Blockstream core engineer Rusty Russell discovered critical Bitcoin Lightning Network bugs that were affecting C-Lightning, Éclair, and Lightning Network Daemon (lnd) implementations.
Early LN Versions Failed to Check Funding Transaction Amounts
Presently, three autonomous teams are working on the Lightning Network implementations: Blockstream, ACINQ, and Lightning Labs. The main objective of these teams, among other things, is to reduce transaction costs while enhancing the scalability and security of the Bitcoin network.
ICYMI: Here are all the details of the recent Lightning bug. https://t.co/NVzKmGW5I6
— TheRustyTwit (@rusty_twit) September 27, 2019
The Lightning Network is made up of micropayment channels. These channels update balances perpetually outside the BTC blockchain. But, once the payment channel is closed, the transactions that occurred between the micro-payment channels are then broadcast, as one transaction, to the blockchain. Thus, regardless of the number of transactions conducted, the blockchain is accessed only twice, when the channel is first activated and when the channel is closed. Thus, this method reduces the load of the Bitcoin blockchain significantly.
While reviewing new proposed features for the Lightning Network, Russell performed tests under the following problem statement,
“A lightning node accepting a channel must check that the funding transaction output does indeed open the channel proposed. Otherwise, an attacker can claim to open a channel but either not pay to the peer, or not pay the full amount. Once that transaction reaches the minimum depth, it can spend funds from the channel. The victim will only notice when it tries to close the channel and none of the commitment or mutual close transactions it has are valid.”
As a result, Russell detected that Blockstream implementations before the C-lightning version 0.7.1, did not perform this check. “This can be exploited by a connecting peer and claiming to open a…