HTLCs Explained: How Lightning Routes Conditional Payments

HTLCs explained for Lightning: follow payment hashes, preimages, CLTV expiries, multi-hop routing, failure handling and on-chain resolution.

Hash locks and time locks

An HTLC is a conditional transfer controlled by a payment hash and an expiry. The receiver can claim it by revealing the matching preimage before the deadline. If fulfilment never arrives, the sender can recover value after timeout. Lightning combines these conditions across channel commitments so a routed payment either completes hop by hop or fails back toward the payer.

Start with the validating node, because the ASIC only hashes the candidate header it receives. Record the node release and the pool component that assembled the block. If those facts are unknown, the operator cannot show which rules were actually applied before electricity was committed to the work.

Creating the payment hash

The final recipient generates a secret preimage and gives the payer its cryptographic hash through an invoice or payment protocol. Intermediate nodes see the hash, not the secret. A correct preimage proves the same condition to every hop. Reusing payment secrets or mishandling invoices can weaken privacy and failure isolation even when the cryptography remains valid.

Treat status dashboards as observations, not as the source of truth. Compare them with an independently operated node and retain the raw deployment or template response. Period boundaries, chain reorganisations and cached pool pages can otherwise make a correct-looking percentage describe the wrong state.

Expiry decreases along the route

Each forwarded HTLC has a CLTV expiry earlier for the outgoing side and later for the incoming side, leaving the forwarding node time to react on chain. The difference is the CLTV delta. A route with excessive cumulative delta ties up funds for longer. At the same time, a delta that is too small can leave a node unable to claim upstream after resolving downstream.

Build the failure response before the boundary arrives. Define which rejection messages trigger an alert, who can pause a template source and how failover is prevented from returning miners to the same faulty validation stack. A second hostname is not independent when both endpoints share one node.

Fulfilment travels backwards

The recipient reveals the preimage to its incoming peer. Each intermediate node verifies it, fulfils the incoming HTLC and forwards the same secret upstream until the payer’s first hop settles. Commitment updates make the balance movement durable at each channel. The route does not rely on every participant trusting the next node to pay later.

Separate readiness, signalling and enforcement in the operating log. Readiness is a claim about software and process, signalling is data carried by blocks, and enforcement is a validation result. Combining them into a single supported or unsupported label hides the point at which revenue is actually at risk.

Failure and retry

A node can reject an HTLC for insufficient liquidity, disabled channels, fee mismatch, expiry errors or temporary conditions. Onion-encrypted failure messages travel back to the payer. This may choose another route. Repeated attempts can leak information or lock liquidity. So implementations limit retries and should distinguish local configuration problems from ordinary path failure.

Map responsibility across the full path: validating node, template server, pool protocol, proxy, firmware and ASIC. For each layer, state what it can alter and what it merely relays. This prevents a version-bit setting in firmware from being mistaken for complete consensus-rule support. Relate that responsibility map to the pool and job-control boundary in our Stratum V2 guide.

On-chain resolution

If peers stop cooperating, commitment and HTLC-success or HTLC-timeout transactions enforce the conditions on Bitcoin. The exact path depends on which commitment is broadcast and whether the preimage is known. On-chain resolution consumes fees and confirmations. Nodes need current feerate estimates and enough reserve to avoid uneconomic or delayed recovery.

Test the primary and failover paths with the same checks. Compare chain tip, chainwork, deployment state, required rules and template age, then save the result with a timestamp. The process should be repeatable by another operator without relying on an undocumented pool conversation.

Operator measurements

Track pending HTLC count and value, expiry distance, failure codes, channel liquidity and peer uptime. Alert when HTLCs approach the safety threshold for unilateral action. Keep the Bitcoin backend synchronised and verify that force-close transactions can be fee bumped where supported. Routing revenue should be assessed against locked capital and on-chain risk, not successful forwards alone.

Turn the conclusion into a business decision. State which chain and settlement venues the operation intends to serve, the maximum acceptable stale-block exposure and the point at which mining pauses. This connects protocol evidence to electricity cost, pool revenue and payout finality.

Operator decision record

A concise decision record for HTLCs explained should name the source documents, their dates, the node release tested, the responsible pool or template provider and the exact trigger for action. Include screenshots or machine-readable output for the deployment state. But keep the raw node response as the stronger evidence.

State whether a change affects policy, block construction or consensus validity, because those layers have different failure costs.

Run the check on every production and failover path. Confirm that monitoring alerts on stale templates, unexpected chain tips, rejected proposals and a rise in stale shares. Keep rollback instructions for node and pool configuration. But do not roll back across an active consensus boundary without understanding the rules the older release enforces.

If the evidence conflicts, pause the affected path and investigate before committing more electricity to uncertain work.

For related background, read our plain-English BIP-110 guide and technical BIP-110 review. Those articles use a modern proposal to show why signalling, activation, template construction and accepted chain history must be examined separately.

Conclusion

Htlcs explained is best understood as a defined interaction between validating software, mining infrastructure and economic acceptance. The safest operator does not infer consensus from a dashboard percentage or a pool slogan. They verify the rule source, the activation boundary, the template fields and the chain their payouts ultimately settle on. That discipline reduces the chance of hashing an invalid or commercially unwanted block.