Eclair tightens Bitcoin funding rules after unconfirmed inputs put Lightning payments at risk

Bitcoin Lightning developer ACINQ has urged node operators to upgrade after fixing security weaknesses that malicious peers could exploit.The company released Eclair version 0.14.6 on Oct. 27, introducing stricter transaction requirements and recovery mechanisms to prevent manipulated channel funding from jeopardizing pending payments.“We highly recommend upgrading, as some of these issues can be exploited by malicious nodes,” ACINQ said in its release announcement.The warning centers on a weakness in how Lightning channels handle funding changes before the underlying Bitcoin transactions are confirmed.Lightning allows users to transfer Bitcoin through payment channels without recording every transaction on the blockchain. Operators can also add or withdraw liquidity from existing channels through a process known as splicing.However, ACINQ's release documentation warns that accepting unconfirmed funding inputs from another node creates an opportunity for manipulation.A malicious peer could double-spend an unconfirmed transaction after signing a splice, invalidating the funding arrangement that supports the channel.If the affected channel subsequently closes through Bitcoin's blockc...