Prevent HTLC double-forwards, prune forwarded onions

lightning/src/chain/channelmonitor.rs

@@ -1256,18 +1256,19 @@ pub(crate) struct ChannelMonitorImpl<Signer: EcdsaChannelSigner> {
 	// deserialization
 	current_holder_commitment_number: u64,
 
-	/// The set of payment hashes from inbound payments for which we know the preimage. Payment
-	/// preimages that are not included in any unrevoked local commitment transaction or unrevoked
-	/// remote commitment transactions are automatically removed when commitment transactions are
-	/// revoked. Note that this happens one revocation after it theoretically could, leaving
-	/// preimages present here for the previous state even when the channel is "at rest". This is a
-	/// good safety buffer, but also is important as it ensures we retain payment preimages for the
-	/// previous local commitment transaction, which may have been broadcast already when we see
-	/// the revocation (in setups with redundant monitors).
+	/// The set of payment hashes from inbound payments and forwards for which we know the preimage.
+	/// Payment preimages that are not included in any unrevoked local commitment transaction or
+	/// unrevoked remote commitment transactions are automatically removed when commitment
+	/// transactions are revoked. Note that this happens one revocation after it theoretically could,
+	/// leaving preimages present here for the previous state even when the channel is "at rest".
+	/// This is a good safety buffer, but also is important as it ensures we retain payment preimages
+	/// for the previous local commitment transaction, which may have been broadcast already when we
+	/// see the revocation (in setups with redundant monitors).
 	///
 	/// We also store [`PaymentClaimDetails`] here, tracking the payment information(s) for this
 	/// preimage for inbound payments. This allows us to rebuild the inbound payment information on
-	/// startup even if we lost our `ChannelManager`.
+	/// startup even if we lost our `ChannelManager`. For forwardeds, the list of
+	/// [`PaymentClaimDetails`] is empty.
 	payment_preimages: HashMap<PaymentHash, (PaymentPreimage, Vec<PaymentClaimDetails>)>,
 
 	// Note that `MonitorEvent`s MUST NOT be generated during update processing, only generated