Improve re-organization safety about lnd HOT 4 OPEN

Another case that's unhandled is in contractcourt/chain_watcher.go closeObserver() method. It notifies once on the spend (which requires only 1-confirmation), and then exits out after "handling" the confirmed commit tx. If the commit tx gets re-orged out, the chain_watcher will be unaware, and the contractcourt subsystem will not properly handle this event.

from lnd.

Other call-sites that use RegisterSpendNtfn:

• breacharbiter.go
• contractcourt/commit_sweep_resolver.go
• contractcourt/htlc_outgoing_contest_resolver.go
• sweep/sweeper.go
  I haven't checked if the ones listed above properly handle re-orgs. I can update this issue once I check.

from lnd.

Sub-systems are not re-org safe:

• Sub-system grabs current-height after acquiring mutex
• chainntnfs receives: disconnected block, disconnected block, block (confirm/spend), block, block
• chainntnfs backend puts the blocks in a buffered channel
• Sub-system calls RegisterConfirmationsNtfn with the original height.
• Historical dispatch occurs from [height, height+1]
• The desired confirmation has occurred at height-1
• Sub-system grabs the blocks from its BlockEpochRegistration channel, finally updating its height to height+1.

The blocks are received before the call to txnotifier.RegisterConf, so they will not notify on the confirmation. This requires a 2-block re-org. Re-orgs are a global event, so while this race is unlikely, one re-org could affect one very unlucky user out of the thousands on the network.

from lnd.

Additionally, the onus seems to be on the sub-system or caller to handle re-orgs.

from lnd.