Eclair Node Software Patches Lightning Network Fee Loss Bugs

Eclair Addresses Lightning Network Vulnerabilities

ACINQ’s Eclair, a popular Lightning Network node implementation, has merged two critical repairs designed to prevent potential Bitcoin losses stemming from exploitable fee structures. The fixes, integrated into the project’s master branch on October 2nd and 5th, address vulnerabilities in channel funding and splicing processes.

Fee-Bump Exploits Mitigated

The first repair, PR #3388, tackles a scenario where a malicious peer could initiate replace-by-fee (RBF) attempts during channel opening or splicing. Previously, Eclair lacked an upper bound on fees a peer could demand, potentially allowing a malicious actor to impose an arbitrary mining fee rate without contributing funds. The update now limits fee increases to the maximum funding rate recommended by Eclair.

Backend Compromise Protection

The second fix, PR #3390, focuses on protecting against compromised Bitcoin Core backends in Eclair-signer mode. This vulnerability allowed a compromised backend to report a fee within budget while constructing a transaction that actually paid a higher fee by dropping the change output. The repair verifies the actual fee against the reported fee and rejects invalid change-output positions, ensuring accurate fee calculation.

These fixes are separate from previously reported vulnerabilities, including a cooperative-closing fee flaw and denial-of-service issues. Operators are advised to verify their Eclair builds include the October updates to ensure protection against these potential exploits. Bitcoin Optech highlighted the importance of these changes in its October 9th newsletter.

Source: CryptoSlate