Lightning Development Kit releases update to fix security flaws

The Lightning Development Kit (LDK) has released version 0.2.6 to address two critical security vulnerabilities. LDK is a software development kit used to build Bitcoin Lightning applications, including mobile wallets and payment infrastructure.

The first vulnerability involves the ‘splice’ function, which allows nodes to add or remove funds from existing payment channels. A flaw in fee calculation could allow a malicious peer to manipulate fees during a splice operation, diverting excess funds to their own output. While the developers noted that small amounts of funds could be at risk, they have not specified a maximum numerical limit for potential losses.

The second issue involves a payment hash conflict. If two payment contracts share the same hash and a node receives a bogus payment immediately after a successful one, the ChannelManager component may fail to load the saved state during deserialization. This prevents the node from completing a normal restart, effectively disrupting service.