Bitcoin Lightning’s year-old security fixes still missing from 71% of flagged nodes
An October 21 preprint estimates 71% of an exposed LND cohort remained on affected release lines at its October 13 cutoff. Read the full story on CryptoSlateUnderstand the crypto stories that matter and what to watch next. Get The Catalyst in your inbox
Nearly three-quarters of public Bitcoin Lightning nodes identified as exposed in August remained on affected software lines in October.
An Oct. 21 study found that 71% of a group of 550 public LND nodes flagged during an Aug. 11 security disclosure were still operating on affected software release lines as of Oct. 13.
Only about 10% had upgraded during that period, while 108 nodes were no longer classified as live. The findings suggest that security fixes are reaching some Lightning operators well after their release dates.
The delays are particularly striking because patches for six vulnerabilities covered by the August disclosures had been available since LND version 0.19.0, released 446 days before the public warning.
LND is one of the software implementations used to operate nodes on Bitcoin's Lightning Network, which processes payments outside the blockchain's main transaction layer.
Related ReadingResearch by Saurabh Kumar of Bitcoin Data Labs found that the network's largest software upgrade waves closely followed releases from Umbrel, a platform that packages Bitcoin node software.
The three biggest waves involved between 262 and 385 nodes each, with at least 87% of participating nodes broadcasting updated software features within 48 hours of an Umbrel release.
However, Umbrel distributed those versions between 19 and 41 days after the corresponding LND releases, introducing another potential delay between developers making fixes available and operators receiving them through their preferred platforms.