Eclair Update Patches Critical Lightning Vulnerabilities

ACINQ announced the release of Eclair 0.14.3 on September 14, addressing three vulnerabilities that could be exploited by malicious peers on the Bitcoin Lightning Network.

Vulnerability 1: Over‑charging Closing Fees

When Eclair handled cooperative channel closures, an adversarial peer could propose a closing fee larger than the node’s local balance. The software’s fallback negotiation could accept the proposal, causing the entire local balance to be consumed as transaction fees and sent to miners. The patch now rejects any closing‑fee proposal that exceeds the operator’s configured maximum.

Vulnerability 2: Splice‑Related Fund Loss

During a splice operation—changing a channel’s funding without closing—it was possible for a peer to withhold its signature after Eclair had signed first. This could leave the victim unable to publish the latest state, potentially stranding funds and exposing payments in flight to theft. The update forces a close using the newest state backed by a fully signed funding transaction.

Vulnerability 3: On‑the‑Fly Funding Exploit

Eclair’s on‑the‑fly funding feature, which opens a channel while forwarding a payment, could be abused by a malicious wallet that manipulates payment‑expiry timing. The attacker could collect the outgoing payment on‑chain while the incoming payment expires, causing the relay operator to lose funds. The fix adds checks for relay fees and expiry buffers before committing funds.

Additional Safeguards

• Default ceiling of 50 satoshis per vByte for automatically estimated channel‑opening and splice fees.
• Improved validation of external fee data.

Broader Security Context

Other Lightning implementations are also under pressure. Earlier this month, BTCPay Server reported bots probing LND nodes for an unauthenticated password‑change endpoint, potentially allowing attackers to gain administrative control. BTCPay responded with unique passwords for LND wallets, blocked unauthenticated routes, and advised against manual exposure of the LND API.

These incidents highlight increasing security challenges across the Lightning ecosystem as attackers seek software weaknesses to seize or redirect funds.