Bitcoin
Bitcoin Lightning Network’s vulnerabilities’ full disclosure released: Details exploitation of channels
The Lightning Network’s full vulnerabilities were recently disclosed by Rusty Russell, Blockstream Core Tech Engineer. The report stated that “an attacker can claim to open a channel but either not pay to the peer, or not pay the full amount.”
The report added that once the vulnerabilities were discovered, it was reported to the most widely used implementations: eclair and 1nd, resulting in both the implementations finding similar vulnerabilities. Succeeding this, the team made the decision to fix security issues and disclose information about it after a majority of the users had upgraded to the latest release. The release said:
“While this long-standing bug had not been independently discovered, and thus was unlikely to be discovered by a malicious party before being fixed, it did provide an opportunity to test communications and methods of upgrade across the entire lightning ecosystem.”
Lightning Network is a second-layer scaling technology for Bitcoin, which enables instant and low-cost payments. The first beta version was released by Lightning Labs in March 2018.
The initial announcement about the security issues discovered in various Lightning implementations was made on 30 August. The report stated that that there were three releases that were effected; CVE-2019-12998 c-lightning < 0.7.1, CVE-2019-1299-12999 1nd <0.7, and CVE-2019-13000 eclair <=0.3. And in order to mitigate the risk of losing funds, users were urged to upgrade to version 0.7.1 immediately.
In the report, Rusty Russell said,
“Lightning Network’s Common Vulnerabilities and Exposures [CVE] page announced that security issues were discovered in various lightning projects, which could have resulted in loss of funds.”
This was soon followed by another report on 10 September, with Russell stating that there were “confirmed instances of the CVE being exploited in the wild” and that users had to upgrade it in order to keep their funds safe. Additionally, Russell stated that they had “limits in place on the network,” in order to ensure that there was no widespread loss of funds.
The complete disclosure of the vulnerability, released on 27 September, spoke about the problem as,
“A lightning node accepting a channel must check that the funding transaction output does indeed open the channel proposed. Otherwise, an attacker can claim to open a channel but either not pay to the peer, or not pay the full amount.
It added,
“Once that transaction reaches the minimum depth, it can spend funds from the channel. The victim will only notice when it tries to close the channel and none of the commitment or mutual close transactions it has are valid.”
