Bitcoin Optech Newsletter #427

AI editorial brief — source checked

This week's Bitcoin Optech Newsletter #427 details the disclosure of two denial-of-service vulnerabilities in older versions of Eclair, both fixed in v0.14.1, and introduces LN-GAP, a proposal for running complex multi-round contracts in Lightning channels. It also covers recent releases and notable code changes across Bitcoin infrastructure projects, including Bitcoin Core 32.0rc4 and fixes in Eclair, LDK, LND, Rust Bitcoin, and BDK.

1. Two DoS vulnerabilities in Eclair v0.14.0 and earlier were fixed in Eclair v0.14.1 via Eclair #3324.
   Source evidence

   ● Disclosure of two DoS vulnerabilities fixed in Eclair v0.14.1: Erick Cestari posted to Delving Bitcoin the responsible disclosure of two denial-of-service (DoS) vulnerabilities in the channel
2. The first DoS vulnerability, found by Matt Morehouse, is a race condition in duplicate temporary_channel_id check allowing memory exhaustion.
   Source evidence

   The first, found by Matt Morehouse with his smite fuzzer, is a race condition in a duplicate temporary_channel_id check. Eclair checked whether the ID was already in use before accepting an
3. The second DoS vulnerability, found by Erick Cestari, bypasses Eclair's pending channel limit by reusing channel_id as temporary_channel_id.
   Source evidence

   The second, found by Cestari, bypasses Eclair’s limit on the number of pending channels whose funding transaction has not confirmed. The duplicate check only looked at temporary IDs, so an
4. Mobile wallets using Eclair as LSP, like Phoenix, are unaffected as ACINQ patched its nodes months ago.
   Source evidence

   Replying to a question, Morehouse noted that mobile wallets that use an Eclair node as their LSP, such as Phoenix, are unaffected because ACINQ patched its nodes months ago.
5. LN-GAP proposal enables complex multi-round contracts in Lightning channels with onchain dispute resolution via a venue using one-bit signatures and OP_CHECKSIGADD.
   Source evidence

   ● Offchain contracts in Lightning channels: Adam Gibson posted to the Bitcoin-Dev mailing list about a proposal for protocol, called LN-GAP, to run complex, multi-round, two-party contracts

What remains uncertain: The newsletter does not establish whether the LN-GAP proposal has been implemented beyond the chess game example or adopted by any Lightning Network participants.