Eclair merges two patches guarding Lightning nodes against excessive fee loss
Two security fixes land in Eclair master
Eclair, the Lightning node software made by ACINQ, has merged two code repairs that close gaps where a node could lose Bitcoin to excessive mining fees. The patches arrived on October 2 and October 5, but as of October 12 the project's release page still listed September's v0.14.3 as the latest packaged version.
What the fixes protect against
The first patch, pull request #3388, targets a problem during dual-funded channel openings and splicing, which is when a Lightning channel's funding amount is adjusted. A peer node could ask to replace the funding transaction with one carrying a higher mining fee rate, a practice called replace-by-fee. Eclair would match that higher rate for its own contribution without any spending cap, letting a malicious peer force the node to pay arbitrary fees while contributing nothing itself.
The new repair rejects any fee above the maximum funding fee rate Eclair recommends to its peer. Exceptions remain when the peer buys liquidity and pays the fees for Eclair's inputs, or when the Eclair node contributes no funds at all.
The second patch, pull request #3390, addresses a separate risk in Eclair-signer mode. In this setup, Bitcoin Core's backend, bitcoind, selects coins and builds transactions while Eclair keeps the signing keys. A compromised backend could report a fee inside budget while actually constructing a transaction that pays more, for example by dropping the change output so the extra value goes to miners instead of the node owner.
The repair now calculates the real fee from the actual coin amounts being spent, verifies that the backend's reported fee matches, and applies the budget to that verified amount. It also checks that Eclair's rebuilt contributions pay the same confirmed fee and rejects invalid change-output positions.
Separate from earlier reported flaws
These fixes address dual-funding, splicing, and signer configurations specifically. They are distinct from a cooperative-closing fee flaw covered by CryptoSlate in September and from restart denial-of-service issues fixed on October 2.
What remains unclear
The October merges do not confirm that a packaged upgrade has been released. The project's release page as of October 12 still showed v0.14.3 from September as the latest version.
Why Lightning operators should act
Bitcoin Optech highlighted both changes in its October 9 newsletter as closing protection gaps during dual funding and splicing. Operators running Eclair should check whether their installed build includes the October patches, since the fixes were merged into master but not yet packaged into a new release.
Sources
Newisty Editorial Team covers technology, cryptocurrency, digital products, online platforms, developer tools and the wider digital economy. Our content is researched from official sources, company announcements, public documentation, market data and other primary or reputable sources. Articles are reviewed and edited before publication for clarity, accuracy and useful context.