Duplicate funding outpoint creates channels with the same `channel_id`

[NishantBansal2003]

CLN never checks whether the funding outpoint in funding_created is already in use by another channel with the same peer. As a result, a peer can complete two (or more) independent open_channel -> accept_channel -> funding_created -> funding_signed negotiations that reference the same funding outpoint. CLN sends funding_signed for both and commits two channel records with the same channel_id, violating the invariant that a channel_id uniquely identify a channel.

Although the second channel will eventually be rejected (as the funding output script contains the wrong, non-negotiated keys) or forgotten after 2016 blocks, funding_signed should never be sent once the funding outpoint (and thus the channel_id) is reused. Many code paths perform lookups by channel_id, so duplicate IDs could lead to state corruption.

Steps to reproduce

1. Send open_channel and wait for CLN to send accept_channel.
2. Send funding_created with a funding outpoint; CLN replies with funding_signed.
3. Send a second open_channel and wait for CLN to send accept_channel.
4. Send funding_created reusing the same funding outpoint; CLN replies with funding_signed again.

Expected: Step 4 is rejected because the funding outpoint (and thus the channel_id) is already in use.

Actual: CLN sends funding_signed and commits a second channel with the same channel_id.

Root cause

The fundee commit path derives the channel_id from the funding outpoint but never checks whether it is already in use before committing. In opening_fundee_finished(), wallet_commit_channel() unconditionally calls new_channel() and wallet_channel_insert(), creating a new channel and appending it to peer->channels. The database does not enforce uniqueness on the funding outpoint (the channel table is keyed by an autoincrement dbid), and openingd is a fresh per-negotiation subdaemon with no visibility into the peer’s existing channels, so the duplicate is never rejected.

CLN node logs

2026-07-02T16:45:31.066Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-connectd: Handed peer, entering loop
2026-07-02T16:45:31.066Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-connectd: [IN] 001200000000
2026-07-02T16:45:31.066Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-connectd: [OUT] 00130000
2026-07-02T16:45:31.066Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-connectd: Activating for message WIRE_OPEN_CHANNEL
2026-07-02T16:45:31.080Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#1: pid 176, msgfd 85
2026-07-02T16:45:31.081Z DEBUG   hsmd: Client: Received message 30 from client
2026-07-02T16:45:31.081Z DEBUG   hsmd: Client: Received message 10 from client
2026-07-02T16:45:31.081Z DEBUG   hsmd: new_client: 1
2026-07-02T16:45:31.081Z plugin-chanbackup: [IN] 7b226a736f6e727063223a22322e30222c226964223a22636c6e3a706565725f636f6e6e6563746564233738222c22726573756c74223a7b22726573756c74223a22636f6e74696e7565227d7d0a0a
2026-07-02T16:45:31.081Z TRACE   lightningd: Plugin chanbackup returned from peer_connected hook call
2026-07-02T16:45:31.084Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-hsmd: Got WIRE_HSMD_GET_PER_COMMITMENT_POINT
2026-07-02T16:45:31.084Z DEBUG   hsmd: Client: Received message 18 from client
2026-07-02T16:45:31.084Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#1: [IN] 002006226e46111a0b59caaf126043eb5bbf28c34f3a5e332a1fc7b2b73cf188910fbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb00000000000186a0000000000000022200000000000002220000000005f5e10000000000000003e800000000000003e8000001fd009001e00320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfcf900000103401000
2026-07-02T16:45:31.084Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#1: Setting their reserve to 1000sat
2026-07-02T16:45:31.084Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#1: [OUT] 0021bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb0000000000000222ffffffffffffffff00000000000003e8000000000000000000000001000601e302256da46f239b383eab91adfb65ab9d667afab0d944534a9d0e8d9fb0338dfe1f02d2312cee7a0a30bbe6ddd2c2918e0ec57383ac151045d490866aef3ef88f16a0036a3c98577ebd868df49bdac674c07aa72b254f2b0532c0a13c6c6c916c5c7785030c935b09ace0327541e3c1a65d1b03c7786d9af4ecfbe293af51490a57af864c0289ccd5fc805e7faec98627a66978f23dd0ce46c858e37a1350105ae104226ad703c7dd6e4131e894c0807ccff868e16619f96d10421bc15a93ba851a3ab39621ef00000103401000
2026-07-02T16:45:31.085Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#1: billboard: Incoming channel: accepted, now waiting for them to create funding tx
2026-07-02T16:45:31.094Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#1: [IN] 0022bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbd6c8fe981d9e8ddfc4abe27fbf3140c5b7603a338bc7d5782e07d7b8a296defa0000fa7a54f4050af1f5cf74bc88f874259e23eb1a78ed9a4741dd3fce09850598b428a56065cad295be84b1d5d86b1e2c643148900ae7f113dca914392781b437ab
2026-07-02T16:45:31.094Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-hsmd: Got WIRE_HSMD_SETUP_CHANNEL
2026-07-02T16:45:31.094Z DEBUG   hsmd: Client: Received message 31 from client
2026-07-02T16:45:31.096Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-hsmd: Got WIRE_HSMD_VALIDATE_COMMITMENT_TX
2026-07-02T16:45:31.096Z DEBUG   hsmd: Client: Received message 35 from client
2026-07-02T16:45:31.098Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-hsmd: Got WIRE_HSMD_SIGN_REMOTE_COMMITMENT_TX
2026-07-02T16:45:31.098Z DEBUG   hsmd: Client: Received message 19 from client
2026-07-02T16:45:31.098Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#1: Got opening_fundee_finish_response
2026-07-02T16:45:31.099Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#1: Initial channel state CGOSSIP_WAITING_FOR_USABLE
2026-07-02T16:45:31.100Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#1: Watching funding tx fade96a2b8d7072e78d5c78b333a60b7c54031bf7fe2abc4df8d9e1d98fec8d6
2026-07-02T16:45:31.100Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#1: Watching for funding txid: fade96a2b8d7072e78d5c78b333a60b7c54031bf7fe2abc4df8d9e1d98fec8d6
2026-07-02T16:45:31.114Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: pid 180, msgfd 86
2026-07-02T16:45:31.115Z UNUSUAL 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#1: Ignoring fee limits!
2026-07-02T16:45:31.115Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#1: channel_gossip: reestablished
2026-07-02T16:45:31.115Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#1: Status closed, but not exited. Killing
2026-07-02T16:45:31.118Z DEBUG   hsmd: new_client: 1
2026-07-02T16:45:31.118Z jsonrpc#77: [IN] 7b226a736f6e727063223a22322e30222c226964223a226e6f74696669636174696f6e2d6368616e6e656c5f73746174655f6368616e6765642f6368616e6261636b75703a7374617469636261636b75702336222c226d6574686f64223a227374617469636261636b7570222c22706172616d73223a7b7d7d0a0a
2026-07-02T16:45:31.118Z jsonrpc#77: "notification-channel_state_changed/chanbackup:staticbackup#6"[IN] 
2026-07-02T16:45:31.118Z jsonrpc#77: [OUT] 7b226a736f6e727063223a22322e30222c226964223a226e6f74696669636174696f6e2d6368616e6e656c5f73746174655f6368616e6765642f6368616e6261636b75703a7374617469636261636b75702336222c22726573756c74223a7b22736362223a5b22303030303030303030303030303030316436633866653938316439653864646663346162653237666266333134306335623736303361333338626337643537383265303764376238613239366465666130333466333535626463623763633061663732386566336363656239363135643930363834626235623263613566383539616230663062373034303735383731616130313766303030303031646131616436633866653938316439653864646663346162653237666266333134306335623736303361333338626337643537383265303764376238613239366465666130303030303030303030303030303030303030313836613030303033343031303030303030303030396230313063303030313030303030303030303030303030303030303030303338343033323066623165393038653531663934343934323964313262313765346638396166346261393963613366303335646532303261343531393362333835306366633033323066623165393038653531663934343934323964313262313765346638396166346261393963613366303335646532303261343531393362333835306366633033323066623165393038653531663934343934323964313262313765346638396166346261393963613366303335646532303261343531393362333835306366633033323066623165393038653531663934343934323964313262313765346638396166346261393963613366303335646532303261343531393362333835306366633035303130313037303230303930225d7d7d0a0a
2026-07-02T16:45:31.118Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: option_static_remotekey = 1, option_anchor_outputs = 0 option_anchors_zero_fee_htlc_tx = 1
2026-07-02T16:45:31.119Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: init REMOTE: remote_per_commit = 0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc, old_remote_per_commit = 0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc next_idx_local = 1 next_idx_remote = 1 revocations_received = 0 feerates { RCVD_ADD_ACK_REVOCATION:509 } range 1-4294967295 blockheights { RCVD_ADD_ACK_REVOCATION:0 }, our current 101
2026-07-02T16:45:31.119Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-hsmd: Got WIRE_HSMD_GET_PER_COMMITMENT_POINT
2026-07-02T16:45:31.119Z DEBUG   hsmd: Client: Received message 18 from client
2026-07-02T16:45:31.119Z plugin-chanbackup: [IN] 7b226a736f6e727063223a22322e30222c226d6574686f64223a226c6f67222c22706172616d73223a7b226c6576656c223a226465627567222c226d657373616765223a225570646174696e672074686520534342227d7d0a0a7b226a736f6e727063223a22322e30222c226d6574686f64223a226c6f67222c22706172616d73223a7b226c6576656c223a226465627567222c226d657373616765223a225570646174696e6720746865205343422066696c652e2e2e227d7d0a0a
2026-07-02T16:45:31.119Z DEBUG   plugin-chanbackup: Updating the SCB
2026-07-02T16:45:31.119Z DEBUG   plugin-chanbackup: Updating the SCB file...
2026-07-02T16:45:31.119Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: [OUT] 0023d6c8fe981d9e8ddfc4abe27fbf3140c5b7603a338bc7d5782e07d7b8a296defa6c4a8f6a943e2dace8884082caf0ce8163b12a33d3f2f78650d048e2f3a38cd0525561d3ce406c647c7fa074764786866cae1897c2eeeec521328633c5649dc0
2026-07-02T16:45:31.119Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: billboard: Funding needs 1 more confirmations to be ready.
2026-07-02T16:45:31.119Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: billboard: Funding needs 1 more confirmations to be ready.
2026-07-02T16:45:31.177Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: [IN] 0024d6c8fe981d9e8ddfc4abe27fbf3140c5b7603a338bc7d5782e07d7b8a296defa0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc01080000000000000000
2026-07-02T16:45:31.178Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: Peer told us that they'll use alias=0x0x0 for this channel
2026-07-02T16:45:31.178Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#1: Got channel_ready
2026-07-02T16:45:31.179Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: billboard: They've confirmed channel ready, we haven't yet.
2026-07-02T16:45:31.179Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-connectd: [IN] 01019472ff6999fdbbbfa60e45e91a50a10ecf24ea866eff4b01bdbf798e68bc14e8203e9441acb740ca93235daa8357e20371254df783bec916233edaada12e0f48000340100000000001036539539700534e4cb6a982b964b89f1e2310ce8cb687cd00dc41f5251e632bfad0be4a41267a1a41372a6d142c2d090623240c52204e740d3f65045927557e1e4f017f0000
2026-07-02T16:45:31.179Z TRACE   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-gossipd: handle_recv_gossip: WIRE_NODE_ANNOUNCEMENT
2026-07-02T16:45:31.179Z TRACE   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-gossipd: Bad gossip order: node_announcement: unknown node 036539539700534e4cb6a982b964b89f1e2310ce8cb687cd00dc41f5251e632bfa
2026-07-02T16:45:31.191Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#1: [IN] 0024d6c8fe981d9e8ddfc4abe27fbf3140c5b7603a338bc7d5782e07d7b8a296defa03a1905308281af24f0c8063d1fdbfd2f09ff1b1656fbdbe0001e92677b2ed78fe
2026-07-02T16:45:31.193Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-connectd: Activating for message WIRE_OPEN_CHANNEL
2026-07-02T16:45:31.209Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#2: pid 185, msgfd 85
2026-07-02T16:45:31.209Z DEBUG   hsmd: Client: Received message 30 from client
2026-07-02T16:45:31.209Z DEBUG   hsmd: Client: Received message 10 from client
2026-07-02T16:45:31.209Z DEBUG   hsmd: new_client: 2
2026-07-02T16:45:31.212Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-hsmd: Got WIRE_HSMD_GET_PER_COMMITMENT_POINT
2026-07-02T16:45:31.212Z DEBUG   hsmd: Client: Received message 18 from client
2026-07-02T16:45:31.212Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#2: [IN] 002006226e46111a0b59caaf126043eb5bbf28c34f3a5e332a1fc7b2b73cf188910fbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb00000000000186a0000000000000022200000000000002220000000005f5e10000000000000003e800000000000003e8000001fd009001e00320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfc0320fb1e908e51f9449429d12b17e4f89af4ba99ca3f035de202a45193b3850cfcf900000103401000
2026-07-02T16:45:31.212Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#2: Setting their reserve to 1000sat
2026-07-02T16:45:31.214Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#2: [OUT] 0021bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb0000000000000222ffffffffffffffff00000000000003e8000000000000000000000001000601e30291f15d2e2d254181ce1ffe06963a17b28cc300fb8753347ec170c97b4f2c64b70369b896ba2d09b23824c608fcd48c4a909268a1074b585e108e58d53c15b0e1b1038368fe106917a556950466be012978542dab64b747bda365a7705427142ebd76026df12703ea44f99aaab1ade142ea48c4b24552da184f06a2c3e91588b792dc7d036c69b00aaba492d0eb87317bdb4765d4c721cac552c438e44a55951206aa8bfa0344396517a2617aee3a097a66a9cfefe0f9da8e16a176751f47424aa3869167fc00000103401000
2026-07-02T16:45:31.214Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#2: billboard: Incoming channel: accepted, now waiting for them to create funding tx
2026-07-02T16:45:31.234Z 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-openingd-chan#2: [IN] 0022bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbd6c8fe981d9e8ddfc4abe27fbf3140c5b7603a338bc7d5782e07d7b8a296defa0000cf946b4f2b302515aad7d2d5d3310227f0a4a20acd84910799159021e058324d4b730278905956e9fe810d549c313a3a1a7a9d998174086587cf25685e7cdfff
2026-07-02T16:45:31.234Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-hsmd: Got WIRE_HSMD_SETUP_CHANNEL
2026-07-02T16:45:31.234Z DEBUG   hsmd: Client: Received message 31 from client
2026-07-02T16:45:31.235Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-hsmd: Got WIRE_HSMD_VALIDATE_COMMITMENT_TX
2026-07-02T16:45:31.236Z DEBUG   hsmd: Client: Received message 35 from client
2026-07-02T16:45:31.237Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-hsmd: Got WIRE_HSMD_SIGN_REMOTE_COMMITMENT_TX
2026-07-02T16:45:31.237Z DEBUG   hsmd: Client: Received message 19 from client
2026-07-02T16:45:31.237Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#2: Got opening_fundee_finish_response
2026-07-02T16:45:31.238Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#2: Initial channel state CGOSSIP_WAITING_FOR_USABLE
2026-07-02T16:45:31.239Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#2: Watching funding tx fade96a2b8d7072e78d5c78b333a60b7c54031bf7fe2abc4df8d9e1d98fec8d6
2026-07-02T16:45:31.239Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#2: Watching for funding txid: fade96a2b8d7072e78d5c78b333a60b7c54031bf7fe2abc4df8d9e1d98fec8d6
2026-07-02T16:45:31.253Z DEBUG   034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-channeld-chan#2: pid 192, msgfd 87
2026-07-02T16:45:31.253Z UNUSUAL 034f355bdcb7cc0af728ef3cceb9615d90684bb5b2ca5f859ab0f0b704075871aa-chan#2: Ignoring fee limits!

This bug was discovered while fuzzing the funding flow using the smite