Eclair, ACINQ's Lightning node software, merged two security fixes in early October to address vulnerabilities that could cause nodes to lose Bitcoin through excessive mining fees during channel funding and splicing operations.
The first repair, merged on October 2, addresses peer-initiated replace-by-fee (RBF) attempts during dual-funded channel openings or splices. Previously, a malicious peer could request a replacement transaction with a higher fee rate, forcing Eclair to pay the increased fees on its contributed inputs while the peer contributed nothing. The fix rejects fee requests above Eclair's recommended maximum funding fee rate, with exceptions for cases where the peer covers the fees or Eclair contributes no funds.
The second repair, merged on October 5, protects Eclair nodes running in signer mode, where a separate Bitcoin Core backend selects coins and constructs transactions while Eclair retains signing keys. A compromised backend could misreport transaction fees while actually paying more to miners, potentially by removing change outputs. The fix verifies actual fees against supplied budgets by fetching coin values by transaction ID and ensures rebuilt contributions pay the same verified fee.
As of October 12, Eclair's latest listed release remained September's v0.14.3, meaning these October merges have not yet been packaged into an official release. Operators using Eclair should verify their installations contain these October changes.
