Your signal. Your price.
LND PR 11061 implements Schnorr signature verification for Bolt 12 offers. Core Lightning PRs 9434 and 9473 resolve critical crash bugs in the Askrene routing engine plugin related to loading and deleting routing biases.
LND PR 11125 introduces robust UTXO locking that survives blockchain reorgs until a target confirmation count is reached. LND PR 11064 requires explicit channel type signaling during channel openings to strictly comply with specifications.
LND nodes running versions prior to 0.20 were vulnerable to a chain reorg exploit where attackers could publish old, revoked commitment transactions to drain funds. Developer Bastian Teinturier disclosed the vulnerability, which was patched in late February.
Seth urges BTCPay Server operators to update immediately to versions 2.4.2 or 2.4.3 RC4. These releases patch critical, undisclosed security vulnerabilities that have already resulted in drained LND lightning nodes.
BTC Pay Server version 2.4.2 resolved a critical vulnerability exposing LND-backed instances to fund theft. Gustavo warns that the exploit was actively utilized in the wild, making immediate upgrades and LND macaroon rotation mandatory for all affected operators.
LND implemented mailbox limits of 1,000 queued messages or 4 megabytes of data to prevent memory exhaustion from peer spam. Gustavo reports that if a peer exceeds these limits, LND will disconnect them to preserve message order rather than dropping messages.
Seth explains a critical BTCPay Server vulnerability allowed remote attackers to steal LND macaroons, giving them full admin access to close channels and sweep funds. The vulnerability was restricted to LND configurations and did not affect other backends.
Adam Curry is decommissioning their self-hosted LND lightning node to avoid a 240 dollar monthly hosting fee and massive database bloat. The database grew so large that the node required seven hours to reboot.
Core Lightning, Eclair, and LND merged several critical stability fixes. These updates prevent daemon crashes from oversized HTLC payloads, eliminate channel force-closes caused by duplicate settlement messages, and mitigate out-of-memory vulnerabilities during network state synchronization.
A severe security flaw in BTCPay Server exposed LND macaroon credentials to unauthenticated remote attackers. The exploit allowed hackers to download administrative tokens, close lightning channels, and sweep node funds without entering credentials.
Operators running LND inside BTCPay Server must immediately update to version 2.4.2. To secure funds from prior compromise, operators also need to manually revoke and regenerate all existing LND macaroon credentials.
LND PR 10962 fixes an issue where the RBF Cooperative Close Flow could accidentally spend overlay assets during fee bumping by making auxiliary channels incompatible with this flow.
LND PR 10897 ensures that low-Bitcoin-value UTXOs representing high-value overlay assets are not skipped during fee rate increases, by recognizing them as auxiliary channel outputs and including them in sweeps.
LND 20.2 beta fixes a DNS fallback panic during peer discovery by validating record types, not assuming SRV. It also patches an HTLC forward interceptor issue.
LND's PR adds invoice request message support for Bolt 12 offers, building on prior groundwork. Full signature verification and offer checking remain for future PRs.
LND versions prior to 0.20.1 are vulnerable to a remote denial-of-service attack triggered by a malformed zero-timestamp gossip message, necessitating urgent updates for users running older versions.