ACINQ shipped Eclair 0.14.3 on Sept. 14 to patch three peer-triggered Lightning Network vulnerabilities, and the worst of them could send a node’s entire channel balance to Bitcoin miners as transaction fees. ACINQ strongly recommended that every operator upgrade, and the technical newsletter covering the release described 0.14.3 as a security update.
The most severe flaw sat in cooperative close fee negotiation. When Eclair was responsible for paying the closing fee, an adversarial peer could propose a charge larger than the victim’s local balance, and Eclair’s fallback negotiation could accept it. That would wipe out the operator’s output on the closing transaction and route the whole local balance to miners, with no key compromise involved. The patch now rejects closing-fee proposals above an operator’s configured maximum.
The two other flaws struck closer to routing. In an unfinished splice, Eclair signed first, so a peer that withheld its own signature could leave the latest channel state dependent on a transaction the victim could not publish, stranding the funds. Eclair now force-closes using the newest state backed by a fully signed funding transaction.
The third flaw hit on-the-fly funding. A malicious wallet could manipulate payment-expiry timing to collect the outgoing payment on-chain while the incoming payment expired, leaving the relay operator to absorb the loss. A related attack let an adversary publish an older channel state and use the payment secret to collect the outgoing leg of a relayed payment. The release now checks relay fees and expiry buffers before committing funds, and it adds a default 50 satoshis-per-vByte ceiling on automatically estimated channel-opening and splice fees.
Operators running older Eclair versions remain exposed until they upgrade. No losses from these flaws have been reported.
Separately, BTCPay Server said this month that bots had repeatedly probed servers where administrators manually re-enabled external access to LND, a different Lightning implementation. The probes targeted an unauthenticated password-change endpoint during the brief window when an LND wallet was locked; success would have let an attacker replace the wallet password and request an administrator macaroon controlling the node. BTCPay responded with unique LND wallet passwords, blocked unauthenticated wallet-management routes at its network edge, and advised operators not to expose the LND API.
