The October 1-dated v0.2.7 and v0.1.13 releases fix the reconnect path; v0.2.7 also addresses an LSPS2 amount flaw
Lightning Development Kit (LDK), a library for building Bitcoin Lightning wallets and payment applications, has patched a flaw that could let a malicious channel peer steal the value of a forwarded payment by lying after reconnecting. Affected application developers need to incorporate the fix into the software they deploy
The attack starts with a channel peer acknowledging an update, then reconnecting and pretending it never received it. Before the fix, that false claim could cause LDK to sign a conflicting commitment transaction
A commitment transaction represents a channel's agreed state and can be used to settle it on Bitcoin's blockchain. In the scenario described in PR 5057, the newly signed transaction was not recorded by LDK's channel monitor, the component tracking the channel's on-chain claims
That gap could turn a forwarded payment into a loss. The malicious sender could confirm the transaction on-chain and let the payment settle with the next recipient. It could then reclaim the incoming payment contract when it expired, even though the forwarding node knew the secret normally used to claim payment
The forwarding application would have paid downstream without recovering the corresponding incoming funds. The fix permits retransmission only while the peer's acknowledgment remains outstanding and force-closes the channel when the peer claims an already-acknowledged update was missed
Related ReadingCore Lightning patches flaw that could let revoked channel state escape penalty
Start with the stories that matter. Get the context behind the headlines and a clear view of what to watch next
Thanks for signing up to The Catalyst. Look out for your first daily email. If you already receive it, you’re all set
Alongside the LDK reconnect fix, version 0.2.7 addresses a different theft path involving LSPS2 just-in-time payments, where a liquidity service opens a channel as part of handling a payment
An intercepted payment could misrepresent its amount, causing the service to open a channel and forward more Bitcoin than the incoming payment supplied. The service would cover the difference from its own funds. PR 5042 addresses that amount check
That exposure concerns the LSPS2 service flow. The v0.1.13 notes list the shared reconnect fix without listing the LSPS2 fix
These defects differ from the splice-fee diversion and saved-state loading bugs covered in CryptoSlate's Sept. 13 LDK v0.2.6 report. Core Lightning is a separate implementation, as described in the update below
LDK’s architecture documentation explains that the SDK is compiled and executed inside applications. Developers must incorporate the relevant patched library code into deployed software. For LSPS2 integrations, the PR 5042 commit explanation flags that payment contracts queued by a prior version retain unvalidated amounts; teams need to account for those pending contracts as well as updating the library
Also known as "Akiba," Liam Wright is a reporter, podcast producer, and Editor-in-Chief at CryptoSlate. He believes that decentralized technology has the potential to make…
