Core Lightning Vulnerability Risk, Experimental Features Recommended to be Disabled

Core Lightning (CLN) has a vulnerability in an experimental feature that may put user funds at risk. The Core Lightning team has stated that they are investigating the issue and recommend that all nodes with experimental features enabled disable them immediately and wait for a patch. High-risk options include --experimental-dual-fund, --experimental-splicing, and --experimental-peer-storage. Similar issues were fixed in August, where remote peers could specify arbitrary or even zero fees in channel opening or fund adjustment protocols, allowing local nodes to sign and write to the database without additional verification, potentially forcing nodes to incur abnormal fees or even trigger a crash loop, leading to prolonged offline status. Node operators are advised to immediately disable or remove all experimental parameters; they should not completely shut down nodes but use offline mode to retain on-chain monitoring capabilities, preventing peers from force-closing channels while the node is offline; after the official patch is released, verify signatures before upgrading and be cautious of fake patch links shared by impersonated official accounts.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.