Eclair tightens Bitcoin funding rules after unconfirmed inputs put Lightning payments at risk
Summary
ACINQ released Eclair 0.14.6 to fix Lightning channel security weaknesses involving unconfirmed funding transactions and splicing. A malicious peer could double-spend an unconfirmed input, potentially putting pending payments at risk if a channel closed. The patch requires confirmed peer inputs for splices by default, improves settlement and recovery of funds when funding transactions change or disappear, and warns against using the optional zero-fee commitment feature with untrusted peers. No confirmed theft or real-world exploitation was reported. ACINQ urged operators to upgrade; existing channels can stay open during installation.
