Hacking News
LDK Reconnect Flaw Exploited for Bitcoin Theft
A security flaw in the Lightning Development Kit (LDK) has been patched to prevent a malicious channel peer from stealing the value of forwarded Bitcoin payments. The flaw, which allows a peer to lie about an acknowledged update after reconnecting, was fixed in the v0.2.7 and v0.1.13 releases. Affected application developers must incorporate the fix into their deployed software. The flaw could cause a forwarded payment to be lost, as the malicious peer could confirm the transaction on the blockchain and reclaim the incoming payment contract when it expired. The fix permits retransmission only while the peer's acknowledgment remains outstanding and force-closes the channel when the peer claims an already-acknowledged update was missed. This highlights a security vulnerability in the Lightning network and the importance of patching such flaws to protect against potential theft attacks.