Core Lightning Patches Critical Channel Flaw

Core Lightning, a popular implementation for the Bitcoin Lightning Network, has released a critical patch to address a vulnerability that could have allowed malicious actors to broadcast outdated channel states without incurring penalties. The flaw, detailed in version v26.06.7, potentially enabled a peer to exploit a specific channel setup to avoid the standard cheating penalty mechanism.

The issue arose when a channel's outputs matched existing "shutdown scripts." In such cases, Core Lightning might incorrectly interpret a revoked channel state broadcast as a cooperative close, bypassing the intended security measure. This could occur if a peer did not initially set up a shutdown script, later providing one that matched a revoked commitment. The patch rectifies this by enhancing transaction validation to check locktime and sequence encoding before considering a transaction as a cooperative close.

While the vulnerability described a potential evasion method rather than confirmed theft, operators running versions prior to v26.06.7 are strongly advised to update. The project recommends the latest security release, v26.06.8, which includes further fixes. Additionally, users who employed specific Docker images during a particular period should verify their image digests, as some released images under v26.06.7 did not contain the necessary patches. This fix is specific to Core Lightning and does not alter Bitcoin's base-layer rules.