The Lightning Network, the most popular scaling solution for Bitcoin, has not only created additional transactional capacity but also new business models, but it’s not without its growing pains.
Like any system, it’s not without its vulnerabilities; we’ve seen issues that affect the network in the past, such as jamming attacks, replacement cycling attacks, BTCD library bugs, and unattributed payment routes.
While that may sound like a lot, none of these issues have caused a system failure, and the network continues to operate and route payments daily.
Any public monetary network is going to get tested and constantly attacked because the payoff is right there for everyone to see: the amount of liquidity locked in a particular network. We see this all the time in the crypto space, where security is not the top priority.
That’s not to say Lightning is without issue; recently, Lightning Labs, the maintainers of LND, announced that they’ve patched an issue dubbed the LND Onion Bomb.
LND, one of the four most popular implementations of Lightning, is now in version 18, yet it has disclosed a vulnerability that affected versions before 17. LND is by far the most frequently used implementation, with about 87%, followed by C-Lightning and Eclair, with 11% and 2%, respectively.
What is the LND Onion Bomb?
The LND Onion Bomb was a denial-of-service (DoS) vulnerability in older versions of LND. If a user still runs version 0.17.0 of LND, an attacker could exploit this bug by sending specially crafted packets over the Tor network.
These packets would overload the victim’s node with data, causing it to crash and go offline.
Why are onion bombs a cause for tears?
While the LND Onion Bomb didn’t directly steal bitcoins, a DoS attack can be disruptive. A crashed node can’t participate in the Lightning Network, potentially affecting its ability to send or receive payments, effectively killing off routing paths.
In a worst-case scenario, an extended DoS attack could disrupt the entire network.
Offline or bricked Lightning node is not only a pain in the arse, but it may also require a restart, and if you don’t have regular channel backups and a Lightning watch tower setup, you’re going to have a bad time once you force close as you might not have the latest state available.
Even if you do have a backup of the latest channel state and you don’t need to push through a justice transaction because you have reliable and trustworthy channel partners, a partner who thinks you won’t come back online might close your channel, to avoid having zombie channel with locked up liquidity.
If you take too long to communicate to your channel partners or don’t return online promptly, you might have no channels, and you will have to re-establish channels and pay on-chain fees once again.
Is the onion bomb still a threat?
The good news is that the LND Onion Bomb was patched in LND version 0.17.0, released in early 2024. If you’re running an up-to-date version of LND, you’re safe from this specific attack.
How to stay protected?
- Update your LND software: This is the most crucial step. Make sure you’re running LND version 0.17.0 or later. Out-of-date software is vulnerable to all sorts of attacks, not just the LND Onion Bomb.
- Be aware of other vulnerabilities: The LND Onion Bomb was just one example. It’s a good practice to stay informed about potential security issues in the Bitcoin and Lightning Network ecosystems.
Node runner due diligence
The LND Onion Bomb was a serious vulnerability, but thanks to the latest patch, it’s no longer a clear threat. As a Lightning node runner, you must stay on top of the latest developments; if not, you leave yourself open to attack and potential loss of funds.
While being your custodian eliminates many third-party risks, it introduces a new set of attack vectors or risks of losing funds. By keeping your software updated and staying informed about security best practices, you can help ensure the smooth operation of the Lightning Network.
That doesn’t mean you should always update your node the moment new versions of your preferred implementation are pushed live; before upgrading, look at discussions on various Lightning forums or Nostr or speak to more established node runners or channel partners to get a feel for any issues you might incur in upgrading.
Do your own research.
If you want to learn more about LND Onion Bombs, use this article as a starting point. Don’t trust what we say as the final word. Take the time to research other sources, and you can start by checking out the resources below.
