Security· ★★★· neutral·

LDK patches Lightning flaw that let peers steal forwarded Bitcoin via reconnect lie

  • —October 1 releases v0.2.7 and v0.1.13 fix the reconnect flaw on the 0.2 and 0.1 branches
  • —Attack: a peer acknowledges an update, reconnects and denies receiving it
  • —LDK could sign a conflicting commitment transaction not recorded by its channel monitor
  • —v0.2.7 also fixes an amount check in LSPS2 just-in-time payments
Why it matters: The flaw affects Lightning wallets and payment apps; unpatched deployments risk losing forwarded payments.
#BTC
Source: CryptoSlate
More on this
Security · Oct 9
Core Lightning patches critical security flaws and a Bitcoin payment bug
 Security · Oct 2
Electrum patches Lightning flaw, but old Bitcoin backups break
 Security · Sep 14
LDK releases v0.2.6 patch fixing two critical Lightning Network vulnerabilities