Antoine Riard, a Lightning Network (LN) developer, recently disclosed a major vulnerability affecting Bitcoin’s scaling layer. This vulnerability, which was addressed with a series of mitigations, involves a “new transaction-relay jamming attack” that can affect shared funds in channels. Riard abandoned LN-related work after testing the feasibility of these attacks in the open.
Lightning Network Major Vulnerability Detected
Antoine Riard, security researcher and developer of the Lightning Network (LN), Bitcoin’s L2 scaling solution, has recently revealed a new major vulnerability affecting funds available in channels. The vulnerability involves what Riard calls “replacement cycling attacks,” which manipulate the state of Hash Time Lock Contracts (HTLC), a fundamental part of the inner workings of the LN.
The researcher introduced mitigations to this kind of attack on October 16, clarifying that he was not sure if these actions would stop malicious actors from taking advantage of these vulnerabilities. On the reach of these attacks, Riard stated:
I think this new class of replacement cycling attacks puts lightning in a very perilous position, where only a sustainable fix can happen at the base-layer, e.g adding a memory-intensive history of all-seen transactions or some consensus upgrade.
Furthermore, he clarified that the mitigations introduced only served to stop simple attacks, while more sophisticated attackers might be able to avoid them.
‘A Lesson in Terms of Bitcoin Protocol Deployment’
After disclosing the scope of the attack, Riard explained he would stop LN development tasks, which included handling these kinds of security issues at a protocol level. Due to the severity of the problems found, he thinks this might offer insight into today’s development process and how it might have to change for blockchain structures that handle millions in funds.
He explained:
There might be a lesson in terms of Bitcoin protocol deployment, we might have to get them right at first try. Little second chance to fix them in flight.
Other developers proposed different ideas to control this attack vector. Nonetheless, Bitcoin developer Matt Corallo acknowledged the severity of the issue, stressing that “fixing this in the Bitcoin Core stack is no trivial deal – the reason for this attack is to keep enough history to fix it Bitcoin Core would need unbounded memory.”
Corallo recently called Bitcoiners to calm down, declaring that LN was not broken but acknowledging they had work to do. “Lightning is (currently) for channel counterparties you trust to not to do a ton of work to build novel software to attack you,” he added.
According to a recent report, LN has grown by 1,212% in the last two years.
What do you think about the recently partially disclosed vulnerabilities in the Lightning Network? Tell us in the comments section below.
