ACINQ's Lightning node software, Eclair, merged two critical code repairs into its master branch on Oct. 2 and Oct. 5 to address vulnerabilities that could cause node operators to drain their Bitcoin balances through excessive mining fees during channel funding and splicing operations.
Key Takeaways
- PR #3388 caps peer-initiated replace-by-fee (RBF) requests to prevent malicious peers from forcing unbounded fee payments during dual-funding or splicing.
- PR #3390 secures Eclair-signer mode, preventing a compromised bitcoind backend from dropping change outputs and overpaying miner fees.
- Both fixes postdate Eclair's v0.14.3 release from September, which remained listed as the latest build on its release page as of Oct. 12.
Capping Replace-by-Fee Demands in Dual Funding (PR #3388)
The first repair, PR #3388, addresses peer-initiated replace-by-fee (RBF) attempts during dual-funded channel openings or splicing transactions that modify existing channel funding. Prior to the fix, when an Eclair node contributed funds, it paid for its inputs at higher peer-requested fee rates without an upper bound or fee budget enforced on that specific path. A malicious peer contributing zero funds could repeatedly request higher fee rates, forcing the contributing Eclair node to pay arbitrary mining fees.
The update automatically rejects any RBF attempt that exceeds the maximum funding fee rate Eclair recommends to its peer. Two exceptions exist where Eclair does not bear the cost addressed by this limit: when the peer buys liquidity and pays the fee for Eclair's inputs, or when the Eclair node contributes no funds to the transaction.
Verifying Transaction Fees in Signer Mode (PR #3390)
The second update, PR #3390, addresses a vulnerability in Eclair-signer mode, where Bitcoin Core's bitcoind backend selects coins and constructs transactions while Eclair holds the signing keys. Prior to this patch, a compromised backend could report a fee within budget while constructing a transaction that omitted the change output. Under Bitcoin transaction accounting rules, any input value not assigned to output addresses automatically becomes a miner fee.
To resolve this, Eclair now fetches spending coins by transaction ID to authenticate their actual values and calculates the true fee independent of the backend's report. The software verifies that the reported fee matches the actual fee, applies the configured budget, confirms that Eclair's rebuilt contributions match the verified fee, and rejects invalid change-output positions. Both PR #3388 and PR #3390 were featured in Bitcoin Optech's Oct. 9 newsletter.
Why It Matters
As layer-2 infrastructure scales, preventing fee-siphoning vectors is essential to maintaining the economic viability of node operations. Although these vulnerabilities do not allow an attacker to transfer node funds directly into their own wallet, they enable malicious peers or compromised backends to drain liquidity by shifting balances directly to miners. Operators running standard deployments must carefully track node software patches, similar to how investors monitor security developments following broader hardware wallet attacks.
