Lightning apps using unpatched LDK risk Bitcoin theft from a reconnect lie

Lightning Development Kit (LDK), a library for building Bitcoin Lightning wallets and payment applications, has patched a flaw that could let a malicious channel peer steal the value of a forwarded payment by lying after reconnecting. Affected application developers need to incorporate the fix into the software they deploy. The attack starts with a channel peer acknowledging an update, then reconnecting and pretending it never received it. Before the fix, that false claim could cause LDK to sign a conflicting commitment transaction. A commitment transaction represents a channel's agreed state and can be used to settle it on Bitcoin's blockchain.

Source: CryptoSlate