ECLAIR 0.14.5 CALLED ITSELF “SECURITY HARDENING” — OPTECH: TWO OF THE BUGS LET A PAYER OR A PEER STEAL FUNDS — THE SPLICE FIX MAKES ECLAIR CHECK ITS OWN BITCOIN NODE

Eclair, the Lightning node software from ACINQ, shipped version 0.14.5 at 16:12 UTC on October 20, 2026, five days after 0.14.4. The release note said only that it "contains security hardening fixes" and that "some of these issues can be exploited by malicious nodes." It did not say which. Bitcoin Optech's newsletter #428, published October 23, did. Two of the fixes close ways to take money from an Eclair node.

The first, pull request #3409, hit nodes that forward trampoline payments. When route finding failed, Eclair retried with looser limits, and a payer could slip in a route whose outgoing payment expired after the incoming one. Per Optech, the payer "could then reclaim the incoming HTLC onchain after it expired, while the receiver could still claim the outgoing HTLC." The node forwards the money and never collects it.

The second, #3411, is the cleaner lesson. When splicing taproot channels, a peer can send just the amount and script of an input it adds, not the whole earlier transaction. "Nothing checked that this txOut matched the actual output, so our peer could lie about it," the pull request says. Eclair would sign a splice that could never confirm and treat it as the channel's new state, while the peer used an older commitment to claim payments after Eclair's side had timed out. The fix: Eclair now fetches the earlier transaction from its own bitcoin node and aborts if the output does not match.

That is the whole reason to run a node. A number a peer hands you is a claim. A number your node pulls from the chain is a check. Eclair had a node the whole time and did not ask it. Both fixes merged on October 20, at 14:44 and 15:15 UTC, and the release followed 57 minutes after the second. The release says operators can upgrade without closing channels. At the time of this writing, bitcoin was $81,486.