Bitcoin Lightning flaw in Eclair could allow fund loss to miners

A flaw in Bitcoin Lightning software Eclair could enable malicious peers to deplete a node's local channel balance through fees. ACINQ released Eclair 0.14.3 on Sept. 14 to address three vulnerabilities that could lead to fund loss or locking during channel closures, splicing, and on-the-fly funding. The company urged operators to upgrade to prevent exploitation. The most critical vulnerability involved cooperative channel closures, where an adversarial peer could propose a closing fee exceeding the victim's balance, resulting in the entire local balance being sent to miners. The patch now rejects such proposals above the configured maximum. Another weakness could leave funds stranded during an unfinished splice, while a third vulnerability affected on-the-fly funding, allowing a malicious wallet to manipulate payment timings. Eclair now checks relay fees and expiry buffers before committing funds and has set a default ceiling for channel-opening fees. These fixes come amid rising security threats in the Lightning ecosystem, as operators of other software face similar attacks.