Optech 429: a CLN crash loop disclosed; silent payments for multisig wallets
Serguey Asael Shinder2 min readBitcoin Optech's newsletter of 30 October carries two items for people who run Lightning nodes or build wallets.
The first is a denial-of-service bug in Core Lightning versions 25.02 through 26.04, disclosed by Nishant Bansal. CLN never checked that the two node IDs in a channel announcement were different. An announcement naming the same node as both ends passed validation and was written to the on-disk gossip store; loading it into the in-memory channel graph added the unknown node twice, tripped a no-duplicates assertion in gossipd and crashed the node. Because the message stayed in the store, the node crashed again on every restart until an operator removed it by hand, and upgrading alone did not clear it. An attacker needed only a funded 2-of-2 output it controlled and a fresh node key, so the cost was on-chain fees. Older releases relayed such announcements without crashing, which let them reach vulnerable nodes the attacker could not connect to directly. The bug was reported in April and fixed in CLN 26.04.1, which rejects any announcement whose first node ID is not strictly lower than the second; the BOLT 7 specification now places the same requirement on receivers.
The second item is a proposal by Oleksandr Kurbatov for using multiparty inputs in silent payments, which BIP352 currently advises against for lack of a security proof. Signers in a FROST or MuSig2 setup each contribute to the shared secret, and a coordinator aggregates their responses into one proof, called AggDLEQ, that is compatible with BIP374. It takes two rounds and, according to Kurbatov, needs no changes to BIP352, BIP374, BIP375, MuSig2, FROST or PSBT. A paper with security proofs is under internal review; he notes that one of its claims rests on an assumption whose hardness is an open question.
What it means
CLN operators still on 25.02 to 26.04 should upgrade and check whether their gossip store already holds such an announcement, because the fix stops new ones but a stored one keeps crashing the node. The silent payments work is research, not a release: it shows a path for shared wallets to receive and send to reusable addresses, pending proofs.