Bitcoin Nodes Exposed to Fund Theft and Restart Failure by Critical Lightning Bugs

A recent update to the Lightning Development Kit (LDK), a toolkit for building Bitcoin Lightning applications, has addressed two critical bugs that could lead to fund theft and restart failure.

The LDK v0.2.6 release on September 9 included fixes for two vulnerabilities that affected nodes' financial security and normal operation.

The first bug allowed a malicious peer to cause excess fee allocation during a splice, which can divert small amounts of funds from an existing payment channel. The second flaw involved two payment contracts sharing the same payment hash, causing ChannelManager state to become unable to load after restarting an existing node.

LDK's API documentation describes the splice as spending the channel's funding output and replacing it with a new one. However, the update fixes this issue by preventing excess fee allocation, ensuring that funds are allocated correctly when a channel changes.