Second Vulnerability in Bitcoin's Lightning Network Discovered

Share this article

Developers have found a new vulnerability in the Bitcoin Lightning Network’s node software, according to a recently published disclosure notice.

Few Details Have Been Revealed

Lightning developer Conner Fromknecht disclosed the issue on Oct. 9 on the project’s mailing lists. The disclosure advises node operators to upgrade their software as soon as possible.

It is not clear how serious the vulnerability is. The disclosure does not reveal how the potential exploit works, though it does suggest that the vulnerability has not been exploited “in the wild. Furthermore, the bug has already been fixed: version 0.11 of the Lightning Network software solves the problem and was released in late August, which means that many Lightning node operators have already installed the fix.

However, the team notes that the vulnerability was discovered in such a way that the disclosure process has been shortened. Full details about the bug will be released on Oct. 20.

Lightning Labs also says that it will begin a “comprehensive bug bounty program” in the near future, meaning that there will be monetary rewards for those who discover future bugs.

Lightning Network Security in Question

The Lightning Network is a still-developing layer-2 payment protocol that operates on top of Bitcoin, enabling faster and cheaper transactions on the network.

This is the second time a vulnerability has been discovered in Lightning’s node software. Last year, Bitcoin developer Rusty Russell found a separate vulnerability that allowed attackers to steal funds by sending invalid transactions. Though Lightning Labs never announced how many users fell victim to the exploit, the team confirmed that the vulnerability was indeed exploited “in the wild.”

Both of these bugs concern short-lived programming oversights, not security issues that are fundamental to the design of Lightning itself. Many see Lightning Network as the most promising way to speed up Bitcoin transactions and reduce transaction fees. Major crypto companies like Bitfinex and CoinGate have adopted the Lightning Network without any apparent issues.

On the other hand, Lightning Labs itself has stated that the project is in its “early stages” and has advised users not to “put more money on Lightning than [they are] willing to lose.” As such, it is not clear whether the Lightning Network is truly ready for prime time.

Share this article