Bitcoin Lightning developer ACINQ released an urgent security update for its Eclair software on October 27 after identifying flaws that malicious nodes could exploit. A peer could sign a channel funding change and then double-spend the unconfirmed transaction, invalidating the funding arrangement and threatening pending payments if the channel closed. Eclair 0.14.6 now requires confirmed inputs by default before contributing to such changes and prevents additional modifications from being built on unconfirmed funding changes. The update also strengthens settlement logic to recover funds and pending payment outputs in certain channel-closing scenarios. ACINQ recommends installing the new version, says real-world exploitation remains unknown and notes that existing channels can remain open during the upgrade.
Source: Read the original article
