Lightning Development Kit v0.2.6 patches fund‑theft and restart bugs

The Lightning Development Kit (LDK), a software development kit used to build Bitcoin Lightning applications such as mobile wallets and payment‑service infrastructure, released version 0.2.6 on Sept. 9. The update addresses two distinct security issues that could affect node operators.

Splice fee‑allocation flaw

LDK’s splice operation lets a node add or remove funds from an existing payment channel by replacing the channel’s funding output with a new transaction. The fee‑calculation logic determines how much of the node’s money covers the transaction. A flaw allowed a malicious peer to manipulate the fee allocation, causing excess fees to be directed to the peer’s output. The vulnerability exposed a small, unspecified amount of funds when a node initiated a splice.

ChannelManager state‑loading bug

A separate bug involved two payment contracts sharing the same payment hash. After a legitimate payment was forwarded, receiving and immediately rejecting a bogus payment could corrupt the ChannelManager’s saved state. During node restart, deserialization of this state would fail, preventing the node from loading its channel data and halting normal operation. Rejecting the bogus payment alone does not avoid the failure.

Impact and remediation

Both issues affect the reliability and financial safety of Lightning nodes. The release notes state that no losses or exploited applications have been observed, but developers are urged to integrate the patched LDK version into their applications. Because LDK’s core implementation is compiled into each application, updating the toolkit is the primary maintenance step for affected wallets and services.

Next steps for developers

• Upgrade to LDK v0.2.6 as soon as possible.
• Verify that the splice fee‑allocation logic now correctly attributes fees.
• Test node restart procedures to ensure ChannelManager state loads without errors.