Optimistic channel handshake can result in a reset sending sequence and overwriting a packet commitment

[colin-axner]

Summary of Bug

The sequences:
NextSequenceSend
NextSequenceRecv
NextSequenceAck

are set in ChanOpenInit and ChanOpenTry. A packet is allowed to be optimistically sent on a channel in state INIT or TRYOPEN. If a packet is sent while the channel is in INIT but crossing hello's happens then a call to TRYOPEN would reset the sequence to 1, causing the packet commitment to be over written by the next packet being sent.

This bug was not exploitable since crossing hello's was accidentally disallowed as explained in #7605

I think the solution should be the same, if the previous channel exists then the sequence should not be overwritten.

---

For Admin Use

• Not duplicate issue
• Appropriate labels applied
• Appropriate contributors tagged
• Contributor assigned/self-assigned

[cwgoes]

Excellent catch; this also needs to be reflected in the spec.