LDK Fixes Critical Bugs in Latest Update

The Lightning Development Kit (LDK) has released v0.2.6 to address two critical bugs that could impact the security and functionality of Bitcoin Lightning applications.

The update fixes a flaw in the splice function, which allows nodes to add or remove funds from existing payment channels. A malicious peer could exploit this vulnerability to divert excess fees to their own output, potentially draining small amounts of a node's funds.

The second bug prevents ChannelManager state from loading after a node restarts, caused by receiving and rejecting a bogus payment hash that matches one already successfully forwarded. This issue can disrupt normal node operations and prevent applications from completing their restart process.

The fixes are available in the latest version of LDK, which is designed to package a Lightning implementation as a software development kit for various applications, including mobile wallets and payment-service infrastructure.