daemons: use amount_msat/amount_sat in all internal wire transfers.

As a side-effect of using amount_msat in gossipd/routing.c, we explicitly
handle overflows and don't need to pre-prune ridiculous-fee channels.

Signed-off-by: Rusty Russell <rusty@rustcorp.com.au>

lightningd/channel.c

@@ -145,14 +145,14 @@ struct channel *new_channel(struct peer *peer, u64 dbid,
 			    u64 next_htlc_id,
 			    const struct bitcoin_txid *funding_txid,
 			    u16 funding_outnum,
-			    u64 funding_satoshi,
-			    u64 push_msat,
+			    struct amount_sat funding,
+			    struct amount_msat push,
 			    bool remote_funding_locked,
 			    /* NULL or stolen */
 			    struct short_channel_id *scid,
-			    u64 our_msatoshi,
-			    u64 msatoshi_to_us_min,
-			    u64 msatoshi_to_us_max,
+			    struct amount_msat our_msat,
+			    struct amount_msat msat_to_us_min,
+			    struct amount_msat msat_to_us_max,
 			    /* Stolen */
 			    struct bitcoin_tx *last_tx,
 			    const struct bitcoin_signature *last_sig,
@@ -210,13 +210,13 @@ struct channel *new_channel(struct peer *peer, u64 dbid,
 	channel->next_htlc_id = next_htlc_id;
 	channel->funding_txid = *funding_txid;
 	channel->funding_outnum = funding_outnum;
-	channel->funding_satoshi = funding_satoshi;
-	channel->push_msat = push_msat;
+	channel->funding = funding;
+	channel->push = push;
 	channel->remote_funding_locked = remote_funding_locked;
 	channel->scid = tal_steal(channel, scid);
-	channel->our_msatoshi = our_msatoshi;
-	channel->msatoshi_to_us_min = msatoshi_to_us_min;
-	channel->msatoshi_to_us_max = msatoshi_to_us_max;
+	channel->our_msat = our_msat;
+	channel->msat_to_us_min = msat_to_us_min;
+	channel->msat_to_us_max = msat_to_us_max;
 	channel->last_tx = tal_steal(channel, last_tx);
 	channel->last_sig = *last_sig;
 	channel->last_htlc_sigs = tal_steal(channel, last_htlc_sigs);

lightningd/channel.h

@@ -59,16 +59,17 @@ struct channel {
 	/* Funding txid and amounts */
 	struct bitcoin_txid funding_txid;
 	u16 funding_outnum;
-	u64 funding_satoshi, push_msat;
+	struct amount_sat funding;
+	struct amount_msat push;
 	bool remote_funding_locked;
 	/* Channel if locked locally. */
 	struct short_channel_id *scid;
 
 	/* Amount going to us, not counting unfinished HTLCs; if we have one. */
-	u64 our_msatoshi;
+	struct amount_msat our_msat;
 	/* Statistics for min and max our_msatoshi. */
-	u64 msatoshi_to_us_min;
-	u64 msatoshi_to_us_max;
+	struct amount_msat msat_to_us_min;
+	struct amount_msat msat_to_us_max;
 
 	/* Timer we use in case they don't add an HTLC in a timely manner. */
 	struct oneshot *htlc_timeout;
@@ -127,14 +128,14 @@ struct channel *new_channel(struct peer *peer, u64 dbid,
 			    u64 next_htlc_id,
 			    const struct bitcoin_txid *funding_txid,
 			    u16 funding_outnum,
-			    u64 funding_satoshi,
-			    u64 push_msat,
+			    struct amount_sat funding,
+			    struct amount_msat push,
 			    bool remote_funding_locked,
 			    /* NULL or stolen */
 			    struct short_channel_id *scid,
-			    u64 our_msatoshi,
-			    u64 msatoshi_to_us_min,
-			    u64 msatoshi_to_us_max,
+			    struct amount_msat our_msatoshi,
+			    struct amount_msat msatoshi_to_us_min,
+			    struct amount_msat msatoshi_to_us_max,
 			    /* Stolen */
 			    struct bitcoin_tx *last_tx,
 			    const struct bitcoin_signature *last_sig,

lightningd/channel_control.c

@@ -339,7 +339,7 @@ void peer_start_channeld(struct channel *channel,
 				      &get_chainparams(ld)->genesis_blockhash,
 				      &channel->funding_txid,
 				      channel->funding_outnum,
-				      channel->funding_satoshi,
+				      channel->funding,
 				      &channel->our_config,
 				      &channel->channel_info.their_config,
 				      channel->channel_info.feerate_per_kw,
@@ -354,7 +354,7 @@ void peer_start_channeld(struct channel *channel,
 				      channel->funder,
 				      cfg->fee_base,
 				      cfg->fee_per_satoshi,
-				      channel->our_msatoshi,
+				      channel->our_msat,
 				      &channel->local_basepoints,
 				      &channel->local_funding_pubkey,
 				      &ld->id,

lightningd/closing_control.c

@@ -17,6 +17,19 @@
 #include <lightningd/peer_control.h>
 #include <lightningd/subd.h>
 
+static struct amount_sat calc_tx_fee(struct amount_sat sat_in,
+				     const struct bitcoin_tx *tx)
+{
+	struct amount_sat fee = sat_in;
+	for (size_t i = 0; i < tal_count(tx->output); i++) {
+		if (!amount_sat_sub(&fee, fee, (struct amount_sat){tx->output[i].amount}))
+			fatal("Tx spends more than input %s? %s",
+			      type_to_string(tmpctx, struct amount_sat, &sat_in),
+			      type_to_string(tmpctx, struct bitcoin_tx, tx));
+	}
+	return fee;
+}
+
 /* Is this better than the last tx we were holding?  This can happen
  * even without closingd misbehaving, if we have multiple,
  * interrupted, rounds of negotiation. */
@@ -24,22 +37,19 @@ static bool better_closing_fee(struct lightningd *ld,
 			       struct channel *channel,
 			       const struct bitcoin_tx *tx)
 {
-	u64 weight, fee, last_fee, min_fee;
+	struct amount_sat fee, last_fee, min_fee;
+	u64 weight;
 	u32 min_feerate;
-	size_t i;
 	bool feerate_unknown;
 
 	/* Calculate actual fee (adds in eliminated outputs) */
-	fee = channel->funding_satoshi;
-	for (i = 0; i < tal_count(tx->output); i++)
-		fee -= tx->output[i].amount;
+	fee = calc_tx_fee(channel->funding, tx);
+	last_fee = calc_tx_fee(channel->funding, channel->last_tx);
 
-	last_fee = channel->funding_satoshi;
-	for (i = 0; i < tal_count(channel->last_tx->output); i++)
-		last_fee -= channel->last_tx->output[i].amount;
-
-	log_debug(channel->log, "Their actual closing tx fee is %"PRIu64
-		 " vs previous %"PRIu64, fee, last_fee);
+	log_debug(channel->log, "Their actual closing tx fee is %s"
+		 " vs previous %s",
+		  type_to_string(tmpctx, struct amount_sat, &fee),
+		  type_to_string(tmpctx, struct amount_sat, &last_fee));
 
 	/* Weight once we add in sigs. */
 	weight = measure_tx_weight(tx) + 74 * 2;
@@ -47,11 +57,12 @@ static bool better_closing_fee(struct lightningd *ld,
 	/* If we don't have a feerate estimate, this gives feerate_floor */
 	min_feerate = feerate_min(ld, &feerate_unknown);
 
-	min_fee = min_feerate * weight / 1000;
-	if (fee < min_fee) {
-		log_debug(channel->log, "... That's below our min %"PRIu64
-			 " for weight %"PRIu64" at feerate %u",
-			 min_fee, weight, min_feerate);
+	min_fee = amount_tx_fee(min_feerate, weight);
+	if (amount_sat_less(fee, min_fee)) {
+		log_debug(channel->log, "... That's below our min %s"
+			  " for weight %"PRIu64" at feerate %u",
+			  type_to_string(tmpctx, struct amount_sat, &fee),
+			  weight, min_feerate);
 		return false;
 	}
 
@@ -60,10 +71,10 @@ static bool better_closing_fee(struct lightningd *ld,
 
 	/* If we don't know the feerate, prefer higher fee. */
 	if (feerate_unknown)
-		return fee >= last_fee;
+		return amount_sat_greater_eq(fee, last_fee);
 
 	/* Otherwise prefer lower fee. */
-	return fee <= last_fee;
+	return amount_sat_less_eq(fee, last_fee);
 }
 
 static void peer_received_closing_signature(struct channel *channel,
@@ -143,9 +154,9 @@ void peer_start_closingd(struct channel *channel,
 {
 	u8 *initmsg;
 	u32 feerate;
-	u64 minfee, startfee, feelimit;
+	struct amount_sat minfee, startfee, feelimit;
 	u64 num_revocations;
-	u64 funding_msatoshi, our_msatoshi, their_msatoshi;
+	struct amount_msat their_msat;
 	int hsmfd;
 	struct lightningd *ld = channel->peer->ld;
 
@@ -185,10 +196,10 @@ void peer_start_closingd(struct channel *channel,
 	 *    [BOLT #3](03-transactions.md#fee-calculation).
 	 */
 	feelimit = commit_tx_base_fee(channel->channel_info.feerate_per_kw[LOCAL],
-				      0).satoshis;
+				      0);
 
 	/* Pick some value above slow feerate (or min possible if unknown) */
-	minfee = commit_tx_base_fee(feerate_min(ld, NULL), 0).satoshis;
+	minfee = commit_tx_base_fee(feerate_min(ld, NULL), 0);
 
 	/* If we can't determine feerate, start at half unilateral feerate. */
 	feerate = mutual_close_feerate(ld->topology);
@@ -197,11 +208,11 @@ void peer_start_closingd(struct channel *channel,
 		if (feerate < feerate_floor())
 			feerate = feerate_floor();
 	}
-	startfee = commit_tx_base_fee(feerate, 0).satoshis;
+	startfee = commit_tx_base_fee(feerate, 0);
 
-	if (startfee > feelimit)
+	if (amount_sat_greater(startfee, feelimit))
 		startfee = feelimit;
-	if (minfee > feelimit)
+	if (amount_sat_greater(minfee, feelimit))
 		minfee = feelimit;
 
 	num_revocations
@@ -212,22 +223,28 @@ void peer_start_closingd(struct channel *channel,
 	 * Each node offering a signature:
 	 *  - MUST round each output down to whole satoshis.
 	 */
-	/* Convert unit */
-	funding_msatoshi = channel->funding_satoshi * 1000;
 	/* What is not ours is theirs */
-	our_msatoshi = channel->our_msatoshi;
-	their_msatoshi = funding_msatoshi - our_msatoshi;
+	if (!amount_sat_sub_msat(&their_msat,
+				 channel->funding, channel->our_msat)) {
+		log_broken(channel->log, "our_msat overflow funding %s minus %s",
+			  type_to_string(tmpctx, struct amount_sat,
+					 &channel->funding),
+			  type_to_string(tmpctx, struct amount_msat,
+					 &channel->our_msat));
+		channel_fail_permanent(channel, "our_msat overflow on closing");
+		return;
+	}
 	initmsg = towire_closing_init(tmpctx,
 				      cs,
 				      &channel->funding_txid,
 				      channel->funding_outnum,
-				      channel->funding_satoshi,
+				      channel->funding,
 				      &channel->local_funding_pubkey,
 				      &channel->channel_info.remote_fundingkey,
 				      channel->funder,
-				      our_msatoshi / 1000, /* Rounds down */
-				      their_msatoshi / 1000, /* Rounds down */
-				      channel->our_config.dust_limit.satoshis,
+				      amount_msat_to_sat_round_down(channel->our_msat),
+				      amount_msat_to_sat_round_down(their_msat),
+				      channel->our_config.dust_limit,
 				      minfee, feelimit, startfee,
 				      p2wpkh_for_keyidx(tmpctx, ld,
 							channel->final_key_idx),

lightningd/gossip_control.c

@@ -42,20 +42,20 @@ static void got_txout(struct bitcoind *bitcoind,
 		      struct short_channel_id *scid)
 {
 	const u8 *script;
-	u64 satoshis;
+	struct amount_sat sat;
 
 	/* output will be NULL if it wasn't found */
 	if (output) {
 		script = output->script;
-		satoshis = output->amount;
+		sat = (struct amount_sat){ output->amount};
 	} else {
 		script = NULL;
-		satoshis = 0;
+		sat = AMOUNT_SAT(0);
 	}
 
 	subd_send_msg(
 	    bitcoind->ld->gossip,
-	    towire_gossip_get_txout_reply(scid, scid, satoshis, script));
+	    towire_gossip_get_txout_reply(scid, scid, sat, script));
 	tal_free(scid);
 }
 
@@ -78,7 +78,7 @@ static void get_txout(struct subd *gossip, const u8 *msg)
 	if (op) {
 		subd_send_msg(gossip,
 			      towire_gossip_get_txout_reply(
-				  scid, scid, op->satoshis, op->scriptpubkey));
+				  scid, scid, op->sat, op->scriptpubkey));
 		tal_free(scid);
 	} else if (blockheight >= topo->min_blockheight &&
 		   blockheight <= topo->max_blockheight) {
@@ -87,7 +87,7 @@ static void get_txout(struct subd *gossip, const u8 *msg)
 		 * this is either a spent outpoint or an invalid one. Return a
 		 * failure. */
 		subd_send_msg(gossip, take(towire_gossip_get_txout_reply(
-					  NULL, scid, 0, NULL)));
+						   NULL, scid, AMOUNT_SAT(0), NULL)));
 		tal_free(scid);
 	} else {
 		bitcoind_getoutput(topo->bitcoind,
@@ -354,7 +354,7 @@ static struct command_result *json_getroute(struct command *cmd,
 	}
 
 	u8 *req = towire_gossip_getroute_request(cmd, source, destination,
-						 msat->millisatoshis,
+						 *msat,
 						 *riskfactor * 1000000.0,
 						 *cltv, fuzz,
 						 excluded,
@@ -399,8 +399,7 @@ static void json_listchannels_reply(struct subd *gossip UNUSED, const u8 *reply,
 				type_to_string(reply, struct short_channel_id,
 					       &entries[i].short_channel_id));
 		json_add_bool(response, "public", entries[i].public);
-		json_add_amount_sat(response,
-				    (struct amount_sat){ entries[i].satoshis },
+		json_add_amount_sat(response, entries[i].sat,
 				    "satoshis", "amount_msat");
 		json_add_num(response, "message_flags", entries[i].message_flags);
 		json_add_num(response, "channel_flags", entries[i].channel_flags);

lightningd/gossip_msg.c

@@ -102,7 +102,7 @@ void fromwire_gossip_getchannels_entry(const u8 **pptr, size_t *max,
 	fromwire_short_channel_id(pptr, max, &entry->short_channel_id);
 	fromwire(pptr, max, entry->source, sizeof(entry->source));
 	fromwire(pptr, max, entry->destination, sizeof(entry->destination));
-	entry->satoshis = fromwire_u64(pptr, max);
+	entry->sat = fromwire_amount_sat(pptr, max);
 	entry->message_flags = fromwire_u8(pptr, max);
 	entry->channel_flags = fromwire_u8(pptr, max);
 	entry->public = fromwire_bool(pptr, max);
@@ -119,7 +119,7 @@ void towire_gossip_getchannels_entry(u8 **pptr,
 	towire_short_channel_id(pptr, &entry->short_channel_id);
 	towire(pptr, entry->source, sizeof(entry->source));
 	towire(pptr, entry->destination, sizeof(entry->destination));
-	towire_u64(pptr, entry->satoshis);
+	towire_amount_sat(pptr, entry->sat);
 	towire_u8(pptr, entry->message_flags);
 	towire_u8(pptr, entry->channel_flags);
 	towire_bool(pptr, entry->public);

lightningd/gossip_msg.h

@@ -24,7 +24,7 @@ struct gossip_getnodes_entry {
 struct gossip_getchannels_entry {
 	/* These are raw to optimize marshaling: be careful! */
 	u8 source[sizeof(struct pubkey)], destination[sizeof(struct pubkey)];
-	u64 satoshis;
+	struct amount_sat sat;
 	struct short_channel_id short_channel_id;
 	u8 message_flags;
 	u8 channel_flags;

lightningd/htlc_end.c

@@ -75,7 +75,7 @@ static void *PRINTF_FMT(2,3)
 
 struct htlc_in *htlc_in_check(const struct htlc_in *hin, const char *abortstr)
 {
-	if (hin->msatoshi == 0)
+	if (amount_msat_eq(hin->msat, AMOUNT_MSAT(0)))
 		return corrupt(abortstr, "zero msatoshi");
 	else if (htlc_state_owner(hin->hstate) != REMOTE)
 		return corrupt(abortstr, "invalid state %s",
@@ -109,7 +109,7 @@ struct htlc_in *htlc_in_check(const struct htlc_in *hin, const char *abortstr)
 
 struct htlc_in *new_htlc_in(const tal_t *ctx,
 			    struct channel *channel, u64 id,
-			    u64 msatoshi, u32 cltv_expiry,
+			    struct amount_msat msat, u32 cltv_expiry,
 			    const struct sha256 *payment_hash,
 			    const struct secret *shared_secret TAKES,
 			    const u8 *onion_routing_packet)
@@ -119,7 +119,7 @@ struct htlc_in *new_htlc_in(const tal_t *ctx,
 	hin->dbid = 0;
 	hin->key.channel = channel;
 	hin->key.id = id;
-	hin->msatoshi = msatoshi;
+	hin->msat = msat;
 	hin->cltv_expiry = cltv_expiry;
 	hin->payment_hash = *payment_hash;
 	if (shared_secret)
@@ -150,10 +150,13 @@ struct htlc_out *htlc_out_check(const struct htlc_out *hout,
 		return corrupt(abortstr, "Both origin and incoming");
 
 	if (hout->in) {
-		if (hout->in->msatoshi < hout->msatoshi)
-			return corrupt(abortstr, "Input msatoshi %"PRIu64
-				       " less than %"PRIu64,
-				       hout->in->msatoshi, hout->msatoshi);
+		if (amount_msat_less(hout->in->msat, hout->msat))
+			return corrupt(abortstr, "Input amount %s"
+				       " less than %s",
+				       type_to_string(tmpctx, struct amount_msat,
+						      &hout->in->msat),
+				       type_to_string(tmpctx, struct amount_msat,
+						      &hout->msat));
 		if (hout->in->cltv_expiry <= hout->cltv_expiry)
 			return corrupt(abortstr, "Input cltv_expiry %u"
 				       " less than %u",
@@ -240,7 +243,8 @@ void htlc_out_connect_htlc_in(struct htlc_out *hout, struct htlc_in *hin)
 /* You need to set the ID, then connect_htlc_out this! */
 struct htlc_out *new_htlc_out(const tal_t *ctx,
 			      struct channel *channel,
-			      u64 msatoshi, u32 cltv_expiry,
+			      struct amount_msat msat,
+			      u32 cltv_expiry,
 			      const struct sha256 *payment_hash,
 			      const u8 *onion_routing_packet,
 			      bool am_origin,
@@ -253,7 +257,7 @@ struct htlc_out *new_htlc_out(const tal_t *ctx,
 
 	hout->key.channel = channel;
 	hout->key.id = HTLC_INVALID_ID;
-	hout->msatoshi = msatoshi;
+	hout->msat = msat;
 	hout->cltv_expiry = cltv_expiry;
 	hout->payment_hash = *payment_hash;
 	memcpy(hout->onion_routing_packet, onion_routing_packet,

lightningd/htlc_end.h

@@ -3,6 +3,7 @@
 #include "config.h"
 #include <ccan/htable/htable_type.h>
 #include <ccan/short_types/short_types.h>
+#include <common/amount.h>
 #include <common/htlc_state.h>
 #include <common/sphinx.h>
 #include <wire/gen_onion_wire.h>
@@ -22,7 +23,7 @@ struct htlc_in {
 	 * database. */
 	u64 dbid;
 	struct htlc_key key;
-	u64 msatoshi;
+	struct amount_msat msat;
 	u32 cltv_expiry;
 	struct sha256 payment_hash;
 
@@ -55,7 +56,7 @@ struct htlc_out {
 	u64 dbid;
 	u64 origin_htlc_id;
 	struct htlc_key key;
-	u64 msatoshi;
+	struct amount_msat msat;
 	u32 cltv_expiry;
 	struct sha256 payment_hash;
 
@@ -122,7 +123,7 @@ struct htlc_out *find_htlc_out(const struct htlc_out_map *map,
 /* You still need to connect_htlc_in this! */
 struct htlc_in *new_htlc_in(const tal_t *ctx,
 			    struct channel *channel, u64 id,
-			    u64 msatoshi, u32 cltv_expiry,
+			    struct amount_msat msat, u32 cltv_expiry,
 			    const struct sha256 *payment_hash,
 			    const struct secret *shared_secret TAKES,
 			    const u8 *onion_routing_packet);
@@ -130,7 +131,8 @@ struct htlc_in *new_htlc_in(const tal_t *ctx,
 /* You need to set the ID, then connect_htlc_out this! */
 struct htlc_out *new_htlc_out(const tal_t *ctx,
 			      struct channel *channel,
-			      u64 msatoshi, u32 cltv_expiry,
+			      struct amount_msat msat,
+			      u32 cltv_expiry,
 			      const struct sha256 *payment_hash,
 			      const u8 *onion_routing_packet,
 			      bool am_origin,

lightningd/invoice.c

@@ -145,7 +145,7 @@ static struct command_result *parse_fallback(struct command *cmd,
 /* BOLT11 struct wants an array of arrays (can provide multiple routes) */
 static struct route_info **select_inchan(const tal_t *ctx,
 					 struct lightningd *ld,
-					 u64 capacity_needed,
+					 struct amount_msat capacity_needed,
 					 const struct route_info *inchans,
 					 bool *any_offline)
 {
@@ -162,7 +162,7 @@ static struct route_info **select_inchan(const tal_t *ctx,
 	for (size_t i = 0; i < tal_count(inchans); i++) {
 		struct peer *peer;
 		struct channel *c;
-		u64 msatoshi_avail;
+		struct amount_msat avail, excess;
 
 		/* Do we know about this peer? */
 		peer = peer_by_id(ld, &inchans[i].pubkey);
@@ -175,15 +175,22 @@ static struct route_info **select_inchan(const tal_t *ctx,
 			continue;
 
 		/* Does it have sufficient capacity. */
-		msatoshi_avail = c->funding_satoshi * 1000 - c->our_msatoshi;
+		if (!amount_sat_sub_msat(&avail, c->funding, c->our_msat)) {
+			log_broken(ld->log,
+				   "underflow: funding %s - our_msat %s",
+				   type_to_string(tmpctx, struct amount_sat,
+						  &c->funding),
+				   type_to_string(tmpctx, struct amount_msat,
+						  &c->our_msat));
+			continue;
+		}
 
 		/* Even after reserve taken into account */
-		if (c->our_config.channel_reserve.satoshis * 1000
-		    > msatoshi_avail)
+		if (!amount_msat_sub_sat(&avail,
+					 avail, c->our_config.channel_reserve))
 			continue;
 
-		msatoshi_avail -= c->our_config.channel_reserve.satoshis * 1000;
-		if (msatoshi_avail < capacity_needed)
+		if (!amount_msat_sub(&excess, avail, capacity_needed))
 			continue;
 
 		/* Is it offline? */
@@ -193,9 +200,9 @@ static struct route_info **select_inchan(const tal_t *ctx,
 		}
 
 		/* Avoid divide-by-zero corner case. */
-		wsum += (msatoshi_avail - capacity_needed + 1);
+		wsum += excess.millisatoshis + 1;
 		if (pseudorand(1ULL << 32)
-		    <= ((msatoshi_avail - capacity_needed + 1) << 32) / wsum)
+		    <= ((excess.millisatoshis + 1) << 32) / wsum)
 			r = &inchans[i];
 	}
 
@@ -239,7 +246,7 @@ static void gossipd_incoming_channels_reply(struct subd *gossipd,
 	info->b11->routes
 		= select_inchan(info->b11,
 				info->cmd->ld,
-				info->b11->msat ? info->b11->msat->millisatoshis : 1,
+				info->b11->msat ? *info->b11->msat : AMOUNT_MSAT(1),
 				inchans,
 				&any_offline);
 

lightningd/onchain_control.c

@@ -275,7 +275,7 @@ static void onchain_add_utxo(struct channel *channel, const u8 *msg)
 
 	if (!fromwire_onchain_add_utxo(msg, &u->txid, &u->outnum,
 				       &u->close_info->commitment_point,
-				       &u->amount.satoshis, &blockheight)) {
+				       &u->amount, &blockheight)) {
 		fatal("onchaind gave invalid add_utxo message: %s", tal_hex(msg, msg));
 	}
 	u->blockheight = blockheight>0?&blockheight:NULL;
@@ -449,18 +449,29 @@ enum watch_result onchaind_funding_spent(struct channel *channel,
 	feerate = try_get_feerate(ld->topology, FEERATE_NORMAL);
 	if (!feerate) {
 		/* We have at least one data point: the last tx's feerate. */
-		u64 fee = channel->funding_satoshi;
+		struct amount_sat fee = channel->funding;
 		for (size_t i = 0; i < tal_count(channel->last_tx->output); i++)
-			fee -= channel->last_tx->output[i].amount;
+			if (!amount_sat_sub(&fee, fee,
+					    (struct amount_sat) {channel->last_tx->output[i].amount})) {
+				log_broken(channel->log, "Could not get fee"
+					   " funding %s tx %s",
+					   type_to_string(tmpctx,
+							  struct amount_sat,
+							  &channel->funding),
+					   type_to_string(tmpctx,
+							  struct bitcoin_tx,
+							  channel->last_tx));
+				return KEEP_WATCHING;
+			}
 
-		feerate = fee / measure_tx_weight(tx);
+		feerate = fee.satoshis / measure_tx_weight(tx);
 		if (feerate < feerate_floor())
 			feerate = feerate_floor();
 	}
 
 	msg = towire_onchain_init(channel,
 				  &channel->their_shachain.chain,
-				  channel->funding_satoshi,
+				  channel->funding,
 				  &channel->channel_info.old_remote_per_commit,
 				  &channel->channel_info.remote_per_commit,
 				   /* BOLT #2:
@@ -472,7 +483,7 @@ enum watch_result onchaind_funding_spent(struct channel *channel,
 				  channel->channel_info.their_config.to_self_delay,
 				  channel->our_config.to_self_delay,
 				  feerate,
-				  channel->our_config.dust_limit.satoshis,
+				  channel->our_config.dust_limit,
 				  &our_last_txid,
 				  p2wpkh_for_keyidx(tmpctx, ld,
 						    channel->final_key_idx),

lightningd/opening_control.c

@@ -69,7 +69,7 @@ struct funding_channel {
 	struct command *cmd; /* Which initially owns us until openingd request */
 
 	struct wallet_tx wtx;
-	u64 push_msat;
+	struct amount_msat push;
 	u8 channel_flags;
 
 	/* Variables we need to compose fields in cmd's response */
@@ -110,7 +110,7 @@ void kill_uncommitted_channel(struct uncommitted_channel *uc,
 void json_add_uncommitted_channel(struct json_stream *response,
 				  const struct uncommitted_channel *uc)
 {
-	u64 msatoshi_total, our_msatoshi;
+	struct amount_msat total, ours;
 	if (!uc)
 		return;
 
@@ -128,12 +128,14 @@ void json_add_uncommitted_channel(struct json_stream *response,
 		json_array_end(response);
 	}
 
-	msatoshi_total = uc->fc->wtx.amount.satoshis * 1000;
-	our_msatoshi = msatoshi_total - uc->fc->push_msat;
-	json_add_amount_msat(response, (struct amount_msat){our_msatoshi},
+	/* These should never fail. */
+	if (amount_sat_to_msat(&total, uc->fc->wtx.amount)
+	    && amount_msat_sub(&ours, total, uc->fc->push)) {
+		json_add_amount_msat(response, ours,
 			     "msatoshi_to_us", "to_us_msat");
-	json_add_amount_msat(response, (struct amount_msat){msatoshi_total},
-			     "msatoshi_total", "total_msat");
+		json_add_amount_msat(response, total,
+				     "msatoshi_total", "total_msat");
+	}
 	json_object_end(response);
 }
 
@@ -146,14 +148,14 @@ wallet_commit_channel(struct lightningd *ld,
 		      struct bitcoin_signature *remote_commit_sig,
 		      const struct bitcoin_txid *funding_txid,
 		      u16 funding_outnum,
-		      u64 funding_satoshi,
-		      u64 push_msat,
+		      struct amount_sat funding,
+		      struct amount_msat push,
 		      u8 channel_flags,
 		      struct channel_info *channel_info,
 		      u32 feerate)
 {
 	struct channel *channel;
-	u64 our_msatoshi;
+	struct amount_msat our_msat;
 	s64 final_key_idx;
 
 	/* Get a key to use for closing outputs from this tx */
@@ -163,10 +165,17 @@ wallet_commit_channel(struct lightningd *ld,
 		return NULL;
 	}
 
-	if (uc->fc)
-		our_msatoshi = funding_satoshi * 1000 - push_msat;
-	else
-		our_msatoshi = push_msat;
+	if (uc->fc) {
+		if (!amount_sat_sub_msat(&our_msat, funding, push)) {
+			log_broken(uc->log, "push %s exceeds funding %s",
+				   type_to_string(tmpctx, struct amount_msat,
+						  &push),
+				   type_to_string(tmpctx, struct amount_sat,
+						  &funding));
+			return NULL;
+		}
+	} else
+		our_msat = push;
 
 	/* Feerates begin identical. */
 	channel_info->feerate_per_kw[LOCAL]
@@ -188,17 +197,17 @@ wallet_commit_channel(struct lightningd *ld,
 			      1, 1, 0,
 			      funding_txid,
 			      funding_outnum,
-			      funding_satoshi,
-			      push_msat,
+			      funding,
+			      push,
 			      false, /* !remote_funding_locked */
 			      NULL, /* no scid yet */
 			      /* The three arguments below are msatoshi_to_us,
 			       * msatoshi_to_us_min, and msatoshi_to_us_max.
 			       * Because, this is a newly-funded channel,
 			       * all three are same value. */
-			      our_msatoshi,
-			      our_msatoshi, /* msatoshi_to_us_min */
-			      our_msatoshi, /* msatoshi_to_us_max */
+			      our_msat,
+			      our_msat, /* msat_to_us_min */
+			      our_msat, /* msat_to_us_max */
 			      remote_commit,
 			      remote_commit_sig,
 			      NULL, /* No HTLC sigs yet */
@@ -305,7 +314,7 @@ static void opening_funder_finished(struct subd *openingd, const u8 *resp,
 					   &channel_info.remote_fundingkey,
 					   &expected_txid,
 					   &feerate,
-					   &fc->uc->our_config.channel_reserve.satoshis)) {
+					   &fc->uc->our_config.channel_reserve)) {
 		log_broken(fc->uc->log,
 			   "bad OPENING_FUNDER_REPLY %s",
 			   tal_hex(resp, resp));
@@ -387,8 +396,8 @@ static void opening_funder_finished(struct subd *openingd, const u8 *resp,
 					&remote_commit_sig,
 					&funding_txid,
 					funding_outnum,
-					fc->wtx.amount.satoshis,
-					fc->push_msat,
+					fc->wtx.amount,
+					fc->push,
 					fc->channel_flags,
 					&channel_info,
 					feerate);
@@ -401,8 +410,8 @@ static void opening_funder_finished(struct subd *openingd, const u8 *resp,
 	/* Get HSM to sign the funding tx. */
 	log_debug(channel->log, "Getting HSM to sign funding tx");
 
-	msg = towire_hsm_sign_funding(tmpctx, channel->funding_satoshi,
-				      fc->wtx.change.satoshis,
+	msg = towire_hsm_sign_funding(tmpctx, channel->funding,
+				      fc->wtx.change,
 				      fc->wtx.change_key_index,
 				      &fc->uc->local_funding_pubkey,
 				      &channel_info.remote_fundingkey,
@@ -466,7 +475,8 @@ static void opening_fundee_finished(struct subd *openingd,
 	struct lightningd *ld = openingd->ld;
 	struct bitcoin_txid funding_txid;
 	u16 funding_outnum;
-	u64 funding_satoshi, push_msat;
+	struct amount_sat funding;
+	struct amount_msat push;
 	u32 feerate;
 	u8 channel_flags;
 	struct channel *channel;
@@ -490,12 +500,12 @@ static void opening_fundee_finished(struct subd *openingd,
 					   &channel_info.remote_fundingkey,
 					   &funding_txid,
 					   &funding_outnum,
-					   &funding_satoshi,
-					   &push_msat,
+					   &funding,
+					   &push,
 					   &channel_flags,
 					   &feerate,
 					   &funding_signed,
-					   &uc->our_config.channel_reserve.satoshis)) {
+					   &uc->our_config.channel_reserve)) {
 		log_broken(uc->log, "bad OPENING_FUNDEE_REPLY %s",
 			   tal_hex(reply, reply));
 		uncommitted_channel_disconnect(uc, "bad OPENING_FUNDEE_REPLY");
@@ -515,8 +525,8 @@ static void opening_fundee_finished(struct subd *openingd,
 					&remote_commit_sig,
 					&funding_txid,
 					funding_outnum,
-					funding_satoshi,
-					push_msat,
+					funding,
+					push,
 					channel_flags,
 					&channel_info,
 					feerate);
@@ -787,7 +797,7 @@ void peer_start_openingd(struct peer *peer,
 				  &get_chainparams(peer->ld)->genesis_blockhash,
 				  &uc->our_config,
 				  max_to_self_delay,
-				  min_effective_htlc_capacity.millisatoshis,
+				  min_effective_htlc_capacity,
 				  cs, &uc->local_basepoints,
 				  &uc->local_funding_pubkey,
 				  uc->minimum_depth,
@@ -872,7 +882,7 @@ static struct command_result *json_fund_channel(struct command *cmd,
 	}
 
 	/* FIXME: Support push_msat? */
-	fc->push_msat = 0;
+	fc->push = AMOUNT_MSAT(0);
 	fc->channel_flags = OUR_CHANNEL_FLAGS;
 	if (!*announce_channel) {
 		fc->channel_flags &= ~CHANNEL_FLAGS_ANNOUNCE_CHANNEL;
@@ -891,10 +901,10 @@ static struct command_result *json_fund_channel(struct command *cmd,
 	fc->uc = peer->uncommitted_channel;
 
 	msg = towire_opening_funder(NULL,
-				    fc->wtx.amount.satoshis,
-				    fc->push_msat,
+				    fc->wtx.amount,
+				    fc->push,
 				    *feerate_per_kw,
-				    fc->wtx.change.satoshis,
+				    fc->wtx.change,
 				    fc->wtx.change_key_index,
 				    fc->channel_flags,
 				    fc->wtx.utxos,

lightningd/pay.c

@@ -610,7 +610,7 @@ send_payment(struct lightningd *ld,
 	for (i = 0; i < n_hops - 1; i++) {
 		hop_data[i].realm = 0;
 		hop_data[i].channel_id = route[i+1].channel_id;
-		hop_data[i].amt_forward = route[i+1].amount.millisatoshis;
+		hop_data[i].amt_forward = route[i+1].amount;
 		hop_data[i].outgoing_cltv = base_expiry + route[i+1].delay;
 	}
 
@@ -619,7 +619,7 @@ send_payment(struct lightningd *ld,
 	hop_data[i].realm = 0;
 	hop_data[i].outgoing_cltv = base_expiry + route[i].delay;
 	memset(&hop_data[i].channel_id, 0, sizeof(struct short_channel_id));
-	hop_data[i].amt_forward = route[i].amount.millisatoshis;
+	hop_data[i].amt_forward = route[i].amount;
 
 	/* Now, do we already have a payment? */
 	payment = wallet_payment_by_hash(tmpctx, ld->wallet, rhash);
@@ -675,7 +675,7 @@ send_payment(struct lightningd *ld,
 		 type_to_string(tmpctx, struct amount_msat, &route[0].amount),
 		 n_hops, msatoshi);
 
-	failcode = send_htlc_out(channel, route[0].amount.millisatoshis,
+	failcode = send_htlc_out(channel, route[0].amount,
 				 base_expiry + route[0].delay,
 				 rhash, onion, NULL, &hout);
 	if (failcode) {

lightningd/peer_control.c

@@ -202,7 +202,7 @@ static void sign_last_tx(struct channel *channel)
 					    channel->last_tx,
 					    &channel->channel_info
 					    .remote_fundingkey,
-					    channel->funding_satoshi);
+					    channel->funding);
 
 	if (!wire_sync_write(ld->hsm_fd, take(msg)))
 		fatal("Could not write to HSM: %s", strerror(errno));
@@ -453,8 +453,7 @@ static void json_add_htlcs(struct lightningd *ld,
 		json_object_start(response, NULL);
 		json_add_string(response, "direction", "in");
 		json_add_u64(response, "id", hin->key.id);
-		json_add_amount_msat(response,
-				     (struct amount_msat){ hin->msatoshi },
+		json_add_amount_msat(response, hin->msat,
 				     "msatoshi", "amount_msat");
 		json_add_u64(response, "expiry", hin->cltv_expiry);
 		json_add_hex(response, "payment_hash",
@@ -473,8 +472,7 @@ static void json_add_htlcs(struct lightningd *ld,
 		json_object_start(response, NULL);
 		json_add_string(response, "direction", "out");
 		json_add_u64(response, "id", hout->key.id);
-		json_add_amount_msat(response,
-				     (struct amount_msat){ hout->msatoshi },
+		json_add_amount_msat(response, hout->msat,
 				     "msatoshi", "amount_msat");
 		json_add_u64(response, "expiry", hout->cltv_expiry);
 		json_add_hex(response, "payment_hash",
@@ -504,7 +502,7 @@ static void json_add_channel(struct lightningd *ld,
 {
 	struct channel_id cid;
 	struct channel_stats channel_stats;
-	struct amount_msat spendable;
+	struct amount_msat spendable, funding_msat;
 	struct peer *p = channel->peer;
 
 	json_object_start(response, key);
@@ -540,11 +538,11 @@ static void json_add_channel(struct lightningd *ld,
 	if (channel->funder == LOCAL) {
 		json_add_u64(response, pubkey_to_hexstr(tmpctx, &p->id), 0);
 		json_add_u64(response, pubkey_to_hexstr(tmpctx, &ld->id),
-			     channel->funding_satoshi * 1000);
+			     channel->funding.satoshis * 1000);
 	} else {
 		json_add_u64(response, pubkey_to_hexstr(tmpctx, &ld->id), 0);
 		json_add_u64(response, pubkey_to_hexstr(tmpctx, &p->id),
-			     channel->funding_satoshi * 1000);
+			     channel->funding.satoshis * 1000);
 	}
 	json_object_end(response);
 
@@ -555,28 +553,31 @@ static void json_add_channel(struct lightningd *ld,
 				  AMOUNT_SAT(0));
 		json_add_sat_only(response,
 				  pubkey_to_hexstr(tmpctx, &ld->id),
-				  (struct amount_sat){channel->funding_satoshi});
+				  channel->funding);
 	} else {
 		json_add_sat_only(response,
 				  pubkey_to_hexstr(tmpctx, &ld->id),
 				  AMOUNT_SAT(0));
 		json_add_sat_only(response,
 				  pubkey_to_hexstr(tmpctx, &p->id),
-				  (struct amount_sat){channel->funding_satoshi});
+				  channel->funding);
 	}
 	json_object_end(response);
 
-	json_add_amount_msat(response,
-			     (struct amount_msat){channel->our_msatoshi},
+	if (!amount_sat_to_msat(&funding_msat, channel->funding)) {
+		log_broken(channel->log,
+			   "Overflow converting funding %s",
+			   type_to_string(tmpctx, struct amount_sat,
+					  &channel->funding));
+		funding_msat = AMOUNT_MSAT(0);
+	}
+	json_add_amount_msat(response, channel->our_msat,
 			     "msatoshi_to_us", "to_us_msat");
-	json_add_amount_msat(response,
-			     (struct amount_msat){channel->msatoshi_to_us_min},
+	json_add_amount_msat(response, channel->msat_to_us_min,
 			     "msatoshi_to_us_min", "min_to_us_msat");
-	json_add_amount_msat(response,
-			     (struct amount_msat){channel->msatoshi_to_us_max},
+	json_add_amount_msat(response, channel->msat_to_us_max,
 			     "msatoshi_to_us_max", "max_to_us_msat");
-	json_add_amount_msat(response,
-			     (struct amount_msat){channel->funding_satoshi * 1000},
+	json_add_amount_msat(response, funding_msat,
 			     "msatoshi_total", "total_msat");
 
 	/* channel config */
@@ -605,7 +606,7 @@ static void json_add_channel(struct lightningd *ld,
 			    "our_reserve_msat");
 	/* Compute how much we can send via this channel. */
 	if (!amount_msat_sub_sat(&spendable,
-				 (struct amount_msat){channel->our_msatoshi},
+				 channel->our_msat,
 				 channel->channel_info.their_config.channel_reserve))
 		spendable = AMOUNT_MSAT(0);
 
@@ -643,25 +644,25 @@ static void json_add_channel(struct lightningd *ld,
 	json_add_u64(response, "in_payments_offered",
 		     channel_stats.in_payments_offered);
 	json_add_amount_msat(response,
-			     (struct amount_msat){channel_stats.in_msatoshi_offered},
+			     channel_stats.in_msatoshi_offered,
 			     "in_msatoshi_offered",
 			     "in_offered_msat");
 	json_add_u64(response, "in_payments_fulfilled",
 		     channel_stats.in_payments_fulfilled);
 	json_add_amount_msat(response,
-			     (struct amount_msat){channel_stats.in_msatoshi_fulfilled},
+			     channel_stats.in_msatoshi_fulfilled,
 			     "in_msatoshi_fulfilled",
 			     "in_fulfilled_msat");
 	json_add_u64(response, "out_payments_offered",
 		     channel_stats.out_payments_offered);
 	json_add_amount_msat(response,
-			     (struct amount_msat){channel_stats.out_msatoshi_offered},
+			     channel_stats.out_msatoshi_offered,
 			     "out_msatoshi_offered",
 			     "out_offered_msat");
 	json_add_u64(response, "out_payments_fulfilled",
 		     channel_stats.out_payments_fulfilled);
 	json_add_amount_msat(response,
-			     (struct amount_msat){channel_stats.out_msatoshi_fulfilled},
+			     channel_stats.out_msatoshi_fulfilled,
 			     "out_msatoshi_fulfilled",
 			     "out_fulfilled_msat");
 

lightningd/peer_htlcs.c

@@ -167,13 +167,22 @@ static void fail_out_htlc(struct htlc_out *hout, const char *localfail)
  *   the final node.
  */
 static bool check_amount(struct htlc_in *hin,
-			 u64 amt_to_forward, u64 amt_in_htlc, u64 fee)
+			 struct amount_msat amt_to_forward,
+			 struct amount_msat amt_in_htlc,
+			 struct amount_msat fee)
 {
-	if (amt_in_htlc - fee >= amt_to_forward)
+	struct amount_msat fwd;
+
+	if (amount_msat_sub(&fwd, amt_in_htlc, fee)
+	    && amount_msat_greater_eq(fwd, amt_to_forward))
 		return true;
+
 	log_debug(hin->key.channel->log, "HTLC %"PRIu64" incorrect amount:"
-		  " %"PRIu64" in, %"PRIu64" out, fee reqd %"PRIu64,
-		  hin->key.id, amt_in_htlc, amt_to_forward, fee);
+		  " %s in, %s out, fee reqd %s",
+		  hin->key.id,
+		  type_to_string(tmpctx, struct amount_msat, &amt_in_htlc),
+		  type_to_string(tmpctx, struct amount_msat, &amt_to_forward),
+		  type_to_string(tmpctx, struct amount_msat, &fee));
 	return false;
 }
 
@@ -223,7 +232,7 @@ static void fulfill_htlc(struct htlc_in *hin, const struct preimage *preimage)
 	/* Update channel stats */
 	wallet_channel_stats_incr_in_fulfilled(wallet,
 					       channel->dbid,
-					       hin->msatoshi);
+					       hin->msat);
 
 	/* No owner?  We'll either send to channeld in peer_htlcs, or
 	 * onchaind in onchaind_tell_fulfill. */
@@ -246,7 +255,7 @@ static void fulfill_htlc(struct htlc_in *hin, const struct preimage *preimage)
 static void handle_localpay(struct htlc_in *hin,
 			    u32 cltv_expiry,
 			    const struct sha256 *payment_hash,
-			    u64 amt_to_forward,
+			    struct amount_msat amt_to_forward,
 			    u32 outgoing_cltv_value)
 {
 	enum onion_type failcode;
@@ -262,7 +271,7 @@ static void handle_localpay(struct htlc_in *hin,
 	 *
 	 * The amount in the HTLC doesn't match the value in the onion.
 	 */
-	if (!check_amount(hin, amt_to_forward, hin->msatoshi, 0)) {
+	if (!check_amount(hin, amt_to_forward, hin->msat, AMOUNT_MSAT(0))) {
 		failcode = WIRE_FINAL_INCORRECT_HTLC_AMOUNT;
 		goto fail;
 	}
@@ -293,10 +302,10 @@ static void handle_localpay(struct htlc_in *hin,
 	 *   - if the amount paid is less than the amount expected:
 	 *     - MUST fail the HTLC.
 	 */
-	if (details->msatoshi != NULL && hin->msatoshi < *details->msatoshi) {
+	if (details->msatoshi != NULL && hin->msat.millisatoshis < *details->msatoshi) {
 		failcode = WIRE_INCORRECT_OR_UNKNOWN_PAYMENT_DETAILS;
 		goto fail;
-	} else if (details->msatoshi != NULL && hin->msatoshi > *details->msatoshi * 2) {
+	} else if (details->msatoshi != NULL && hin->msat.millisatoshis > *details->msatoshi * 2) {
 		/* FIXME: bolt update fixes this quote! */
 		/* BOLT #4:
 		 *
@@ -327,10 +336,12 @@ static void handle_localpay(struct htlc_in *hin,
 
 	log_info(ld->log, "Resolving invoice '%s' with HTLC %"PRIu64,
 		 details->label->s, hin->key.id);
-	log_debug(ld->log, "%s: Actual amount %"PRIu64"msat, HTLC expiry %u",
-		  details->label->s, hin->msatoshi, cltv_expiry);
+	log_debug(ld->log, "%s: Actual amount %s, HTLC expiry %u",
+		  details->label->s,
+		  type_to_string(tmpctx, struct amount_msat, &hin->msat),
+		  cltv_expiry);
 	fulfill_htlc(hin, &details->r);
-	wallet_invoice_resolve(ld->wallet, invoice, hin->msatoshi);
+	wallet_invoice_resolve(ld->wallet, invoice, hin->msat.millisatoshis);
 
 	return;
 
@@ -429,7 +440,8 @@ static void htlc_offer_timeout(struct channel *channel)
 			      "Adding HTLC timed out: killed channel");
 }
 
-enum onion_type send_htlc_out(struct channel *out, u64 amount, u32 cltv,
+enum onion_type send_htlc_out(struct channel *out,
+			      struct amount_msat amount, u32 cltv,
 			      const struct sha256 *payment_hash,
 			      const u8 *onion_routing_packet,
 			      struct htlc_in *in,
@@ -472,13 +484,13 @@ enum onion_type send_htlc_out(struct channel *out, u64 amount, u32 cltv,
 
 static void forward_htlc(struct htlc_in *hin,
 			 u32 cltv_expiry,
-			 u64 amt_to_forward,
+			 struct amount_msat amt_to_forward,
 			 u32 outgoing_cltv_value,
 			 const struct pubkey *next_hop,
 			 const u8 next_onion[TOTAL_PACKET_SIZE])
 {
 	enum onion_type failcode;
-	u64 fee;
+	struct amount_msat fee;
 	struct lightningd *ld = hin->key.channel->peer->ld;
 	struct channel *next = active_channel_by_id(ld, next_hop, NULL);
 
@@ -494,14 +506,16 @@ static void forward_htlc(struct htlc_in *hin,
 	 *   - SHOULD accept HTLCs that pay a fee equal to or greater than:
 	 *     - fee_base_msat + ( amount_to_forward * fee_proportional_millionths / 1000000 )
 	 */
-	if (mul_overflows_u64(amt_to_forward,
-			      ld->config.fee_per_satoshi)) {
+	if (!amount_msat_fee(&fee, amt_to_forward,
+			     ld->config.fee_base,
+			     ld->config.fee_per_satoshi)) {
+		log_broken(ld->log, "Fee overflow forwarding %s!",
+			   type_to_string(tmpctx, struct amount_msat,
+					  &amt_to_forward));
 		failcode = WIRE_FEE_INSUFFICIENT;
 		goto fail;
 	}
-	fee = ld->config.fee_base
-		+ amt_to_forward * ld->config.fee_per_satoshi / 1000000;
-	if (!check_amount(hin, amt_to_forward, hin->msatoshi, fee)) {
+	if (!check_amount(hin, amt_to_forward, hin->msat, fee)) {
 		failcode = WIRE_FEE_INSUFFICIENT;
 		goto fail;
 	}
@@ -559,7 +573,7 @@ fail:
 /* Temporary information, while we resolve the next hop */
 struct gossip_resolve {
 	struct short_channel_id next_channel;
-	u64 amt_to_forward;
+	struct amount_msat amt_to_forward;
 	u32 outgoing_cltv_value;
 	u8 *next_onion;
 	struct htlc_in *hin;
@@ -721,7 +735,7 @@ static void fulfill_our_htlc_out(struct channel *channel, struct htlc_out *hout,
 	/* Update channel stats */
 	wallet_channel_stats_incr_out_fulfilled(ld->wallet,
 						channel->dbid,
-						hout->msatoshi);
+						hout->msat);
 
 	if (hout->am_origin)
 		payment_succeeded(ld, hout, preimage);
@@ -874,12 +888,25 @@ static void remove_htlc_in(struct channel *channel, struct htlc_in *hin)
 
 	/* If we fulfilled their HTLC, credit us. */
 	if (hin->preimage) {
-		log_debug(channel->log, "Balance %"PRIu64" -> %"PRIu64,
-			  channel->our_msatoshi,
-			  channel->our_msatoshi + hin->msatoshi);
-		channel->our_msatoshi += hin->msatoshi;
-		if (channel->our_msatoshi > channel->msatoshi_to_us_max)
-			channel->msatoshi_to_us_max = channel->our_msatoshi;
+		struct amount_msat oldamt = channel->our_msat;
+		if (!amount_msat_add(&channel->our_msat, channel->our_msat,
+				     hin->msat)) {
+			channel_internal_error(channel,
+					       "Overflow our_msat %s + HTLC %s",
+					       type_to_string(tmpctx,
+							      struct amount_msat,
+							      &channel->our_msat),
+					       type_to_string(tmpctx,
+							      struct amount_msat,
+							      &hin->msat));
+		}
+		log_debug(channel->log, "Balance %s -> %s",
+			  type_to_string(tmpctx, struct amount_msat, &oldamt),
+			  type_to_string(tmpctx, struct amount_msat,
+					 &channel->our_msat));
+		if (amount_msat_greater(channel->our_msat,
+					channel->msat_to_us_max))
+			channel->msat_to_us_max = channel->our_msat;
 	}
 
 	tal_free(hin);
@@ -899,13 +926,26 @@ static void remove_htlc_out(struct channel *channel, struct htlc_out *hout)
 	if (!hout->preimage) {
 		fail_out_htlc(hout, NULL);
 	} else {
+		struct amount_msat oldamt = channel->our_msat;
 		/* We paid for this HTLC, so deduct balance. */
-		log_debug(channel->log, "Balance %"PRIu64" -> %"PRIu64,
-			  channel->our_msatoshi,
-			  channel->our_msatoshi - hout->msatoshi);
-		channel->our_msatoshi -= hout->msatoshi;
-		if (channel->our_msatoshi < channel->msatoshi_to_us_min)
-			channel->msatoshi_to_us_min = channel->our_msatoshi;
+		if (!amount_msat_sub(&channel->our_msat, channel->our_msat,
+				     hout->msat)) {
+			channel_internal_error(channel,
+					       "Underflow our_msat %s - HTLC %s",
+					       type_to_string(tmpctx,
+							      struct amount_msat,
+							      &channel->our_msat),
+					       type_to_string(tmpctx,
+							      struct amount_msat,
+							      &hout->msat));
+		}
+
+		log_debug(channel->log, "Balance %s -> %s",
+			  type_to_string(tmpctx, struct amount_msat, &oldamt),
+			  type_to_string(tmpctx, struct amount_msat,
+					 &channel->our_msat));
+		if (amount_msat_less(channel->our_msat, channel->msat_to_us_min))
+			channel->msat_to_us_min = channel->our_msat;
 	}
 
 	tal_free(hout);
@@ -950,7 +990,7 @@ static bool update_out_htlc(struct channel *channel,
 		/* Update channel stats */
 		wallet_channel_stats_incr_out_offered(ld->wallet,
 						      channel->dbid,
-						      hout->msatoshi);
+						      hout->msat);
 
 		if (hout->in)
 			wallet_forwarded_payment_add(ld->wallet, hout->in, hout,
@@ -1107,12 +1147,14 @@ static bool channel_added_their_htlc(struct channel *channel,
 	 *  - receiving an `amount_msat` equal to 0, OR less than its own `htlc_minimum_msat`:
 	 *    - SHOULD fail the channel.
 	 */
-	if (added->amount_msat == 0
-	    || added->amount_msat < channel->our_config.htlc_minimum.millisatoshis) {
+	if (amount_msat_eq(added->amount, AMOUNT_MSAT(0))
+	    || amount_msat_less(added->amount, channel->our_config.htlc_minimum)) {
 		channel_internal_error(channel,
-				    "trying to add HTLC msat %"PRIu64
-				    " but minimum is %s",
-				    added->amount_msat,
+				       "trying to add HTLC amount %s"
+				       " but minimum is %s",
+				       type_to_string(tmpctx,
+						      struct amount_msat,
+						      &added->amount),
 				       type_to_string(tmpctx,
 						      struct amount_msat,
 						      &channel->our_config.htlc_minimum));
@@ -1126,7 +1168,7 @@ static bool channel_added_their_htlc(struct channel *channel,
 
 	/* This stays around even if we fail it immediately: it *is*
 	 * part of the current commitment. */
-	hin = new_htlc_in(channel, channel, added->id, added->amount_msat,
+	hin = new_htlc_in(channel, channel, added->id, added->amount,
 			  added->cltv_expiry, &added->payment_hash,
 			  shared_secret, added->onion_routing_packet);
 
@@ -1134,7 +1176,7 @@ static bool channel_added_their_htlc(struct channel *channel,
 	wallet_htlc_save_in(ld->wallet, channel, hin);
 	/* Update channel stats */
 	wallet_channel_stats_incr_in_offered(ld->wallet, channel->dbid,
-					     added->amount_msat);
+					     added->amount);
 
 	log_debug(channel->log, "Adding their HTLC %"PRIu64, added->id);
 	connect_htlc_in(&channel->peer->ld->htlcs_in, hin);
@@ -1386,7 +1428,7 @@ void peer_got_revoke(struct channel *channel, const u8 *msg)
 static void add_htlc(struct added_htlc **htlcs,
 		     enum htlc_state **htlc_states,
 		     u64 id,
-		     u64 amount_msat,
+		     struct amount_msat amount,
 		     const struct sha256 *payment_hash,
 		     u32 cltv_expiry,
 		     const u8 onion_routing_packet[TOTAL_PACKET_SIZE],
@@ -1395,7 +1437,7 @@ static void add_htlc(struct added_htlc **htlcs,
 	struct added_htlc a;
 
 	a.id = id;
-	a.amount_msat = amount_msat;
+	a.amount = amount;
 	a.payment_hash = *payment_hash;
 	a.cltv_expiry = cltv_expiry;
 	memcpy(a.onion_routing_packet, onion_routing_packet,
@@ -1478,7 +1520,7 @@ void peer_htlcs(const tal_t *ctx,
 			continue;
 
 		add_htlc(htlcs, htlc_states,
-			 hin->key.id, hin->msatoshi, &hin->payment_hash,
+			 hin->key.id, hin->msat, &hin->payment_hash,
 			 hin->cltv_expiry, hin->onion_routing_packet,
 			 hin->hstate);
 
@@ -1498,7 +1540,7 @@ void peer_htlcs(const tal_t *ctx,
 			continue;
 
 		add_htlc(htlcs, htlc_states,
-			 hout->key.id, hout->msatoshi, &hout->payment_hash,
+			 hout->key.id, hout->msat, &hout->payment_hash,
 			 hout->cltv_expiry, hout->onion_routing_packet,
 			 hout->hstate);
 
@@ -1701,11 +1743,11 @@ static void fixup_hout(struct lightningd *ld, struct htlc_out *hout)
 	}
 
 	log_broken(ld->log, "HTLC #%"PRIu64" (%s) "
-		   " for amount %"PRIu64
+		   " for amount %s"
 		   " to %s"
 		   " is missing a resolution: %s.",
 		   hout->key.id, htlc_state_name(hout->hstate),
-		   hout->msatoshi,
+		   type_to_string(tmpctx, struct amount_msat, &hout->msat),
 		   type_to_string(tmpctx, struct pubkey,
 				  &hout->key.channel->peer->id),
 		   fix);

lightningd/peer_htlcs.h

@@ -44,7 +44,8 @@ void peer_got_revoke(struct channel *channel, const u8 *msg);
 void update_per_commit_point(struct channel *channel,
 			     const struct pubkey *per_commitment_point);
 
-enum onion_type send_htlc_out(struct channel *out, u64 amount, u32 cltv,
+enum onion_type send_htlc_out(struct channel *out,
+			      struct amount_msat amount, u32 cltv,
 			      const struct sha256 *payment_hash,
 			      const u8 *onion_routing_packet,
 			      struct htlc_in *in,

lightningd/test/Makefile

@@ -8,6 +8,7 @@ ALL_TEST_PROGRAMS += $(LIGHTNINGD_TEST_PROGRAMS)
 ALL_OBJS += $(LIGHTNINGD_TEST_OBJS)
 
 LIGHTNINGD_TEST_COMMON_OBJS :=			\
+	common/amount.o				\
 	common/bech32.o				\
 	common/daemon_conn.o			\
 	common/htlc_state.o			\

lightningd/test/run-invoice-select-inchan.c

@@ -6,18 +6,6 @@
 bool deprecated_apis = false;
 
 /* AUTOGENERATED MOCKS START */
-/* Generated stub for amount_msat_greater */
-bool amount_msat_greater(struct amount_msat a UNNEEDED, struct amount_msat b UNNEEDED)
-{ fprintf(stderr, "amount_msat_greater called!\n"); abort(); }
-/* Generated stub for amount_msat_sub_sat */
- bool amount_msat_sub_sat(struct amount_msat *val UNNEEDED,
-					    struct amount_msat a UNNEEDED,
-					    struct amount_sat b UNNEEDED)
-{ fprintf(stderr, "amount_msat_sub_sat called!\n"); abort(); }
-/* Generated stub for amount_sat_to_msat */
- bool amount_sat_to_msat(struct amount_msat *msat UNNEEDED,
-					   struct amount_sat sat UNNEEDED)
-{ fprintf(stderr, "amount_sat_to_msat called!\n"); abort(); }
 /* Generated stub for bitcoind_gettxout */
 void bitcoind_gettxout(struct bitcoind *bitcoind UNNEEDED,
 		       const struct bitcoin_txid *txid UNNEEDED, const u32 outnum UNNEEDED,
@@ -355,9 +343,6 @@ struct command_result *param_u64(struct command *cmd UNNEEDED, const char *name
 				 const char *buffer UNNEEDED, const jsmntok_t *tok UNNEEDED,
 				 uint64_t **num UNNEEDED)
 { fprintf(stderr, "param_u64 called!\n"); abort(); }
-/* Generated stub for parse_amount_msat */
-bool parse_amount_msat(struct amount_msat *msat UNNEEDED, const char *s UNNEEDED, size_t slen UNNEEDED)
-{ fprintf(stderr, "parse_amount_msat called!\n"); abort(); }
 /* Generated stub for peer_memleak_done */
 void peer_memleak_done(struct command *cmd UNNEEDED, struct subd *leaker UNNEEDED)
 { fprintf(stderr, "peer_memleak_done called!\n"); abort(); }
@@ -437,7 +422,7 @@ u8 *towire_gossip_get_incoming_channels(const tal_t *ctx UNNEEDED, const bool *p
 u8 *towire_hsm_get_channel_basepoints(const tal_t *ctx UNNEEDED, const struct pubkey *peerid UNNEEDED, u64 dbid UNNEEDED)
 { fprintf(stderr, "towire_hsm_get_channel_basepoints called!\n"); abort(); }
 /* Generated stub for towire_hsm_sign_commitment_tx */
-u8 *towire_hsm_sign_commitment_tx(const tal_t *ctx UNNEEDED, const struct pubkey *peer_id UNNEEDED, u64 channel_dbid UNNEEDED, const struct bitcoin_tx *tx UNNEEDED, const struct pubkey *remote_funding_key UNNEEDED, u64 funding_amount UNNEEDED)
+u8 *towire_hsm_sign_commitment_tx(const tal_t *ctx UNNEEDED, const struct pubkey *peer_id UNNEEDED, u64 channel_dbid UNNEEDED, const struct bitcoin_tx *tx UNNEEDED, const struct pubkey *remote_funding_key UNNEEDED, struct amount_sat funding_amount UNNEEDED)
 { fprintf(stderr, "towire_hsm_sign_commitment_tx called!\n"); abort(); }
 /* Generated stub for towire_hsm_sign_invoice */
 u8 *towire_hsm_sign_invoice(const tal_t *ctx UNNEEDED, const u8 *u5bytes UNNEEDED, const u8 *hrp UNNEEDED)
@@ -598,9 +583,9 @@ static void add_peer(struct lightningd *ld, int n, enum channel_state state,
 	c->state = state;
 	c->owner = connected ? (void *)peer : NULL;
 	/* Channel has incoming capacity n*1000 - 1 millisatoshi */
-	c->funding_satoshi = n+1;
-	c->our_msatoshi = 1;
-	c->our_config.channel_reserve.satoshis = 1;
+	c->funding.satoshis = n+1;
+	c->our_msat = AMOUNT_MSAT(1);
+	c->our_config.channel_reserve = AMOUNT_SAT(1);
 	list_add_tail(&peer->channels, &c->list);
 }
 
@@ -630,47 +615,47 @@ int main(void)
 
 	inchans = tal_arr(tmpctx, struct route_info, 0);
 	/* Nothing to choose from -> NULL result. */
-	assert(select_inchan(tmpctx, ld, 0, inchans, &any_offline) == NULL);
+	assert(select_inchan(tmpctx, ld, AMOUNT_MSAT(0), inchans, &any_offline) == NULL);
 	assert(any_offline == false);
 
 	/* inchan but no peer -> NULL result. */
 	add_inchan(&inchans, 0);
-	assert(select_inchan(tmpctx, ld, 0, inchans, &any_offline) == NULL);
+	assert(select_inchan(tmpctx, ld, AMOUNT_MSAT(0), inchans, &any_offline) == NULL);
 	assert(any_offline == false);
 
 	/* connected peer but no inchan -> NULL result. */
 	add_peer(ld, 1, CHANNELD_NORMAL, false);
-	assert(select_inchan(tmpctx, ld, 0, inchans, &any_offline) == NULL);
+	assert(select_inchan(tmpctx, ld, AMOUNT_MSAT(0), inchans, &any_offline) == NULL);
 	assert(any_offline == false);
 
 	/* inchan but peer awaiting lockin -> NULL result. */
 	add_peer(ld, 0, CHANNELD_AWAITING_LOCKIN, true);
-	assert(select_inchan(tmpctx, ld, 0, inchans, &any_offline) == NULL);
+	assert(select_inchan(tmpctx, ld, AMOUNT_MSAT(0), inchans, &any_offline) == NULL);
 	assert(any_offline == false);
 
 	/* inchan but peer not connected -> NULL result. */
 	add_inchan(&inchans, 1);
-	assert(select_inchan(tmpctx, ld, 0, inchans, &any_offline) == NULL);
+	assert(select_inchan(tmpctx, ld, AMOUNT_MSAT(0), inchans, &any_offline) == NULL);
 	assert(any_offline == true);
 
 	/* Finally, a correct peer! */
 	add_inchan(&inchans, 2);
 	add_peer(ld, 2, CHANNELD_NORMAL, true);
 
-	ret = select_inchan(tmpctx, ld, 0, inchans, &any_offline);
+	ret = select_inchan(tmpctx, ld, AMOUNT_MSAT(0), inchans, &any_offline);
 	assert(tal_count(ret) == 1);
 	assert(tal_count(ret[0]) == 1);
 	assert(any_offline == true);
 	assert(route_info_eq(ret[0], &inchans[2]));
 
 	/* Not if we ask for too much! Reserve is 1 satoshi */
-	ret = select_inchan(tmpctx, ld, 1999, inchans, &any_offline);
+	ret = select_inchan(tmpctx, ld, AMOUNT_MSAT(1999), inchans, &any_offline);
 	assert(tal_count(ret) == 1);
 	assert(tal_count(ret[0]) == 1);
 	assert(any_offline == false); /* Other candidate insufficient funds. */
 	assert(route_info_eq(ret[0], &inchans[2]));
 
-	ret = select_inchan(tmpctx, ld, 2000, inchans, &any_offline);
+	ret = select_inchan(tmpctx, ld, AMOUNT_MSAT(2000), inchans, &any_offline);
 	assert(ret == NULL);
 	assert(any_offline == false); /* Other candidate insufficient funds. */
 
@@ -679,7 +664,7 @@ int main(void)
 	add_peer(ld, 3, CHANNELD_NORMAL, true);
 
 	for (size_t i = n = 0; i < 1000; i++) {
-		ret = select_inchan(tmpctx, ld, 1000, inchans, &any_offline);
+		ret = select_inchan(tmpctx, ld, AMOUNT_MSAT(1000), inchans, &any_offline);
 		assert(tal_count(ret) == 1);
 		assert(tal_count(ret[0]) == 1);
 		assert(any_offline == false); /* Other candidate insufficient funds. */
@@ -695,7 +680,7 @@ int main(void)
 	       n, 1000 - n);
 
 	for (size_t i = n = 0; i < 1000; i++) {
-		ret = select_inchan(tmpctx, ld, 1499, inchans, &any_offline);
+		ret = select_inchan(tmpctx, ld, AMOUNT_MSAT(1499), inchans, &any_offline);
 		assert(tal_count(ret) == 1);
 		assert(tal_count(ret[0]) == 1);
 		assert(any_offline == false); /* Other candidate insufficient funds. */

lightningd/test/run-jsonrpc.c

@@ -3,10 +3,6 @@
 #include "../json.c"
 
 /* AUTOGENERATED MOCKS START */
-/* Generated stub for amount_sat_to_msat */
- bool amount_sat_to_msat(struct amount_msat *msat UNNEEDED,
-					   struct amount_sat sat UNNEEDED)
-{ fprintf(stderr, "amount_sat_to_msat called!\n"); abort(); }
 /* Generated stub for db_begin_transaction_ */
 void db_begin_transaction_(struct db *db UNNEEDED, const char *location UNNEEDED)
 { fprintf(stderr, "db_begin_transaction_ called!\n"); abort(); }