Bitcoin Nodes Patched Against Critical Fund Theft Bugs
The Lightning Development Kit (LDK) has released an update to fix critical bugs that could have led to fund theft and restart failure in Bitcoin nodes. The v0.2.6 release addresses two security flaws: one that allowed a malicious peer to divert small amounts of a node's funds, and another that prevented saved channel state from loading after a shutdown.
The first flaw was related to the 'splice' function, which allows nodes to add or remove funds from an existing payment channel. The issue allowed a malicious peer to cause excess fee allocation, with the excess going to their output.
The second flaw occurred when two payment contracts shared the same payment hash. Receiving and immediately rejecting a bogus payment could leave ChannelManager state unable to load, preventing normal node restarts.
The LDK update is available for developers to incorporate into their applications, which includes wallet builders and payment-service infrastructure providers. The release notice reports no observed losses or exploited applications.