Unpatched LDK in Lightning Apps Faces Bitcoin Theft Risk

LDK Vulnerability Exposes Lightning Apps to Theft

A security flaw within the Lightning Development Kit (LDK), a library used to build Bitcoin Lightning wallets and payment applications, has been identified and patched. The vulnerability could allow a malicious channel peer to steal funds from forwarded payments by falsely claiming an update wasn’t received after reconnecting.

The fix is included in LDK releases v0.2.7 and v0.1.13, dated October 1st, addressing the issue on the 0.2 and 0.1 branches respectively. Bitcoin Optech highlighted the updates in its October 9th newsletter.

How the Exploit Works

The attack vector involves a channel peer initially acknowledging an update, then disconnecting and reconnecting while falsely claiming the update was never received. Prior to the patch, this could lead LDK to sign a conflicting commitment transaction. These transactions represent the agreed-upon state of a channel and are used for on-chain settlement.

Crucially, the newly signed transaction wouldn’t be recorded by LDK’s channel monitor, creating a discrepancy. This allows the malicious sender to confirm the transaction and settle the payment, then reclaim the incoming payment contract even though they shouldn't have access to the necessary secret. The forwarding node effectively pays downstream without recovering its funds.

The implemented fix prevents retransmission of acknowledgments after they’ve been received and forces channel closure if a peer claims a previously acknowledged update was missed.

Additional Fixes in LDK v0.2.7

Alongside the reconnect vulnerability, version 0.2.7 also addresses a separate potential theft scenario involving LSPS2 just-in-time payments. This involved a liquidity service potentially opening a channel and forwarding more Bitcoin than the initial incoming payment due to an intercepted and misrepresented amount. PR 5042 addresses this amount check issue.

Developers integrating LSPS2 are advised to account for pending contracts with unvalidated amounts in addition to updating the library itself.

Source: CryptoSlate