Bitcoin Lightning flaw in Eclair could allow fund loss to miners

A flaw in Bitcoin Lightning software Eclair could enable malicious peers to deplete a node's local channel balance through fees. ACINQ released Eclair 0.14.3 on Sept. 14 to address three vulnerabilities that could lead to fund loss or locking during channel closures, splicing, and on-the-fly funding. The company urged operators to upgrade to prevent exploitation. The most critical vulnerability involved cooperative channel closures, where an adversarial peer could propose a closing fee exceeding the victim's balance, resulting in the entire local balance being sent to miners. The patch now rejects such proposals above the configured maximum. Another weakness could leave funds stranded during an unfinished splice, while a third vulnerability affected on-the-fly funding, allowing a malicious wallet to manipulate payment timings. Eclair now checks relay fees and expiry buffers before committing funds and has set a default ceiling for channel-opening fees. These fixes come amid rising security threats in the Lightning ecosystem, as operators of other software face similar attacks.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.