Bitcoin Lightning Toolkit Fixes Critical Bugs Exposing Nodes to Theft

Lightning Development Kit (LDK), a toolkit for building Bitcoin Lightning applications, has released version 0.2.6 with fixes for critical bugs that could have exposed nodes to fund theft and restart failure.

The update addresses two security flaws in LDK's API documentation, which described the process of adding funds or removing funds from an existing payment channel through a 'splice' function.

A malicious peer could exploit this flaw by causing excess fee allocation, with the excess going to their output. The release notes that a small amount of funds is at risk when initiating a splice, but does not specify a numerical ceiling.

The second security flaw involved two payment contracts sharing the same payment hash. After one had been successfully forwarded, receiving and immediately rejecting a bogus one could leave ChannelManager state unable to load, resulting in restart failure.

LDK's developers have reported that there are no observed losses or exploited applications, but affected application teams should bring these fixes into their software as soon as possible.