Bitcoin Lightning developer ACINQ issued an urgent security update for its Eclair node software on October 27. The update, version 0.14.6, addresses a weakness that could allow malicious peers to manipulate unconfirmed channel funding transactions.
The identified flaw involved accepting unconfirmed inputs during channel splicing – the process of adding or withdrawing liquidity from an existing Lightning channel. A malicious node could double‑spend an unconfirmed funding transaction after signing a splice, potentially invalidating the channel’s funding and exposing pending HTLC payments to loss if the channel later closed on‑chain.
To mitigate this risk, the new release introduces a default setting that requires all funding inputs from peers to be confirmed before they are accepted for splicing. The safeguard also blocks additional splices on top of unconfirmed funding changes, reducing the attack surface for malicious actors.
In addition to the input‑confirmation rule, Eclair’s settlement logic has been revised. When a channel must close while its funding transaction is still pending, the software now selects a commitment transaction backed by a funding output recognized by the node’s Bitcoin Core backend, reverting to the most recent confirmed funding state if necessary. This change prevents the node from attempting to settle using a funding transaction that later disappears from its mempool.
A related correction improves handling of transactions that miners confirm after the node has stopped tracking them as the preferred settlement route. The updated logic now correctly identifies such transactions and attempts to recover the associated outputs, protecting funds that might otherwise remain unclaimed.
ACINQ also reminded operators that its optional zero‑fee commitment feature remains disabled by default and should not be used when splicing with untrusted peers. The security researcher Erick Cestari is credited for responsibly disclosing the issues.
Operators running older versions of Eclair are advised to install the patch. Existing channels can stay open during the upgrade, which requires stopping the node, installing the new version, and restarting the software.
