Core Lightning clears a loophole that could allow the suspended channel status to escape punishment.

What is this event?

Core Lightning, the node implementation software of Lightning Network fixed a channel closure loophole in version v26.06.7 The loophole allowed counterparties to send an abandoned or revoked channel state back into the main network whereby the abandoned party might not be able to enforce penalties for fraudulent behavior immediately.

Why is it so important to close the withdrawal channel?

Lightning Network works with commitments or signed positions instead of balances in the channel. When balances change, a contract partner will replace an old commitment with a new one. If one party attempts to broadcast an abandoned commitment, the other should claim penalty rights from that channel's money to punish fraud.

What are the conditions under which this hole has formed?

The problem isn't with all channels. There are certain conditions that must be met:

• When opening the channel, the other party didn't specify an upfront shutdown script.
• Later, the contract can specify the output script of the revoked commitment in a shutdown message.
• Then we can drop the cooperative close and broadcast old commitment.
• If Core Lightning looks at the outputs alone, the business may look right and cross the penalty line according to the project manager's editing log ( patch notes ) and regression test results.

How does the new solution change behavior?

The repair will check the locktime and sequence encoding of the transaction to identify it as a commitment before evaluating outputs as mutually close possible.

What should a custodian check for?

• Versions older than v26 are required.06.7
• Project recommends v26.06.8 Seriously, which is a later security release with additional fixes
• The revoked-close path must have the shutdown-script condition mentioned, so a weak version does not mean that every channel will be exploited this way.
• Users of Docker images during the previous rollout should check image digest values
• Release notes of v26.06.7 Notes that images using the v26 tags06.7 and related tags from August 28 to September 1 show new version startup but no fixes
• The project identifies corrected digests and lets the user who finds a mismatch draw a new image.

The timeline version should know.

Core Lightning released version v26 on 28 August,9509 then published the source code of an initially embargoed release on 11 September. Pull requestsAI were merged into the main development branch on 15 September and implemented changes to v26.CryptoSlate This was followed on 22 September with other security fixes and source code ready for immediate testing although some were still withheld; Optech's report on 25 September described a revoked-close repair ship.AI

Additional context to help you visualize.

There have been previous related reports stating that a wave of vulnerabilitiesAI found caused Bitcoin 's Core Lightning to enter into a secret 14-day emergency lockdown, and another report mentioning a silent flaw in the scaling network that left users at risk of being wiped out with patches arriving later than disclosed. These chapters help explain why version control and image digest values are important for programmers.

Where did this report come from?

The original report was titled "Core Lightning patches flaw that could let revoked channel state escape penalty" and first appeared on CryptoSlate