{"id":29049,"date":"2020-09-23T10:42:41","date_gmt":"2020-09-23T07:42:41","guid":{"rendered":"https:\/\/forklog.com\/en\/?p=29049"},"modified":"2025-08-27T14:50:11","modified_gmt":"2025-08-27T11:50:11","slug":"lightning-network-vulnerability-could-allow-bitcoins-to-be-withdrawn-from-circulation","status":"publish","type":"post","link":"https:\/\/forklog.com\/en\/lightning-network-vulnerability-could-allow-bitcoins-to-be-withdrawn-from-circulation\/","title":{"rendered":"Lightning Network vulnerability could allow bitcoins to be withdrawn from circulation"},"content":{"rendered":"<p>The introduction of Wumbo channels to the Lightning Network created a new vulnerability. This drew the attention of Joost Jager, a developer working on Bitcoin scalability solutions.<!--more--><\/p>\n<blockquote class=\\\"twitter-tweet\\\">\n<p dir=\\\"ltr\\\" lang=\\\"en\\\">1\/ Lightning is great, but can\u2019t say it is battle-tested. If script kids would be interested, they could take down those shiny new 5 BTC <a href=\\\"https:\/\/twitter.com\/hashtag\/wumbo?src=hash&#038;ref_src=twsrc%5Etfw\\\">#wumbo<\/a> channels with negligible cost and no effort at all. <a href=\\\"https:\/\/t.co\/9PTkxfF042\\\">pic.twitter.com\/9PTkxfF042<\/a><\/p>\n<p>\u2014 Joost Jager (@joostjgr) <a href=\\\"https:\/\/twitter.com\/joostjgr\/status\/1308414364911841281?ref_src=twsrc%5Etfw\\\">September 22, 2020<\/a><\/p>\n<\/blockquote>\n<p><script async src=\\\"https:\/\/platform.twitter.com\/widgets.js\\\" charset=\\\"utf-8\\\"><\/script><\/p>\n<p>According to him, Wumbo channels, regardless of their maximum throughput, cannot simultaneously store more than 483 hashes and HTLC contracts (HTLCs).<\/p>\n<blockquote>\n<p>&#8220;An attacker could exhaust available resources by sending 483 micropayments to their own address. This operation blocks a Wumbo channel for up to two weeks,&#8221; writes Jager.<\/p>\n<\/blockquote>\n<p>The attack requires little effort or large sums \u2014 using the longest-path route and repeated payments, the objective can be reached very quickly.<\/p>\n<blockquote>\n<p>&#8220;The script&#8217;s creator only needs to send as few as 54 payments for a single channel to take out of circulation two-digit amounts in bitcoin,&#8221; notes the expert.<\/p>\n<\/blockquote>\n<p>Joost Jager began developing a firewall for Lightning Network nodes that would address the bug.<\/p>\n<blockquote>\n<p>&#8220;There are other attacks that could cause you to lose money, and they seem more serious. But this vulnerability is one of the largest in that we don&#8217;t know how to fix it,&#8221; he wrote.<\/p>\n<\/blockquote>\n<p>Support for Wumbo channels was <a href=\"https:\/\/forklog.com\/en\/news\/new-lnd-client-version-lifts-transfer-limit-on-the-lightning-network\">realized<\/a> in the Lightning Network in August. They lift the originally set throughput limits, enabling larger sums of bitcoin to be transmitted on the second layer of the network.<\/p>\n<p>Earlier, Bitfinex <a href=\"https:\/\/forklog.com\/en\/news\/bitfinex-expands-bitcoin-transfers-via-lightning-networks-wumbo-channels\">announced<\/a> support for Wumbo channels.<\/p>\n<p>Subscribe to ForkLog news on Telegram: <a href=\\\"https:\/\/t.me\/forklogfeed\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">ForkLog Feed<\/a> \u2014 the full news feed, <a href=\\\"https:\/\/telegram.me\/forklog\\\" target=\\\"_blank\\\" rel=\\\"nofollow noopener noreferrer\\\">ForkLog<\/a> \u2014 the most important news and polls.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>The introduction of Wumbo channels to the Lightning Network created a new vulnerability. This drew the attention of Joost Jager, a developer working on Bitcoin scalability solutions.<\/p>\n","protected":false},"author":1,"featured_media":29050,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"select":"1","news_style_id":"","cryptorium_level":"","_short_excerpt_text":"","creation_source":"","_metatest_mainpost_news_update":false,"footnotes":""},"categories":[3],"tags":[1301,1154,325],"class_list":["post-29049","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-news-and-analysis","tag-blockchain-vulnerabilities","tag-crimes","tag-lightning-network"],"aioseo_notices":[],"amp_enabled":true,"views":"18","promo_type":"1","layout_type":"","short_excerpt":"","is_update":"","_links":{"self":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/29049","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/comments?post=29049"}],"version-history":[{"count":1,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/29049\/revisions"}],"predecessor-version":[{"id":29051,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/posts\/29049\/revisions\/29051"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media\/29050"}],"wp:attachment":[{"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/media?parent=29049"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/categories?post=29049"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/forklog.com\/en\/wp-json\/wp\/v2\/tags?post=29049"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}