LDK Patches Critical Vulnerability in Bitcoin Lightning Network to Prevent Theft

Key Facts

1LDK released versions 0.2.7 and 0.1.13 to fix a reconnect vulnerability that risked Bitcoin theft.

2Version 0.2.7 also addresses a separate payment-amount flaw within the LSPS2 protocol.

LDK developers released versions 0.2.7 and 0.1.13 to fix a security vulnerability in the reconnection process that risked Bitcoin theft. TokenPost reported that the flaw allowed malicious peers to falsely claim they had not received channel updates upon reconnecting, potentially leading to conflicting commitment transactions and the reclamation of funds after hashed time-lock contracts (HTLC) expired.

Version 0.2.7 also addresses a separate payment-amount flaw within the LSPS2 protocol, where a client could request an amount larger than the incoming flow, causing liquidity services to forward more Bitcoin than received. While there are no confirmed reports of these vulnerabilities being exploited, the patches are considered essential for securing the wallets and nodes that utilize the LDK infrastructure.