A CHANNEL WITH THE SAME NODE AT BOTH ENDS CRASHED CORE LIGHTNING — LND’S OLDER 0.20 LINE GETS AN EQUALITY CHECK IN AN OCT. 22 CANDIDATE — ITS NEWER 0.21.5 CANDIDATE HAS NO SUCH CHECK

On October 24, 2026, a researcher who posts as NishantBansal2003 disclosed a Core Lightning bug. A channel announcement that names the same node at both ends crashed the node, and it crashed again on every restart until the operator dug the record out by hand. Core Lightning fixed it in v26.04.1 in April. On May 4 the Lightning spec, BOLT 7, added a rule for whoever receives one: if the first node ID isn’t lexicographically less than the second, the node “MUST ignore the message.”

lnd is the other big implementation. On October 20 its developers merged a check straight into the older 0.20 branch. The code comment reads: “A channel must connect two distinct nodes.” It ships in v0.20.6-beta.rc1, a release candidate posted October 22. The release note says only that validation “now requires the two advertised node identities to be distinct.”

The newer line didn’t get it. We searched the Go code of v0.21.5-beta.rc1, posted the same October 22, and of lnd’s master branch on October 24. Neither has a line comparing the two node IDs. lnd’s own docs change says the fix went directly into the 0.20 branch. And the 0.20.6 check only catches equal IDs; the spec also rules out IDs in the wrong order. None of this shows lnd crashes the way Core Lightning did. lnd hasn’t said either way.

Here’s why it matters. Senders were always told to order the two IDs, which means they differ. A peer out to hurt you ignores sender rules. The disclosure’s own lesson: “Check sender requirements on the receiver too.” While a crashed Core Lightning node was down, it couldn’t watch the chain for a partner broadcasting an old channel state. ThatThat’s where Lightning money gets stolen. rsquo;s when Lightning money is at risk. At the time of this writing, bitcoin was $80,440.