Bitcoin Lightning developers sound alarm over security flaws as second patch lands in five days
Version 0.14.5 addresses issues exploitable by malicious nodes and lets Eclair operators upgrade without closing existing channels. Read the full story on CryptoSlateUnderstand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Bitcoin Lightning developer ACINQ urged node operators to upgrade Eclair after patching security flaws that malicious peers could exploit.
The company released Eclair version 0.14.5 on Oct. 20, its second security-focused update in five days, warning that some of the newly addressed vulnerabilities could be exploited by hostile nodes. The software powers Bitcoin Lightning nodes that maintain payment channels and route transactions across the network.
The developers credited security researchers Nuhiat-Arefin and mptfire with responsibly disclosing problems addressed in the update.
The warning places renewed pressure on Lightning node operators, who maintain Bitcoin-funded payment channels used to transfer funds across the network. Vulnerabilities involving interactions with malicious peers create potential security and operational risks for infrastructure supporting Lightning payments.
However, ACINQ has not detailed the newly patched exploit mechanisms or specified which older versions are affected. The announcement also reported no confirmed attacks or financial losses, leaving the potential financial consequences unclear.
The developers have sought to minimize disruption from the upgrade. According to the release instructions, operators can install the update without closing existing payment channels.
Instead, they must stop Eclair, install the new version, and restart the software. This avoids the blockchain transactions and channel reconfiguration that closing and reopening Lightning channels can require.