Core Lightning fixes channel-close flaw in v26.06.7

Core Lightning has addressed a channel-close vulnerability in version 26.06.7 that allowed peers to broadcast an old, revoked channel state without incurring penalties. The issue, detailed by Bitcoin Optech on Sept. 25, poses risks for operators using outdated builds. In the Lightning Network, peers replace channel commitments as balances change. If a revoked commitment is broadcast, the counterparty should claim a penalty. However, prior to the fix, Core Lightning could misclassify this as a cooperative close if the outputs matched existing shutdown scripts. This exploit depended on specific channel setups, allowing peers without an upfront shutdown script to name the output script of a revoked commitment, thus bypassing penalties. The fix introduces checks for transaction locktime and sequence encoding to properly identify commitments. Operators using versions older than v26.06.7 are urged to update, with v26.06.8 recommended for additional security fixes. Users who deployed Docker images during the earlier rollout should verify the image digest, as some images reported the new version without including the fixes. The version history shows that v26.06.7 was released on Aug. 28, with the source code published on Sept. 11, followed by v26.06.8 on Sept. 22.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.