Bitcoin Lightning developer ACINQ has urged node operators to improve after fixing safety weaknesses that malicious friends might exploit.
The corporate launched Eclair model 0.14.6 on Oct. 27, introducing stricter transaction necessities and restoration mechanisms to stop manipulated channel funding from jeopardizing pending funds.
“We extremely suggest upgrading, as a few of these points may be exploited by malicious nodes,” ACINQ stated in its launch announcement.
The warning facilities on a weak spot in how Lightning channels deal with funding modifications earlier than the underlying Bitcoin transactions are confirmed.
Lightning permits customers to switch Bitcoin by cost channels with out recording each transaction on the blockchain. Operators also can add or withdraw liquidity from present channels by a course of often known as splicing.
Nonetheless, ACINQ’s launch documentation warns that accepting unconfirmed funding inputs from one other node creates a chance for manipulation.
A malicious peer might double-spend an unconfirmed transaction after signing a splice, invalidating the funding association that helps the channel.
If the affected channel subsequently closes by Bitcoin’s blockchain, pending funds secured by conditional contracts often known as HTLCs might grow to be weak as a result of their settlement is dependent upon the invalidated funding transaction.
The builders described a possible safety publicity relatively than a confirmed theft, leaving the extent of any real-world exploitation unknown.
Eclair tightens funding guidelines to guard Bitcoin funds
The replace introduces a brand new safety setting that requires confirmed inputs from friends earlier than they’ll contribute funds to channel splices.
Enabled by default, the safety additionally prevents operators from constructing further splices on high of unconfirmed funding modifications, decreasing alternatives for malicious friends to undermine settlement.
ACINQ separated this requirement from its present dual-funding protections, which now apply particularly to channel creation.
The builders additionally strengthened the software program’s response when a channel should shut whereas a funding transaction stays unconfirmed.
Beneath the revised settlement logic, Eclair selects a dedication transaction backed by funding that its Bitcoin Core backend acknowledges, reverting to the most recent confirmed funding state when vital.
That change addresses an issue through which an operator might try to settle a channel utilizing a funding transaction that had disappeared from its native pool of pending Bitcoin transactions.
A associated correction tackles one other potential loss situation involving transactions that miners verify after Eclair has stopped monitoring them as its most popular settlement route.
Beforehand, the software program might misidentify such a transaction as belonging to the counterparty, doubtlessly failing to say funds and pending cost outputs that remained recoverable.
The brand new logic acknowledges these transactions and makes an attempt to get well the corresponding outputs, defending funds which may in any other case be left unclaimed.
ACINQ additionally warned operators in opposition to utilizing its optionally available zero-fee dedication characteristic when splicing with untrusted friends. That characteristic was already disabled by default.
The discharge credit safety researcher Erick Cestari with responsibly disclosing points addressed by the replace.
Operators working older Eclair variations have been suggested to put in the patch and retain the brand new confirmed-input safeguard. ACINQ stated present cost channels can stay open throughout the improve, which requires stopping the software program, putting in the brand new model, and restarting the node.
