Eclair Patches Critical Vulnerabilities in Bitcoin Lightning Network Software

ACINQ has released Eclair version 0.14.3, a vital security update designed to protect Bitcoin Lightning node operators from potential fund depletion and locking. This patch addresses three distinct vulnerabilities that could have allowed malicious peers to exploit routine operations—such as channel closures, splicing, and on-the-fly funding—to redirect or freeze user funds. The developer strongly urges all operators to upgrade immediately to mitigate these risks.

Addressing the "Fee Wipeout" and Splicing Flaws

One of the most severe vulnerabilities involved the cooperative channel closure process. In previous versions, a malicious peer could propose a transaction fee that exceeded the node operator's local balance; Eclair’s fallback negotiation would occasionally accept these proposals, effectively funneling the operator's entire balance to Bitcoin miners as fees. Additionally, the update fixes a weakness in the "splicing" process where a peer could withhold a signature to strand funds or intercept relayed payments. To counter these, the 0.14.3 release implements strict maximums on closing fees and ensures that nodes force-close using the latest fully signed state.

Safeguarding On-the-Fly Funding and Ecosystem Security

The update also secures Eclair’s "on-the-fly" funding feature, which previously allowed attackers to manipulate payment-expiry timing to claim outgoing payments while letting incoming payments expire. By introducing rigorous checks on relay fees and expiry buffers, Eclair now prevents operators from absorbing these losses. Furthermore, a new 50 satoshis-per-vByte ceiling has been added to automated fee estimations to protect against malicious external fee data. These improvements arrive as the broader Lightning ecosystem faces increased pressure from automated bots targeting various implementations, highlighting a critical need for defensive infrastructure and proactive patching.