     OPEN            = 3 # both parties have sent funding_locked
-    CLOSING         = 4 # shutdown has been sent.
-    FORCE_CLOSING   = 5 # force-close tx has been broadcast
-    CLOSED          = 6 # funding txo has been spent
+    CLOSING         = 4 # shutdown has been sent, and closing tx is unconfirmed.
+    FORCE_CLOSING   = 5 # we force-closed, and closing tx is unconfirmed. (otherwise we remain OPEN)
+    CLOSED          = 6 # closing tx has been mined
     REDEEMED        = 7 # we can stop watching
 
 class peer_states(IntEnum):

electrum/lnworker.py

@@ -771,7 +771,13 @@ class LNWallet(LNWorker):
     async def update_closed_channel(self, chan, funding_txid, funding_height, closing_txid, closing_height, keep_watching):
 
         if chan.get_state() < channel_states.CLOSED:
-            chan.set_state(channel_states.CLOSED)
+            conf = closing_height.conf
+            if conf > 0:
+                chan.set_state(channel_states.CLOSED)
+            else:
+                # we must not trust the server with unconfirmed transactions
+                # if the remote force closed, we remain OPEN until the closing tx is confirmed
+                pass
 
         if chan.get_state() == channel_states.CLOSED and not keep_watching:
             chan.set_state(channel_states.REDEEMED)

electrum/tests/regtest/regtest.sh

@@ -155,6 +155,7 @@ if [[ $1 == "breach" ]]; then
     $alice lnpay $request
     echo "alice broadcasts old ctx"
     $bitcoin_cli sendrawtransaction $ctx
+    new_blocks 1
     wait_until_channel_closed bob
     new_blocks 1
     wait_for_balance bob 0.14