Bitcoin Lightning Development Kit Patches Critical Security Flaws

The Lightning Development Kit, a popular toolkit for building Bitcoin payment applications, released version 0.2.6 on September 9 to address two significant security issues. These bugs could have allowed malicious peers to divert small amounts of funds or caused nodes to fail during a restart process.

The first flaw involves a feature called splicing, which allows users to add or remove funds from an existing payment channel. A malicious peer could manipulate the fee calculation during this process to siphon off a portion of the funds. While the team did not provide a specific dollar amount for the risk, they confirmed the vulnerability exists whenever a node initiates a splice.

A second issue involves how the software handles payment contracts. If two contracts share the same payment hash, rejecting a fake payment after a legitimate one is forwarded could corrupt the stored channel state. This prevents the node from loading correctly after a restart, effectively taking the node offline.

The developers report that there are no known cases of these bugs being exploited. Application builders who use the toolkit should update to the latest version immediately to ensure their services remain secure. Since the toolkit is integrated directly into apps, developers are responsible for pulling these updates into their specific wallet and payment software.