A flaw in Bitcoin Lightning software Eclair could let malicious peers wipe out a node’s local channel balance through fees.

ACINQ released Eclair 0.14.3 on Sept. 14 to patch three peer-triggered vulnerabilities that could cause operators to lose or lock funds during channel closures, splicing, and on-the-fly funding.

The Bitcoin technology company, a contributor to Lightning Network development and maker of Eclair and Phoenix Wallet, strongly recommended operators upgrade because malicious nodes could exploit these issues.

The most direct attack involved cooperative channel closures. When Eclair was responsible for the closing fee, an adversarial peer could propose a charge larger than the victim’s local balance. Eclair’s fallback negotiation could accept the proposal, eliminate the operator’s output and effectively send the entire local balance to Bitcoin miners as transaction fees.

The patch now rejects closing-fee proposals above an operator’s configured maximum. Bitcoin Optech described 0.14.3 as a security release addressing vulnerabilities involving channel closing, splicing and on-the-fly funding.

A second weakness could strand funds during an unfinished splice, a process that changes the transaction funding a Lightning channel without closing it. If Eclair signed first and the peer withheld its signature, the latest channel state could depend on a transaction the victim could not publish.

That setup also created a path for losses on payments still in flight. An attacker could allow the incoming side of a relayed payment to expire, publish an older channel state, and use the payment secret to collect the outgoing leg. Eclair will now force-close using the newest state backed by a fully signed funding transaction.

The third vulnerability affected Eclair’s on-the-fly funding feature, which can open a channel while forwarding a payment. A malicious wallet could manipulate payment-expiry timing to collect the outgoing payment on-chain while the incoming payment expired, leaving the relay operator to absorb the loss.