Implement block_disconnect for pruning of waiting-conf HTLC updates
[rust-lightning] / src / ln / channelmonitor.rs
index 15db1426735b66643dde33477a43502be4ead2a1..379ae31c3ebb68cdab7542a5295d54fbca852971 100644 (file)
@@ -178,10 +178,6 @@ impl<Key : Send + cmp::Eq + hash::Hash> ChainListener for SimpleManyChannelMonit
                                                // In case of reorg we may have htlc outputs solved in a different way so
                                                // we prefer to keep claims but don't store duplicate updates for a given
                                                // (payment_hash, HTLCSource) pair.
-                                               // TODO: Note that we currently don't really use this as ChannelManager
-                                               // will fail/claim backwards after the first block. We really should delay
-                                               // a few blocks before failing backwards (but can claim backwards
-                                               // immediately) as long as we have a few blocks of headroom.
                                                let mut existing_claim = false;
                                                e.get_mut().retain(|htlc_data| {
                                                        if htlc.0 == htlc_data.0 {
@@ -205,7 +201,13 @@ impl<Key : Send + cmp::Eq + hash::Hash> ChainListener for SimpleManyChannelMonit
                pending_events.append(&mut new_events);
        }
 
-       fn block_disconnected(&self, _: &BlockHeader) { }
+       fn block_disconnected(&self, header: &BlockHeader, disconnected_height: u32) {
+               let block_hash = header.bitcoin_hash();
+               let mut monitors = self.monitors.lock().unwrap();
+               for monitor in monitors.values_mut() {
+                       monitor.block_disconnected(disconnected_height, &block_hash);
+               }
+       }
 }
 
 impl<Key : Send + cmp::Eq + hash::Hash + 'static> SimpleManyChannelMonitor<Key> {
@@ -306,7 +308,6 @@ pub(crate) const HTLC_FAIL_TIMEOUT_BLOCKS: u32 = 3;
 /// Number of blocks we wait on seeing a confirmed HTLC-Timeout or previous revoked commitment
 /// transaction before we fail corresponding inbound HTLCs. This prevents us from failing backwards
 /// and then getting a reorg resulting in us losing money.
-//TODO: We currently don't actually use this...we should
 pub(crate) const HTLC_FAIL_ANTI_REORG_DELAY: u32 = 6;
 
 #[derive(Clone, PartialEq)]
@@ -401,6 +402,8 @@ pub struct ChannelMonitor {
 
        destination_script: Script,
 
+       htlc_updated_waiting_threshold_conf: HashMap<u32, Vec<(HTLCSource, Option<PaymentPreimage>, PaymentHash)>>,
+
        // We simply modify last_block_hash in Channel's block_connected so that serialization is
        // consistent but hopefully the users' copy handles block_connected in a consistent way.
        // (we do *not*, however, update them in insert_combine to ensure any local user copies keep
@@ -411,6 +414,38 @@ pub struct ChannelMonitor {
        logger: Arc<Logger>,
 }
 
+macro_rules! subtract_high_prio_fee {
+       ($self: ident, $fee_estimator: expr, $value: expr, $predicted_weight: expr, $spent_txid: expr) => {
+               {
+                       let mut fee = $fee_estimator.get_est_sat_per_1000_weight(ConfirmationTarget::HighPriority) * $predicted_weight / 1000;
+                       if $value <= fee {
+                               fee = $fee_estimator.get_est_sat_per_1000_weight(ConfirmationTarget::Normal) * $predicted_weight / 1000;
+                               if $value <= fee {
+                                       fee = $fee_estimator.get_est_sat_per_1000_weight(ConfirmationTarget::Background) * $predicted_weight / 1000;
+                                       if $value <= fee {
+                                               log_error!($self, "Failed to generate an on-chain punishment tx spending {} as even low priority fee ({} sat) was more than the entire claim balance ({} sat)",
+                                                       $spent_txid, fee, $value);
+                                               false
+                                       } else {
+                                               log_warn!($self, "Used low priority fee for on-chain punishment tx spending {} as high priority fee was more than the entire claim balance ({} sat)",
+                                                       $spent_txid, $value);
+                                               $value -= fee;
+                                               true
+                                       }
+                               } else {
+                                       log_warn!($self, "Used medium priority fee for on-chain punishment tx spending {} as high priority fee was more than the entire claim balance ({} sat)",
+                                               $spent_txid, $value);
+                                       $value -= fee;
+                                       true
+                               }
+                       } else {
+                               $value -= fee;
+                               true
+                       }
+               }
+       }
+}
+
 #[cfg(any(test, feature = "fuzztarget"))]
 /// Used only in testing and fuzztarget to check serialization roundtrips don't change the
 /// underlying object
@@ -430,7 +465,8 @@ impl PartialEq for ChannelMonitor {
                        self.current_remote_commitment_number != other.current_remote_commitment_number ||
                        self.current_local_signed_commitment_tx != other.current_local_signed_commitment_tx ||
                        self.payment_preimages != other.payment_preimages ||
-                       self.destination_script != other.destination_script
+                       self.destination_script != other.destination_script ||
+                       self.htlc_updated_waiting_threshold_conf != other.htlc_updated_waiting_threshold_conf
                {
                        false
                } else {
@@ -480,6 +516,8 @@ impl ChannelMonitor {
                        payment_preimages: HashMap::new(),
                        destination_script: destination_script,
 
+                       htlc_updated_waiting_threshold_conf: HashMap::new(),
+
                        last_block_hash: Default::default(),
                        secp_ctx: Secp256k1::new(),
                        logger,
@@ -842,18 +880,8 @@ impl ChannelMonitor {
                                writer.write_all(&delayed_payment_base_key[..])?;
                                writer.write_all(&payment_base_key[..])?;
                                writer.write_all(&shutdown_pubkey.serialize())?;
-                               if let Some(ref prev_latest_per_commitment_point) = *prev_latest_per_commitment_point {
-                                       writer.write_all(&[1; 1])?;
-                                       writer.write_all(&prev_latest_per_commitment_point.serialize())?;
-                               } else {
-                                       writer.write_all(&[0; 1])?;
-                               }
-                               if let Some(ref latest_per_commitment_point) = *latest_per_commitment_point {
-                                       writer.write_all(&[1; 1])?;
-                                       writer.write_all(&latest_per_commitment_point.serialize())?;
-                               } else {
-                                       writer.write_all(&[0; 1])?;
-                               }
+                               prev_latest_per_commitment_point.write(writer)?;
+                               latest_per_commitment_point.write(writer)?;
                                match funding_info  {
                                        &Some((ref outpoint, ref script)) => {
                                                writer.write_all(&outpoint.txid[..])?;
@@ -864,8 +892,8 @@ impl ChannelMonitor {
                                                debug_assert!(false, "Try to serialize a useless Local monitor !");
                                        },
                                }
-                               write_option!(current_remote_commitment_txid);
-                               write_option!(prev_remote_commitment_txid);
+                               current_remote_commitment_txid.write(writer)?;
+                               prev_remote_commitment_txid.write(writer)?;
                        },
                        Storage::Watchtower { .. } => unimplemented!(),
                }
@@ -905,7 +933,7 @@ impl ChannelMonitor {
                                writer.write_all(&byte_utils::be64_to_array($htlc_output.amount_msat))?;
                                writer.write_all(&byte_utils::be32_to_array($htlc_output.cltv_expiry))?;
                                writer.write_all(&$htlc_output.payment_hash.0[..])?;
-                               write_option!(&$htlc_output.transaction_output_index);
+                               $htlc_output.transaction_output_index.write(writer)?;
                        }
                }
 
@@ -997,6 +1025,17 @@ impl ChannelMonitor {
                self.last_block_hash.write(writer)?;
                self.destination_script.write(writer)?;
 
+               writer.write_all(&byte_utils::be64_to_array(self.htlc_updated_waiting_threshold_conf.len() as u64))?;
+               for (ref target, ref updates) in self.htlc_updated_waiting_threshold_conf.iter() {
+                       writer.write_all(&byte_utils::be32_to_array(**target))?;
+                       writer.write_all(&byte_utils::be64_to_array(updates.len() as u64))?;
+                       for ref update in updates.iter() {
+                               update.0.write(writer)?;
+                               update.1.write(writer)?;
+                               update.2.write(writer)?;
+                       }
+               }
+
                Ok(())
        }
 
@@ -1060,13 +1099,12 @@ impl ChannelMonitor {
        /// HTLC-Success/HTLC-Timeout transactions.
        /// Return updates for HTLC pending in the channel and failed automatically by the broadcast of
        /// revoked remote commitment tx
-       fn check_spend_remote_transaction(&mut self, tx: &Transaction, height: u32, fee_estimator: &FeeEstimator) -> (Vec<Transaction>, (Sha256dHash, Vec<TxOut>), Vec<SpendableOutputDescriptor>, Vec<(HTLCSource, Option<PaymentPreimage>, PaymentHash)>)  {
+       fn check_spend_remote_transaction(&mut self, tx: &Transaction, height: u32, fee_estimator: &FeeEstimator) -> (Vec<Transaction>, (Sha256dHash, Vec<TxOut>), Vec<SpendableOutputDescriptor>) {
                // Most secp and related errors trying to create keys means we have no hope of constructing
                // a spend transaction...so we return no transactions to broadcast
                let mut txn_to_broadcast = Vec::new();
                let mut watch_outputs = Vec::new();
                let mut spendable_outputs = Vec::new();
-               let mut htlc_updated = Vec::new();
 
                let commitment_txid = tx.txid(); //TODO: This is gonna be a performance bottleneck for watchtowers!
                let per_commitment_option = self.remote_claimable_outpoints.get(&commitment_txid);
@@ -1075,7 +1113,7 @@ impl ChannelMonitor {
                        ( $thing : expr ) => {
                                match $thing {
                                        Ok(a) => a,
-                                       Err(_) => return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs, htlc_updated)
+                                       Err(_) => return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs)
                                }
                        };
                }
@@ -1100,7 +1138,7 @@ impl ChannelMonitor {
                        };
                        let delayed_key = ignore_error!(chan_utils::derive_public_key(&self.secp_ctx, &PublicKey::from_secret_key(&self.secp_ctx, &per_commitment_key), &self.their_delayed_payment_base_key.unwrap()));
                        let a_htlc_key = match self.their_htlc_base_key {
-                               None => return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs, htlc_updated),
+                               None => return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs),
                                Some(their_htlc_base_key) => ignore_error!(chan_utils::derive_public_key(&self.secp_ctx, &PublicKey::from_secret_key(&self.secp_ctx, &per_commitment_key), &their_htlc_base_key)),
                        };
 
@@ -1182,7 +1220,7 @@ impl ChannelMonitor {
                                                if transaction_output_index as usize >= tx.output.len() ||
                                                                tx.output[transaction_output_index as usize].value != htlc.amount_msat / 1000 ||
                                                                tx.output[transaction_output_index as usize].script_pubkey != expected_script.to_v0_p2wsh() {
-                                                       return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs, htlc_updated); // Corrupted per_commitment_data, fuck this user
+                                                       return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs); // Corrupted per_commitment_data, fuck this user
                                                }
                                                let input = TxIn {
                                                        previous_output: BitcoinOutPoint {
@@ -1209,10 +1247,13 @@ impl ChannelMonitor {
                                                                        value: htlc.amount_msat / 1000,
                                                                }),
                                                        };
-                                                       single_htlc_tx.output[0].value -= fee_estimator.get_est_sat_per_1000_weight(ConfirmationTarget::HighPriority) * (single_htlc_tx.get_weight() + Self::get_witnesses_weight(&[if htlc.offered { InputDescriptors::RevokedOfferedHTLC } else { InputDescriptors::RevokedReceivedHTLC }])) / 1000;
-                                                       let sighash_parts = bip143::SighashComponents::new(&single_htlc_tx);
-                                                       sign_input!(sighash_parts, single_htlc_tx.input[0], Some(idx), htlc.amount_msat / 1000);
-                                                       txn_to_broadcast.push(single_htlc_tx);
+                                                       let predicted_weight = single_htlc_tx.get_weight() + Self::get_witnesses_weight(&[if htlc.offered { InputDescriptors::RevokedOfferedHTLC } else { InputDescriptors::RevokedReceivedHTLC }]);
+                                                       if subtract_high_prio_fee!(self, fee_estimator, single_htlc_tx.output[0].value, predicted_weight, tx.txid()) {
+                                                               let sighash_parts = bip143::SighashComponents::new(&single_htlc_tx);
+                                                               sign_input!(sighash_parts, single_htlc_tx.input[0], Some(idx), htlc.amount_msat / 1000);
+                                                               assert!(predicted_weight >= single_htlc_tx.get_weight());
+                                                               txn_to_broadcast.push(single_htlc_tx);
+                                                       }
                                                }
                                        }
                                }
@@ -1224,16 +1265,22 @@ impl ChannelMonitor {
                                watch_outputs.append(&mut tx.output.clone());
                                self.remote_commitment_txn_on_chain.insert(commitment_txid, (commitment_number, tx.output.iter().map(|output| { output.script_pubkey.clone() }).collect()));
 
-                               // TODO: We really should only fail backwards after our revocation claims have been
-                               // confirmed, but we also need to do more other tracking of in-flight pre-confirm
-                               // on-chain claims, so we can do that at the same time.
                                macro_rules! check_htlc_fails {
                                        ($txid: expr, $commitment_tx: expr) => {
                                                if let Some(ref outpoints) = self.remote_claimable_outpoints.get($txid) {
                                                        for &(ref htlc, ref source_option) in outpoints.iter() {
                                                                if let &Some(ref source) = source_option {
-                                                                       log_trace!(self, "Failing HTLC with payment_hash {} from {} remote commitment tx due to broadcast of revoked remote commitment transaction", log_bytes!(htlc.payment_hash.0), $commitment_tx);
-                                                                       htlc_updated.push(((**source).clone(), None, htlc.payment_hash.clone()));
+                                                                       log_info!(self, "Failing HTLC with payment_hash {} from {} remote commitment tx due to broadcast of revoked remote commitment transaction, waiting for confirmation (at height {})", log_bytes!(htlc.payment_hash.0), $commitment_tx, height + HTLC_FAIL_ANTI_REORG_DELAY - 1);
+                                                                       match self.htlc_updated_waiting_threshold_conf.entry(height + HTLC_FAIL_ANTI_REORG_DELAY - 1) {
+                                                                               hash_map::Entry::Occupied(mut entry) => {
+                                                                                       let e = entry.get_mut();
+                                                                                       e.retain(|ref update| update.0 != **source);
+                                                                                       e.push(((**source).clone(), None, htlc.payment_hash.clone()));
+                                                                               }
+                                                                               hash_map::Entry::Vacant(entry) => {
+                                                                                       entry.insert(vec![((**source).clone(), None, htlc.payment_hash.clone())]);
+                                                                               }
+                                                                       }
                                                                }
                                                        }
                                                }
@@ -1249,7 +1296,7 @@ impl ChannelMonitor {
                                }
                                // No need to check local commitment txn, symmetric HTLCSource must be present as per-htlc data on remote commitment tx
                        }
-                       if inputs.is_empty() { return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs, htlc_updated); } // Nothing to be done...probably a false positive/local tx
+                       if inputs.is_empty() { return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs); } // Nothing to be done...probably a false positive/local tx
 
                        let outputs = vec!(TxOut {
                                script_pubkey: self.destination_script.clone(),
@@ -1261,7 +1308,11 @@ impl ChannelMonitor {
                                input: inputs,
                                output: outputs,
                        };
-                       spend_tx.output[0].value -= fee_estimator.get_est_sat_per_1000_weight(ConfirmationTarget::HighPriority) * (spend_tx.get_weight() + Self::get_witnesses_weight(&input_descriptors[..])) / 1000;
+                       let predicted_weight = spend_tx.get_weight() + Self::get_witnesses_weight(&input_descriptors[..]);
+
+                       if !subtract_high_prio_fee!(self, fee_estimator, spend_tx.output[0].value, predicted_weight, tx.txid()) {
+                               return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs);
+                       }
 
                        let mut values_drain = values.drain(..);
                        let sighash_parts = bip143::SighashComponents::new(&spend_tx);
@@ -1270,6 +1321,7 @@ impl ChannelMonitor {
                                let value = values_drain.next().unwrap();
                                sign_input!(sighash_parts, input, htlc_idx, value);
                        }
+                       assert!(predicted_weight >= spend_tx.get_weight());
 
                        spendable_outputs.push(SpendableOutputDescriptor::StaticOutput {
                                outpoint: BitcoinOutPoint { txid: spend_tx.txid(), vout: 0 },
@@ -1289,9 +1341,6 @@ impl ChannelMonitor {
 
                        log_trace!(self, "Got broadcast of non-revoked remote commitment transaction {}", commitment_txid);
 
-                       // TODO: We really should only fail backwards after our revocation claims have been
-                       // confirmed, but we also need to do more other tracking of in-flight pre-confirm
-                       // on-chain claims, so we can do that at the same time.
                        macro_rules! check_htlc_fails {
                                ($txid: expr, $commitment_tx: expr, $id: tt) => {
                                        if let Some(ref latest_outpoints) = self.remote_claimable_outpoints.get($txid) {
@@ -1312,7 +1361,16 @@ impl ChannelMonitor {
                                                                        }
                                                                }
                                                                log_trace!(self, "Failing HTLC with payment_hash {} from {} remote commitment tx due to broadcast of remote commitment transaction", log_bytes!(htlc.payment_hash.0), $commitment_tx);
-                                                               htlc_updated.push(((**source).clone(), None, htlc.payment_hash.clone()));
+                                                               match self.htlc_updated_waiting_threshold_conf.entry(height + HTLC_FAIL_ANTI_REORG_DELAY - 1) {
+                                                                       hash_map::Entry::Occupied(mut entry) => {
+                                                                               let e = entry.get_mut();
+                                                                               e.retain(|ref update| update.0 != **source);
+                                                                               e.push(((**source).clone(), None, htlc.payment_hash.clone()));
+                                                                       }
+                                                                       hash_map::Entry::Vacant(entry) => {
+                                                                               entry.insert(vec![((**source).clone(), None, htlc.payment_hash.clone())]);
+                                                                       }
+                                                               }
                                                        }
                                                }
                                        }
@@ -1345,7 +1403,7 @@ impl ChannelMonitor {
                                                },
                                        };
                                        let a_htlc_key = match self.their_htlc_base_key {
-                                               None => return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs, htlc_updated),
+                                               None => return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs),
                                                Some(their_htlc_base_key) => ignore_error!(chan_utils::derive_public_key(&self.secp_ctx, revocation_point, &their_htlc_base_key)),
                                        };
 
@@ -1401,7 +1459,7 @@ impl ChannelMonitor {
                                                        if transaction_output_index as usize >= tx.output.len() ||
                                                                        tx.output[transaction_output_index as usize].value != htlc.amount_msat / 1000 ||
                                                                        tx.output[transaction_output_index as usize].script_pubkey != expected_script.to_v0_p2wsh() {
-                                                               return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs, htlc_updated); // Corrupted per_commitment_data, fuck this user
+                                                               return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs); // Corrupted per_commitment_data, fuck this user
                                                        }
                                                        if let Some(payment_preimage) = self.payment_preimages.get(&htlc.payment_hash) {
                                                                let input = TxIn {
@@ -1428,14 +1486,17 @@ impl ChannelMonitor {
                                                                                        value: htlc.amount_msat / 1000,
                                                                                }),
                                                                        };
-                                                                       single_htlc_tx.output[0].value -= fee_estimator.get_est_sat_per_1000_weight(ConfirmationTarget::HighPriority) * (single_htlc_tx.get_weight() + Self::get_witnesses_weight(&[if htlc.offered { InputDescriptors::OfferedHTLC } else { InputDescriptors::ReceivedHTLC }])) / 1000;
-                                                                       let sighash_parts = bip143::SighashComponents::new(&single_htlc_tx);
-                                                                       sign_input!(sighash_parts, single_htlc_tx.input[0], htlc.amount_msat / 1000, payment_preimage.0.to_vec());
-                                                                       spendable_outputs.push(SpendableOutputDescriptor::StaticOutput {
-                                                                               outpoint: BitcoinOutPoint { txid: single_htlc_tx.txid(), vout: 0 },
-                                                                               output: single_htlc_tx.output[0].clone(),
-                                                                       });
-                                                                       txn_to_broadcast.push(single_htlc_tx);
+                                                                       let predicted_weight = single_htlc_tx.get_weight() + Self::get_witnesses_weight(&[if htlc.offered { InputDescriptors::OfferedHTLC } else { InputDescriptors::ReceivedHTLC }]);
+                                                                       if subtract_high_prio_fee!(self, fee_estimator, single_htlc_tx.output[0].value, predicted_weight, tx.txid()) {
+                                                                               let sighash_parts = bip143::SighashComponents::new(&single_htlc_tx);
+                                                                               sign_input!(sighash_parts, single_htlc_tx.input[0], htlc.amount_msat / 1000, payment_preimage.0.to_vec());
+                                                                               assert!(predicted_weight >= single_htlc_tx.get_weight());
+                                                                               spendable_outputs.push(SpendableOutputDescriptor::StaticOutput {
+                                                                                       outpoint: BitcoinOutPoint { txid: single_htlc_tx.txid(), vout: 0 },
+                                                                                       output: single_htlc_tx.output[0].clone(),
+                                                                               });
+                                                                               txn_to_broadcast.push(single_htlc_tx);
+                                                                       }
                                                                }
                                                        }
                                                        if !htlc.offered {
@@ -1466,7 +1527,7 @@ impl ChannelMonitor {
                                                }
                                        }
 
-                                       if inputs.is_empty() { return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs, htlc_updated); } // Nothing to be done...probably a false positive/local tx
+                                       if inputs.is_empty() { return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs); } // Nothing to be done...probably a false positive/local tx
 
                                        let outputs = vec!(TxOut {
                                                script_pubkey: self.destination_script.clone(),
@@ -1478,7 +1539,10 @@ impl ChannelMonitor {
                                                input: inputs,
                                                output: outputs,
                                        };
-                                       spend_tx.output[0].value -= fee_estimator.get_est_sat_per_1000_weight(ConfirmationTarget::HighPriority) * (spend_tx.get_weight() + Self::get_witnesses_weight(&input_descriptors[..])) / 1000;
+                                       let predicted_weight = spend_tx.get_weight() + Self::get_witnesses_weight(&input_descriptors[..]);
+                                       if !subtract_high_prio_fee!(self, fee_estimator, spend_tx.output[0].value, predicted_weight, tx.txid()) {
+                                               return (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs);
+                                       }
 
                                        let mut values_drain = values.drain(..);
                                        let sighash_parts = bip143::SighashComponents::new(&spend_tx);
@@ -1488,6 +1552,7 @@ impl ChannelMonitor {
                                                sign_input!(sighash_parts, input, value.0, (value.1).0.to_vec());
                                        }
 
+                                       assert!(predicted_weight >= spend_tx.get_weight());
                                        spendable_outputs.push(SpendableOutputDescriptor::StaticOutput {
                                                outpoint: BitcoinOutPoint { txid: spend_tx.txid(), vout: 0 },
                                                output: spend_tx.output[0].clone(),
@@ -1497,7 +1562,7 @@ impl ChannelMonitor {
                        }
                }
 
-               (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs, htlc_updated)
+               (txn_to_broadcast, (commitment_txid, watch_outputs), spendable_outputs)
        }
 
        /// Attempts to claim a remote HTLC-Success/HTLC-Timeout's outputs using the revocation key
@@ -1562,7 +1627,10 @@ impl ChannelMonitor {
                                input: inputs,
                                output: outputs,
                        };
-                       spend_tx.output[0].value -= fee_estimator.get_est_sat_per_1000_weight(ConfirmationTarget::HighPriority) * (spend_tx.get_weight() + Self::get_witnesses_weight(&vec![InputDescriptors::RevokedOutput])) / 1000;
+                       let predicted_weight = spend_tx.get_weight() + Self::get_witnesses_weight(&[InputDescriptors::RevokedOutput]);
+                       if !subtract_high_prio_fee!(self, fee_estimator, spend_tx.output[0].value, predicted_weight, tx.txid()) {
+                               return (None, None);
+                       }
 
                        let sighash_parts = bip143::SighashComponents::new(&spend_tx);
 
@@ -1581,6 +1649,7 @@ impl ChannelMonitor {
                        spend_tx.input[0].witness.push(vec!(1));
                        spend_tx.input[0].witness.push(redeemscript.into_bytes());
 
+                       assert!(predicted_weight >= spend_tx.get_weight());
                        let outpoint = BitcoinOutPoint { txid: spend_tx.txid(), vout: 0 };
                        let output = spend_tx.output[0].clone();
                        (Some(spend_tx), Some(SpendableOutputDescriptor::StaticOutput { outpoint, output }))
@@ -1770,7 +1839,7 @@ impl ChannelMonitor {
                                        }
                                };
                                if funding_txo.is_none() || (prevout.txid == funding_txo.as_ref().unwrap().0.txid && prevout.vout == funding_txo.as_ref().unwrap().0.index as u32) {
-                                       let (remote_txn, new_outputs, mut spendable_output, mut updated) = self.check_spend_remote_transaction(tx, height, fee_estimator);
+                                       let (remote_txn, new_outputs, mut spendable_output) = self.check_spend_remote_transaction(tx, height, fee_estimator);
                                        txn = remote_txn;
                                        spendable_outputs.append(&mut spendable_output);
                                        if !new_outputs.1.is_empty() {
@@ -1789,9 +1858,6 @@ impl ChannelMonitor {
                                                        spendable_outputs.push(spendable_output);
                                                }
                                        }
-                                       if updated.len() > 0 {
-                                               htlc_updated.append(&mut updated);
-                                       }
                                } else {
                                        if let Some(&(commitment_number, _)) = self.remote_commitment_txn_on_chain.get(&prevout.txid) {
                                                let (tx, spendable_output) = self.check_spend_remote_htlc(tx, commitment_number, fee_estimator);
@@ -1842,10 +1908,23 @@ impl ChannelMonitor {
                                }
                        }
                }
+               if let Some(updates) = self.htlc_updated_waiting_threshold_conf.remove(&height) {
+                       for update in updates {
+                               log_trace!(self, "HTLC {} failure update has get enough confirmation to be pass upstream", log_bytes!((update.2).0));
+                               htlc_updated.push(update);
+                       }
+               }
                self.last_block_hash = block_hash.clone();
                (watch_outputs, spendable_outputs, htlc_updated)
        }
 
+       fn block_disconnected(&mut self, height: u32, block_hash: &Sha256dHash) {
+               if let Some(_) = self.htlc_updated_waiting_threshold_conf.remove(&(height + HTLC_FAIL_ANTI_REORG_DELAY - 1)) {
+                       //We discard htlc update there as failure-trigger tx (revoked commitment tx, non-revoked commitment tx, HTLC-timeout tx) has been disconnected
+               }
+               self.last_block_hash = block_hash.clone();
+       }
+
        pub(super) fn would_broadcast_at_height(&self, height: u32) -> bool {
                // We need to consider all HTLCs which are:
                //  * in any unrevoked remote commitment transaction, as they could broadcast said
@@ -2242,6 +2321,21 @@ impl<R: ::std::io::Read> ReadableArgs<R, Arc<Logger>> for (Sha256dHash, ChannelM
                let last_block_hash: Sha256dHash = Readable::read(reader)?;
                let destination_script = Readable::read(reader)?;
 
+               let waiting_threshold_conf_len: u64 = Readable::read(reader)?;
+               let mut htlc_updated_waiting_threshold_conf = HashMap::with_capacity(cmp::min(waiting_threshold_conf_len as usize, MAX_ALLOC_SIZE / 128));
+               for _ in 0..waiting_threshold_conf_len {
+                       let height_target = Readable::read(reader)?;
+                       let updates_len: u64 = Readable::read(reader)?;
+                       let mut updates = Vec::with_capacity(cmp::min(updates_len as usize, MAX_ALLOC_SIZE / 128));
+                       for _ in 0..updates_len {
+                               let htlc_source = Readable::read(reader)?;
+                               let preimage = Readable::read(reader)?;
+                               let hash = Readable::read(reader)?;
+                               updates.push((htlc_source, preimage, hash));
+                       }
+                       htlc_updated_waiting_threshold_conf.insert(height_target, updates);
+               }
+
                Ok((last_block_hash.clone(), ChannelMonitor {
                        commitment_transaction_number_obscure_factor,
 
@@ -2265,6 +2359,9 @@ impl<R: ::std::io::Read> ReadableArgs<R, Arc<Logger>> for (Sha256dHash, ChannelM
                        payment_preimages,
 
                        destination_script,
+
+                       htlc_updated_waiting_threshold_conf,
+
                        last_block_hash,
                        secp_ctx,
                        logger,
@@ -2831,7 +2928,7 @@ mod tests {
                for (idx, inp) in claim_tx.input.iter_mut().zip(inputs_des.iter()).enumerate() {
                        sign_input!(sighash_parts, inp.0, idx as u32, 0, inp.1, sum_actual_sigs);
                }
-               assert_eq!(base_weight + ChannelMonitor::get_witnesses_weight(&inputs_des),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() as u64 - sum_actual_sigs));
+               assert_eq!(base_weight + ChannelMonitor::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() as u64 - sum_actual_sigs));
 
                // Claim tx with 1 offered HTLCs, 3 received HTLCs
                claim_tx.input.clear();
@@ -2853,7 +2950,7 @@ mod tests {
                for (idx, inp) in claim_tx.input.iter_mut().zip(inputs_des.iter()).enumerate() {
                        sign_input!(sighash_parts, inp.0, idx as u32, 0, inp.1, sum_actual_sigs);
                }
-               assert_eq!(base_weight + ChannelMonitor::get_witnesses_weight(&inputs_des),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() as u64 - sum_actual_sigs));
+               assert_eq!(base_weight + ChannelMonitor::get_witnesses_weight(&inputs_des[..]),  claim_tx.get_weight() + /* max_length_sig */ (73 * inputs_des.len() as u64 - sum_actual_sigs));
 
                // Justice tx with 1 revoked HTLC-Success tx output
                claim_tx.input.clear();
@@ -2873,7 +2970,7 @@ mod tests {
                for (idx, inp) in claim_tx.input.iter_mut().zip(inputs_des.iter()).enumerate() {
                        sign_input!(sighash_parts, inp.0, idx as u32, 0, inp.1, sum_actual_sigs);
                }
-               assert_eq!(base_weight + ChannelMonitor::get_witnesses_weight(&inputs_des), claim_tx.get_weight() + /* max_length_isg */ (73 * inputs_des.len() as u64 - sum_actual_sigs));
+               assert_eq!(base_weight + ChannelMonitor::get_witnesses_weight(&inputs_des[..]), claim_tx.get_weight() + /* max_length_isg */ (73 * inputs_des.len() as u64 - sum_actual_sigs));
        }
 
        // Further testing is done in the ChannelManager integration tests.