Eclair 0.14.3 patches Lightning flaws that could drain channel balances

  • ACINQ released Eclair 0.14.3 to patch three peer-triggered vulnerabilities.
  • 50 satoshis per vByte is the new default ceiling for automatically estimated fees.
  • BTCPay Server observed bots probing externally accessible LND servers earlier this month.

ACINQ released Eclair 0.14.3 on Sept. 14 to fix three peer-triggered vulnerabilities in its Lightning Network software (Bitcoin's payment-channel network). The flaws could let malicious peers cause fund losses or lock funds during cooperative channel closures, splicing and on-the-fly funding. One attack allowed a peer to propose closing fees larger than an operator's local balance, potentially directing the entire balance to Bitcoin miners; Eclair now rejects fees above the configured maximum. Another could strand funds during an incomplete splice and expose in-flight relayed payments to theft, while a third affected on-the-fly funding by manipulating payment expiry. The release adds checks for relay fees and expiry buffers and sets a default ceiling of 50 satoshis per vByte for automatically estimated channel-opening and splice fees. The fixes come as BTCPay Server reports repeated probing of exposed LND infrastructure, underscoring broader security pressure across the Lightning ecosystem.

The information on this website is generated using AI and we cannot guarantee its accuracy. Please use it as reference information only.