Eclair tightens Bitcoin funding rules after unconfirmed inputs put Lightning payments at risk

Bitcoin Lightning developer ACINQ has urged node operators to upgrade after fixing security weaknesses that malicious peers could exploit.

The company released Eclair version 0.14.6 on Oct. 27, introducing stricter transaction requirements and recovery mechanisms to prevent manipulated channel funding from jeopardizing pending payments.

“We highly recommend upgrading, as some of these issues can be exploited by malicious nodes,” ACINQ said in its release announcement.

The warning centers on a weakness in how Lightning channels handle funding changes before the underlying Bitcoin transactions are confirmed.

Lightning allows users to transfer Bitcoin through payment channels without recording every transaction on the blockchain. Operators can also add or withdraw liquidity from existing channels through a process known as splicing.

However, ACINQ's release documentation warns that accepting unconfirmed funding inputs from another node creates an opportunity for manipulation.

A malicious peer could double-spend an unconfirmed transaction after signing a splice, invalidating the funding arrangement that supports the channel.

If the affected channel subsequently closes through Bitcoin's blockchain, pending payments secured by conditional contracts known as HTLCs could become vulnerable because their settlement depends on the invalidated funding transaction.

The developers described a potential security exposure rather than a confirmed theft, leaving the extent of any real-world exploitation unknown.

Eclair tightens funding rules to protect Bitcoin payments

The update introduces a new security setting that requires confirmed inputs from peers before they can contribute funds to channel splices.

Enabled by default, the protection also prevents operators from building additional splices on top of unconfirmed funding changes, reducing opportunities for malicious peers to undermine settlement.

ACINQ separated this requirement from its existing dual-funding protections, which now apply specifically to channel creation.

The developers also strengthened the software's response when a channel must close while a funding transaction remains unconfirmed.

Under the revised settlement logic, Eclair selects a commitment transaction backed by funding that its Bitcoin Core backend recognizes, reverting to the latest confirmed funding state when necessary.

That change addresses a problem in which an operator could attempt to settle a channel using a funding transaction that had disappeared from its local pool of pending Bitcoin transactions.

A related correction tackles another potential loss scenario involving transactions that miners confirm after Eclair has stopped tracking them as its preferred settlement route.

Previously, the software could misidentify such a transaction as belonging to the counterparty, potentially failing to claim funds and pending payment outputs that remained recoverable.

The new logic recognizes those transactions and attempts to recover the corresponding outputs, protecting funds that might otherwise be left unclaimed.

ACINQ also warned operators against using its optional zero-fee commitment feature when splicing with untrusted peers. That feature was already disabled by default.

The release credits security researcher Erick Cestari with responsibly disclosing issues addressed by the update.

Operators running older Eclair versions have been advised to install the patch and retain the new confirmed-input safeguard. ACINQ said existing payment channels can remain open during the upgrade, which requires stopping the software, installing the new version, and restarting the node.