Lightning apps using unpatched LDK risk Bitcoin theft from a reconnect lie
BTC when published $83,737Now $80,568 ▼ −3.78% since it was published
Lightning Development Kit (LDK), a library for building Bitcoin Lightning wallets and payment applications, has patched a flaw that could let a malicious channel peer steal the value of a forwarded payment by lying after reconnecting. Affected application developers need to incorporate the fix into the software they deploy. The attack starts with a channel peer acknowledging an update, then reconnecting and pretending it never received it. Before the fix, that false claim could cause LDK to sign a conflicting commitment transaction. A commitment transaction represents a channel's agreed state and can be used to settle it on Bitcoin's blockchain.
First reported by CryptoSlate. This page is a short excerpt; the full text is theirs.
