Bitcoin Lightning developer ACINQ has urged node operators to improve after fixing safety weaknesses that malicious friends might exploit.
The corporate launched Eclair model 0.14.6 on Oct. 27, introducing stricter transaction necessities and restoration mechanisms to forestall manipulated channel funding from jeopardizing pending funds.
“We extremely advocate upgrading, as a few of these points might be exploited by malicious nodes,” ACINQ stated in its launch announcement.
The warning facilities on a weak spot in how Lightning channels deal with funding adjustments earlier than the underlying Bitcoin transactions are confirmed.
Lightning permits customers to switch Bitcoin by way of cost channels with out recording each transaction on the blockchain. Operators also can add or withdraw liquidity from current channels by way of a course of often known as splicing.
Nonetheless, ACINQ’s launch documentation warns that accepting unconfirmed funding inputs from one other node creates a chance for manipulation.
A malicious peer might double-spend an unconfirmed transaction after signing a splice, invalidating the funding association that helps the channel.
If the affected channel subsequently closes by way of Bitcoin’s blockchain, pending funds secured by conditional contracts often known as HTLCs might turn into susceptible as a result of their settlement relies on the invalidated funding transaction.
The builders described a possible safety publicity fairly than a confirmed theft, leaving the extent of any real-world exploitation unknown.
Eclair tightens funding guidelines to guard Bitcoin funds
The replace introduces a brand new safety setting that requires confirmed inputs from friends earlier than they’ll contribute funds to channel splices.
Enabled by default, the safety additionally prevents operators from constructing extra splices on high of unconfirmed funding adjustments, decreasing alternatives for malicious friends to undermine settlement.
ACINQ separated this requirement from its current dual-funding protections, which now apply particularly to channel creation.
The builders additionally strengthened the software program’s response when a channel should shut whereas a funding transaction stays unconfirmed.
Below the revised settlement logic, Eclair selects a dedication transaction backed by funding that its Bitcoin Core backend acknowledges, reverting to the newest confirmed funding state when essential.
That change addresses an issue wherein an operator might try and settle a channel utilizing a funding transaction that had disappeared from its native pool of pending Bitcoin transactions.
A associated correction tackles one other potential loss state of affairs involving transactions that miners verify after Eclair has stopped monitoring them as its most popular settlement route.
Beforehand, the software program might misidentify such a transaction as belonging to the counterparty, doubtlessly failing to assert funds and pending cost outputs that remained recoverable.
The brand new logic acknowledges these transactions and makes an attempt to get better the corresponding outputs, defending funds which may in any other case be left unclaimed.
ACINQ additionally warned operators in opposition to utilizing its non-compulsory zero-fee dedication characteristic when splicing with untrusted friends. That characteristic was already disabled by default.
The discharge credit safety researcher Erick Cestari with responsibly disclosing points addressed by the replace.
Operators operating older Eclair variations have been suggested to put in the patch and retain the brand new confirmed-input safeguard. ACINQ stated current cost channels can stay open throughout the improve, which requires stopping the software program, putting in the brand new model, and restarting the node.
