Bitcoin Lightning developer ACINQ released Eclair version 0.14.6 on October 27 with stronger funding requirements and recovery procedures to protect pending payments. ACINQ urged node operators to upgrade because malicious nodes could exploit some of the weaknesses. Older Eclair versions remain exposed to the identified risks. The developers described possible security failures, not confirmed theft, and the extent of any exploitation is unknown.
Lightning payment channels let users transfer Bitcoin without putting each transaction on the blockchain. Splicing lets operators increase or decrease liquidity in an existing channel. ACINQ's release documentation warns that a peer can manipulate channel funding when another node accepts funding inputs that lack confirmation. A malicious peer could sign a splice and then double-spend an unconfirmed transaction, invalidating the channel's funding arrangement. Pending payments protected by conditional contracts called HTLCs could become vulnerable if the channel later closes on the Bitcoin blockchain, because settlement depends on the invalidated transaction.
A new security setting requires peers to supply confirmed inputs before contributing funds to a channel splice. The setting is enabled by default and also blocks further splices that depend on funding changes awaiting confirmation. These restrictions reduce opportunities for malicious peers to disrupt settlement. ACINQ made the splice requirement separate from the existing dual-funding protections, which now cover channel creation specifically.
Eclair also changes how settlement works when a channel closes before a funding transaction receives confirmation. Eclair chooses a commitment transaction whose funding the Bitcoin Core backend recognizes, falling back to the most recent confirmed funding state when necessary. The change addresses cases where an operator could try to settle through a funding transaction no longer present in the operator's local pool of pending Bitcoin transactions.
Another fix addresses transactions that miners confirm after Eclair stops treating those transactions as the preferred settlement route. Eclair previously could mistake such a transaction for the counterparty's transaction and fail to claim recoverable funds and pending-payment outputs. The revised logic identifies those transactions and tries to recover the associated outputs, protecting funds that could otherwise remain unclaimed.
ACINQ warned operators not to use the optional zero-fee commitment feature for splicing with untrusted peers. The feature was already off by default. The release acknowledges security researcher Erick Cestari for responsibly disclosing issues covered by the update.
Operators using older versions have been advised to install the patch and keep the confirmed-input protection enabled. ACINQ said existing payment channels can stay open throughout the upgrade. The upgrade requires operators to stop Eclair, install the updated version and restart the node.
Eclair 0.14.6 Released to Strengthen Bitcoin Lightning Network Security
CryptoSlateShare
Summary
ACINQ released Eclair 0.14.6 on October 27 as part of a network upgrade to improve Bitcoin Lightning Network security. The update tightens funding rules and recovery processes, reducing risks from unconfirmed inputs. It enforces confirmed inputs for channel splicing and adjusts settlement logic for channels closing before funding confirmation. ACINQ urged node operators to upgrade to prevent potential security breach risks from malicious peers.
Source:Show original
Disclaimer: The information on this page may have been obtained from third parties and does not necessarily reflect the views or opinions of KuCoin. This content is provided for general informational purposes only, without any representation or warranty of any kind, nor shall it be construed as financial or investment advice. KuCoin shall not be liable for any errors or omissions, or for any outcomes resulting from the use of this information.
Investments in digital assets can be risky. Please carefully evaluate the risks of a product and your risk tolerance based on your own financial circumstances. For more information, please refer to our Terms of Use and Risk Disclosure.