Bitcoin Optech Newsletter #427

Bitcoin Optech Newsletter #427 details the disclosure and fixes for two denial-of-service (DoS) vulnerabilities in Eclair v0.14.0 and earlier, urging users to upgrade to v0.14.1. Erick Cestari posted the responsible disclosure to Delving Bitcoin. The first vulnerability, found by Matt Morehouse, was a race condition in the temporary_channel_id check during channel opening. An attacker could send multiple identical open_channel messages quickly, causing Eclair to create duplicate channel states for one ID, leading to memory leaks of about 1 MB per second until the node ran out of memory or CPU. The second vulnerability, found by Cestari, allowed bypassing Eclair’s limit on unconfirmed pending channels. Attackers could reuse a channel’s final channel_id as a temporary_channel_id for subsequent open_channel messages. The limiter would count the reused ID twice and drop both entries upon a new channel receiving its final ID, preventing the counter from rising while the number of memory-consuming pending channels grew unboundedly. The newsletter also mentions a proposed scheme for complex multi-round contracts within Lightning channels and regular updates on new releases and changes to popular Bitcoin infrastructure software.