Core Lightning Patches Vulnerability Threatening Network Integrity

Core Lightning, a leading Lightning Network node implementation, has successfully addressed a critical flaw that could have allowed malicious peers to evade penalties for broadcasting outdated channel states. The vulnerability, fixed in version v26.06.7 and subsequent releases, marks an important security update for node operators seeking to protect their funds from potential exploitation.

Understanding the Revoked State Loophole

In the Lightning Network, channel balances are updated through a series of commitments. If a peer attempts to broadcast an old, revoked state to claim more funds than they are currently entitled to, the protocol typically triggers a "penalty" mechanism, allowing the honest party to claim the entire balance. However, the discovered flaw allowed a peer to bypass this safeguard. By manipulating shutdown scripts, a malicious actor could trick a Core Lightning node into misidentifying a fraudulent broadcast as a "cooperative close," effectively escaping the penalty path and finalizing an illegitimate transaction.

Technical Resolution and Operator Recommendations

The development team resolved the issue by refining how the software recognizes transaction types. Instead of relying solely on output matching, the updated software now examines the transaction's locktime and sequence encoding to distinguish between a genuine mutual close and a revoked commitment. While no instances of confirmed theft have been reported, the project strongly advises operators to upgrade to v26.06.8, which includes additional security enhancements. Furthermore, those using Docker images distributed between late August and early September must verify their image digests. Some early v26.06.7 tags were found to lack the necessary fixes despite reporting the new version number on startup. Operators are encouraged to re-pull the latest images to ensure their nodes are fully protected against this channel-handling issue.