Bitcoin Optech Newsletter #425

This week's Bitcoin Optech Newsletter #425 highlights two critical denial-of-service (DoS) vulnerabilities affecting older versions of Eclair (v0.13.1 and earlier), which have since been fixed in v0.14.0. The first vulnerability stemmed from inefficient feature bit parsing, where a single maximum-length init message could allocate 300 MB of memory and occupy a parsing thread for 300 ms, enabling attackers to quickly disconnect peers and exhaust memory. This was discovered using the `smite` LN fuzzer. The second DoS flaw was in gossip queries, where zlib decompression of legacy `query_short_channel_ids` messages lacked an output limit, allowing a 64 KB message to expand to 64 MB, potentially taking nodes offline. Both attacks required only a BOLT8 handshake. The newsletter also outlines a proposal for secure wallet label synchronization across devices and regular updates on Bitcoin consensus rule discussions and infrastructure software changes.