Eclair bug could drain node balance into miner fees

ACINQ, the developer of the Eclair implementation and the Phoenix Wallet, released Eclair 0.14.3 on Sept. 14 to patch three vulnerabilities that could be triggered by a counterparty and lead to loss or misdirection of channel funds. The company advised operators to upgrade promptly.

The most severe flaw affected cooperative channel closes. When Eclair assumed responsibility for the closing fee, a malicious peer could propose a fee larger than the operator’s local channel balance. Eclair’s fallback negotiation could accept that proposal, remove the operator’s output from the closing transaction and cause the node’s entire local balance to be paid to miners as transaction fees. The update rejects closing-fee proposals that exceed an operator’s configured maximum.

A second vulnerability involved splicing, the procedure for updating a channel’s funding transaction without closing the channel. If Eclair signed a splice transaction first and the peer withheld its signature, the node could end up with a latest channel state that relied on a funding transaction it could not publish. An attacker could also exploit that situation to steal relayed payments by letting the incoming leg expire, publishing an older channel state and using the payment secret to claim the outgoing leg. Eclair 0.14.3 changes behavior so the node will force-close using the newest state only when that state is backed by a fully signed funding transaction.

The third issue affected on-the-fly funding, which opens a channel while forwarding a payment. A malicious wallet could alter expiry timings so the outgoing payment was finalized on-chain while the incoming payment expired, leaving the relay operator to cover the loss. The patched release adds checks on relay fees and expiry buffers before committing funds and introduces a default cap on automatically estimated fees for channel openings and splices.

Eclair 0.14.3 also implements a safety ceiling of 50 satoshis per virtual byte for automatically estimated channel-opening and splice fees to limit exposure to incorrect or malicious fee data from external services. The release was described by maintainers as a security update addressing vulnerabilities related to channel closing, splicing and on-the-fly funding.

The fixes arrive amid increased probing of Lightning infrastructure. Earlier in September, automated bots scanned servers where administrators had re-enabled external access to another popular Lightning implementation. Attackers targeted an unauthenticated password-change endpoint during a brief window when a wallet was locked; if successful they could replace the wallet password and request an administrator macaroon that grants control over the node. Administrators responded by requiring unique wallet passwords, blocking unauthenticated wallet-management routes at the network edge and advising operators not to expose external node APIs.

Operators running Lightning nodes are advised to update Eclair installations, review API exposure and strengthen access controls. The patched release addresses the specific vulnerabilities fixed in Eclair 0.14.3 and the recent scanning activity highlights the need for regular updates and careful configuration across Lightning implementations.