A vulnerability within the Bitcoin Lightning software Eclair could allow hostile peers to drain a node’s local channel balance entirely via transaction fees.
On Sept. 14, ACINQ launched Eclair 0.14.3 to resolve three peer-initiated security flaws capable of causing node runners to misplace or lock up funds during on-the-fly funding, splicing, and channel closures.
As a contributor to Lightning Network advancement and the creator of the Phoenix Wallet and Eclair, the Bitcoin technology firm strongly urged operators to update their software since bad actors could exploit these weaknesses.
Eclair’s patched vulnerabilities
Cooperative channel closures presented the most direct vector of attack. When Eclair handled the closing fee, a malicious peer could suggest a charge exceeding the victim’s local balance. Eclair’s fallback negotiation protocol might then accept this figure, wipe out the operator’s output, and route the entire local balance straight to Bitcoin miners as network fees.
The updated software now refuses any closing-fee proposal that exceeds an operator’s set maximum. Bitcoin Optech characterized version 0.14.3 as a critical security patch targeting issues tied to channel closures, splicing, and on-the-fly funding.
A second flaw risked stranding funds during an incomplete spliceâan operation that alters the transaction funding a Lightning channel without shutting it down. If Eclair signed initially and the peer withheld its own signature, the most recent channel state could rely on a transaction the victim was unable to broadcast.
This scenario likewise opened the door for financial losses on active payments in transit. An attacker could permit the incoming portion of a relayed payment to time out, broadcast a previous channel state, and leverage the payment secret to claim the outgoing leg. Moving forward, Eclair will trigger a force-close using the latest state secured by a fully signed funding transaction.
The third security hole impacted Eclair’s on-the-fly funding capability, which permits opening a channel simultaneously with forwarding a payment. A fraudulent wallet could tamper with payment-expiry schedules to cash out the outgoing payment on-chain while letting the incoming payment lapse, forcing the relay operator to cover the deficit.
To counter this, Eclair now validates relay fees and expiry buffers before locking in funds. Furthermore, the update institutes a default ceiling of 50 satoshis-per-vByte for automatically calculated channel-opening and splice fees, restricting potential damage from faulty external fee feeds.
Bitcoin Lightning operators face widening security pressure
These updates emerge as administrators running alternative Lightning implementations deal with separate campaigns aimed at vulnerable infrastructure.
Earlier in the month, Bitcoin payment processor BTCPay Server reported that bots had continuously scanned servers where administrators had manually turned external access back on for LND, a competing Lightning implementation.
The hackers focused on an unauthenticated password-modification endpoint during the narrow timeframe when an LND wallet remained locked. Had they succeeded, attackers could have swapped the wallet password and obtained an administrator macaroon granting full control over the node.
In response, BTCPay deployed unique passwords for LND wallets and restricted unauthenticated wallet-management paths at its network boundary. The platform also cautioned operators against manually exposing the LND API.
These events highlight growing security scrutiny throughout the Bitcoin Lightning network as malicious actors actively hunt for software bugs to misappropriate or siphon funds.
